From 8a1ef6fe3a8c4eeba192f7420a41d21b00e4cf5a Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 08:48:11 +0200
Subject: [PATCH 01/20] fix(acceptance): emit a real calendar date for
 date-typed fields (validValue)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Live deep-chain build (Organization→Project→Task) parked Task: fast gate green but
e2e acceptance timed out with the task-form never hiding — i.e. the create was
failing, not a transient hiccup as the build's own note guessed.

Root cause: validValue (acceptance-spec.ts) had no case for date/datetime/timestamp
types, so a dueDate field got the generic '${name}-${seed}' sample ('dueDate-2').
That passes the UI Zod (z.string) and API TypeBox (t.String), but the service inserts
it into a timestamptz column and Postgres throws 'invalid input syntax for type
timestamp with time zone' -> create 500s -> onSuccess/closeForm never fires -> form
stays visible -> 10s waitFor(hidden) times out -> false park.

Confirmed at the boundary against the live DB:
  'dueDate-3'::timestamptz  -> ERROR: invalid input syntax
  '2024-06-15'::timestamptz -> 2024-06-15 00:00:00+00 (accepted)

Fix: validValue returns '2024-06-15' for date/datetime/timestamp types. Date-only so it
stays a substring of whatever timestamp representation the row cell renders back (the
shows assertion is toContainText). Boolean fields were already fine (checkbox path).

Regression test added. typecheck/lint/format clean, 3193/3206 suite green.

Follow-ups (filed): empty-optional-date '' also 500s a timestamptz insert (generated
form should coerce '' -> undefined for optional date/number); e2e seed resilience to
transient socket hang-ups / vitest worker timeouts under load.
---
 .../src/loop/acceptance/acceptance-spec.ts    | 13 +++++
 packages/core/tests/acceptance-spec.test.ts   | 49 +++++++++++++++++++
 2 files changed, 62 insertions(+)

diff --git a/packages/core/src/loop/acceptance/acceptance-spec.ts b/packages/core/src/loop/acceptance/acceptance-spec.ts
index 70b19c5e..aeaabdac 100644
--- a/packages/core/src/loop/acceptance/acceptance-spec.ts
+++ b/packages/core/src/loop/acceptance/acceptance-spec.ts
@@ -50,6 +50,19 @@ function validValue(
     return String(seed + 1);
   }
 
+  if (
+    field.type === "date" ||
+    field.type === "datetime" ||
+    field.type === "timestamp"
+  ) {
+    // A real calendar date. Date-typed fields land in a DB date/timestamp column, so the generic
+    // `${name}-${seed}` sample would pass string-level validation (Zod z.string / TypeBox t.String)
+    // yet throw at the insert ("invalid input syntax for type timestamp") → the create 500s and the
+    // form never closes → false e2e park. Date-only ("YYYY-MM-DD") so it stays a substring of
+    // whatever timestamp representation the row cell renders back for the shows assertion.
+    return "2024-06-15";
+  }
+
   if (/url|website/i.test(field.name)) {
     return `https://example${seed}.com`;
   }
diff --git a/packages/core/tests/acceptance-spec.test.ts b/packages/core/tests/acceptance-spec.test.ts
index 2bc09751..5ff254a7 100644
--- a/packages/core/tests/acceptance-spec.test.ts
+++ b/packages/core/tests/acceptance-spec.test.ts
@@ -540,3 +540,52 @@ test("fieldIsMentioned matches on WORD BOUNDARIES, not raw substring", () => {
   // And it isn't tripped by an unrelated word either.
   expect(fieldIsMentioned(acceptField("name"), "the total amount")).toBe(false);
 });
+
+test("planToAcceptanceSpec: date-typed fields get a REAL calendar date sample (not a `${name}-${seed}` string a timestamp column rejects)", () => {
+  // Regression: a `date`/`datetime`/`timestamp` field used to fall through to the generic
+  // "${name}-${seed}" sample (e.g. "dueDate-2"). That passes z.string()/t.String() but the app
+  // inserts it into a timestamptz column, where Postgres throws "invalid input syntax for type
+  // timestamp" → the create 500s and the form never closes → false e2e park.
+  const datePlan: IProductPlan = {
+    product: "Tracker",
+    slices: [
+      {
+        entity: {
+          id: "Task",
+          desc: "t",
+          fields: [
+            { name: "title", type: "string" },
+            { name: "dueDate", type: "date" },
+            { name: "startsAt", type: "datetime" },
+          ],
+          relationships: [],
+          rules: ["title is required"],
+        },
+        ui: {
+          screens: ["list", "form"],
+          action: "add",
+          shows: ["title", "dueDate"],
+          nav: "Tasks",
+        },
+        verification: {
+          mustRemainTrue: ["x"],
+          mustNotHappen: ["a task can be saved without a title"],
+          acceptanceCheck: "create a task",
+        },
+      },
+    ],
+  };
+
+  const task = planToAcceptanceSpec(datePlan).entities[0];
+
+  for (const name of ["dueDate", "startsAt"]) {
+    const field = task?.fields.find((f) => f.name === name);
+
+    expect(field, `expected field ${name}`).toBeDefined();
+    // NOT the generic garbage sample.
+    expect(field?.valid).not.toContain(`${name}-`);
+    // A real, parseable YYYY-MM-DD date (what a timestamp column accepts).
+    expect(field?.valid).toMatch(/^\d{4}-\d{2}-\d{2}$/);
+    expect(Number.isNaN(new Date(field?.valid ?? "").getTime())).toBe(false);
+  }
+});

From dab29cf3ce218088e7593315834d3bb5b4aefa70 Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 08:55:40 +0200
Subject: [PATCH 02/20] test(acceptance): cover timestamp type + strict
 calendar-date check (panel r1 finding)

- Exercise date, datetime AND timestamp (production branch handles all three).
- Replace the weak !isNaN(new Date()) check, which accepts normalized-impossible dates
  (new Date('2024-02-31') rolls to 2024-03-02), with a strict UTC round-trip that rejects
  them. Self-checks the checker rejects '2024-02-31' and accepts '2024-06-15'.
---
 packages/core/tests/acceptance-spec.test.ts | 32 ++++++++++++++++++---
 1 file changed, 28 insertions(+), 4 deletions(-)

diff --git a/packages/core/tests/acceptance-spec.test.ts b/packages/core/tests/acceptance-spec.test.ts
index 5ff254a7..c26c1829 100644
--- a/packages/core/tests/acceptance-spec.test.ts
+++ b/packages/core/tests/acceptance-spec.test.ts
@@ -546,6 +546,29 @@ test("planToAcceptanceSpec: date-typed fields get a REAL calendar date sample (n
   // "${name}-${seed}" sample (e.g. "dueDate-2"). That passes z.string()/t.String() but the app
   // inserts it into a timestamptz column, where Postgres throws "invalid input syntax for type
   // timestamp" → the create 500s and the form never closes → false e2e park.
+  // A strict calendar-date check: rejects impossible dates that `new Date()` would silently
+  // normalize (e.g. "2024-02-31" rolls to 2024-03-02, which a naive !isNaN check would accept).
+  const isRealCalendarDate = (s: string): boolean => {
+    const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(s);
+
+    if (!m) {
+      return false;
+    }
+
+    const [year, month, day] = [Number(m[1]), Number(m[2]), Number(m[3])];
+    const dt = new Date(Date.UTC(year, month - 1, day));
+
+    return (
+      dt.getUTCFullYear() === year &&
+      dt.getUTCMonth() === month - 1 &&
+      dt.getUTCDate() === day
+    );
+  };
+
+  // Sanity-check the checker itself: it must reject a normalized-impossible date.
+  expect(isRealCalendarDate("2024-02-31")).toBe(false);
+  expect(isRealCalendarDate("2024-06-15")).toBe(true);
+
   const datePlan: IProductPlan = {
     product: "Tracker",
     slices: [
@@ -557,6 +580,7 @@ test("planToAcceptanceSpec: date-typed fields get a REAL calendar date sample (n
             { name: "title", type: "string" },
             { name: "dueDate", type: "date" },
             { name: "startsAt", type: "datetime" },
+            { name: "loggedAt", type: "timestamp" },
           ],
           relationships: [],
           rules: ["title is required"],
@@ -578,14 +602,14 @@ test("planToAcceptanceSpec: date-typed fields get a REAL calendar date sample (n
 
   const task = planToAcceptanceSpec(datePlan).entities[0];
 
-  for (const name of ["dueDate", "startsAt"]) {
+  // Cover every date-ish type the production branch handles: date, datetime, timestamp.
+  for (const name of ["dueDate", "startsAt", "loggedAt"]) {
     const field = task?.fields.find((f) => f.name === name);
 
     expect(field, `expected field ${name}`).toBeDefined();
     // NOT the generic garbage sample.
     expect(field?.valid).not.toContain(`${name}-`);
-    // A real, parseable YYYY-MM-DD date (what a timestamp column accepts).
-    expect(field?.valid).toMatch(/^\d{4}-\d{2}-\d{2}$/);
-    expect(Number.isNaN(new Date(field?.valid ?? "").getTime())).toBe(false);
+    // A real, valid calendar date (what a timestamp column accepts) — not a normalized impossible one.
+    expect(isRealCalendarDate(field?.valid ?? "")).toBe(true);
   }
 });

From 53e62e59bd3c292a484093586ec4261ef5f0b002 Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 09:04:16 +0200
Subject: [PATCH 03/20] fix(acceptance): explicit field TYPE beats name
 heuristics in validValue (panel r2 finding)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A date-typed field whose NAME matches the email heuristic (emailVerifiedAt, lastEmailSentAt)
was getting user@example.com because the email name-check ran before the date-type branch —
an email string 500s a timestamp-column insert, the same false-park class. Reordered so
explicit type checks (email/number/date) run first, then name-based heuristics for string
fields. Test covers emailVerifiedAt(timestamp) → real date, not an email.
---
 packages/core/src/loop/acceptance/acceptance-spec.ts | 12 +++++++++---
 packages/core/tests/acceptance-spec.test.ts          | 10 +++++++---
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/packages/core/src/loop/acceptance/acceptance-spec.ts b/packages/core/src/loop/acceptance/acceptance-spec.ts
index aeaabdac..6f11d4b8 100644
--- a/packages/core/src/loop/acceptance/acceptance-spec.ts
+++ b/packages/core/src/loop/acceptance/acceptance-spec.ts
@@ -40,9 +40,10 @@ function validValue(
   field: { name: string; type: string },
   seed: number
 ): string {
-  const isEmail = field.type === "email" || /email/i.test(field.name);
-
-  if (isEmail) {
+  // Explicit TYPE wins over name heuristics. A date-typed field must get a real date even when its
+  // name matches the email heuristic (e.g. `emailVerifiedAt`, `lastEmailSentAt`) — otherwise it gets
+  // an email string that 500s the timestamp-column insert, the exact false-park this branch fixes.
+  if (field.type === "email") {
     return `user${seed}@example.com`;
   }
 
@@ -63,6 +64,11 @@ function validValue(
     return "2024-06-15";
   }
 
+  // Name-based heuristics for otherwise-untyped (string) fields.
+  if (/email/i.test(field.name)) {
+    return `user${seed}@example.com`;
+  }
+
   if (/url|website/i.test(field.name)) {
     return `https://example${seed}.com`;
   }
diff --git a/packages/core/tests/acceptance-spec.test.ts b/packages/core/tests/acceptance-spec.test.ts
index c26c1829..b100811d 100644
--- a/packages/core/tests/acceptance-spec.test.ts
+++ b/packages/core/tests/acceptance-spec.test.ts
@@ -581,6 +581,8 @@ test("planToAcceptanceSpec: date-typed fields get a REAL calendar date sample (n
             { name: "dueDate", type: "date" },
             { name: "startsAt", type: "datetime" },
             { name: "loggedAt", type: "timestamp" },
+            // Name matches the email heuristic but the TYPE is a date — type must win.
+            { name: "emailVerifiedAt", type: "timestamp" },
           ],
           relationships: [],
           rules: ["title is required"],
@@ -602,13 +604,15 @@ test("planToAcceptanceSpec: date-typed fields get a REAL calendar date sample (n
 
   const task = planToAcceptanceSpec(datePlan).entities[0];
 
-  // Cover every date-ish type the production branch handles: date, datetime, timestamp.
-  for (const name of ["dueDate", "startsAt", "loggedAt"]) {
+  // Cover every date-ish type the production branch handles, incl. a date field whose name
+  // matches the email heuristic (emailVerifiedAt) — TYPE must take precedence over name.
+  for (const name of ["dueDate", "startsAt", "loggedAt", "emailVerifiedAt"]) {
     const field = task?.fields.find((f) => f.name === name);
 
     expect(field, `expected field ${name}`).toBeDefined();
-    // NOT the generic garbage sample.
+    // NOT the generic garbage sample, and NOT an email (the name-precedence trap).
     expect(field?.valid).not.toContain(`${name}-`);
+    expect(field?.valid).not.toContain("@");
     // A real, valid calendar date (what a timestamp column accepts) — not a normalized impossible one.
     expect(isRealCalendarDate(field?.valid ?? "")).toBe(true);
   }

From f37b9cd9a83f81787e7c47a06fe37b4669ac39e3 Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 09:15:32 +0200
Subject: [PATCH 04/20] fix(acceptance): apply email type-precedence
 symmetrically to negativesFor (panel r3 finding)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

3 reviewers converged: negativesFor still used f.type === 'email' || /email/i.test(name), so a
date/number field named like an email (emailVerifiedAt) got a 'not-an-email' negative. That value
reaches a timestamp/number column → 500 (not the expected 400/422) → false park — the same class
validValue was just fixed for. Extracted a shared isEmailField(field) helper (explicit type wins
over name; number/date types are never email) and used it in BOTH validValue and negativesFor so
they can never disagree. Test asserts the negatives array: emailVerifiedAt(timestamp) gets NO
not-an-email negative, a real email field DOES (positive control).
---
 .../src/loop/acceptance/acceptance-spec.ts    | 43 ++++++++++++-------
 packages/core/tests/acceptance-spec.test.ts   | 18 +++++++-
 2 files changed, 44 insertions(+), 17 deletions(-)

diff --git a/packages/core/src/loop/acceptance/acceptance-spec.ts b/packages/core/src/loop/acceptance/acceptance-spec.ts
index 6f11d4b8..0c606958 100644
--- a/packages/core/src/loop/acceptance/acceptance-spec.ts
+++ b/packages/core/src/loop/acceptance/acceptance-spec.ts
@@ -35,15 +35,34 @@ export function testIdsFor(key: string): ITestIds {
   };
 }
 
+function isDateType(type: string): boolean {
+  return type === "date" || type === "datetime" || type === "timestamp";
+}
+
+// Whether a field should be treated as an email. Explicit TYPE wins over the name heuristic: a
+// `date`/`number`-typed field named like an email (e.g. `emailVerifiedAt`) is NOT an email — else
+// both the positive sample and the invalid-email negative feed a non-string value into a
+// date/number column and 500 the insert (a false park). Shared by validValue AND negativesFor so
+// the two can never disagree about whether a field is an email.
+function isEmailField(field: { name: string; type: string }): boolean {
+  if (field.type === "email") {
+    return true;
+  }
+
+  if (field.type === "number" || isDateType(field.type)) {
+    return false;
+  }
+
+  return /email/i.test(field.name);
+}
+
 // Deterministic valid sample per field, seeded off (entityIndex, fieldName) — no Date/random.
 function validValue(
   field: { name: string; type: string },
   seed: number
 ): string {
-  // Explicit TYPE wins over name heuristics. A date-typed field must get a real date even when its
-  // name matches the email heuristic (e.g. `emailVerifiedAt`, `lastEmailSentAt`) — otherwise it gets
-  // an email string that 500s the timestamp-column insert, the exact false-park this branch fixes.
-  if (field.type === "email") {
+  // Explicit TYPE wins over name heuristics (see isEmailField).
+  if (isEmailField(field)) {
     return `user${seed}@example.com`;
   }
 
@@ -51,11 +70,7 @@ function validValue(
     return String(seed + 1);
   }
 
-  if (
-    field.type === "date" ||
-    field.type === "datetime" ||
-    field.type === "timestamp"
-  ) {
+  if (isDateType(field.type)) {
     // A real calendar date. Date-typed fields land in a DB date/timestamp column, so the generic
     // `${name}-${seed}` sample would pass string-level validation (Zod z.string / TypeBox t.String)
     // yet throw at the insert ("invalid input syntax for type timestamp") → the create 500s and the
@@ -64,11 +79,6 @@ function validValue(
     return "2024-06-15";
   }
 
-  // Name-based heuristics for otherwise-untyped (string) fields.
-  if (/email/i.test(field.name)) {
-    return `user${seed}@example.com`;
-  }
-
   if (/url|website/i.test(field.name)) {
     return `https://example${seed}.com`;
   }
@@ -96,7 +106,10 @@ function negativesFor(
       out.push({ field: f.name, value: "", why: `${f.name} is required` });
     }
 
-    if (!isForeignKey && (f.type === "email" || /email/i.test(f.name))) {
+    // Use the SAME email determination as validValue (type wins over name), so a date/number
+    // field named like an email (emailVerifiedAt) never gets a "not-an-email" negative — that
+    // value would reach a timestamp/number column and 500 (not the expected 400/422) → false park.
+    if (!isForeignKey && isEmailField(f)) {
       out.push({
         field: f.name,
         value: "not-an-email",
diff --git a/packages/core/tests/acceptance-spec.test.ts b/packages/core/tests/acceptance-spec.test.ts
index b100811d..7b4fabe4 100644
--- a/packages/core/tests/acceptance-spec.test.ts
+++ b/packages/core/tests/acceptance-spec.test.ts
@@ -581,8 +581,11 @@ test("planToAcceptanceSpec: date-typed fields get a REAL calendar date sample (n
             { name: "dueDate", type: "date" },
             { name: "startsAt", type: "datetime" },
             { name: "loggedAt", type: "timestamp" },
-            // Name matches the email heuristic but the TYPE is a date — type must win.
-            { name: "emailVerifiedAt", type: "timestamp" },
+            // Name matches the email heuristic but the TYPE is a date — type must win, in BOTH
+            // the positive sample (validValue) and the negatives (no "not-an-email").
+            { name: "emailVerifiedAt", type: "timestamp", optional: true },
+            // A genuine email field — positive control: it SHOULD get the not-an-email negative.
+            { name: "contactEmail", type: "email", optional: true },
           ],
           relationships: [],
           rules: ["title is required"],
@@ -616,4 +619,15 @@ test("planToAcceptanceSpec: date-typed fields get a REAL calendar date sample (n
     // A real, valid calendar date (what a timestamp column accepts) — not a normalized impossible one.
     expect(isRealCalendarDate(field?.valid ?? "")).toBe(true);
   }
+
+  // Negatives must apply the SAME type-precedence: a date-typed field named like an email gets
+  // NO "not-an-email" negative (that value would 500 a timestamp insert, not 400/422 → false park),
+  // while a genuinely email-typed field DOES.
+  const emailNegs = (fieldName: string): boolean =>
+    (task?.negatives ?? []).some(
+      (n) => n.field === fieldName && n.value === "not-an-email"
+    );
+
+  expect(emailNegs("emailVerifiedAt")).toBe(false);
+  expect(emailNegs("contactEmail")).toBe(true);
 });

From 4eab46059054d96efcbb421254a918a1c6a4b05b Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 09:31:28 +0200
Subject: [PATCH 05/20] test(acceptance): cover number field named like email
 (isEmailField type-precedence, panel r4)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

isEmailField also guards number types (emailCount type=number → number sample + negative-number
negative, never email). Added that case to the regression suite: numeric valid value (no '@'),
no not-an-email negative, and the '-1' number negative present.
---
 packages/core/tests/acceptance-spec.test.ts | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/packages/core/tests/acceptance-spec.test.ts b/packages/core/tests/acceptance-spec.test.ts
index 7b4fabe4..530fcdfb 100644
--- a/packages/core/tests/acceptance-spec.test.ts
+++ b/packages/core/tests/acceptance-spec.test.ts
@@ -586,6 +586,9 @@ test("planToAcceptanceSpec: date-typed fields get a REAL calendar date sample (n
             { name: "emailVerifiedAt", type: "timestamp", optional: true },
             // A genuine email field — positive control: it SHOULD get the not-an-email negative.
             { name: "contactEmail", type: "email", optional: true },
+            // Number type whose name matches the email heuristic — type must win here too: a
+            // numeric sample + the negative-number negative, never an email value/negative.
+            { name: "emailCount", type: "number", optional: true },
           ],
           relationships: [],
           rules: ["title is required"],
@@ -630,4 +633,17 @@ test("planToAcceptanceSpec: date-typed fields get a REAL calendar date sample (n
 
   expect(emailNegs("emailVerifiedAt")).toBe(false);
   expect(emailNegs("contactEmail")).toBe(true);
+
+  // A NUMBER field named like an email must also resolve by type, not name: numeric valid sample
+  // (no "@"), and the negative-number negative — never a not-an-email negative.
+  const emailCount = task?.fields.find((f) => f.name === "emailCount");
+
+  expect(emailCount?.valid).not.toContain("@");
+  expect(emailCount?.valid).toMatch(/^\d+$/);
+  expect(emailNegs("emailCount")).toBe(false);
+  expect(
+    (task?.negatives ?? []).some(
+      (n) => n.field === "emailCount" && n.value === "-1"
+    )
+  ).toBe(true);
 });

From be07036a75febd0de5151f3f3cd0d2f36dfeca89 Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 11:44:40 +0200
Subject: [PATCH 06/20] feat(conventions): front-load design-system guides
 (tokens/theming/responsive/a11y/components-ui)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Spec 1A of the modern-layout capability. The harness guided 12 topics but nothing on styling —
so the model built UI blind to BoringStack's production-ready design system (CSS-var tokens,
ShadCN/Radix primitives in components/ui, data-theme theming, mobile-first responsive, and the
14 jsx-a11y rules the gate runs as ERRORS) and only discovered a11y violations at the gate.

Adds 5 front-loaded convention topics that CODIFY what the scaffold already ships (lean on it,
reinvent nothing):
- design-tokens: never hardcode colors; use CSS-var Tailwind tokens by role.
- theming: data-theme-driven; never dark: variants.
- responsive: mobile-first breakpoints + the Sheet mobile-drawer nav pattern.
- accessibility: satisfy jsx-a11y proactively (aria-label/aria-hidden/sr-only, no interactive
  div, semantic landmarks); mapped to the jsx-a11y rules so it also PUSHes reactively on a trip.
- components-ui: prefer @/components/ui Radix primitives, cn()+cva composition, asChild.

Synced the pull_conventions tool enum + description. Tests lock each guide's load-bearing
content + the a11y rule mapping. typecheck/lint/format clean, 3195 green.

Also adds the design spec: docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md
---
 ...6-07-29-modern-layout-capability-design.md | 80 +++++++++++++++++++
 packages/core/src/agent/agent.constants.ts    |  7 +-
 packages/core/src/loop/conventions.ts         | 76 ++++++++++++++++++
 packages/core/tests/convention-index.test.ts  | 45 +++++++++++
 4 files changed, 207 insertions(+), 1 deletion(-)
 create mode 100644 docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md

diff --git a/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md b/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md
new file mode 100644
index 00000000..dacdbd52
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md
@@ -0,0 +1,80 @@
+# Modern Layout Capability — Design Spec (Spec 1)
+
+**Status:** approved-by-delegation (user AFK, full decision delegation; decision rule = "best for tsforge + BoringStack"). Panel-gate + live-build validation substitute for user review.
+
+**Goal:** Give the tsforge harness a first-class, general understanding of modern web-app **layouts** and **design-system usage**, so builds produce responsive, accessible, themeable UIs that *lean on* BoringStack's existing primitives, and so an app's **primary UI can live outside the generic "dashboard"** with settings demoted to a secondary area.
+
+**Principle:** Layout + design-system knowledge is a **harness** capability, not a BoringStack change (BoringStack stays minimal). The harness already ships this style of value as front-loaded convention guides + build-time wiring + conditional acceptance; we extend those seams. **Design the model broad** (don't lock into too few layout options); **implement narrow** (ship what the todos app needs, with seams for the rest).
+
+---
+
+## Global Constraints (verbatim, bind every task)
+
+- **Never relax the gate.** No downgrading rules/severity. Fixes make the model satisfy the gate.
+- **Core stays stack-agnostic.** All BoringStack-specific logic lives under `packages/core/src/loop/boringstack/`; generic seams only in the core loop.
+- **No `as`/`!` casts, no eslint-disable, cc ≤ 20, shared AST walkers.** Run full `bun run validate` before "done".
+- **Lean on what exists — do not reinvent.** Compose BoringStack's CSS-variable design tokens + `components/ui/` (ShadCN/Radix) + `data-theme` theming. Author no new CSS framework, no new component library.
+- **Responsive + accessible + themeable are defaults, not options**, in every layout the harness emits.
+- **Every harness change is panel-gated** (4-model panel, reviewers ok ≥ 2) **and live-build validated** (solo build on a quiet box).
+
+---
+
+## Reality this builds on (from two read-only audits)
+
+**Routing (audit 1):** BoringStack routes are already flat/top-level (`/task`, not `/dashboard/task`). The shell is `AppShell` (sidebar + header) at `apps/ui/src/components/core/AppShell/`. Post-login redirect is `DEFAULT_REDIRECT_TO = "/dashboard"` (`apps/ui/src/features/auth/components/LoginPage/LoginPage.constants.ts`). The harness hardcodes every feature → `ProtectedRoute → AppShell → sidebar entry → nav-testid → sidebar-nav e2e` (`wire-resource.ts` `wireUiRouteFile` ~L133-187 `path:"/${camel}"`; `build.ts` `scopeFor` ~L161-179; `refine-prompt.ts` ~L269; `acceptance/testid-contract.ts` ~L130; `acceptance/e2e-generator.ts` nav test ~L681-686).
+
+**Design system (audit 2):** Tokens in `apps/ui/src/assets/css/tailwind.css` (`:root` + `:root[data-theme="dark"]`, mapped via Tailwind `@theme`): colors `background/foreground/primary(+strong/low/ink/foreground)/secondary/muted(+foreground/strong)/accent(+cyan/pink)/destructive/success/border(+strong)/input/ring/card/panel(+strong)/popover`, `--radius*`, `--font-sans` (Inter) / `--font-mono`, `--animate-*`. Components in `apps/ui/src/components/ui/`: Button, Card, Dialog, DropdownMenu, Form, Input, Label, Popover, ScrollArea, Sheet, Skeleton, Sonner, Switch, Tabs (cva + `cn()` + tailwind-merge + Radix + lucide). Theme via `useTheme()` + `data-theme` attribute (NO `dark:` classes; `AGENT_CONTRACT.md` forbids them). Responsive = mobile-first Tailwind + Sheet drawer (`hidden md:flex` sidebar). A11y = `eslint-plugin-jsx-a11y` 14 rules as ERRORS + Radix + semantic HTML + skip link. Harness `conventions.ts` has 12 topic guides but **nothing on styling/theming/responsive/a11y/composition**.
+
+---
+
+## Part A — Design-system convention guides (codify what exists)
+
+New harness convention topics (front-loaded like the existing 12 in `packages/core/src/loop/conventions.ts`). Pure knowledge; leans 100% on the scaffold. This is the low-risk, high-value half and lands first.
+
+New topics:
+1. **`design-tokens`** — the exact token vocabulary + when each applies (primary = CTA, destructive = delete, muted-foreground = secondary text, border/border-strong = dividers, panel/card = containers, ring = focus). Rule: **never hardcode hex/rgb**; use tokens via bare Tailwind classes (`bg-primary`, `text-muted-foreground`). Opacity variants (`border-strong/40`).
+2. **`theming`** — theming is `data-theme`-driven; **never use `dark:` variants**; tokens flip automatically. Test both themes by toggling `data-theme`.
+3. **`responsive`** — mobile-first (no-prefix = mobile; `md:`/`lg:` = up); the Sheet mobile-drawer pattern for nav; responsive padding idioms (`px-4 lg:px-6`); container queries for intra-component layout.
+4. **`accessibility`** — semantic landmarks (`nav`/`main`/`header`/`section`); `aria-label` for icon-only buttons; `aria-hidden` on decorative icons; `sr-only`; `aria-current="page"`; skip link; labels linked to inputs; never make a `div` interactive (use `Button`/links). Frame it as "satisfy the 14 jsx-a11y rules proactively, don't discover them at the gate."
+5. **`components-ui`** — prefer `@/components/ui/*` primitives; extend via `cva` variants; compose classes with `cn()` (not ternary/template strings); `asChild` slot pattern; `data-slot` scoping.
+
+Wire these into the topic registry + surface at the same points as existing guides (build refine-prompt + interim `check`/RULE_DOCS).
+
+## Part B — Layout-role capability (the structural change)
+
+**Plan schema (broad).** Extend `IUiIntent` (`packages/core/src/loop/planning/plan-types.ts`):
+```ts
+layout?: "app-sidebar" | "app-topnav" | "settings" | "focused" | "public"; // default "app-sidebar"
+home?: boolean;   // this feature's route is the post-login landing (exactly one per plan)
+```
+`nav` (existing description) stays. The enum is intentionally broad (anti-lock-in); **v1 implements `app-sidebar` + `settings`**; `app-topnav`/`public`/`focused` are schema-valid and fall back to `app-sidebar`+guidance for now (documented), so the todos app isn't blocked and the vocabulary is future-proof.
+
+**Wiring (implement narrow):** In `packages/core/src/loop/boringstack/`:
+- **Sidebar grouping** — the harness's sidebar wiring/guidance groups nav into a **primary app group** (`layout: app-sidebar`) and a demoted **Settings group** (`layout: settings`, plus the scaffold's existing account/profile/notification links). AppSidebar edit stays in feature scope; the refine-prompt tells the model which group to add to based on `layout`.
+- **Home landing** — the feature with `home: true` sets `DEFAULT_REDIRECT_TO` to its route. Add `LoginPage.constants.ts` to that feature's scope; the refine-prompt instructs the redirect change. Exactly one home per plan (validated).
+- **Route/layout** — keep `ProtectedRoute → AppShell` for `app-sidebar` and `settings` (both are authenticated app areas; "settings" is a grouping + optional sub-nav, not a separate auth boundary in v1). `wireUiRouteFile` stays; only grouping + home differ. (Distinct SettingsLayout / public-unauth shells are **designed-for** via the enum but **deferred** — YAGNI until a build needs them.)
+
+**Acceptance (unchanged contract, role-aware only where safe):** Every feature remains reachable + e2e-tested via its nav testid — `role` only changes *which sidebar group* the nav link lives in, not whether it exists. This deliberately preserves the proven acceptance machinery (no gate relaxation). Smart-view filtering (Spec 2) is verified as UI within the Task feature, not as new entities.
+
+---
+
+## What's implemented now vs designed-for-later
+
+- **Now:** Parts A (all 5 guides) + B (`app-sidebar` + `settings` roles, home landing, sidebar grouping, broad schema).
+- **Later (schema-valid, not implemented):** `app-topnav`, `public` (unauth features), `focused` as a distinct feature layout, a dedicated `SettingsLayout` shell. Each is its own future spec when a build needs it.
+- **Non-goals:** any BoringStack fork; new CSS/components; M2M relationships; scheduled reminders (Spec 2 Phase 2).
+
+## Testing & validation
+
+- Unit tests for: plan-schema accepts/defaults `layout`/`home`; exactly-one-home validation; sidebar-group selection by role; home→`DEFAULT_REDIRECT_TO` wiring; guides present in the registry.
+- **Panel-gate** the harness diff (4-model, ≥2 agree).
+- **Live build**: Spec 2 (todos app) is the end-to-end proof — app lands on Today, settings demoted, UI uses tokens/primitives, a11y gate clean. Run solo on a quiet box.
+
+## Architecture / files to change
+
+- `packages/core/src/loop/conventions.ts` — register + author the 5 design-system topics (Part A).
+- `packages/core/src/loop/planning/plan-types.ts` — `IUiIntent.layout` + `home` (Part B schema).
+- `packages/core/src/loop/boringstack/wire-resource.ts` / `build.ts` / `refine-prompt.ts` — sidebar grouping, home-redirect wiring, `LoginPage.constants` scope (Part B wiring).
+- `packages/core/src/loop/boringstack/acceptance/testid-contract.ts` — keep nav contract; document role→group only.
+- Plan validation (where `isEntitySpec`/plan is validated) — exactly-one-home + valid `layout`.
+- Tests alongside each.
diff --git a/packages/core/src/agent/agent.constants.ts b/packages/core/src/agent/agent.constants.ts
index 53ade6c1..27c42e17 100644
--- a/packages/core/src/agent/agent.constants.ts
+++ b/packages/core/src/agent/agent.constants.ts
@@ -369,9 +369,14 @@ export const PULL_CONVENTIONS_TOOL = {
             "testing",
             "api-service",
             "i18n",
+            "design-tokens",
+            "theming",
+            "responsive",
+            "accessibility",
+            "components-ui",
           ],
           description:
-            'which guide: component-anatomy (where a component lives + one-per-file), file-layout (no inline types/constants/helpers), jsx (no computation in markup), state (hooks, not component body), no-casts (type guards instead of `as`/`!`), routing (thin route files), forms, data-fetching (api-client, never raw fetch), lint-gotchas (await promises, no void-expr values, no stringified errors, no duplicate strings), testing (.test.ts vs .test.tsx, the vi.hoisted api-client mock, createApp/app.handle route tests, enforced test rules), api-service (mutating service methods record an audit event; throw ApiError), i18n (add a locale key only when you reference it via t("key") — never pre-declare, or it\'s a dead-key error).',
+            'which guide: component-anatomy (where a component lives + one-per-file), file-layout (no inline types/constants/helpers), jsx (no computation in markup), state (hooks, not component body), no-casts (type guards instead of `as`/`!`), routing (thin route files), forms, data-fetching (api-client, never raw fetch), lint-gotchas (await promises, no void-expr values, no stringified errors, no duplicate strings), testing (.test.ts vs .test.tsx, the vi.hoisted api-client mock, createApp/app.handle route tests, enforced test rules), api-service (mutating service methods record an audit event; throw ApiError), i18n (add a locale key only when you reference it via t("key") — never pre-declare, or it\'s a dead-key error), design-tokens (never hardcode colors; use CSS-variable Tailwind tokens by role), theming (data-theme-driven, never dark: variants), responsive (mobile-first breakpoints + Sheet mobile drawer), accessibility (satisfy jsx-a11y up front: aria-label/aria-hidden/sr-only, no interactive div, semantic landmarks), components-ui (use @/components/ui Radix primitives, cn() + cva, asChild).',
         },
       },
       required: ["topic"],
diff --git a/packages/core/src/loop/conventions.ts b/packages/core/src/loop/conventions.ts
index 63895d36..024dc768 100644
--- a/packages/core/src/loop/conventions.ts
+++ b/packages/core/src/loop/conventions.ts
@@ -26,6 +26,11 @@ const TOPICS = [
   "testing",
   "api-service",
   "i18n",
+  "design-tokens",
+  "theming",
+  "responsive",
+  "accessibility",
+  "components-ui",
 ] as const;
 
 export type ConventionTopic = (typeof TOPICS)[number];
@@ -87,6 +92,30 @@ export const TOPIC_RULES: Readonly<Record<ConventionTopic, readonly string[]>> =
     // so EITHER pushes the guide: `i18n-locale-keys-used` (defined→used, the dead-key trap) and
     // `static-translation-key-exists` (used→defined, a `t()` whose key isn't in the locale files).
     i18n: ["i18n-locale-keys-used", "static-translation-key-exists"],
+    // Styling/theming/responsive/composition have no dedicated lint rule — they're front-loaded
+    // via buildConventionGuides (like api-service), so an empty rule list here.
+    "design-tokens": [],
+    theming: [],
+    responsive: [],
+    // Accessibility maps to the eslint-plugin-jsx-a11y rules the gate runs as ERRORS, so the guide
+    // PUSHes the moment the model trips one (bare names — topicForRule strips the jsx-a11y/ prefix).
+    accessibility: [
+      "no-static-element-interactions",
+      "click-events-have-key-events",
+      "no-noninteractive-element-interactions",
+      "label-has-associated-control",
+      "interactive-supports-focus",
+      "alt-text",
+      "anchor-has-content",
+      "heading-has-content",
+      "aria-props",
+      "aria-role",
+      "aria-unsupported-elements",
+      "role-has-required-aria-props",
+      "role-supports-aria-props",
+      "no-redundant-roles",
+    ],
+    "components-ui": [],
   };
 
 const GUIDES: Readonly<Record<ConventionTopic, string>> = {
@@ -303,6 +332,53 @@ const GUIDES: Readonly<Record<ConventionTopic, string>> = {
     "functionality the feature needs (a hollow list-only page), it's pure churn you'll re-add, and the " +
     "build's i18n edit-guard VETOES a net deletion of session-authored keys anyway. (Removal is only for " +
     "a genuinely obsolete pre-existing key, or a balanced rename that adds the replacement in the same edit.)",
+  "design-tokens":
+    "DESIGN TOKENS (boringstack). NEVER hardcode a color — no hex/rgb, no named colors, no arbitrary " +
+    "`bg-[#…]`. Every color is a CSS-variable design token exposed as a BARE Tailwind class; pick the " +
+    "token whose ROLE matches: `bg-background`/`text-foreground` (page), `bg-card`/`bg-panel` " +
+    "(containers/surfaces), `text-muted-foreground` (secondary/de-emphasized text), `border-border` and " +
+    "`border-border-strong/40` (dividers — the `/40` opacity variant for subtlety), " +
+    "`bg-primary text-primary-ink hover:bg-primary-strong` (primary CTA), `bg-secondary`/`bg-accent` " +
+    "(secondary / highlight), `bg-destructive text-destructive-foreground` (delete/danger), `text-success` " +
+    "(success), `ring-ring` (focus ring), `rounded-md`/`rounded-xl` (the `--radius` scale), `font-sans` " +
+    "(Inter — the default) / `font-mono`. Spacing/sizing use the normal Tailwind scale. A raw color value " +
+    "is a design-system violation — there is a token for every role.",
+  theming:
+    "THEMING (boringstack). Light/dark is DATA-ATTRIBUTE driven: tokens flip on " +
+    '`<html data-theme="dark">`, so a token class (`bg-background`, `text-foreground`, `bg-card`) is ' +
+    "AUTOMATICALLY correct in BOTH themes. NEVER write a `dark:` Tailwind variant (`dark:bg-…`) — it is " +
+    "banned (AGENT_CONTRACT) and redundant; the token already switches. Do not read or set the theme " +
+    "yourself — the `useTheme()` hook + the existing ThemeToggle own it. To test both themes, toggle " +
+    '`document.documentElement.setAttribute("data-theme", "dark")` and assert token-classed elements ' +
+    "still render; never assert a literal color value.",
+  responsive:
+    "RESPONSIVE (boringstack). Mobile-first: an UNPREFIXED class is the MOBILE style; add `sm:`/`md:`/`lg:` " +
+    "for larger screens (`px-4 lg:px-6`, `grid-cols-1 md:grid-cols-2`, `flex-col md:flex-row`). `md:` is the " +
+    "primary layout breakpoint. Every page MUST be usable at 375px wide — never fix a px width that " +
+    "overflows small screens; use `w-full`/`max-w-*` + breakpoint prefixes. NAV pattern: the sidebar is " +
+    '`hidden md:flex` on desktop with a `Sheet` drawer (`@/components/ui/sheet`, `side="left"`) for mobile ' +
+    "— REUSE that, don't invent a nav. For layout INSIDE a component, container queries (`@container`) are " +
+    "available (see the Card header).",
+  accessibility:
+    "ACCESSIBILITY (boringstack). The gate runs `eslint-plugin-jsx-a11y` as ERRORS — satisfy it on the " +
+    "first draft, don't discover it at the gate. An icon-only button needs an `aria-label`; a DECORATIVE " +
+    'icon (lucide) needs `aria-hidden="true"`; screen-reader-only text is `className="sr-only"`; every ' +
+    "heading/anchor must have content; a `<label>` must link its control (`htmlFor`+`id`, or use the " +
+    "`Label`+`Form` primitives). NEVER attach `onClick` to a `<div>`/`<span>` (no-static-element-" +
+    'interactions / click-events-have-key-events) — use `<button type="button">` or the `Button` ' +
+    "primitive so keyboard + focus come for free. STRUCTURE with semantic landmarks — `<nav aria-label=…>`, " +
+    '`<main>`, `<header>`, `<section>` — and mark the active nav link `aria-current="page"`. Prefer Radix ' +
+    "primitives (Dialog/Tabs/DropdownMenu/Switch) over hand-rolled widgets: they ship focus-trap, roles, " +
+    "and keyboard handling already.",
+  "components-ui":
+    "COMPONENTS (boringstack). Prefer the ready primitives in `@/components/ui/` — Button, Input, Label, " +
+    "Form (react-hook-form), Card (+Header/Title/Content/Footer), Dialog, Sheet, DropdownMenu, Popover, " +
+    "Tabs, Switch, ScrollArea, Skeleton, Sonner (toast) — over hand-built markup: they are already " +
+    "accessible (Radix) and themed (tokens). Compose classNames with the `cn()` helper (tailwind-merge + " +
+    "clsx) — NEVER string-concatenate or ternary a className. Add a VARIANT to a primitive via its `cva` " +
+    "config; do not fork it. `asChild` renders a primitive AS another element (e.g. `<Button asChild>` " +
+    "wrapping a router `Link`). These `src/components/ui/` primitives are EXEMPT from component-anatomy — " +
+    "import them, never recreate them under a feature.",
 };
 
 /** The guide for a topic (the exact string pushed or pulled). */
diff --git a/packages/core/tests/convention-index.test.ts b/packages/core/tests/convention-index.test.ts
index 7c713b31..4da4f7ed 100644
--- a/packages/core/tests/convention-index.test.ts
+++ b/packages/core/tests/convention-index.test.ts
@@ -139,3 +139,48 @@ test("the strict-lint rules map to the lint-gotchas guide", () => {
     expect(topicForRule(rule)).toBe("lint-gotchas");
   }
 });
+
+// Spec 1A — the design-system guides codify BoringStack's existing tokens/ShadCN/theming/responsive/
+// a11y so the model leans on them instead of reinventing. Lock the load-bearing content of each so a
+// future edit can't hollow a guide out.
+test("the design-system guides carry their load-bearing rules", () => {
+  const tokens = conventionGuide("design-tokens");
+
+  expect(tokens).toContain("NEVER hardcode a color");
+  expect(tokens).toContain("text-muted-foreground");
+
+  const theming = conventionGuide("theming");
+
+  expect(theming).toContain("data-theme");
+  expect(theming).toContain("dark:"); // teaches that dark: variants are banned
+
+  const responsive = conventionGuide("responsive");
+
+  expect(responsive).toContain("Mobile-first");
+  expect(responsive).toContain("Sheet");
+
+  const a11y = conventionGuide("accessibility");
+
+  expect(a11y).toContain("aria-label");
+  expect(a11y).toContain("aria-hidden");
+  expect(a11y).toContain("jsx-a11y");
+
+  const ui = conventionGuide("components-ui");
+
+  expect(ui).toContain("@/components/ui/");
+  expect(ui).toContain("cn(");
+});
+
+// Accessibility is the one design-system topic with a reactive rule mapping: the jsx-a11y rules the
+// gate runs as ERRORS must route to the accessibility guide (bare names, jsx-a11y/ prefix stripped),
+// so unseenGuidesForErrors pushes it the moment the model trips one.
+test("jsx-a11y rules map to the accessibility guide", () => {
+  for (const rule of [
+    "jsx-a11y/no-static-element-interactions",
+    "jsx-a11y/click-events-have-key-events",
+    "jsx-a11y/label-has-associated-control",
+    "jsx-a11y/aria-role",
+  ]) {
+    expect(topicForRule(rule)).toBe("accessibility");
+  }
+});

From 4a6d1cace4fb48c1eed42b1f6f470a2cefb28708 Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 11:56:30 +0200
Subject: [PATCH 07/20] feat(layout): plan layout-archetype + home landing
 capability (Spec 1B)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds the structural half of the modern-layout capability so an app's PRIMARY UI can be the
landing (not a generic /dashboard) and settings can be demoted — without touching the proven
route/nav/e2e machinery (role only drives sidebar grouping + the post-login redirect).

- Plan schema (plan-types): IUiIntent.layout (LayoutArchetype: app-sidebar|app-topnav|settings|
  focused|public, default app-sidebar) + home?:boolean. Enum is broad on purpose (anti-lock-in);
  v1 implements app-sidebar + settings, the rest fall back to app-sidebar + guidance.
- Validation (plan-store): layout must be a known archetype; at most ONE home slice. Both fields
  optional → every existing plan/test unaffected.
- Wiring (refine-prompt): per-slice layout guidance — app-sidebar features go to the primary nav
  group at the top of AppSidebar; settings features go to a demoted Settings group; the home
  feature repoints DEFAULT_REDIRECT_TO to its own route.
- Scope (build.scopeFor): the home feature — and ONLY it — gets LoginPage.constants in scope so it
  can set the landing (AUTH_REDIRECT_FILE); threaded from the plan's ui.home at the one call site.

Tests: schema round-trip, invalid-layout + >1-home rejection, exactly-one-home accept, scopeFor
home-only redirect scope, refine-prompt home-redirect + settings-group wiring. typecheck/lint/
format clean, 3202 green.
---
 packages/core/src/loop/boringstack/build.ts   | 16 +++-
 .../src/loop/boringstack/refine-prompt.ts     | 42 ++++++++++
 packages/core/src/loop/planning/plan-store.ts | 31 +++++++
 packages/core/src/loop/planning/plan-types.ts | 18 ++++
 packages/core/tests/boringstack-build.test.ts | 10 +++
 .../tests/boringstack-refine-prompt.test.ts   | 75 +++++++++++++++++
 packages/core/tests/plan-store.test.ts        | 84 +++++++++++++++++++
 7 files changed, 274 insertions(+), 2 deletions(-)

diff --git a/packages/core/src/loop/boringstack/build.ts b/packages/core/src/loop/boringstack/build.ts
index 8770b4e0..ececd381 100644
--- a/packages/core/src/loop/boringstack/build.ts
+++ b/packages/core/src/loop/boringstack/build.ts
@@ -141,6 +141,13 @@ export const APP_ROUTES_FILE = "apps/ui/src/app/router/routes.tsx";
 export const APP_SIDEBAR_TEST_FILE =
   "apps/ui/src/components/core/AppSidebar/AppSidebar.test.tsx";
 
+/** The login page's constants, which hold `DEFAULT_REDIRECT_TO` (the post-login landing route).
+ *  Scoped in ONLY for the feature marked `ui.home` in the plan, so it can point the redirect at
+ *  its own route (the app "home") instead of the scaffold default `/dashboard`. Non-home features
+ *  never get this in scope, so they can't touch the landing. */
+export const AUTH_REDIRECT_FILE =
+  "apps/ui/src/features/auth/components/LoginPage/LoginPage.constants.ts";
+
 /**
  * The feature-EXCLUSIVE directories the model may FULLY REWRITE — its own API resource, its API
  * tests, and its UI feature. These are safe rewrite targets because no other feature owns them.
@@ -158,9 +165,12 @@ export function featureOwnedGlobs(name: string): string[] {
   ];
 }
 
-export function scopeFor(name: string): string[] {
+export function scopeFor(name: string, isHome = false): string[] {
   return [
     ...featureOwnedGlobs(name),
+    // The app "home" feature (plan `ui.home`) may repoint the post-login redirect at its own
+    // route; only it gets the login constants in scope (see AUTH_REDIRECT_FILE).
+    ...(isHome ? [AUTH_REDIRECT_FILE] : []),
     // The entity's table + columns live in the shared app schema (not the resource
     // dir), so a greenfield build must let the model add its domain columns there.
     APP_SCHEMA_FILE,
@@ -570,7 +580,9 @@ export function boringstackDeps(opts: {
       await generate(cwd, feature.id, exec);
       await genUi(cwd, feature.id, exec);
 
-      host.setScope(scopeFor(feature.id));
+      host.setScope(
+        scopeFor(feature.id, sliceFor?.(feature.id)?.ui.home === true)
+      );
       // The editable file the expert repairs if a stall's errors are all out of
       // scope (locked consumers of this feature's types) — its service file.
       host.setExpertRescueTarget((await rescueFileFor(cwd, feature)) ?? "");
diff --git a/packages/core/src/loop/boringstack/refine-prompt.ts b/packages/core/src/loop/boringstack/refine-prompt.ts
index e7dc5d18..e9d9ddcb 100644
--- a/packages/core/src/loop/boringstack/refine-prompt.ts
+++ b/packages/core/src/loop/boringstack/refine-prompt.ts
@@ -2,6 +2,46 @@ import type { IFeature } from "../greenfield/greenfield.types";
 import type { ISlice } from "../planning/plan-types";
 import { toCamelCase } from "./case";
 
+/** Per-slice layout wiring: where the feature's nav link goes (primary app group vs a demoted
+ *  Settings group) and, if it's the app home, the post-login redirect. v1 implements app-sidebar
+ *  + settings; the other archetypes build as app-sidebar for now (the enum is broad on purpose). */
+function layoutGuidance(slice: ISlice): string {
+  const layout = slice.ui.layout ?? "app-sidebar";
+  const route = `/${toCamelCase(slice.entity.id)}`;
+  const lines: string[] = [];
+
+  if (layout === "settings") {
+    lines.push(
+      "**Layout**: `settings` — a DEMOTED config area. Add this feature's sidebar link to a " +
+        "secondary **Settings** group in `AppSidebar` (grouped with the account/profile/settings " +
+        "links, below the primary app nav), NOT the primary app nav group."
+    );
+  } else {
+    const fallback =
+      layout === "app-sidebar"
+        ? ""
+        : ` (\`${layout}\` has no distinct shell yet — build it as \`app-sidebar\` for now)`;
+
+    lines.push(
+      "**Layout**: `app-sidebar` — a PRIMARY app view" +
+        fallback +
+        ". Add its sidebar link to the primary app nav group at the TOP of `AppSidebar`, above the " +
+        "Settings/account links."
+    );
+  }
+
+  if (slice.ui.home === true) {
+    lines.push(
+      "**Home**: this feature is the app's landing view. Set `DEFAULT_REDIRECT_TO` to " +
+        `\`"${route}"\` in ` +
+        "`apps/ui/src/features/auth/components/LoginPage/LoginPage.constants.ts` so a signed-in " +
+        "user lands here instead of `/dashboard`. ONLY this (home) feature edits that file."
+    );
+  }
+
+  return lines.join("\n\n");
+}
+
 function productContextSection(slice: ISlice): string {
   const fieldsList = slice.entity.fields
     .map((f) => {
@@ -52,6 +92,8 @@ ${rulesList}
 
 **Navigation**: ${slice.ui.nav}
 
+${layoutGuidance(slice)}
+
 ### Verification Contract
 
 **Must remain true**:
diff --git a/packages/core/src/loop/planning/plan-store.ts b/packages/core/src/loop/planning/plan-store.ts
index 649d9e94..c2f2ddab 100644
--- a/packages/core/src/loop/planning/plan-store.ts
+++ b/packages/core/src/loop/planning/plan-store.ts
@@ -143,6 +143,27 @@ function isUiIntent(value: unknown): value is IUiIntent {
     return false;
   }
 
+  // Optional layout archetype: if present it must be one the harness knows.
+  const validLayouts = [
+    "app-sidebar",
+    "app-topnav",
+    "settings",
+    "focused",
+    "public",
+  ];
+
+  if (
+    value.layout !== undefined &&
+    !(typeof value.layout === "string" && validLayouts.includes(value.layout))
+  ) {
+    return false;
+  }
+
+  // Optional home flag: post-login landing marker.
+  if (value.home !== undefined && typeof value.home !== "boolean") {
+    return false;
+  }
+
   return true;
 }
 
@@ -229,6 +250,16 @@ export function isProductPlan(value: unknown): value is IProductPlan {
     return false;
   }
 
+  // At most ONE slice may be the app home (the post-login landing). isRecord guards keep this
+  // cast-free even though `value.slices` is still `unknown[]` at this point.
+  const homeCount = value.slices.filter(
+    (s) => isRecord(s) && isRecord(s.ui) && s.ui.home === true
+  ).length;
+
+  if (homeCount > 1) {
+    return false;
+  }
+
   return true;
 }
 
diff --git a/packages/core/src/loop/planning/plan-types.ts b/packages/core/src/loop/planning/plan-types.ts
index 979991b7..12a16aa5 100644
--- a/packages/core/src/loop/planning/plan-types.ts
+++ b/packages/core/src/loop/planning/plan-types.ts
@@ -10,11 +10,29 @@ export interface IEntitySpec {
   readonly rules: readonly string[];
 }
 
+/** The modern-layout archetypes the harness understands. The set is intentionally broad so a
+ *  plan is never locked into too few options; v1 IMPLEMENTS `app-sidebar` (the default) and
+ *  `settings`, and the rest are schema-valid but fall back to `app-sidebar` + guidance until a
+ *  build needs them (see the layout wiring in refine-prompt). */
+export type LayoutArchetype =
+  | "app-sidebar" // left sidebar + header content shell (default SaaS look)
+  | "app-topnav" // horizontal top-nav + content
+  | "settings" // demoted secondary/config area (profile, account, prefs)
+  | "focused" // centered single-column (auth, onboarding)
+  | "public"; // unauthenticated marketing/landing
+
 export interface IUiIntent {
   readonly screens: readonly ("list" | "detail" | "form" | "dashboard")[];
   readonly action: string; // primary user action → observable result
   readonly shows: readonly string[];
   readonly nav: string;
+  /** Which layout archetype this feature's UI uses. Default `app-sidebar`. Drives sidebar
+   *  grouping (primary app nav vs a demoted Settings group) — NOT a separate auth boundary in
+   *  v1 (both stay ProtectedRoute + AppShell). */
+  readonly layout?: LayoutArchetype;
+  /** This feature's route is the post-login landing (the app "home"). At most ONE per plan; if
+   *  none is marked, login falls back to the scaffold default (`/dashboard`). */
+  readonly home?: boolean;
 }
 
 export interface IVerificationContract {
diff --git a/packages/core/tests/boringstack-build.test.ts b/packages/core/tests/boringstack-build.test.ts
index f57930d1..d51b6436 100644
--- a/packages/core/tests/boringstack-build.test.ts
+++ b/packages/core/tests/boringstack-build.test.ts
@@ -17,6 +17,7 @@ import {
   saveBaseline,
   APP_SCHEMA_FILE,
   LOCALE_GLOB,
+  AUTH_REDIRECT_FILE,
 } from "../src/loop/boringstack/build";
 import type {
   IAcceptanceRunner,
@@ -426,6 +427,15 @@ describe("scopeFor", () => {
       "apps/ui/src/components/core/AppSidebar/AppSidebar.test.tsx"
     );
   });
+
+  test("scopes in the login redirect ONLY for the app-home feature", () => {
+    // The home feature (plan `ui.home`) repoints DEFAULT_REDIRECT_TO at its own route, so it —
+    // and only it — gets LoginPage.constants in scope. Non-home features must not touch the landing.
+    expect(scopeFor("Task", true)).toContain(AUTH_REDIRECT_FILE);
+    expect(scopeFor("Task", false)).not.toContain(AUTH_REDIRECT_FILE);
+    // Default (no flag) is non-home — backward compatible with every existing caller/plan.
+    expect(scopeFor("Task")).not.toContain(AUTH_REDIRECT_FILE);
+  });
 });
 
 describe("rescueFileFor", () => {
diff --git a/packages/core/tests/boringstack-refine-prompt.test.ts b/packages/core/tests/boringstack-refine-prompt.test.ts
index 952983a2..9e2f82b0 100644
--- a/packages/core/tests/boringstack-refine-prompt.test.ts
+++ b/packages/core/tests/boringstack-refine-prompt.test.ts
@@ -411,6 +411,81 @@ describe("refinePrompt", () => {
     expect(p).toContain("**Display** list is for rendering only");
   });
 
+  it("wires the app-home landing redirect + primary-nav placement when the slice is app-sidebar + home", () => {
+    const feature: IFeature = {
+      id: "Task",
+      desc: "a task",
+      passes: false,
+      attempts: 0,
+    };
+    const slice: ISlice = {
+      entity: {
+        id: "Task",
+        desc: "a task",
+        fields: [{ name: "title", type: "string" }],
+        relationships: ["belongsTo User"],
+        rules: ["title required"],
+      },
+      ui: {
+        screens: ["list", "form"],
+        action: "add → list",
+        shows: ["title"],
+        nav: "Tasks",
+        layout: "app-sidebar",
+        home: true,
+      },
+      verification: {
+        mustRemainTrue: ["auth"],
+        mustNotHappen: ["no title"],
+        acceptanceCheck: "bun test",
+      },
+    };
+    const p = refinePrompt(feature, slice);
+
+    // Home → the post-login redirect points at THIS feature's route (/task).
+    expect(p).toContain("DEFAULT_REDIRECT_TO");
+    expect(p).toContain('"/task"');
+    expect(p).toContain("LoginPage.constants.ts");
+    // Primary app view → its nav link goes to the top-of-sidebar app group.
+    expect(p).toContain("primary app nav group");
+  });
+
+  it("puts a settings-layout feature in the demoted Settings group and emits no home redirect", () => {
+    const feature: IFeature = {
+      id: "NotificationPrefs",
+      desc: "prefs",
+      passes: false,
+      attempts: 0,
+    };
+    const slice: ISlice = {
+      entity: {
+        id: "NotificationPrefs",
+        desc: "prefs",
+        fields: [{ name: "emailEnabled", type: "boolean" }],
+        relationships: ["belongsTo User"],
+        rules: ["belongs to a user"],
+      },
+      ui: {
+        screens: ["form"],
+        action: "save prefs",
+        shows: ["emailEnabled"],
+        nav: "Notification Preferences",
+        layout: "settings",
+      },
+      verification: {
+        mustRemainTrue: ["auth"],
+        mustNotHappen: ["prefs without a user"],
+        acceptanceCheck: "bun test",
+      },
+    };
+    const p = refinePrompt(feature, slice);
+
+    expect(p).toContain("DEMOTED config area");
+    expect(p).toContain("**Settings** group");
+    // Not the app home → no redirect rewrite instruction.
+    expect(p).not.toContain("DEFAULT_REDIRECT_TO");
+  });
+
   it("refinePrompt without a slice is unchanged (contains id + desc)", () => {
     const p = refinePrompt({
       id: "Bookmark",
diff --git a/packages/core/tests/plan-store.test.ts b/packages/core/tests/plan-store.test.ts
index 8dd2a658..077bb0a5 100644
--- a/packages/core/tests/plan-store.test.ts
+++ b/packages/core/tests/plan-store.test.ts
@@ -51,6 +51,90 @@ test("plan round-trips through serialize/parse with status", () => {
   ]);
 });
 
+// Spec 1B — the layout capability: a slice may declare a layout archetype + a home landing.
+test("plan round-trips a slice's layout archetype + home marker", () => {
+  const plan: IProductPlan = {
+    product: "Todos",
+    slices: [
+      {
+        entity: {
+          id: "Task",
+          desc: "a task",
+          fields: [{ name: "title", type: "string" }],
+          relationships: ["belongsTo User"],
+          rules: ["title required"],
+        },
+        ui: {
+          screens: ["list", "form"],
+          action: "add → list",
+          shows: ["title"],
+          nav: "Tasks",
+          layout: "app-sidebar",
+          home: true,
+        },
+        verification: {
+          mustRemainTrue: ["auth"],
+          mustNotHappen: ["no title"],
+          acceptanceCheck: "bun test",
+        },
+      },
+    ],
+  };
+  const parsed = parsePlan(serializePlan(plan, "approved"));
+
+  expect(parsed?.plan.slices[0]?.ui.layout).toBe("app-sidebar");
+  expect(parsed?.plan.slices[0]?.ui.home).toBe(true);
+});
+
+// A malformed slice is built as raw text (the type would forbid an invalid layout / can't easily
+// express "two homes are wrong"), mirroring the other reject-by-default tests below.
+const sliceJson = (id: string, extraUi: Record<string, unknown>): unknown => ({
+  entity: {
+    id,
+    desc: "d",
+    fields: [{ name: "title", type: "string" }],
+    relationships: ["belongsTo User"],
+    rules: ["title required"],
+  },
+  ui: {
+    screens: ["list"],
+    action: "a",
+    shows: ["title"],
+    nav: id,
+    ...extraUi,
+  },
+  verification: {
+    mustRemainTrue: ["auth"],
+    mustNotHappen: ["bad"],
+    acceptanceCheck: "bun test",
+  },
+});
+
+const planText = (slices: unknown[]): string =>
+  `---\nstatus: approved\n---\n\`\`\`json\n${JSON.stringify({ product: "x", slices })}\n\`\`\``;
+
+test("parsePlan rejects an unknown layout archetype", () => {
+  expect(
+    parsePlan(planText([sliceJson("Task", { layout: "carousel" })]))
+  ).toBeNull();
+});
+
+test("parsePlan rejects more than one home slice", () => {
+  expect(
+    parsePlan(
+      planText([sliceJson("A", { home: true }), sliceJson("B", { home: true })])
+    )
+  ).toBeNull();
+});
+
+test("parsePlan accepts exactly one home slice", () => {
+  const parsed = parsePlan(
+    planText([sliceJson("A", { home: true }), sliceJson("B", {})])
+  );
+
+  expect(parsed).not.toBeNull();
+});
+
 test("a malformed artifact parses to null (reject-by-default)", () => {
   expect(parsePlan("not a plan")).toBeNull();
 });

From e09692b9e85e3c214e1dca2debf3e2366fb48bae Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 12:20:10 +0200
Subject: [PATCH 08/20] fix(layout): deterministic home redirect +
 single-source archetypes + test coverage (panel r1)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round-1 panel findings on the layout capability:

- (major, false-green) Home landing was prompt-only → a model could leave DEFAULT_REDIRECT_TO at
  /dashboard and still pass every gate. FIXED at the root: the harness now writes the redirect
  DETERMINISTICALLY (wireHomeRedirect/applyHomeRedirect in wire-resource; called from build.implement
  for the ui.home slice) — not model-prompted. Dropped the scopeFor(isHome)/AUTH_REDIRECT_FILE +
  prompt-edit path entirely; the refine-prompt now tells the model NOT to touch the redirect.
- (minor, dual source) validLayouts was a hand-copy of the LayoutArchetype union → replaced with a
  single-source LAYOUT_ARCHETYPES tuple that drives BOTH the type and the runtime validation list.
- Tests added/strengthened: wireHomeRedirect (repoint/idempotent/throw-on-missing-anchor);
  refine-prompt default-layout (no layout → app-sidebar, no home note) + updated home test for the
  deterministic note; plan-store non-boolean-home reject, zero-home accept, omitted-fields
  backward-compat; convention-index diff-visible guard that the 5 new topics are in both the
  registry and the pull enum.
- (finding on text-destructive-foreground) verified FALSE — --destructive-foreground +
  --color-destructive-foreground exist in the scaffold tokens; guide is correct.

Grouping stays guide-driven (cosmetic: a mis-grouped nav link still works); only the FUNCTIONAL
landing is now deterministic + gate-safe. typecheck/lint/format clean, 3209 green.
---
 packages/core/src/loop/boringstack/build.ts   | 24 ++++------
 .../src/loop/boringstack/refine-prompt.ts     |  8 ++--
 .../src/loop/boringstack/wire-resource.ts     | 40 ++++++++++++++++
 packages/core/src/loop/planning/plan-store.ts | 13 ++---
 packages/core/src/loop/planning/plan-types.ts | 17 ++++---
 packages/core/tests/boringstack-build.test.ts | 10 ----
 .../tests/boringstack-refine-prompt.test.ts   | 48 +++++++++++++++++--
 .../tests/boringstack-wire-resource.test.ts   | 31 ++++++++++++
 packages/core/tests/convention-index.test.ts  | 22 +++++++++
 packages/core/tests/plan-store.test.ts        | 19 ++++++++
 10 files changed, 187 insertions(+), 45 deletions(-)

diff --git a/packages/core/src/loop/boringstack/build.ts b/packages/core/src/loop/boringstack/build.ts
index ececd381..4e827485 100644
--- a/packages/core/src/loop/boringstack/build.ts
+++ b/packages/core/src/loop/boringstack/build.ts
@@ -11,6 +11,7 @@ import type { IProvider } from "../../inference";
 import type { IGate } from "../../gate/gate-runner";
 import type { Exec } from "./exec";
 import { generateResource, generateFeature } from "./generate";
+import { applyHomeRedirect } from "./wire-resource";
 import { runBoringstackGate } from "./gate";
 import { extractFailures } from "./extract-failures";
 import { resolveStuckFile } from "../expert-handoff";
@@ -141,13 +142,6 @@ export const APP_ROUTES_FILE = "apps/ui/src/app/router/routes.tsx";
 export const APP_SIDEBAR_TEST_FILE =
   "apps/ui/src/components/core/AppSidebar/AppSidebar.test.tsx";
 
-/** The login page's constants, which hold `DEFAULT_REDIRECT_TO` (the post-login landing route).
- *  Scoped in ONLY for the feature marked `ui.home` in the plan, so it can point the redirect at
- *  its own route (the app "home") instead of the scaffold default `/dashboard`. Non-home features
- *  never get this in scope, so they can't touch the landing. */
-export const AUTH_REDIRECT_FILE =
-  "apps/ui/src/features/auth/components/LoginPage/LoginPage.constants.ts";
-
 /**
  * The feature-EXCLUSIVE directories the model may FULLY REWRITE — its own API resource, its API
  * tests, and its UI feature. These are safe rewrite targets because no other feature owns them.
@@ -165,12 +159,9 @@ export function featureOwnedGlobs(name: string): string[] {
   ];
 }
 
-export function scopeFor(name: string, isHome = false): string[] {
+export function scopeFor(name: string): string[] {
   return [
     ...featureOwnedGlobs(name),
-    // The app "home" feature (plan `ui.home`) may repoint the post-login redirect at its own
-    // route; only it gets the login constants in scope (see AUTH_REDIRECT_FILE).
-    ...(isHome ? [AUTH_REDIRECT_FILE] : []),
     // The entity's table + columns live in the shared app schema (not the resource
     // dir), so a greenfield build must let the model add its domain columns there.
     APP_SCHEMA_FILE,
@@ -580,9 +571,14 @@ export function boringstackDeps(opts: {
       await generate(cwd, feature.id, exec);
       await genUi(cwd, feature.id, exec);
 
-      host.setScope(
-        scopeFor(feature.id, sliceFor?.(feature.id)?.ui.home === true)
-      );
+      // Deterministically point the post-login landing at the app "home" feature's route (plan
+      // `ui.home`) — harness-owned, NOT model-prompted, so the landing can't silently stay
+      // `/dashboard` and slip past the gate (a false-green). No-op for non-home features.
+      if (sliceFor?.(feature.id)?.ui.home === true) {
+        await applyHomeRedirect(cwd, `/${toCamelCase(feature.id)}`);
+      }
+
+      host.setScope(scopeFor(feature.id));
       // The editable file the expert repairs if a stall's errors are all out of
       // scope (locked consumers of this feature's types) — its service file.
       host.setExpertRescueTarget((await rescueFileFor(cwd, feature)) ?? "");
diff --git a/packages/core/src/loop/boringstack/refine-prompt.ts b/packages/core/src/loop/boringstack/refine-prompt.ts
index e9d9ddcb..04508464 100644
--- a/packages/core/src/loop/boringstack/refine-prompt.ts
+++ b/packages/core/src/loop/boringstack/refine-prompt.ts
@@ -32,10 +32,10 @@ function layoutGuidance(slice: ISlice): string {
 
   if (slice.ui.home === true) {
     lines.push(
-      "**Home**: this feature is the app's landing view. Set `DEFAULT_REDIRECT_TO` to " +
-        `\`"${route}"\` in ` +
-        "`apps/ui/src/features/auth/components/LoginPage/LoginPage.constants.ts` so a signed-in " +
-        "user lands here instead of `/dashboard`. ONLY this (home) feature edits that file."
+      "**Home**: this feature is the app's landing view — the harness AUTOMATICALLY points the " +
+        `post-login redirect (\`DEFAULT_REDIRECT_TO\`) at its route (\`${route}\`). Do NOT edit ` +
+        "the login page or that constant yourself; just build this feature well as the primary " +
+        "app view the user lands in."
     );
   }
 
diff --git a/packages/core/src/loop/boringstack/wire-resource.ts b/packages/core/src/loop/boringstack/wire-resource.ts
index 2d593f6e..1d1d0054 100644
--- a/packages/core/src/loop/boringstack/wire-resource.ts
+++ b/packages/core/src/loop/boringstack/wire-resource.ts
@@ -238,6 +238,46 @@ export async function wireUiFeature(cwd: string, name: string): Promise<void> {
   await wireI18nKeys(cwd, name);
 }
 
+/**
+ * Point the login page's `DEFAULT_REDIRECT_TO` at `route` (the plan `home` feature's route), so a
+ * signed-in user lands INTO the app instead of the generic `/dashboard`. The harness writes this
+ * DETERMINISTICALLY — it is NOT left to the model + a prompt — so the landing can't silently stay
+ * `/dashboard` and slip past the gate (a false-green). Pure + idempotent + self-healing: it
+ * matches the export regardless of the current value, and throws if the anchor is missing rather
+ * than silently no-op'ing (which would re-introduce the false-green).
+ */
+export function wireHomeRedirect(src: string, route: string): string {
+  const anchor = /export const DEFAULT_REDIRECT_TO\s*=\s*"[^"]*";/;
+
+  if (!anchor.test(src)) {
+    throw new Error(
+      "wireHomeRedirect: DEFAULT_REDIRECT_TO not found in LoginPage.constants"
+    );
+  }
+
+  return src.replace(anchor, `export const DEFAULT_REDIRECT_TO = "${route}";`);
+}
+
+/** Apply {@link wireHomeRedirect} to the scaffold's LoginPage constants. Guarded by existence so a
+ *  boringstack variant without this exact file skips cleanly (the app still builds). */
+export async function applyHomeRedirect(
+  cwd: string,
+  route: string
+): Promise<void> {
+  const path = join(
+    cwd,
+    "apps/ui/src/features/auth/components/LoginPage/LoginPage.constants.ts"
+  );
+
+  if (!existsSync(path)) {
+    return;
+  }
+
+  const src = await readFile(path, "utf-8");
+
+  await writeFile(path, wireHomeRedirect(src, route), "utf-8");
+}
+
 /**
  * Seed the i18n keys the generated feature page renders (`features.<lower>.title`
  * and `.empty`) into every locale's `common.json`. new:feature emits the page using
diff --git a/packages/core/src/loop/planning/plan-store.ts b/packages/core/src/loop/planning/plan-store.ts
index c2f2ddab..e2289c0f 100644
--- a/packages/core/src/loop/planning/plan-store.ts
+++ b/packages/core/src/loop/planning/plan-store.ts
@@ -8,6 +8,7 @@ import type {
   IUiIntent,
   IVerificationContract,
 } from "./plan-types";
+import { LAYOUT_ARCHETYPES } from "./plan-types";
 
 /**
  * Serialize a plan to YAML frontmatter + fenced JSON format.
@@ -143,14 +144,10 @@ function isUiIntent(value: unknown): value is IUiIntent {
     return false;
   }
 
-  // Optional layout archetype: if present it must be one the harness knows.
-  const validLayouts = [
-    "app-sidebar",
-    "app-topnav",
-    "settings",
-    "focused",
-    "public",
-  ];
+  // Optional layout archetype: if present it must be one the harness knows. The valid set is
+  // the shared LAYOUT_ARCHETYPES tuple (single source with the LayoutArchetype type) so a new
+  // archetype can't be added to the type yet silently rejected here.
+  const validLayouts: readonly string[] = LAYOUT_ARCHETYPES;
 
   if (
     value.layout !== undefined &&
diff --git a/packages/core/src/loop/planning/plan-types.ts b/packages/core/src/loop/planning/plan-types.ts
index 12a16aa5..30f4a593 100644
--- a/packages/core/src/loop/planning/plan-types.ts
+++ b/packages/core/src/loop/planning/plan-types.ts
@@ -14,12 +14,17 @@ export interface IEntitySpec {
  *  plan is never locked into too few options; v1 IMPLEMENTS `app-sidebar` (the default) and
  *  `settings`, and the rest are schema-valid but fall back to `app-sidebar` + guidance until a
  *  build needs them (see the layout wiring in refine-prompt). */
-export type LayoutArchetype =
-  | "app-sidebar" // left sidebar + header content shell (default SaaS look)
-  | "app-topnav" // horizontal top-nav + content
-  | "settings" // demoted secondary/config area (profile, account, prefs)
-  | "focused" // centered single-column (auth, onboarding)
-  | "public"; // unauthenticated marketing/landing
+/** Single source of truth for the archetypes: the tuple drives BOTH the `LayoutArchetype` type
+ *  and the runtime validation list (plan-store), so the two can never diverge (no `as` cast). */
+export const LAYOUT_ARCHETYPES = [
+  "app-sidebar", // left sidebar + header content shell (default SaaS look)
+  "app-topnav", // horizontal top-nav + content
+  "settings", // demoted secondary/config area (profile, account, prefs)
+  "focused", // centered single-column (auth, onboarding)
+  "public", // unauthenticated marketing/landing
+] as const;
+
+export type LayoutArchetype = (typeof LAYOUT_ARCHETYPES)[number];
 
 export interface IUiIntent {
   readonly screens: readonly ("list" | "detail" | "form" | "dashboard")[];
diff --git a/packages/core/tests/boringstack-build.test.ts b/packages/core/tests/boringstack-build.test.ts
index d51b6436..f57930d1 100644
--- a/packages/core/tests/boringstack-build.test.ts
+++ b/packages/core/tests/boringstack-build.test.ts
@@ -17,7 +17,6 @@ import {
   saveBaseline,
   APP_SCHEMA_FILE,
   LOCALE_GLOB,
-  AUTH_REDIRECT_FILE,
 } from "../src/loop/boringstack/build";
 import type {
   IAcceptanceRunner,
@@ -427,15 +426,6 @@ describe("scopeFor", () => {
       "apps/ui/src/components/core/AppSidebar/AppSidebar.test.tsx"
     );
   });
-
-  test("scopes in the login redirect ONLY for the app-home feature", () => {
-    // The home feature (plan `ui.home`) repoints DEFAULT_REDIRECT_TO at its own route, so it —
-    // and only it — gets LoginPage.constants in scope. Non-home features must not touch the landing.
-    expect(scopeFor("Task", true)).toContain(AUTH_REDIRECT_FILE);
-    expect(scopeFor("Task", false)).not.toContain(AUTH_REDIRECT_FILE);
-    // Default (no flag) is non-home — backward compatible with every existing caller/plan.
-    expect(scopeFor("Task")).not.toContain(AUTH_REDIRECT_FILE);
-  });
 });
 
 describe("rescueFileFor", () => {
diff --git a/packages/core/tests/boringstack-refine-prompt.test.ts b/packages/core/tests/boringstack-refine-prompt.test.ts
index 9e2f82b0..6c8f1c70 100644
--- a/packages/core/tests/boringstack-refine-prompt.test.ts
+++ b/packages/core/tests/boringstack-refine-prompt.test.ts
@@ -442,14 +442,56 @@ describe("refinePrompt", () => {
     };
     const p = refinePrompt(feature, slice);
 
-    // Home → the post-login redirect points at THIS feature's route (/task).
+    // Home → the note references the auto-wired redirect at THIS feature's route (/task) and tells
+    // the model NOT to edit it (the harness owns DEFAULT_REDIRECT_TO deterministically).
     expect(p).toContain("DEFAULT_REDIRECT_TO");
-    expect(p).toContain('"/task"');
-    expect(p).toContain("LoginPage.constants.ts");
+    expect(p).toContain("/task");
+    expect(p).toContain("AUTOMATICALLY");
+    expect(p).toContain("Do NOT edit");
+    // The model is NOT told to hand-edit the login constants file (deterministic wiring).
+    expect(p).not.toContain("LoginPage.constants.ts");
     // Primary app view → its nav link goes to the top-of-sidebar app group.
     expect(p).toContain("primary app nav group");
   });
 
+  it("defaults a slice with no layout field to app-sidebar (primary nav, no home note) — backward compatible", () => {
+    const feature: IFeature = {
+      id: "Bookmark",
+      desc: "a link",
+      passes: false,
+      attempts: 0,
+    };
+    const slice: ISlice = {
+      entity: {
+        id: "Bookmark",
+        desc: "a link",
+        fields: [{ name: "url", type: "string" }],
+        relationships: ["belongsTo User"],
+        rules: ["url required"],
+      },
+      ui: {
+        // No `layout`, no `home` — the common backward-compatible case.
+        screens: ["list", "form"],
+        action: "save → list",
+        shows: ["url"],
+        nav: "Bookmarks",
+      },
+      verification: {
+        mustRemainTrue: ["auth"],
+        mustNotHappen: ["no url"],
+        acceptanceCheck: "bun test",
+      },
+    };
+    const p = refinePrompt(feature, slice);
+
+    // Treated as the default app-sidebar primary view.
+    expect(p).toContain("primary app nav group");
+    // No home → no landing note (phrase unique to the home block).
+    expect(p).not.toContain("post-login redirect");
+    // Not a settings feature.
+    expect(p).not.toContain("DEMOTED config area");
+  });
+
   it("puts a settings-layout feature in the demoted Settings group and emits no home redirect", () => {
     const feature: IFeature = {
       id: "NotificationPrefs",
diff --git a/packages/core/tests/boringstack-wire-resource.test.ts b/packages/core/tests/boringstack-wire-resource.test.ts
index ca3a2f51..85366e20 100644
--- a/packages/core/tests/boringstack-wire-resource.test.ts
+++ b/packages/core/tests/boringstack-wire-resource.test.ts
@@ -6,6 +6,7 @@ import {
   wireTestHelperFile,
   wireUiRouteFile,
   addFeatureI18nKeys,
+  wireHomeRedirect,
 } from "../src/loop/boringstack/wire-resource";
 
 /** A minimal stand-in for boringstack's SPA router, carrying the anchors the
@@ -237,3 +238,33 @@ export type { IUser } from "../../src/api/users/users.types";
     ).toThrow("Anchor not found");
   });
 });
+
+describe("wireHomeRedirect", () => {
+  test("repoints DEFAULT_REDIRECT_TO at the home feature's route", () => {
+    const src = 'export const DEFAULT_REDIRECT_TO = "/dashboard";\n';
+
+    expect(wireHomeRedirect(src, "/task")).toBe(
+      'export const DEFAULT_REDIRECT_TO = "/task";\n'
+    );
+  });
+
+  test("is idempotent + self-healing regardless of the current value", () => {
+    const already = 'export const DEFAULT_REDIRECT_TO = "/task";';
+
+    expect(wireHomeRedirect(already, "/task")).toBe(already);
+    // A different current value is corrected, not appended.
+    expect(
+      wireHomeRedirect(
+        'export const DEFAULT_REDIRECT_TO = "/project";',
+        "/task"
+      )
+    ).toBe('export const DEFAULT_REDIRECT_TO = "/task";');
+  });
+
+  test("throws (never silently no-ops) if the anchor is missing", () => {
+    // A silent no-op would leave the landing at /dashboard — the false-green this determinism fixes.
+    expect(() => wireHomeRedirect("export const OTHER = 1;", "/task")).toThrow(
+      "DEFAULT_REDIRECT_TO not found"
+    );
+  });
+});
diff --git a/packages/core/tests/convention-index.test.ts b/packages/core/tests/convention-index.test.ts
index 4da4f7ed..7858a296 100644
--- a/packages/core/tests/convention-index.test.ts
+++ b/packages/core/tests/convention-index.test.ts
@@ -101,6 +101,28 @@ test("PULL_CONVENTIONS_TOOL enum stays in sync with conventionTopics()", () => {
   expect([...enumTopics].sort()).toEqual([...conventionTopics()].sort());
 });
 
+// Explicit, diff-visible guard for the 5 design-system topics this change added: each must be
+// pullable — present in BOTH the runtime guide registry and the hand-maintained pull-tool enum —
+// so validate can't stay green while the tool schema and registry diverge for these topics.
+test("the new design-system topics are in both the guide registry and the pull enum", () => {
+  const enumTopics =
+    PULL_CONVENTIONS_TOOL.function.parameters.properties.topic.enum;
+  const registry = conventionTopics();
+
+  for (const topic of [
+    "design-tokens",
+    "theming",
+    "responsive",
+    "accessibility",
+    "components-ui",
+  ]) {
+    // `.some` (not `.toContain`) so the string literal compares cleanly against the typed
+    // ConventionTopic[] / enum tuple without a cast.
+    expect(registry.includes(topic)).toBe(true);
+    expect(enumTopics.includes(topic)).toBe(true);
+  }
+});
+
 // The STATE guide must NOT tell the model to use raw fetch (it contradicts DATA-FETCHING's
 // fetch ban) — the aggregate front-load test can't catch this because the data-fetching guide
 // separately contains the api-client string.
diff --git a/packages/core/tests/plan-store.test.ts b/packages/core/tests/plan-store.test.ts
index 077bb0a5..1c876483 100644
--- a/packages/core/tests/plan-store.test.ts
+++ b/packages/core/tests/plan-store.test.ts
@@ -135,6 +135,25 @@ test("parsePlan accepts exactly one home slice", () => {
   expect(parsed).not.toBeNull();
 });
 
+test("parsePlan rejects a non-boolean home value", () => {
+  expect(parsePlan(planText([sliceJson("A", { home: "true" })]))).toBeNull();
+  expect(parsePlan(planText([sliceJson("A", { home: 1 })]))).toBeNull();
+});
+
+test("parsePlan accepts zero home slices (login falls back to the scaffold default)", () => {
+  expect(
+    parsePlan(planText([sliceJson("A", {}), sliceJson("B", {})]))
+  ).not.toBeNull();
+});
+
+test("parsePlan accepts a slice omitting both layout and home (backward compatible)", () => {
+  const parsed = parsePlan(planText([sliceJson("A", {})]));
+
+  expect(parsed).not.toBeNull();
+  expect(parsed?.plan.slices[0]?.ui.layout).toBeUndefined();
+  expect(parsed?.plan.slices[0]?.ui.home).toBeUndefined();
+});
+
 test("a malformed artifact parses to null (reject-by-default)", () => {
   expect(parsePlan("not a plan")).toBeNull();
 });

From 9b0117b759bab7286ddaabad362a96ca82932e96 Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 12:26:34 +0200
Subject: [PATCH 09/20] =?UTF-8?q?fix(test):=20Set-membership=20check=20in?=
 =?UTF-8?q?=20convention-index=20(eslint=20autofixed=20.some=E2=86=92.incl?=
 =?UTF-8?q?udes,=20breaking=20typecheck)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The prior round's diff-visible enum guard used .some((t) => t === topic); eslint --fix rewrote it
to .includes(topic), which fails tsc (string vs the ConventionTopic union) — and bun test doesn't
typecheck, so it slipped past the local test run but the panel's validate (typecheck) caught it.
Use new Set<string>(...).has(topic): cast-free, typechecks, and eslint won't rewrite it. bun run
validate fully green.
---
 packages/core/tests/convention-index.test.ts | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/packages/core/tests/convention-index.test.ts b/packages/core/tests/convention-index.test.ts
index 7858a296..3437aa62 100644
--- a/packages/core/tests/convention-index.test.ts
+++ b/packages/core/tests/convention-index.test.ts
@@ -116,10 +116,11 @@ test("the new design-system topics are in both the guide registry and the pull e
     "accessibility",
     "components-ui",
   ]) {
-    // `.some` (not `.toContain`) so the string literal compares cleanly against the typed
-    // ConventionTopic[] / enum tuple without a cast.
-    expect(registry.includes(topic)).toBe(true);
-    expect(enumTopics.includes(topic)).toBe(true);
+    // A Set<string> membership test compares the string cleanly against the typed
+    // ConventionTopic[] / enum tuple — no cast, and eslint won't rewrite it into a
+    // type-narrowing `.includes()` (which fails typecheck: string vs the topic union).
+    expect(new Set<string>(registry).has(topic)).toBe(true);
+    expect(new Set<string>(enumTopics).has(topic)).toBe(true);
   }
 });
 

From d07d03c0856ab7f22edf63ccfcc964f810a5b569 Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 12:48:55 +0200
Subject: [PATCH 10/20] harden(layout): applyHomeRedirect throws on missing
 file + implement-wiring test + JSDoc merge (panel r3 advisories)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Panel r3 PASSED; this closes its advisory findings:
- (false-green hole) applyHomeRedirect silently returned when LoginPage.constants was absent — a
  home:true plan could go green with the landing never changed. Now THROWS (the scaffold always
  ships the file; a missing one is a real failure, not a skip).
- (missing test) build.implement's redirect wiring is now covered: applyHomeRedirect is an
  injectable dep; a test asserts it fires for the home slice (route /task) and NOT for a non-home
  slice. Plus a direct applyHomeRedirect fs-wrapper test (rewrite + throw-on-absent).
- (dead-code) merged the two consecutive JSDoc blocks on LAYOUT_ARCHETYPES.
- (text-destructive-foreground) re-confirmed FALSE: --destructive-foreground exists in the scaffold.
Sidebar grouping remains guide-driven (cosmetic; a mis-grouped link still works). bun run validate green.
---
 packages/core/src/loop/boringstack/build.ts   |  7 ++-
 .../src/loop/boringstack/wire-resource.ts     | 12 +++--
 packages/core/src/loop/planning/plan-types.ts | 11 ++--
 packages/core/tests/boringstack-build.test.ts | 50 ++++++++++++++++++-
 .../tests/boringstack-wire-resource.test.ts   | 43 ++++++++++++++++
 5 files changed, 112 insertions(+), 11 deletions(-)

diff --git a/packages/core/src/loop/boringstack/build.ts b/packages/core/src/loop/boringstack/build.ts
index 4e827485..1b1680a3 100644
--- a/packages/core/src/loop/boringstack/build.ts
+++ b/packages/core/src/loop/boringstack/build.ts
@@ -526,6 +526,9 @@ export function boringstackDeps(opts: {
   baseline?: ReadonlySet<string>;
   generate?: (cwd: string, name: string, exec: Exec) => Promise<void>;
   generateUi?: (cwd: string, name: string, exec: Exec) => Promise<void>;
+  /** Wire the post-login redirect for the plan's `home` slice. Injectable so the implement()
+   *  wiring is unit-testable; defaults to the real filesystem writer. */
+  applyHomeRedirect?: (cwd: string, route: string) => Promise<void>;
   /** Look up the plan slice for a feature by its id. Supplied by runBoringstackBuild
    *  when building from an approved plan; undefined when planning ad-hoc. */
   sliceFor?: (id: string) => ISlice | undefined;
@@ -545,12 +548,14 @@ export function boringstackDeps(opts: {
     evaluator,
     generate: generateFn,
     generateUi,
+    applyHomeRedirect: applyHomeRedirectFn,
     sliceFor,
     acceptanceRunner,
     fullSpec,
   } = opts;
   const generate = generateFn ?? generateResource;
   const genUi = generateUi ?? generateFeature;
+  const wireHomeRedirectFor = applyHomeRedirectFn ?? applyHomeRedirect;
   const baseline = opts.baseline ?? new Set<string>();
   const e2eAcceptanceDisabled =
     process.env[ENV_FLAG.noE2eAcceptance] === FLAG_ON;
@@ -575,7 +580,7 @@ export function boringstackDeps(opts: {
       // `ui.home`) — harness-owned, NOT model-prompted, so the landing can't silently stay
       // `/dashboard` and slip past the gate (a false-green). No-op for non-home features.
       if (sliceFor?.(feature.id)?.ui.home === true) {
-        await applyHomeRedirect(cwd, `/${toCamelCase(feature.id)}`);
+        await wireHomeRedirectFor(cwd, `/${toCamelCase(feature.id)}`);
       }
 
       host.setScope(scopeFor(feature.id));
diff --git a/packages/core/src/loop/boringstack/wire-resource.ts b/packages/core/src/loop/boringstack/wire-resource.ts
index 1d1d0054..5ff2c573 100644
--- a/packages/core/src/loop/boringstack/wire-resource.ts
+++ b/packages/core/src/loop/boringstack/wire-resource.ts
@@ -258,8 +258,11 @@ export function wireHomeRedirect(src: string, route: string): string {
   return src.replace(anchor, `export const DEFAULT_REDIRECT_TO = "${route}";`);
 }
 
-/** Apply {@link wireHomeRedirect} to the scaffold's LoginPage constants. Guarded by existence so a
- *  boringstack variant without this exact file skips cleanly (the app still builds). */
+/** Apply {@link wireHomeRedirect} to the scaffold's LoginPage constants. Called ONLY for a plan's
+ *  `home` slice, so a MISSING file is a real failure, not something to skip: silently returning
+ *  would leave the landing at `/dashboard` while the build goes green — the exact false-green this
+ *  determinism exists to prevent. So it THROWS rather than no-op'ing. (The boringstack scaffold
+ *  always ships this file; a variant that doesn't must be handled explicitly, not silently.) */
 export async function applyHomeRedirect(
   cwd: string,
   route: string
@@ -270,7 +273,10 @@ export async function applyHomeRedirect(
   );
 
   if (!existsSync(path)) {
-    return;
+    throw new Error(
+      `applyHomeRedirect: LoginPage.constants.ts not found at ${path} — cannot wire the home ` +
+        "landing, and skipping would silently leave the redirect at /dashboard (a false-green)."
+    );
   }
 
   const src = await readFile(path, "utf-8");
diff --git a/packages/core/src/loop/planning/plan-types.ts b/packages/core/src/loop/planning/plan-types.ts
index 30f4a593..d4526aff 100644
--- a/packages/core/src/loop/planning/plan-types.ts
+++ b/packages/core/src/loop/planning/plan-types.ts
@@ -10,12 +10,11 @@ export interface IEntitySpec {
   readonly rules: readonly string[];
 }
 
-/** The modern-layout archetypes the harness understands. The set is intentionally broad so a
- *  plan is never locked into too few options; v1 IMPLEMENTS `app-sidebar` (the default) and
- *  `settings`, and the rest are schema-valid but fall back to `app-sidebar` + guidance until a
- *  build needs them (see the layout wiring in refine-prompt). */
-/** Single source of truth for the archetypes: the tuple drives BOTH the `LayoutArchetype` type
- *  and the runtime validation list (plan-store), so the two can never diverge (no `as` cast). */
+/** The modern-layout archetypes the harness understands. Intentionally broad so a plan is never
+ *  locked into too few options; v1 IMPLEMENTS `app-sidebar` (the default) and `settings`, and the
+ *  rest are schema-valid but fall back to `app-sidebar` + guidance until a build needs them (see
+ *  the layout wiring in refine-prompt). Single source of truth: this tuple drives BOTH the
+ *  `LayoutArchetype` type and the runtime validation list (plan-store), so they can't diverge. */
 export const LAYOUT_ARCHETYPES = [
   "app-sidebar", // left sidebar + header content shell (default SaaS look)
   "app-topnav", // horizontal top-nav + content
diff --git a/packages/core/tests/boringstack-build.test.ts b/packages/core/tests/boringstack-build.test.ts
index f57930d1..6306545a 100644
--- a/packages/core/tests/boringstack-build.test.ts
+++ b/packages/core/tests/boringstack-build.test.ts
@@ -27,7 +27,7 @@ import type { IProvider } from "../src/inference";
 import type { IGate } from "../src/gate/gate-runner";
 import { writePlan } from "../src/loop/planning/plan-store";
 import { saveState } from "../src/loop/greenfield/state";
-import type { IProductPlan } from "../src/loop/planning/plan-types";
+import type { IProductPlan, ISlice } from "../src/loop/planning/plan-types";
 
 function feature(id: string) {
   return { id, desc: `Build ${id} resource`, passes: false, attempts: 0 };
@@ -158,6 +158,54 @@ describe("boringstackDeps.implement", () => {
     expect(host.sent[0]).toContain("Invoice");
   });
 
+  test("wires the post-login redirect for the home slice, skips a non-home slice", async () => {
+    const calls: { cwd: string; route: string }[] = [];
+
+    const mkSlice = (id: string, home: boolean): ISlice => ({
+      entity: {
+        id,
+        desc: "d",
+        fields: [{ name: "title", type: "string" }],
+        relationships: ["belongsTo User"],
+        rules: ["title required"],
+      },
+      ui: {
+        screens: ["list", "form"],
+        action: "a",
+        shows: ["title"],
+        nav: id,
+        layout: "app-sidebar",
+        home,
+      },
+      verification: {
+        mustRemainTrue: ["auth"],
+        mustNotHappen: ["no title"],
+        acceptanceCheck: "bun test",
+      },
+    });
+
+    const deps = boringstackDeps({
+      host: createHost(),
+      cwd: "/repo",
+      exec: createExec(),
+      evaluator: createEvaluator(),
+      generate: async () => {},
+      generateUi: async () => {},
+      applyHomeRedirect: async (cwd: string, route: string) => {
+        calls.push({ cwd, route });
+      },
+      sliceFor: (id: string) => mkSlice(id, id === "Task"),
+    });
+
+    await deps.implement(feature("Task"), state());
+    // The home slice's route becomes the post-login landing.
+    expect(calls).toEqual([{ cwd: "/repo", route: "/task" }]);
+
+    await deps.implement(feature("Note"), state());
+    // The non-home slice adds no redirect call.
+    expect(calls).toEqual([{ cwd: "/repo", route: "/task" }]);
+  });
+
   test("hands the OTHER features to the judge as siblings, derived from state", async () => {
     // Guards the state→gate wiring itself: the judge must receive the sibling ids that
     // come from state.features (minus the current one). A judgeStage-only test can't
diff --git a/packages/core/tests/boringstack-wire-resource.test.ts b/packages/core/tests/boringstack-wire-resource.test.ts
index 85366e20..9b0aa7f3 100644
--- a/packages/core/tests/boringstack-wire-resource.test.ts
+++ b/packages/core/tests/boringstack-wire-resource.test.ts
@@ -1,4 +1,7 @@
 import { test, expect, describe } from "bun:test";
+import { mkdtemp, mkdir, readFile, writeFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import {
   wireRoutesFile,
   wireAppFile,
@@ -7,6 +10,7 @@ import {
   wireUiRouteFile,
   addFeatureI18nKeys,
   wireHomeRedirect,
+  applyHomeRedirect,
 } from "../src/loop/boringstack/wire-resource";
 
 /** A minimal stand-in for boringstack's SPA router, carrying the anchors the
@@ -268,3 +272,42 @@ describe("wireHomeRedirect", () => {
     );
   });
 });
+
+describe("applyHomeRedirect (fs wrapper)", () => {
+  const CONSTS_REL =
+    "apps/ui/src/features/auth/components/LoginPage/LoginPage.constants.ts";
+
+  test("rewrites the scaffold LoginPage constants at the home route", async () => {
+    const dir = await mkdtemp(join(tmpdir(), "tsforge-redirect-"));
+
+    try {
+      await mkdir(join(dir, CONSTS_REL, ".."), { recursive: true });
+      await writeFile(
+        join(dir, CONSTS_REL),
+        'export const DEFAULT_REDIRECT_TO = "/dashboard";\n',
+        "utf-8"
+      );
+
+      await applyHomeRedirect(dir, "/task");
+
+      expect(await readFile(join(dir, CONSTS_REL), "utf-8")).toBe(
+        'export const DEFAULT_REDIRECT_TO = "/task";\n'
+      );
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("THROWS (not a silent skip) when the login constants file is absent", async () => {
+    // Silently skipping would leave the landing at /dashboard while the build goes green.
+    const dir = await mkdtemp(join(tmpdir(), "tsforge-redirect-"));
+
+    try {
+      await expect(applyHomeRedirect(dir, "/task")).rejects.toThrow(
+        "not found"
+      );
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+});

From 81d587d9fefedf1ddee070f54762f4992da41c7f Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 13:13:58 +0200
Subject: [PATCH 11/20] fix(layout): resume-safe plan-level redirect + planner
 emits layout/home + regex anchor (panel r4)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round-4 panel findings (real false-green + completeness holes):

- (false-green, resume) Redirect wiring lived in implement(), which a RESUMED build skips for an
  already-passing home feature → landing could stay /dashboard while final acceptance is green.
  Moved to a PLAN-LEVEL step in runBoringstackBuild (homeRouteForPlan → applyHomeRedirect) that
  runs once per build regardless of resume. Removed it from implement() (+ the injectable dep).
- (false-green, comment) wireHomeRedirect's regex was unanchored → could rewrite a commented-out
  DEFAULT_REDIRECT_TO while the live one stays /dashboard. Anchored to line-start (^…/m).
- (capability inert) The PLANNER never emitted layout/home (schema said 'match EXACTLY, no extra
  keys'; example had none) → applyHomeRedirect never ran on planner-generated plans. Documented
  layout/home in PLANNER_SYSTEM (schema + a rules line), set home:true + layout on PLANNER_EXAMPLE,
  and exported PLANNER_SYSTEM. Test locks the contract surfaces them + the example demonstrates one
  app-sidebar home.
- Tests: homeRouteForPlan (route for the home slice / null when none); applyHomeRedirect fs wrapper
  (rewrite + throw-on-absent); refine-prompt deferred-archetype fallback (app-topnav → app-sidebar
  note). Added the 2 missing jsx-a11y rule names (anchor-is-valid, img-redundant-alt) to the
  accessibility mapping. Merged the duplicate LAYOUT_ARCHETYPES JSDoc.
- (kept) at-most-one home, NOT exactly-one: zero-home is the correct backward-compatible fallback
  (every existing plan has zero); the app-intent case is handled by teaching the planner above.

bun run validate fully green.
---
 packages/core/src/loop/boringstack/build.ts   | 37 +++++---
 .../src/loop/boringstack/wire-resource.ts     |  5 +-
 packages/core/src/loop/conventions.ts         |  2 +
 .../core/src/loop/planning/propose-plan.ts    |  9 +-
 packages/core/tests/boringstack-build.test.ts | 84 ++++++++-----------
 .../tests/boringstack-refine-prompt.test.ts   | 36 ++++++++
 packages/core/tests/propose-plan.test.ts      | 22 +++++
 7 files changed, 132 insertions(+), 63 deletions(-)

diff --git a/packages/core/src/loop/boringstack/build.ts b/packages/core/src/loop/boringstack/build.ts
index 1b1680a3..3e77f7b9 100644
--- a/packages/core/src/loop/boringstack/build.ts
+++ b/packages/core/src/loop/boringstack/build.ts
@@ -526,9 +526,6 @@ export function boringstackDeps(opts: {
   baseline?: ReadonlySet<string>;
   generate?: (cwd: string, name: string, exec: Exec) => Promise<void>;
   generateUi?: (cwd: string, name: string, exec: Exec) => Promise<void>;
-  /** Wire the post-login redirect for the plan's `home` slice. Injectable so the implement()
-   *  wiring is unit-testable; defaults to the real filesystem writer. */
-  applyHomeRedirect?: (cwd: string, route: string) => Promise<void>;
   /** Look up the plan slice for a feature by its id. Supplied by runBoringstackBuild
    *  when building from an approved plan; undefined when planning ad-hoc. */
   sliceFor?: (id: string) => ISlice | undefined;
@@ -548,14 +545,12 @@ export function boringstackDeps(opts: {
     evaluator,
     generate: generateFn,
     generateUi,
-    applyHomeRedirect: applyHomeRedirectFn,
     sliceFor,
     acceptanceRunner,
     fullSpec,
   } = opts;
   const generate = generateFn ?? generateResource;
   const genUi = generateUi ?? generateFeature;
-  const wireHomeRedirectFor = applyHomeRedirectFn ?? applyHomeRedirect;
   const baseline = opts.baseline ?? new Set<string>();
   const e2eAcceptanceDisabled =
     process.env[ENV_FLAG.noE2eAcceptance] === FLAG_ON;
@@ -576,13 +571,6 @@ export function boringstackDeps(opts: {
       await generate(cwd, feature.id, exec);
       await genUi(cwd, feature.id, exec);
 
-      // Deterministically point the post-login landing at the app "home" feature's route (plan
-      // `ui.home`) — harness-owned, NOT model-prompted, so the landing can't silently stay
-      // `/dashboard` and slip past the gate (a false-green). No-op for non-home features.
-      if (sliceFor?.(feature.id)?.ui.home === true) {
-        await wireHomeRedirectFor(cwd, `/${toCamelCase(feature.id)}`);
-      }
-
       host.setScope(scopeFor(feature.id));
       // The editable file the expert repairs if a stall's errors are all out of
       // scope (locked consumers of this feature's types) — its service file.
@@ -895,6 +883,20 @@ export async function runFinalAcceptance(
   return result;
 }
 
+/**
+ * The post-login landing route for a plan: the `/${camel}` route of the slice marked `ui.home`,
+ * or null when none is marked (login keeps the scaffold default `/dashboard`). Derived from the
+ * PLAN so the redirect is wired ONCE per build at the plan level (see runBoringstackBuild) —
+ * resume-safe: a resumed build that skips an already-passing home feature still re-applies it,
+ * unlike per-feature implement() wiring (which resume skips → the redirect would silently stay
+ * /dashboard, a false-green). At most one home is enforced by plan validation.
+ */
+export function homeRouteForPlan(plan: IProductPlan): string | null {
+  const home = plan.slices.find((s) => s.ui.home === true);
+
+  return home ? `/${toCamelCase(home.entity.id)}` : null;
+}
+
 /**
  * Run the BoringStack build driver: require an approved plan, derive features
  * from its slices, and drive them through the greenfield loop
@@ -956,6 +958,17 @@ export async function runBoringstackBuild(opts: {
     return { status: "done", features: [] };
   }
 
+  // Wire the post-login landing at the PLAN level — ONCE per build, resume-safe. A resumed build
+  // skips already-passing features, so doing this inside implement() could leave DEFAULT_REDIRECT_TO
+  // at /dashboard while final acceptance goes green (a false-green). applyHomeRedirect is idempotent
+  // and throws if the login constants are missing (never a silent skip). No home slice → no-op
+  // (login keeps the scaffold default).
+  const homeRoute = homeRouteForPlan(approved);
+
+  if (homeRoute !== null) {
+    await applyHomeRedirect(cwd, homeRoute);
+  }
+
   const state: IGreenfieldState = {
     goal,
     features,
diff --git a/packages/core/src/loop/boringstack/wire-resource.ts b/packages/core/src/loop/boringstack/wire-resource.ts
index 5ff2c573..3157f911 100644
--- a/packages/core/src/loop/boringstack/wire-resource.ts
+++ b/packages/core/src/loop/boringstack/wire-resource.ts
@@ -247,7 +247,10 @@ export async function wireUiFeature(cwd: string, name: string): Promise<void> {
  * than silently no-op'ing (which would re-introduce the false-green).
  */
 export function wireHomeRedirect(src: string, route: string): string {
-  const anchor = /export const DEFAULT_REDIRECT_TO\s*=\s*"[^"]*";/;
+  // Anchored to line-start (`^…/m`) so a COMMENTED-OUT `// export const DEFAULT_REDIRECT_TO …`
+  // can't be matched before the live declaration (which would update the comment and leave the
+  // real redirect at /dashboard — a silent false-green).
+  const anchor = /^export const DEFAULT_REDIRECT_TO\s*=\s*"[^"]*";/m;
 
   if (!anchor.test(src)) {
     throw new Error(
diff --git a/packages/core/src/loop/conventions.ts b/packages/core/src/loop/conventions.ts
index 024dc768..1f3ed315 100644
--- a/packages/core/src/loop/conventions.ts
+++ b/packages/core/src/loop/conventions.ts
@@ -114,6 +114,8 @@ export const TOPIC_RULES: Readonly<Record<ConventionTopic, readonly string[]>> =
       "role-has-required-aria-props",
       "role-supports-aria-props",
       "no-redundant-roles",
+      "anchor-is-valid",
+      "img-redundant-alt",
     ],
     "components-ui": [],
   };
diff --git a/packages/core/src/loop/planning/propose-plan.ts b/packages/core/src/loop/planning/propose-plan.ts
index bbb3b9b4..13b82e49 100644
--- a/packages/core/src/loop/planning/propose-plan.ts
+++ b/packages/core/src/loop/planning/propose-plan.ts
@@ -30,6 +30,8 @@ export const PLANNER_EXAMPLE = {
         action: "create, complete, and delete tasks",
         shows: ["title", "done", "dueDate"],
         nav: "Tasks",
+        layout: "app-sidebar",
+        home: true,
       },
       verification: {
         mustRemainTrue: ["only the owner can see or change a task"],
@@ -48,7 +50,7 @@ export const PLANNER_EXAMPLE = {
  * a model invent its own keys (primaryAction/navigationLabel/screen objects)
  * that the strict parser then rejects.
  */
-const PLANNER_SYSTEM = `You are a product architect. From the product description and any mockups, propose a domain model as feature slices (one per entity). Respond with ONLY a JSON object — no prose, no markdown fences — matching this schema EXACTLY. Use these exact key names and value shapes; do not add, rename, or nest differently.
+export const PLANNER_SYSTEM = `You are a product architect. From the product description and any mockups, propose a domain model as feature slices (one per entity). Respond with ONLY a JSON object — no prose, no markdown fences — matching this schema EXACTLY. Use these exact key names and value shapes; do not add, rename, or nest differently.
 
 Schema:
 {
@@ -66,7 +68,9 @@ Schema:
         "screens": [ <any of "list", "detail", "form", "dashboard" — these EXACT lowercase words only, nothing else> ],
         "action": "<the primary thing a user does, one line>",
         "shows": [ "<field or thing shown on screen>" ],
-        "nav": "<navigation label, e.g. Bookmarks>"
+        "nav": "<navigation label, e.g. Bookmarks>",
+        "layout": "<OPTIONAL: one of app-sidebar (default) | app-topnav | settings | focused | public — where this feature lives in the app shell>",
+        "home": <OPTIONAL boolean: true on the ONE feature that is the app's main landing page after login (omit on the rest)>
       },
       "verification": {
         "mustRemainTrue": [ "<invariant that must always hold>" ],
@@ -83,6 +87,7 @@ Rules for the JSON:
 - "fields" uses "optional" (boolean), never "required".
 - Use "desc" (not "description"), "action" (not "primaryAction"), "nav" (not "navigationLabel"), "acceptanceCheck" (not "acceptanceCheckCommand").
 - "mustNotHappen" must have at least one entry.
+- LAYOUT: give the app a real shape. Mark the ONE primary feature the user should land in with "home": true and "layout": "app-sidebar" (the app opens there, not on a generic dashboard). Put configuration/account features (profile, preferences, billing) at "layout": "settings" so they're grouped as a demoted settings area, not the main app. Most product features are "app-sidebar" (the default — you may omit "layout"). Use "home"/"layout" only from the allowed set above; never invent other values.
 
 Complete example (follow this shape precisely):
 ${JSON.stringify(PLANNER_EXAMPLE, null, 2)}`;
diff --git a/packages/core/tests/boringstack-build.test.ts b/packages/core/tests/boringstack-build.test.ts
index 6306545a..be8b21b4 100644
--- a/packages/core/tests/boringstack-build.test.ts
+++ b/packages/core/tests/boringstack-build.test.ts
@@ -17,6 +17,7 @@ import {
   saveBaseline,
   APP_SCHEMA_FILE,
   LOCALE_GLOB,
+  homeRouteForPlan,
 } from "../src/loop/boringstack/build";
 import type {
   IAcceptanceRunner,
@@ -116,6 +117,41 @@ function invoicePlan(): IProductPlan {
   };
 }
 
+describe("homeRouteForPlan", () => {
+  const mkSlice = (id: string, home: boolean): ISlice => ({
+    entity: {
+      id,
+      desc: "d",
+      fields: [{ name: "title", type: "string" }],
+      relationships: ["belongsTo User"],
+      rules: ["title required"],
+    },
+    ui: {
+      screens: ["list", "form"],
+      action: "a",
+      shows: ["title"],
+      nav: id,
+      home,
+    },
+    verification: {
+      mustRemainTrue: ["auth"],
+      mustNotHappen: ["no title"],
+      acceptanceCheck: "bun test",
+    },
+  });
+  const plan = (slices: ISlice[]): IProductPlan => ({ product: "p", slices });
+
+  test("returns the /camel route of the slice marked home", () => {
+    expect(
+      homeRouteForPlan(plan([mkSlice("Note", false), mkSlice("Task", true)]))
+    ).toBe("/task");
+  });
+
+  test("returns null when no slice is home (login keeps the /dashboard default)", () => {
+    expect(homeRouteForPlan(plan([mkSlice("Note", false)]))).toBeNull();
+  });
+});
+
 describe("boringstackDeps.implement", () => {
   test("calls injected generate with feature id, then freezes scope and sends refine prompt", async () => {
     const host = createHost();
@@ -158,54 +194,6 @@ describe("boringstackDeps.implement", () => {
     expect(host.sent[0]).toContain("Invoice");
   });
 
-  test("wires the post-login redirect for the home slice, skips a non-home slice", async () => {
-    const calls: { cwd: string; route: string }[] = [];
-
-    const mkSlice = (id: string, home: boolean): ISlice => ({
-      entity: {
-        id,
-        desc: "d",
-        fields: [{ name: "title", type: "string" }],
-        relationships: ["belongsTo User"],
-        rules: ["title required"],
-      },
-      ui: {
-        screens: ["list", "form"],
-        action: "a",
-        shows: ["title"],
-        nav: id,
-        layout: "app-sidebar",
-        home,
-      },
-      verification: {
-        mustRemainTrue: ["auth"],
-        mustNotHappen: ["no title"],
-        acceptanceCheck: "bun test",
-      },
-    });
-
-    const deps = boringstackDeps({
-      host: createHost(),
-      cwd: "/repo",
-      exec: createExec(),
-      evaluator: createEvaluator(),
-      generate: async () => {},
-      generateUi: async () => {},
-      applyHomeRedirect: async (cwd: string, route: string) => {
-        calls.push({ cwd, route });
-      },
-      sliceFor: (id: string) => mkSlice(id, id === "Task"),
-    });
-
-    await deps.implement(feature("Task"), state());
-    // The home slice's route becomes the post-login landing.
-    expect(calls).toEqual([{ cwd: "/repo", route: "/task" }]);
-
-    await deps.implement(feature("Note"), state());
-    // The non-home slice adds no redirect call.
-    expect(calls).toEqual([{ cwd: "/repo", route: "/task" }]);
-  });
-
   test("hands the OTHER features to the judge as siblings, derived from state", async () => {
     // Guards the state→gate wiring itself: the judge must receive the sibling ids that
     // come from state.features (minus the current one). A judgeStage-only test can't
diff --git a/packages/core/tests/boringstack-refine-prompt.test.ts b/packages/core/tests/boringstack-refine-prompt.test.ts
index 6c8f1c70..57e06a11 100644
--- a/packages/core/tests/boringstack-refine-prompt.test.ts
+++ b/packages/core/tests/boringstack-refine-prompt.test.ts
@@ -528,6 +528,42 @@ describe("refinePrompt", () => {
     expect(p).not.toContain("DEFAULT_REDIRECT_TO");
   });
 
+  it("falls a deferred archetype (app-topnav) back to app-sidebar with a build-as note", () => {
+    const feature: IFeature = {
+      id: "Report",
+      desc: "a report",
+      passes: false,
+      attempts: 0,
+    };
+    const slice: ISlice = {
+      entity: {
+        id: "Report",
+        desc: "a report",
+        fields: [{ name: "title", type: "string" }],
+        relationships: ["belongsTo User"],
+        rules: ["title required"],
+      },
+      ui: {
+        screens: ["list"],
+        action: "view reports",
+        shows: ["title"],
+        nav: "Reports",
+        layout: "app-topnav",
+      },
+      verification: {
+        mustRemainTrue: ["auth"],
+        mustNotHappen: ["x"],
+        acceptanceCheck: "bun test",
+      },
+    };
+    const p = refinePrompt(feature, slice);
+
+    // v1 has no distinct top-nav shell — the model builds it as app-sidebar for now.
+    expect(p).toContain("app-topnav");
+    expect(p).toContain("no distinct shell yet");
+    expect(p).toContain("primary app nav group");
+  });
+
   it("refinePrompt without a slice is unchanged (contains id + desc)", () => {
     const p = refinePrompt({
       id: "Bookmark",
diff --git a/packages/core/tests/propose-plan.test.ts b/packages/core/tests/propose-plan.test.ts
index 7eb24ed4..02759edf 100644
--- a/packages/core/tests/propose-plan.test.ts
+++ b/packages/core/tests/propose-plan.test.ts
@@ -4,6 +4,7 @@ import {
   parsePlanJson,
   stripReservedSlices,
   PLANNER_EXAMPLE,
+  PLANNER_SYSTEM,
 } from "../src/loop/planning/propose-plan";
 import {
   BORINGSTACK_PLANNER_GUIDANCE,
@@ -387,3 +388,24 @@ test("PLANNER_EXAMPLE (the shape shown to the model) is itself a valid plan", ()
   expect(isProductPlan(PLANNER_EXAMPLE)).toBe(true);
   expect(parsePlanJson(JSON.stringify(PLANNER_EXAMPLE))).not.toBeNull();
 });
+
+test("the planner contract surfaces layout + home so plans can actually use the capability", () => {
+  // The layout capability is inert unless the PLANNER emits layout/home. The contract (schema doc
+  // + rules) must document them, and the worked example must DEMONSTRATE the app-home pattern —
+  // otherwise applyHomeRedirect never runs on planner-generated plans and the landing silently
+  // stays /dashboard while the capability "looks" implemented.
+  expect(PLANNER_SYSTEM).toContain('"layout"');
+  expect(PLANNER_SYSTEM).toContain('"home"');
+  expect(PLANNER_SYSTEM).toContain("app-sidebar");
+  expect(PLANNER_SYSTEM).toContain("settings");
+
+  // Exactly one home in the worked example, and it's an app-sidebar primary view. Widen to
+  // IProductPlan first: PLANNER_EXAMPLE's concrete literal type narrows `home` to `true`, which
+  // eslint flags as an always-truthy condition; the interface type restores `boolean | undefined`.
+  const example: IProductPlan = PLANNER_EXAMPLE;
+  const homeCount = example.slices.filter((s) => s.ui.home === true).length;
+  const home = example.slices.find((s) => s.ui.home === true);
+
+  expect(homeCount).toBe(1);
+  expect(home?.ui.layout).toBe("app-sidebar");
+});

From 5e90525ee59e253df132f26e89641a76d783ea34 Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 13:30:38 +0200
Subject: [PATCH 12/20] test(layout): guard the plan-level redirect firing +
 the comment-anchor case (panel r5)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Panel r5 PASSED; closes its advisory test-gaps (both guard false-greens the code fixes but nothing
asserted the guard):
- Extracted wireHomeRedirectForPlan(cwd, plan, apply=applyHomeRedirect) — runBoringstackBuild calls
  it; a test asserts it FIRES applyHomeRedirect for a home plan (route /task) and skips a home-less
  one. Deleting the call would now fail this test instead of silently restoring the resume false-green.
- wireHomeRedirect test for the commented-out-line case: a leading // export const DEFAULT_REDIRECT_TO
  is left untouched while the LIVE export is repointed (the reason the regex is line-anchored).
- Dropped the stale '14 jsx-a11y rules' count from the design spec (now 16; use no count).
bun run validate green.
---
 ...6-07-29-modern-layout-capability-design.md |  2 +-
 packages/core/src/loop/boringstack/build.ts   | 31 ++++++++++++++-----
 packages/core/tests/boringstack-build.test.ts | 26 ++++++++++++++++
 .../tests/boringstack-wire-resource.test.ts   | 15 +++++++++
 4 files changed, 65 insertions(+), 9 deletions(-)

diff --git a/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md b/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md
index dacdbd52..fdad262e 100644
--- a/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md
+++ b/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md
@@ -35,7 +35,7 @@ New topics:
 1. **`design-tokens`** — the exact token vocabulary + when each applies (primary = CTA, destructive = delete, muted-foreground = secondary text, border/border-strong = dividers, panel/card = containers, ring = focus). Rule: **never hardcode hex/rgb**; use tokens via bare Tailwind classes (`bg-primary`, `text-muted-foreground`). Opacity variants (`border-strong/40`).
 2. **`theming`** — theming is `data-theme`-driven; **never use `dark:` variants**; tokens flip automatically. Test both themes by toggling `data-theme`.
 3. **`responsive`** — mobile-first (no-prefix = mobile; `md:`/`lg:` = up); the Sheet mobile-drawer pattern for nav; responsive padding idioms (`px-4 lg:px-6`); container queries for intra-component layout.
-4. **`accessibility`** — semantic landmarks (`nav`/`main`/`header`/`section`); `aria-label` for icon-only buttons; `aria-hidden` on decorative icons; `sr-only`; `aria-current="page"`; skip link; labels linked to inputs; never make a `div` interactive (use `Button`/links). Frame it as "satisfy the 14 jsx-a11y rules proactively, don't discover them at the gate."
+4. **`accessibility`** — semantic landmarks (`nav`/`main`/`header`/`section`); `aria-label` for icon-only buttons; `aria-hidden` on decorative icons; `sr-only`; `aria-current="page"`; skip link; labels linked to inputs; never make a `div` interactive (use `Button`/links). Frame it as "satisfy the jsx-a11y rules proactively, don't discover them at the gate."
 5. **`components-ui`** — prefer `@/components/ui/*` primitives; extend via `cva` variants; compose classes with `cn()` (not ternary/template strings); `asChild` slot pattern; `data-slot` scoping.
 
 Wire these into the topic registry + surface at the same points as existing guides (build refine-prompt + interim `check`/RULE_DOCS).
diff --git a/packages/core/src/loop/boringstack/build.ts b/packages/core/src/loop/boringstack/build.ts
index 3e77f7b9..bdee7a1a 100644
--- a/packages/core/src/loop/boringstack/build.ts
+++ b/packages/core/src/loop/boringstack/build.ts
@@ -897,6 +897,26 @@ export function homeRouteForPlan(plan: IProductPlan): string | null {
   return home ? `/${toCamelCase(home.entity.id)}` : null;
 }
 
+/**
+ * Wire the plan's post-login landing once per build: if a slice is `home`, point
+ * DEFAULT_REDIRECT_TO at its route. Called from runBoringstackBuild at the plan level (resume-safe
+ * — a resumed build that skips an already-passing home feature still applies it). `apply` is
+ * injectable so the "the wiring actually fires" behaviour is unit-testable without touching the
+ * real filesystem; it defaults to the FS writer, which throws (never silently skips) on a missing
+ * login-constants file. No home slice → no-op (login keeps the scaffold default).
+ */
+export async function wireHomeRedirectForPlan(
+  cwd: string,
+  plan: IProductPlan,
+  apply: (cwd: string, route: string) => Promise<void> = applyHomeRedirect
+): Promise<void> {
+  const route = homeRouteForPlan(plan);
+
+  if (route !== null) {
+    await apply(cwd, route);
+  }
+}
+
 /**
  * Run the BoringStack build driver: require an approved plan, derive features
  * from its slices, and drive them through the greenfield loop
@@ -960,14 +980,9 @@ export async function runBoringstackBuild(opts: {
 
   // Wire the post-login landing at the PLAN level — ONCE per build, resume-safe. A resumed build
   // skips already-passing features, so doing this inside implement() could leave DEFAULT_REDIRECT_TO
-  // at /dashboard while final acceptance goes green (a false-green). applyHomeRedirect is idempotent
-  // and throws if the login constants are missing (never a silent skip). No home slice → no-op
-  // (login keeps the scaffold default).
-  const homeRoute = homeRouteForPlan(approved);
-
-  if (homeRoute !== null) {
-    await applyHomeRedirect(cwd, homeRoute);
-  }
+  // at /dashboard while final acceptance goes green (a false-green). Idempotent; throws (never a
+  // silent skip) if the login constants are missing; no-op when no slice is home.
+  await wireHomeRedirectForPlan(cwd, approved);
 
   const state: IGreenfieldState = {
     goal,
diff --git a/packages/core/tests/boringstack-build.test.ts b/packages/core/tests/boringstack-build.test.ts
index be8b21b4..64bdc2f9 100644
--- a/packages/core/tests/boringstack-build.test.ts
+++ b/packages/core/tests/boringstack-build.test.ts
@@ -18,6 +18,7 @@ import {
   APP_SCHEMA_FILE,
   LOCALE_GLOB,
   homeRouteForPlan,
+  wireHomeRedirectForPlan,
 } from "../src/loop/boringstack/build";
 import type {
   IAcceptanceRunner,
@@ -150,6 +151,31 @@ describe("homeRouteForPlan", () => {
   test("returns null when no slice is home (login keeps the /dashboard default)", () => {
     expect(homeRouteForPlan(plan([mkSlice("Note", false)]))).toBeNull();
   });
+
+  test("wireHomeRedirectForPlan APPLIES the redirect for a home plan, skips a home-less one", async () => {
+    // Guards that the plan-level wiring actually FIRES (deleting the runBoringstackBuild call would
+    // otherwise leave validate green while restoring the resume false-green). Injected applier.
+    const calls: { cwd: string; route: string }[] = [];
+
+    const apply = async (cwd: string, route: string): Promise<void> => {
+      calls.push({ cwd, route });
+    };
+
+    await wireHomeRedirectForPlan(
+      "/repo",
+      plan([mkSlice("Note", false), mkSlice("Task", true)]),
+      apply
+    );
+    expect(calls).toEqual([{ cwd: "/repo", route: "/task" }]);
+
+    await wireHomeRedirectForPlan(
+      "/repo",
+      plan([mkSlice("Note", false)]),
+      apply
+    );
+    // No home slice → no additional call.
+    expect(calls).toEqual([{ cwd: "/repo", route: "/task" }]);
+  });
 });
 
 describe("boringstackDeps.implement", () => {
diff --git a/packages/core/tests/boringstack-wire-resource.test.ts b/packages/core/tests/boringstack-wire-resource.test.ts
index 9b0aa7f3..bb6f420e 100644
--- a/packages/core/tests/boringstack-wire-resource.test.ts
+++ b/packages/core/tests/boringstack-wire-resource.test.ts
@@ -271,6 +271,21 @@ describe("wireHomeRedirect", () => {
       "DEFAULT_REDIRECT_TO not found"
     );
   });
+
+  test("rewrites the LIVE export, not a commented-out one before it (the anchor's whole point)", () => {
+    // The line-start anchor exists so a `// export const DEFAULT_REDIRECT_TO …` comment can't be
+    // rewritten while the real export stays /dashboard — the exact silent false-green.
+    const src =
+      '// export const DEFAULT_REDIRECT_TO = "/old-idea";\n' +
+      'export const DEFAULT_REDIRECT_TO = "/dashboard";\n';
+    const out = wireHomeRedirect(src, "/task");
+
+    // The commented line is untouched…
+    expect(out).toContain('// export const DEFAULT_REDIRECT_TO = "/old-idea";');
+    // …and the LIVE export is the one repointed.
+    expect(out).toContain('export const DEFAULT_REDIRECT_TO = "/task";');
+    expect(out).not.toContain('DEFAULT_REDIRECT_TO = "/dashboard"');
+  });
 });
 
 describe("applyHomeRedirect (fs wrapper)", () => {

From 3a363e7bdfb781de5870a7aed0b30630bbda69b6 Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 13:53:21 +0200
Subject: [PATCH 13/20] test(layout): observable outcome test proving
 runBoringstackBuild wires the redirect + spec-doc sync (panel r6)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Panel r6 agreement-2: the prior 'wiring fires' test exercised wireHomeRedirectForPlan in isolation
— it did NOT prove runBoringstackBuild calls it (my comment over-claimed). Deleting the plan-level
call would still pass. Fixed for real with an OBSERVABLE outcome test: a home plan + a real
LoginPage.constants in a temp clone → after runBoringstackBuild, the file's DEFAULT_REDIRECT_TO is
the home route (/task). Deleting the runBoringstackBuild call leaves it /dashboard → the test fails.

Also synced the design spec to the FINAL implementation (deterministic applyHomeRedirect at the plan
level, LoginPage.constants NOT in feature scope, planner emits layout/home) and removed the last
stale '14' jsx-a11y count. Documented the accepted limitations honestly: sidebar grouping is
guide-only/cosmetic (not gate-verified); a no-home plan leaves the redirect untouched (fresh
scaffolds default to /dashboard); the redirect regex assumes a plain constants file.

bun run validate green.
---
 ...6-07-29-modern-layout-capability-design.md | 10 +--
 packages/core/tests/boringstack-build.test.ts | 69 ++++++++++++++++++-
 2 files changed, 74 insertions(+), 5 deletions(-)

diff --git a/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md b/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md
index fdad262e..6f487451 100644
--- a/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md
+++ b/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md
@@ -23,7 +23,7 @@
 
 **Routing (audit 1):** BoringStack routes are already flat/top-level (`/task`, not `/dashboard/task`). The shell is `AppShell` (sidebar + header) at `apps/ui/src/components/core/AppShell/`. Post-login redirect is `DEFAULT_REDIRECT_TO = "/dashboard"` (`apps/ui/src/features/auth/components/LoginPage/LoginPage.constants.ts`). The harness hardcodes every feature → `ProtectedRoute → AppShell → sidebar entry → nav-testid → sidebar-nav e2e` (`wire-resource.ts` `wireUiRouteFile` ~L133-187 `path:"/${camel}"`; `build.ts` `scopeFor` ~L161-179; `refine-prompt.ts` ~L269; `acceptance/testid-contract.ts` ~L130; `acceptance/e2e-generator.ts` nav test ~L681-686).
 
-**Design system (audit 2):** Tokens in `apps/ui/src/assets/css/tailwind.css` (`:root` + `:root[data-theme="dark"]`, mapped via Tailwind `@theme`): colors `background/foreground/primary(+strong/low/ink/foreground)/secondary/muted(+foreground/strong)/accent(+cyan/pink)/destructive/success/border(+strong)/input/ring/card/panel(+strong)/popover`, `--radius*`, `--font-sans` (Inter) / `--font-mono`, `--animate-*`. Components in `apps/ui/src/components/ui/`: Button, Card, Dialog, DropdownMenu, Form, Input, Label, Popover, ScrollArea, Sheet, Skeleton, Sonner, Switch, Tabs (cva + `cn()` + tailwind-merge + Radix + lucide). Theme via `useTheme()` + `data-theme` attribute (NO `dark:` classes; `AGENT_CONTRACT.md` forbids them). Responsive = mobile-first Tailwind + Sheet drawer (`hidden md:flex` sidebar). A11y = `eslint-plugin-jsx-a11y` 14 rules as ERRORS + Radix + semantic HTML + skip link. Harness `conventions.ts` has 12 topic guides but **nothing on styling/theming/responsive/a11y/composition**.
+**Design system (audit 2):** Tokens in `apps/ui/src/assets/css/tailwind.css` (`:root` + `:root[data-theme="dark"]`, mapped via Tailwind `@theme`): colors `background/foreground/primary(+strong/low/ink/foreground)/secondary/muted(+foreground/strong)/accent(+cyan/pink)/destructive/success/border(+strong)/input/ring/card/panel(+strong)/popover`, `--radius*`, `--font-sans` (Inter) / `--font-mono`, `--animate-*`. Components in `apps/ui/src/components/ui/`: Button, Card, Dialog, DropdownMenu, Form, Input, Label, Popover, ScrollArea, Sheet, Skeleton, Sonner, Switch, Tabs (cva + `cn()` + tailwind-merge + Radix + lucide). Theme via `useTheme()` + `data-theme` attribute (NO `dark:` classes; `AGENT_CONTRACT.md` forbids them). Responsive = mobile-first Tailwind + Sheet drawer (`hidden md:flex` sidebar). A11y = `eslint-plugin-jsx-a11y` (16 rules) as ERRORS + Radix + semantic HTML + skip link. Harness `conventions.ts` has 12 topic guides but **nothing on styling/theming/responsive/a11y/composition**.
 
 ---
 
@@ -45,15 +45,17 @@ Wire these into the topic registry + surface at the same points as existing guid
 **Plan schema (broad).** Extend `IUiIntent` (`packages/core/src/loop/planning/plan-types.ts`):
 ```ts
 layout?: "app-sidebar" | "app-topnav" | "settings" | "focused" | "public"; // default "app-sidebar"
-home?: boolean;   // this feature's route is the post-login landing (exactly one per plan)
+home?: boolean;   // this feature's route is the post-login landing (AT MOST one per plan; none → /dashboard)
 ```
 `nav` (existing description) stays. The enum is intentionally broad (anti-lock-in); **v1 implements `app-sidebar` + `settings`**; `app-topnav`/`public`/`focused` are schema-valid and fall back to `app-sidebar`+guidance for now (documented), so the todos app isn't blocked and the vocabulary is future-proof.
 
 **Wiring (implement narrow):** In `packages/core/src/loop/boringstack/`:
 - **Sidebar grouping** — the harness's sidebar wiring/guidance groups nav into a **primary app group** (`layout: app-sidebar`) and a demoted **Settings group** (`layout: settings`, plus the scaffold's existing account/profile/notification links). AppSidebar edit stays in feature scope; the refine-prompt tells the model which group to add to based on `layout`.
-- **Home landing** — the feature with `home: true` sets `DEFAULT_REDIRECT_TO` to its route. Add `LoginPage.constants.ts` to that feature's scope; the refine-prompt instructs the redirect change. Exactly one home per plan (validated).
+- **Home landing** — the harness writes `DEFAULT_REDIRECT_TO` DETERMINISTICALLY for the `home` slice's route (`wireHomeRedirectForPlan` → `applyHomeRedirect`, called ONCE at the plan level in `runBoringstackBuild` — resume-safe). It is NOT model-edited and `LoginPage.constants` is deliberately NOT in feature scope; the refine-prompt tells the model not to touch it. At most one home (validated); none → login keeps `/dashboard`.
 - **Route/layout** — keep `ProtectedRoute → AppShell` for `app-sidebar` and `settings` (both are authenticated app areas; "settings" is a grouping + optional sub-nav, not a separate auth boundary in v1). `wireUiRouteFile` stays; only grouping + home differ. (Distinct SettingsLayout / public-unauth shells are **designed-for** via the enum but **deferred** — YAGNI until a build needs them.)
 
+**Sidebar grouping is guide-only (cosmetic)** — a mis-grouped nav link still works, so it is not gate-verified (deferred). The home landing IS verified by an observable outcome test (runBoringstackBuild rewrites the live redirect). Accepted limitations: a no-home plan leaves the redirect untouched (fresh scaffolds default to `/dashboard`); the redirect regex assumes a plain constants file (line-anchored, not a full parser).
+
 **Acceptance (unchanged contract, role-aware only where safe):** Every feature remains reachable + e2e-tested via its nav testid — `role` only changes *which sidebar group* the nav link lives in, not whether it exists. This deliberately preserves the proven acceptance machinery (no gate relaxation). Smart-view filtering (Spec 2) is verified as UI within the Task feature, not as new entities.
 
 ---
@@ -74,7 +76,7 @@ home?: boolean;   // this feature's route is the post-login landing (exactly one
 
 - `packages/core/src/loop/conventions.ts` — register + author the 5 design-system topics (Part A).
 - `packages/core/src/loop/planning/plan-types.ts` — `IUiIntent.layout` + `home` (Part B schema).
-- `packages/core/src/loop/boringstack/wire-resource.ts` / `build.ts` / `refine-prompt.ts` — sidebar grouping, home-redirect wiring, `LoginPage.constants` scope (Part B wiring).
+- `packages/core/src/loop/boringstack/wire-resource.ts` (`wireHomeRedirect`/`applyHomeRedirect`) + `build.ts` (`homeRouteForPlan`/`wireHomeRedirectForPlan`, called in `runBoringstackBuild`) — deterministic home redirect. `refine-prompt.ts` — sidebar-group GUIDANCE (cosmetic; not gate-verified) + a note telling the model the redirect is auto-wired. `propose-plan.ts` — planner emits `layout`/`home`. NO `LoginPage.constants` in feature scope.
 - `packages/core/src/loop/boringstack/acceptance/testid-contract.ts` — keep nav contract; document role→group only.
 - Plan validation (where `isEntitySpec`/plan is validated) — exactly-one-home + valid `layout`.
 - Tests alongside each.
diff --git a/packages/core/tests/boringstack-build.test.ts b/packages/core/tests/boringstack-build.test.ts
index 64bdc2f9..307727e4 100644
--- a/packages/core/tests/boringstack-build.test.ts
+++ b/packages/core/tests/boringstack-build.test.ts
@@ -1,5 +1,5 @@
 import { test, expect, describe } from "bun:test";
-import { mkdtemp, rm, mkdir, writeFile } from "node:fs/promises";
+import { mkdtemp, rm, mkdir, writeFile, readFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { Exec } from "../src/loop/boringstack/exec";
@@ -710,6 +710,73 @@ describe("runBoringstackBuild", () => {
     }
   });
 
+  test("repoints the LIVE post-login redirect at the home route (observable, resume-safe)", async () => {
+    // The OUTCOME test the pure-helper unit tests can't give: prove runBoringstackBuild itself
+    // rewrites LoginPage.constants for a home plan. Deleting the plan-level wireHomeRedirectForPlan
+    // call leaves this at /dashboard → this test fails (closing the resume false-green for real).
+    const dir = await mkdtemp(join(tmpdir(), "bs-home-"));
+
+    try {
+      const constsPath = join(
+        dir,
+        "apps/ui/src/features/auth/components/LoginPage/LoginPage.constants.ts"
+      );
+
+      await mkdir(join(constsPath, ".."), { recursive: true });
+      await writeFile(
+        constsPath,
+        'export const DEFAULT_REDIRECT_TO = "/dashboard";\n',
+        "utf-8"
+      );
+
+      const plan: IProductPlan = {
+        product: "A todo app",
+        slices: [
+          {
+            entity: {
+              id: "Task",
+              desc: "a task",
+              fields: [{ name: "title", type: "string" }],
+              relationships: [],
+              rules: [],
+            },
+            ui: {
+              screens: ["list", "form"],
+              action: "add a task",
+              shows: ["title"],
+              nav: "Today",
+              layout: "app-sidebar",
+              home: true,
+            },
+            verification: {
+              mustRemainTrue: ["auth"],
+              mustNotHappen: ["no title"],
+              acceptanceCheck: "bun test",
+            },
+          },
+        ],
+      };
+
+      await writePlan(dir, plan, "approved");
+
+      await runBoringstackBuild({
+        cwd: dir,
+        goal: "todo app",
+        host: createHost(),
+        evaluator: createEvaluator(),
+        exec: createExec(),
+        generate: async () => undefined,
+        generateUi: async () => undefined,
+      });
+
+      expect(await readFile(constsPath, "utf-8")).toContain(
+        'export const DEFAULT_REDIRECT_TO = "/task";'
+      );
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
   test("fails CLOSED (needs-infra) when the pristine gate can't reach the API's OpenAPI spec", async () => {
     const dir = await mkdtemp(join(tmpdir(), "bs-"));
 

From 7fa0bea12bf2634484dc9bbf829314c65faeeac1 Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 14:12:59 +0200
Subject: [PATCH 14/20] fix(layout): baseline-safe redirect placement + reject
 unimplemented archetypes + resume test (panel r7)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Panel r7 PASSED; this closes its findings (two real correctness issues + coverage/doc):
- (baseline invariant) Moved wireHomeRedirectForPlan to AFTER the pristine-baseline capture + infra
  fail-closed, so the redirect write is never swept into the 'pristine' baseline and an
  infra-aborted build never mutates the clone.
- (public → authenticated) Plan validation now gates on IMPLEMENTED_LAYOUT_ARCHETYPES = {app-sidebar,
  settings}; a roadmap-only archetype (app-topnav/focused/public) is REJECTED, not silently wrapped
  in ProtectedRoute+AppShell (which would make a 'public' feature authenticated). LayoutArchetype
  keeps the broad vocabulary; planner offers only the implemented set. Simplified layoutGuidance
  (dead fallback removed) + planner schema.
- (resume coverage) Added an observable RESUME test: home feature pre-marked passing (implement
  skipped) → runBoringstackBuild still rewrites DEFAULT_REDIRECT_TO to /task. This distinguishes the
  plan-level wiring from implement-gated (moving it back to implement would fail this). Plus the
  fresh-plan outcome test from r6.
- Fixed the over-claiming helper-test comment; rejected roadmap archetypes get a plan-store test.
- Docs: LAYOUT_ARCHETYPES JSDoc + spec Part B corrected (reject not fall-back); token list makes
  destructive-foreground/success-foreground explicit (they exist — killing the recurring false find).
- Defended (accepted limitation, documented): no-home leaves the redirect untouched (fresh scaffolds
  default to /dashboard); sidebar grouping is guide-only/cosmetic.

bun run validate fully green.
---
 ...6-07-29-modern-layout-capability-design.md |  4 +-
 packages/core/src/loop/boringstack/build.ts   | 14 ++--
 .../src/loop/boringstack/refine-prompt.ts     | 13 +---
 packages/core/src/loop/planning/plan-store.ts | 11 +--
 packages/core/src/loop/planning/plan-types.ts | 21 +++--
 .../core/src/loop/planning/propose-plan.ts    |  2 +-
 packages/core/tests/boringstack-build.test.ts | 78 ++++++++++++++++++-
 .../tests/boringstack-refine-prompt.test.ts   | 36 ---------
 packages/core/tests/plan-store.test.ts        |  9 +++
 9 files changed, 122 insertions(+), 66 deletions(-)

diff --git a/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md b/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md
index 6f487451..9e5a3d13 100644
--- a/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md
+++ b/docs/superpowers/specs/2026-07-29-modern-layout-capability-design.md
@@ -23,7 +23,7 @@
 
 **Routing (audit 1):** BoringStack routes are already flat/top-level (`/task`, not `/dashboard/task`). The shell is `AppShell` (sidebar + header) at `apps/ui/src/components/core/AppShell/`. Post-login redirect is `DEFAULT_REDIRECT_TO = "/dashboard"` (`apps/ui/src/features/auth/components/LoginPage/LoginPage.constants.ts`). The harness hardcodes every feature → `ProtectedRoute → AppShell → sidebar entry → nav-testid → sidebar-nav e2e` (`wire-resource.ts` `wireUiRouteFile` ~L133-187 `path:"/${camel}"`; `build.ts` `scopeFor` ~L161-179; `refine-prompt.ts` ~L269; `acceptance/testid-contract.ts` ~L130; `acceptance/e2e-generator.ts` nav test ~L681-686).
 
-**Design system (audit 2):** Tokens in `apps/ui/src/assets/css/tailwind.css` (`:root` + `:root[data-theme="dark"]`, mapped via Tailwind `@theme`): colors `background/foreground/primary(+strong/low/ink/foreground)/secondary/muted(+foreground/strong)/accent(+cyan/pink)/destructive/success/border(+strong)/input/ring/card/panel(+strong)/popover`, `--radius*`, `--font-sans` (Inter) / `--font-mono`, `--animate-*`. Components in `apps/ui/src/components/ui/`: Button, Card, Dialog, DropdownMenu, Form, Input, Label, Popover, ScrollArea, Sheet, Skeleton, Sonner, Switch, Tabs (cva + `cn()` + tailwind-merge + Radix + lucide). Theme via `useTheme()` + `data-theme` attribute (NO `dark:` classes; `AGENT_CONTRACT.md` forbids them). Responsive = mobile-first Tailwind + Sheet drawer (`hidden md:flex` sidebar). A11y = `eslint-plugin-jsx-a11y` (16 rules) as ERRORS + Radix + semantic HTML + skip link. Harness `conventions.ts` has 12 topic guides but **nothing on styling/theming/responsive/a11y/composition**.
+**Design system (audit 2):** Tokens in `apps/ui/src/assets/css/tailwind.css` (`:root` + `:root[data-theme="dark"]`, mapped via Tailwind `@theme`): colors `background/foreground/primary(+strong/low/ink/foreground)/secondary(+foreground)/muted(+foreground/strong)/accent(+cyan/pink)/destructive(+foreground)/success(+foreground)/border(+strong)/input/ring/card(+foreground)/panel(+strong)/popover(+foreground)` — note `destructive-foreground` and `success-foreground` DO exist (tailwind.css lines 34/86/132), `--radius*`, `--font-sans` (Inter) / `--font-mono`, `--animate-*`. Components in `apps/ui/src/components/ui/`: Button, Card, Dialog, DropdownMenu, Form, Input, Label, Popover, ScrollArea, Sheet, Skeleton, Sonner, Switch, Tabs (cva + `cn()` + tailwind-merge + Radix + lucide). Theme via `useTheme()` + `data-theme` attribute (NO `dark:` classes; `AGENT_CONTRACT.md` forbids them). Responsive = mobile-first Tailwind + Sheet drawer (`hidden md:flex` sidebar). A11y = `eslint-plugin-jsx-a11y` (16 rules) as ERRORS + Radix + semantic HTML + skip link. Harness `conventions.ts` has 12 topic guides but **nothing on styling/theming/responsive/a11y/composition**.
 
 ---
 
@@ -47,7 +47,7 @@ Wire these into the topic registry + surface at the same points as existing guid
 layout?: "app-sidebar" | "app-topnav" | "settings" | "focused" | "public"; // default "app-sidebar"
 home?: boolean;   // this feature's route is the post-login landing (AT MOST one per plan; none → /dashboard)
 ```
-`nav` (existing description) stays. The enum is intentionally broad (anti-lock-in); **v1 implements `app-sidebar` + `settings`**; `app-topnav`/`public`/`focused` are schema-valid and fall back to `app-sidebar`+guidance for now (documented), so the todos app isn't blocked and the vocabulary is future-proof.
+`nav` (existing description) stays. The `LayoutArchetype` TYPE is intentionally broad (anti-lock-in, the roadmap); **v1 implements `app-sidebar` + `settings`**. Plan validation gates on `IMPLEMENTED_LAYOUT_ARCHETYPES` = {`app-sidebar`, `settings`} — a not-yet-built archetype (`app-topnav`/`public`/`focused`) is **rejected**, NOT silently accepted/fallen-back (critical for `public`, which implies unauthenticated but would be wrapped in `ProtectedRoute`). The vocabulary stays future-proof; a new archetype ships by adding wiring + extending the implemented set.
 
 **Wiring (implement narrow):** In `packages/core/src/loop/boringstack/`:
 - **Sidebar grouping** — the harness's sidebar wiring/guidance groups nav into a **primary app group** (`layout: app-sidebar`) and a demoted **Settings group** (`layout: settings`, plus the scaffold's existing account/profile/notification links). AppSidebar edit stays in feature scope; the refine-prompt tells the model which group to add to based on `layout`.
diff --git a/packages/core/src/loop/boringstack/build.ts b/packages/core/src/loop/boringstack/build.ts
index bdee7a1a..1e30e016 100644
--- a/packages/core/src/loop/boringstack/build.ts
+++ b/packages/core/src/loop/boringstack/build.ts
@@ -978,12 +978,6 @@ export async function runBoringstackBuild(opts: {
     return { status: "done", features: [] };
   }
 
-  // Wire the post-login landing at the PLAN level — ONCE per build, resume-safe. A resumed build
-  // skips already-passing features, so doing this inside implement() could leave DEFAULT_REDIRECT_TO
-  // at /dashboard while final acceptance goes green (a false-green). Idempotent; throws (never a
-  // silent skip) if the login constants are missing; no-op when no slice is home.
-  await wireHomeRedirectForPlan(cwd, approved);
-
   const state: IGreenfieldState = {
     goal,
     features,
@@ -1034,6 +1028,14 @@ export async function runBoringstackBuild(opts: {
     return { status: "needs-infra", features: [], infra: message };
   }
 
+  // Wire the post-login landing at the PLAN level — ONCE per build, resume-safe (a resumed build
+  // that skips an already-passing home feature still applies it; it is NOT in implement()). Placed
+  // AFTER the pristine-baseline capture + infra fail-closed, so this harness mutation is never
+  // swept into the "pristine" baseline and an infra-aborted build never mutates the clone. A home
+  // slice → its route (throws if the login constants are missing — never a silent skip); no home
+  // → no-op (a fresh scaffold already defaults to /dashboard).
+  await wireHomeRedirectForPlan(cwd, approved);
+
   // Choose the GRADING baseline (infra is healthy here — the fail-closed above returned):
   //  - a persisted baseline exists → REUSE it (the pristine capture; carries its own passed
   //    bit — NEVER inferred from an empty set, which would re-announce a RED-unparseable
diff --git a/packages/core/src/loop/boringstack/refine-prompt.ts b/packages/core/src/loop/boringstack/refine-prompt.ts
index 04508464..88d8ec0f 100644
--- a/packages/core/src/loop/boringstack/refine-prompt.ts
+++ b/packages/core/src/loop/boringstack/refine-prompt.ts
@@ -10,6 +10,8 @@ function layoutGuidance(slice: ISlice): string {
   const route = `/${toCamelCase(slice.entity.id)}`;
   const lines: string[] = [];
 
+  // Plan validation only admits the IMPLEMENTED archetypes (app-sidebar | settings), so those are
+  // the only values that reach here; anything else is treated as the app-sidebar default.
   if (layout === "settings") {
     lines.push(
       "**Layout**: `settings` — a DEMOTED config area. Add this feature's sidebar link to a " +
@@ -17,16 +19,9 @@ function layoutGuidance(slice: ISlice): string {
         "links, below the primary app nav), NOT the primary app nav group."
     );
   } else {
-    const fallback =
-      layout === "app-sidebar"
-        ? ""
-        : ` (\`${layout}\` has no distinct shell yet — build it as \`app-sidebar\` for now)`;
-
     lines.push(
-      "**Layout**: `app-sidebar` — a PRIMARY app view" +
-        fallback +
-        ". Add its sidebar link to the primary app nav group at the TOP of `AppSidebar`, above the " +
-        "Settings/account links."
+      "**Layout**: `app-sidebar` — a PRIMARY app view. Add its sidebar link to the primary app " +
+        "nav group at the TOP of `AppSidebar`, above the Settings/account links."
     );
   }
 
diff --git a/packages/core/src/loop/planning/plan-store.ts b/packages/core/src/loop/planning/plan-store.ts
index e2289c0f..c46f44d6 100644
--- a/packages/core/src/loop/planning/plan-store.ts
+++ b/packages/core/src/loop/planning/plan-store.ts
@@ -8,7 +8,7 @@ import type {
   IUiIntent,
   IVerificationContract,
 } from "./plan-types";
-import { LAYOUT_ARCHETYPES } from "./plan-types";
+import { IMPLEMENTED_LAYOUT_ARCHETYPES } from "./plan-types";
 
 /**
  * Serialize a plan to YAML frontmatter + fenced JSON format.
@@ -144,10 +144,11 @@ function isUiIntent(value: unknown): value is IUiIntent {
     return false;
   }
 
-  // Optional layout archetype: if present it must be one the harness knows. The valid set is
-  // the shared LAYOUT_ARCHETYPES tuple (single source with the LayoutArchetype type) so a new
-  // archetype can't be added to the type yet silently rejected here.
-  const validLayouts: readonly string[] = LAYOUT_ARCHETYPES;
+  // Optional layout archetype: if present it must be one the harness IMPLEMENTS. Validation gates
+  // on IMPLEMENTED_LAYOUT_ARCHETYPES (a subset of the LayoutArchetype vocabulary) — a not-yet-built
+  // archetype (e.g. `public`, which implies unauthenticated but would be wrapped in ProtectedRoute)
+  // is REJECTED rather than silently mis-built.
+  const validLayouts: readonly string[] = IMPLEMENTED_LAYOUT_ARCHETYPES;
 
   if (
     value.layout !== undefined &&
diff --git a/packages/core/src/loop/planning/plan-types.ts b/packages/core/src/loop/planning/plan-types.ts
index d4526aff..3664d0d0 100644
--- a/packages/core/src/loop/planning/plan-types.ts
+++ b/packages/core/src/loop/planning/plan-types.ts
@@ -10,11 +10,11 @@ export interface IEntitySpec {
   readonly rules: readonly string[];
 }
 
-/** The modern-layout archetypes the harness understands. Intentionally broad so a plan is never
- *  locked into too few options; v1 IMPLEMENTS `app-sidebar` (the default) and `settings`, and the
- *  rest are schema-valid but fall back to `app-sidebar` + guidance until a build needs them (see
- *  the layout wiring in refine-prompt). Single source of truth: this tuple drives BOTH the
- *  `LayoutArchetype` type and the runtime validation list (plan-store), so they can't diverge. */
+/** The modern-layout archetype VOCABULARY (roadmap) — intentionally broad so the model isn't
+ *  locked into too few options. This tuple drives the `LayoutArchetype` type. It is NOT the set a
+ *  plan may declare: plan validation gates on IMPLEMENTED_LAYOUT_ARCHETYPES (below), so a
+ *  not-yet-built archetype is REJECTED, never silently accepted or fallen-back. Move an entry's
+ *  behaviour into the wiring, add it to IMPLEMENTED_LAYOUT_ARCHETYPES, then plans can use it. */
 export const LAYOUT_ARCHETYPES = [
   "app-sidebar", // left sidebar + header content shell (default SaaS look)
   "app-topnav", // horizontal top-nav + content
@@ -25,6 +25,17 @@ export const LAYOUT_ARCHETYPES = [
 
 export type LayoutArchetype = (typeof LAYOUT_ARCHETYPES)[number];
 
+/** The archetypes the harness actually IMPLEMENTS today — this drives PLAN VALIDATION. The full
+ *  LAYOUT_ARCHETYPES set above is the roadmap/vocabulary; a plan may only DECLARE an implemented
+ *  one. A not-yet-built archetype is rejected rather than silently mis-built — critically `public`
+ *  implies UNAUTHENTICATED, but routing wraps every feature in ProtectedRoute+AppShell, so a
+ *  silently-accepted `public` feature would be authenticated (wrong). Grow this set as archetypes
+ *  ship. */
+export const IMPLEMENTED_LAYOUT_ARCHETYPES = [
+  "app-sidebar",
+  "settings",
+] as const;
+
 export interface IUiIntent {
   readonly screens: readonly ("list" | "detail" | "form" | "dashboard")[];
   readonly action: string; // primary user action → observable result
diff --git a/packages/core/src/loop/planning/propose-plan.ts b/packages/core/src/loop/planning/propose-plan.ts
index 13b82e49..8ddfb0d3 100644
--- a/packages/core/src/loop/planning/propose-plan.ts
+++ b/packages/core/src/loop/planning/propose-plan.ts
@@ -69,7 +69,7 @@ Schema:
         "action": "<the primary thing a user does, one line>",
         "shows": [ "<field or thing shown on screen>" ],
         "nav": "<navigation label, e.g. Bookmarks>",
-        "layout": "<OPTIONAL: one of app-sidebar (default) | app-topnav | settings | focused | public — where this feature lives in the app shell>",
+        "layout": "<OPTIONAL: app-sidebar (default) | settings — where this feature lives in the app shell. These are the only accepted values right now; other archetypes are roadmap-only and rejected>",
         "home": <OPTIONAL boolean: true on the ONE feature that is the app's main landing page after login (omit on the rest)>
       },
       "verification": {
diff --git a/packages/core/tests/boringstack-build.test.ts b/packages/core/tests/boringstack-build.test.ts
index 307727e4..d4d3e4a7 100644
--- a/packages/core/tests/boringstack-build.test.ts
+++ b/packages/core/tests/boringstack-build.test.ts
@@ -153,8 +153,9 @@ describe("homeRouteForPlan", () => {
   });
 
   test("wireHomeRedirectForPlan APPLIES the redirect for a home plan, skips a home-less one", async () => {
-    // Guards that the plan-level wiring actually FIRES (deleting the runBoringstackBuild call would
-    // otherwise leave validate green while restoring the resume false-green). Injected applier.
+    // Unit-tests the helper's route/skip LOGIC (via an injected applier). That runBoringstackBuild
+    // actually CALLS it — including on resume — is proven by the two observable-outcome tests in the
+    // runBoringstackBuild describe (which rewrite a real LoginPage.constants), not here.
     const calls: { cwd: string; route: string }[] = [];
 
     const apply = async (cwd: string, route: string): Promise<void> => {
@@ -777,6 +778,79 @@ describe("runBoringstackBuild", () => {
     }
   });
 
+  test("wires the redirect on RESUME too — home feature already passing (plan-level, not implement-gated)", async () => {
+    // The specific resume false-green: an already-passing home feature → implement() is SKIPPED. If
+    // the wiring lived in implement() it would never run and the landing would stay /dashboard while
+    // the build is green. This test pre-marks the home feature passing; the plan-level wiring must
+    // still fire. (Moving the wiring back into implement() would make THIS test fail.)
+    const dir = await mkdtemp(join(tmpdir(), "bs-home-resume-"));
+
+    try {
+      const constsPath = join(
+        dir,
+        "apps/ui/src/features/auth/components/LoginPage/LoginPage.constants.ts"
+      );
+
+      await mkdir(join(constsPath, ".."), { recursive: true });
+      await writeFile(
+        constsPath,
+        'export const DEFAULT_REDIRECT_TO = "/dashboard";\n',
+        "utf-8"
+      );
+
+      const plan: IProductPlan = {
+        product: "A todo app",
+        slices: [
+          {
+            entity: {
+              id: "Task",
+              desc: "a task",
+              fields: [{ name: "title", type: "string" }],
+              relationships: [],
+              rules: [],
+            },
+            ui: {
+              screens: ["list", "form"],
+              action: "add a task",
+              shows: ["title"],
+              nav: "Today",
+              layout: "app-sidebar",
+              home: true,
+            },
+            verification: {
+              mustRemainTrue: ["auth"],
+              mustNotHappen: ["no title"],
+              acceptanceCheck: "bun test",
+            },
+          },
+        ],
+      };
+
+      await writePlan(dir, plan, "approved");
+      // RESUME: the home feature is already passing → its implement() is skipped.
+      await saveState(dir, {
+        goal: "todo app",
+        features: [{ id: "Task", desc: "a task", passes: true, attempts: 1 }],
+      });
+
+      await runBoringstackBuild({
+        cwd: dir,
+        goal: "todo app",
+        host: createHost(),
+        evaluator: createEvaluator(),
+        exec: createExec(),
+        generate: async () => undefined,
+        generateUi: async () => undefined,
+      });
+
+      expect(await readFile(constsPath, "utf-8")).toContain(
+        'export const DEFAULT_REDIRECT_TO = "/task";'
+      );
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
   test("fails CLOSED (needs-infra) when the pristine gate can't reach the API's OpenAPI spec", async () => {
     const dir = await mkdtemp(join(tmpdir(), "bs-"));
 
diff --git a/packages/core/tests/boringstack-refine-prompt.test.ts b/packages/core/tests/boringstack-refine-prompt.test.ts
index 57e06a11..6c8f1c70 100644
--- a/packages/core/tests/boringstack-refine-prompt.test.ts
+++ b/packages/core/tests/boringstack-refine-prompt.test.ts
@@ -528,42 +528,6 @@ describe("refinePrompt", () => {
     expect(p).not.toContain("DEFAULT_REDIRECT_TO");
   });
 
-  it("falls a deferred archetype (app-topnav) back to app-sidebar with a build-as note", () => {
-    const feature: IFeature = {
-      id: "Report",
-      desc: "a report",
-      passes: false,
-      attempts: 0,
-    };
-    const slice: ISlice = {
-      entity: {
-        id: "Report",
-        desc: "a report",
-        fields: [{ name: "title", type: "string" }],
-        relationships: ["belongsTo User"],
-        rules: ["title required"],
-      },
-      ui: {
-        screens: ["list"],
-        action: "view reports",
-        shows: ["title"],
-        nav: "Reports",
-        layout: "app-topnav",
-      },
-      verification: {
-        mustRemainTrue: ["auth"],
-        mustNotHappen: ["x"],
-        acceptanceCheck: "bun test",
-      },
-    };
-    const p = refinePrompt(feature, slice);
-
-    // v1 has no distinct top-nav shell — the model builds it as app-sidebar for now.
-    expect(p).toContain("app-topnav");
-    expect(p).toContain("no distinct shell yet");
-    expect(p).toContain("primary app nav group");
-  });
-
   it("refinePrompt without a slice is unchanged (contains id + desc)", () => {
     const p = refinePrompt({
       id: "Bookmark",
diff --git a/packages/core/tests/plan-store.test.ts b/packages/core/tests/plan-store.test.ts
index 1c876483..f76f9ef0 100644
--- a/packages/core/tests/plan-store.test.ts
+++ b/packages/core/tests/plan-store.test.ts
@@ -119,6 +119,15 @@ test("parsePlan rejects an unknown layout archetype", () => {
   ).toBeNull();
 });
 
+test("parsePlan rejects a roadmap-only archetype not yet implemented (public/app-topnav/focused)", () => {
+  // These are in the LayoutArchetype vocabulary but NOT implemented; accepting them would silently
+  // mis-build — critically `public` implies unauthenticated but routing wraps everything in
+  // ProtectedRoute, so it'd be authenticated. Validation gates on IMPLEMENTED_LAYOUT_ARCHETYPES.
+  for (const layout of ["public", "app-topnav", "focused"]) {
+    expect(parsePlan(planText([sliceJson("Task", { layout })]))).toBeNull();
+  }
+});
+
 test("parsePlan rejects more than one home slice", () => {
   expect(
     parsePlan(

From 79a55db6d9a08323e4f1264264f6d001043c99db Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 14:34:05 +0200
Subject: [PATCH 15/20] fix(layout): wire redirect after BOTH pristine
 baselines + infra-abort no-mutation test (panel r8)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Panel r8 PASSED; closes its real finding + adds the missing test:
- (gate-relaxed) The redirect still ran before host.captureMetaBaseline() (I'd moved it after the
  COMMAND baseline in r7 but not the META baseline). Moved wireHomeRedirectForPlan to AFTER both
  pristine captures (command gate + captureMetaBaseline) and after the infra fail-closed, so the
  mutation is never swept into either baseline.
- (test) Added: an infra-aborted build with a home slice leaves LoginPage.constants UNMUTATED
  (proves the wiring is after the infra return + both captures; moving it back fails this).
Defended as accepted limitations (documented; harness never produces these inputs): the line-anchored
regex doesn't skip a /* block comment */ containing a fake export (the scaffold's LoginPage.constants
is a plain constants file); refinePrompt's app-sidebar default for non-settings only matters if an
UNVALIDATED slice reaches the exported API — the harness always calls it post-plan-validation, which
rejects unimplemented archetypes.

bun run validate fully green.
---
 packages/core/src/loop/boringstack/build.ts   | 17 +++--
 packages/core/tests/boringstack-build.test.ts | 73 +++++++++++++++++++
 2 files changed, 82 insertions(+), 8 deletions(-)

diff --git a/packages/core/src/loop/boringstack/build.ts b/packages/core/src/loop/boringstack/build.ts
index 1e30e016..682093f7 100644
--- a/packages/core/src/loop/boringstack/build.ts
+++ b/packages/core/src/loop/boringstack/build.ts
@@ -1028,14 +1028,6 @@ export async function runBoringstackBuild(opts: {
     return { status: "needs-infra", features: [], infra: message };
   }
 
-  // Wire the post-login landing at the PLAN level — ONCE per build, resume-safe (a resumed build
-  // that skips an already-passing home feature still applies it; it is NOT in implement()). Placed
-  // AFTER the pristine-baseline capture + infra fail-closed, so this harness mutation is never
-  // swept into the "pristine" baseline and an infra-aborted build never mutates the clone. A home
-  // slice → its route (throws if the login constants are missing — never a silent skip); no home
-  // → no-op (a fresh scaffold already defaults to /dashboard).
-  await wireHomeRedirectForPlan(cwd, approved);
-
   // Choose the GRADING baseline (infra is healthy here — the fail-closed above returned):
   //  - a persisted baseline exists → REUSE it (the pristine capture; carries its own passed
   //    bit — NEVER inferred from an empty set, which would re-announce a RED-unparseable
@@ -1121,6 +1113,15 @@ export async function runBoringstackBuild(opts: {
     host.captureMetaBaseline();
   }
 
+  // Wire the post-login landing at the PLAN level — ONCE per build, resume-safe (a resumed build
+  // that skips an already-passing home feature still applies it; it is NOT in implement()). Placed
+  // AFTER BOTH pristine captures — the command baseline (runBoringstackGate above) AND the meta
+  // baseline (captureMetaBaseline just above) — and after the infra fail-closed, so this harness
+  // mutation is never swept into either baseline and an infra-aborted build never mutates the
+  // clone. A home slice → its route (throws if the login constants are missing — never a silent
+  // skip); no home → no-op (a fresh scaffold already defaults to /dashboard).
+  await wireHomeRedirectForPlan(cwd, approved);
+
   // Create a lookup function that maps feature ids to their plan slices
   const sliceFor = (id: string): ISlice | undefined =>
     approved.slices.find((slice) => slice.entity.id === id);
diff --git a/packages/core/tests/boringstack-build.test.ts b/packages/core/tests/boringstack-build.test.ts
index d4d3e4a7..de693265 100644
--- a/packages/core/tests/boringstack-build.test.ts
+++ b/packages/core/tests/boringstack-build.test.ts
@@ -851,6 +851,79 @@ describe("runBoringstackBuild", () => {
     }
   });
 
+  test("an infra-aborted build with a home slice leaves LoginPage.constants UNMUTATED", async () => {
+    // The redirect wiring runs AFTER the infra fail-closed + both pristine-baseline captures.
+    // So an infra-aborted build must NOT have mutated the clone. Moving the wiring back above the
+    // infra return (or above captureMetaBaseline) would rewrite the file here → this test fails.
+    const dir = await mkdtemp(join(tmpdir(), "bs-home-infra-"));
+
+    try {
+      const constsPath = join(
+        dir,
+        "apps/ui/src/features/auth/components/LoginPage/LoginPage.constants.ts"
+      );
+      const original = 'export const DEFAULT_REDIRECT_TO = "/dashboard";\n';
+
+      await mkdir(join(constsPath, ".."), { recursive: true });
+      await writeFile(constsPath, original, "utf-8");
+
+      const plan: IProductPlan = {
+        product: "A todo app",
+        slices: [
+          {
+            entity: {
+              id: "Task",
+              desc: "a task",
+              fields: [{ name: "title", type: "string" }],
+              relationships: [],
+              rules: [],
+            },
+            ui: {
+              screens: ["list", "form"],
+              action: "add a task",
+              shows: ["title"],
+              nav: "Today",
+              layout: "app-sidebar",
+              home: true,
+            },
+            verification: {
+              mustRemainTrue: ["auth"],
+              mustNotHappen: ["no title"],
+              acceptanceCheck: "bun test",
+            },
+          },
+        ],
+      };
+
+      await writePlan(dir, plan, "approved");
+
+      // Pristine gate RED because generate:api can't reach the API → needs-infra abort.
+      const exec: Exec = async () => ({
+        code: 1,
+        stdout:
+          "::tsforge-app apps/ui::\n" +
+          "[generate:api] FAILED: fetch failed (ECONNREFUSED)",
+        stderr: "",
+      });
+
+      const res = await runBoringstackBuild({
+        cwd: dir,
+        goal: "todo app",
+        host: createHost(),
+        evaluator: createEvaluator(),
+        exec,
+        generate: async () => undefined,
+        generateUi: async () => undefined,
+      });
+
+      expect(res.status).toBe("needs-infra");
+      // The clone was NOT mutated by the aborted build.
+      expect(await readFile(constsPath, "utf-8")).toBe(original);
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
   test("fails CLOSED (needs-infra) when the pristine gate can't reach the API's OpenAPI spec", async () => {
     const dir = await mkdtemp(join(tmpdir(), "bs-"));
 

From 8d0972a304822aa7f7b7bc0a943fd3a072a9ab90 Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 14:53:36 +0200
Subject: [PATCH 16/20] test(layout): lock the redirect-after-meta-baseline
 ordering (closes panel r9 advisory)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds an instrumented-host test that observes LoginPage.constants AT
captureMetaBaseline time — it must still read /dashboard then, and only
be repointed to /task afterwards. This locks the meta-baseline ordering
that the infra-abort test could not (an infra abort never reaches
captureMetaBaseline). Also corrects that test's comment to stop
over-claiming it covers the meta-baseline edge.
---
 packages/core/tests/boringstack-build.test.ts | 93 ++++++++++++++++++-
 1 file changed, 90 insertions(+), 3 deletions(-)

diff --git a/packages/core/tests/boringstack-build.test.ts b/packages/core/tests/boringstack-build.test.ts
index de693265..7d195493 100644
--- a/packages/core/tests/boringstack-build.test.ts
+++ b/packages/core/tests/boringstack-build.test.ts
@@ -1,5 +1,6 @@
 import { test, expect, describe } from "bun:test";
 import { mkdtemp, rm, mkdir, writeFile, readFile } from "node:fs/promises";
+import { readFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { Exec } from "../src/loop/boringstack/exec";
@@ -852,9 +853,10 @@ describe("runBoringstackBuild", () => {
   });
 
   test("an infra-aborted build with a home slice leaves LoginPage.constants UNMUTATED", async () => {
-    // The redirect wiring runs AFTER the infra fail-closed + both pristine-baseline captures.
-    // So an infra-aborted build must NOT have mutated the clone. Moving the wiring back above the
-    // infra return (or above captureMetaBaseline) would rewrite the file here → this test fails.
+    // Locks ONE ordering edge: the wiring runs AFTER the infra fail-closed return (an infra abort
+    // never reaches captureMetaBaseline, so this test does NOT speak to the meta-baseline ordering —
+    // the "wires the redirect AFTER the pristine meta-baseline is captured" test below locks that).
+    // Moving the wiring back above the infra return would rewrite the file here → this test fails.
     const dir = await mkdtemp(join(tmpdir(), "bs-home-infra-"));
 
     try {
@@ -924,6 +926,91 @@ describe("runBoringstackBuild", () => {
     }
   });
 
+  test("wires the redirect AFTER the pristine meta-baseline is captured (ordering lock)", async () => {
+    // The meta-baseline must be a PRISTINE snapshot of the clone; if the redirect were rewritten
+    // BEFORE captureMetaBaseline, the baseline would bake in the mutation (a false-green class). We
+    // observe the file AT capture time via an instrumented host: it must still read /dashboard then,
+    // and only be repointed to /task by the end. Moving the wiring above captureMetaBaseline flips
+    // the at-capture assertion → this test fails.
+    const dir = await mkdtemp(join(tmpdir(), "bs-home-order-"));
+
+    try {
+      const constsPath = join(
+        dir,
+        "apps/ui/src/features/auth/components/LoginPage/LoginPage.constants.ts"
+      );
+
+      await mkdir(join(constsPath, ".."), { recursive: true });
+      await writeFile(
+        constsPath,
+        'export const DEFAULT_REDIRECT_TO = "/dashboard";\n',
+        "utf-8"
+      );
+
+      const plan: IProductPlan = {
+        product: "A todo app",
+        slices: [
+          {
+            entity: {
+              id: "Task",
+              desc: "a task",
+              fields: [{ name: "title", type: "string" }],
+              relationships: [],
+              rules: [],
+            },
+            ui: {
+              screens: ["list", "form"],
+              action: "add a task",
+              shows: ["title"],
+              nav: "Today",
+              layout: "app-sidebar",
+              home: true,
+            },
+            verification: {
+              mustRemainTrue: ["auth"],
+              mustNotHappen: ["no title"],
+              acceptanceCheck: "bun test",
+            },
+          },
+        ],
+      };
+
+      await writePlan(dir, plan, "approved");
+
+      const base = createHost();
+      let atMetaCapture = "";
+      const host = {
+        ...base,
+        captureMetaBaseline: () => {
+          atMetaCapture = readFileSync(constsPath, "utf-8");
+          base.captureMetaBaseline();
+        },
+      };
+
+      await runBoringstackBuild({
+        cwd: dir,
+        goal: "todo app",
+        host,
+        evaluator: createEvaluator(),
+        exec: createExec(),
+        generate: async () => undefined,
+        generateUi: async () => undefined,
+      });
+
+      // The meta-baseline saw the PRISTINE redirect (wiring had not run yet).
+      expect(atMetaCapture).toContain(
+        'export const DEFAULT_REDIRECT_TO = "/dashboard";'
+      );
+      // And the wiring DID run afterwards, repointing the live redirect.
+      expect(await readFile(constsPath, "utf-8")).toContain(
+        'export const DEFAULT_REDIRECT_TO = "/task";'
+      );
+      expect(base.metaBaselineCaptures.count).toBe(1);
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
   test("fails CLOSED (needs-infra) when the pristine gate can't reach the API's OpenAPI spec", async () => {
     const dir = await mkdtemp(join(tmpdir(), "bs-"));
 

From c2d83b2c8dbc558efc86363fe152e215ade5c009 Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 16:48:05 +0200
Subject: [PATCH 17/20] fix(judge): show the shared Drizzle schema to the
 completeness judge (kills a belongsTo false-park)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The live todos build (Project + Task, Task belongsTo Project) reached fast-gate GREEN,
migrated the DB (task table + task_project_id_fkey present and working end-to-end), yet
the completeness JUDGE false-REJECTED it:

  judge rejected "Task": Database schema (Drizzle) defining the task table and the
  foreign key to project is not shown, so the required 'belongs to a project'
  relationship cannot be fully verified.

readResourceCode (which builds the judge's evidence) gathered ONLY the feature dirs
(apps/api/src/api/<f>/**, apps/ui/src/features/<f>/**). The table + FK live in the SHARED
app.schema.ts, outside those globs — so a belongsTo feature is judged on evidence that
structurally cannot contain the FK, and the reject-by-default rubric parks a correct,
fully-working feature the model cannot fix (nothing to fix). A false-PARK is the twin of a
false-green: the gate verdict diverges from observable reality (the FK exists in the DB).

Fix: readResourceCode now emits the shared Drizzle schema FIRST and counts it against the
budget up front, so the FK evidence always reaches the judge and is never truncated away.
Best-effort: no schema file (non-boringstack / not yet generated) → judge sees feature code
alone, exactly as before. +2 tests (schema included; schema survives truncation of a huge
feature). Full validate green (3223).
---
 packages/core/src/loop/boringstack/build.ts   | 30 +++++++--
 packages/core/tests/boringstack-build.test.ts | 62 +++++++++++++++++++
 2 files changed, 88 insertions(+), 4 deletions(-)

diff --git a/packages/core/src/loop/boringstack/build.ts b/packages/core/src/loop/boringstack/build.ts
index 682093f7..fd03df2b 100644
--- a/packages/core/src/loop/boringstack/build.ts
+++ b/packages/core/src/loop/boringstack/build.ts
@@ -181,10 +181,12 @@ export function scopeFor(name: string): string[] {
 
 /**
  * Read the generated resource code from the filesystem for the completeness judge.
- * Concatenates the API resource (.ts) and UI feature (.ts/.tsx/.jsx, test/story files
- * excluded) source, capped at ~96000 characters. React components (.tsx/.jsx) are ordered
- * FIRST across both apps so a large API can't exhaust the budget before the judge sees the
- * UI. Returns empty string if directories don't exist.
+ * Concatenates the shared Drizzle schema (so the judge can see the feature's table + FKs and
+ * verify `belongsTo` relationships), the API resource (.ts), and the UI feature (.ts/.tsx/.jsx,
+ * test/story files excluded) source, capped at ~96000 characters. The schema is emitted FIRST and
+ * counted against the budget up front so it is never truncated; React components (.tsx/.jsx) are
+ * ordered ahead of other feature files so a large API can't exhaust the budget before the judge
+ * sees the UI. Returns empty string if nothing exists.
  */
 export async function readResourceCode(
   cwd: string,
@@ -302,6 +304,26 @@ export async function readResourceCode(
   const blocks: string[] = [];
   let totalLen = 0;
 
+  // The entity's table + FOREIGN KEYS live in the SHARED Drizzle schema, not the feature
+  // dir — so a `belongsTo` relationship (the FK definition) is invisible to the feature-scoped
+  // candidates gathered above. Without it the completeness judge is asked to verify e.g.
+  // "belongs to a project" but cannot see the FK, so it false-REJECTS a fully-correct feature
+  // ("schema not shown, relationship cannot be verified") — parking a built resource the model
+  // can't fix because there is nothing to fix (observed live: the todos Project/Task build, where
+  // the DB table + task_project_id_fkey existed and worked, yet the judge parked it). Show the
+  // schema FIRST and count it against the budget up front so it is NEVER truncated away — the FK
+  // evidence must always reach the judge. Best-effort: a non-boringstack layout (or a schema not
+  // yet generated) simply has no such file and the judge sees the feature code alone, as before.
+  try {
+    const schema = await readFile(join(cwd, APP_SCHEMA_FILE), "utf-8");
+    const block = `// ${APP_SCHEMA_FILE}\n${schema}\n`;
+
+    blocks.push(block);
+    totalLen += block.length;
+  } catch {
+    // No shared schema present — skip (judge falls back to feature-only code).
+  }
+
   for (const { relPath, fullPath } of ordered) {
     const content = await readFile(fullPath, "utf-8");
     const block = `// ${relPath}\n${content}\n`;
diff --git a/packages/core/tests/boringstack-build.test.ts b/packages/core/tests/boringstack-build.test.ts
index 7d195493..77989e27 100644
--- a/packages/core/tests/boringstack-build.test.ts
+++ b/packages/core/tests/boringstack-build.test.ts
@@ -1286,6 +1286,68 @@ describe("readResourceCode — feeds the completeness judge", () => {
       await rm(dir, { recursive: true, force: true });
     }
   });
+
+  test("includes the shared Drizzle schema so the judge can verify belongsTo FKs", async () => {
+    // The live todos build false-PARKED: the judge was asked to verify Task "belongs to a project"
+    // but readResourceCode only gathered the feature dirs — the FK lives in the SHARED schema, which
+    // the judge never saw, so it rejected a correct feature ("schema not shown"). The schema must be
+    // in the judged code.
+    const dir = await mkdtemp(join(tmpdir(), "tsforge-rrc-schema-"));
+
+    try {
+      await mkdir(join(dir, "apps/api/src/api/task"), { recursive: true });
+      await mkdir(join(dir, "apps/api/src/clients/postgres/schema"), {
+        recursive: true,
+      });
+      await writeFile(
+        join(dir, "apps/api/src/api/task/task.service.ts"),
+        "export const taskService = 'TASK_SVC';\n"
+      );
+      // The FK the judge needs to see, in the shared schema (outside the feature dir).
+      await writeFile(
+        join(dir, "apps/api/src/clients/postgres/schema/app.schema.ts"),
+        'export const task = pgTable("task", { projectId: uuid().references(() => project.id) }); // FK_MARKER\n'
+      );
+
+      const code = await readResourceCode(dir, "Task");
+
+      expect(code).toContain("FK_MARKER");
+      expect(code).toContain("app.schema.ts");
+      expect(code).toContain("TASK_SVC");
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("the shared schema survives truncation even when the feature code is huge", async () => {
+    // The schema is the FK evidence — it must never be the block that gets truncated away. Emit a
+    // feature file large enough to blow the ~96000-char budget on its own and assert the schema
+    // (added first, counted up front) is still present.
+    const dir = await mkdtemp(join(tmpdir(), "tsforge-rrc-schematrunc-"));
+
+    try {
+      await mkdir(join(dir, "apps/api/src/api/task"), { recursive: true });
+      await mkdir(join(dir, "apps/api/src/clients/postgres/schema"), {
+        recursive: true,
+      });
+      await writeFile(
+        join(dir, "apps/api/src/clients/postgres/schema/app.schema.ts"),
+        "// SCHEMA_FK_MARKER\n"
+      );
+      // ~120k chars of feature code — larger than the whole budget.
+      await writeFile(
+        join(dir, "apps/api/src/api/task/task.service.ts"),
+        `// HUGE\n${"x".repeat(120000)}\n`
+      );
+
+      const code = await readResourceCode(dir, "Task");
+
+      expect(code).toContain("SCHEMA_FK_MARKER");
+      expect(code).toContain("…[truncated]");
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
 });
 
 describe("readResourceCode — budget + ordering (root-cause coverage)", () => {

From b32c92c36e3bee2c84d3917cb8c7acbe961c53b3 Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 17:05:14 +0200
Subject: [PATCH 18/20] fix(judge): bound the shared-schema block by maxChars
 too (panel r1 advisory)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The schema block is priority evidence (emitted first), but must still respect the ~96000-char
cap — a many-entity app accretes one table per feature into app.schema.ts, so an unchecked push
could return unbounded evidence to the judge. Now truncate the schema to the cap (head preserved,
where its own table + FK sit) rather than push it whole. +1 test (oversized schema stays bounded).
---
 packages/core/src/loop/boringstack/build.ts   |  8 ++++-
 packages/core/tests/boringstack-build.test.ts | 33 +++++++++++++++++++
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/packages/core/src/loop/boringstack/build.ts b/packages/core/src/loop/boringstack/build.ts
index fd03df2b..8ebf3a6a 100644
--- a/packages/core/src/loop/boringstack/build.ts
+++ b/packages/core/src/loop/boringstack/build.ts
@@ -316,7 +316,13 @@ export async function readResourceCode(
   // yet generated) simply has no such file and the judge sees the feature code alone, as before.
   try {
     const schema = await readFile(join(cwd, APP_SCHEMA_FILE), "utf-8");
-    const block = `// ${APP_SCHEMA_FILE}\n${schema}\n`;
+    const raw = `// ${APP_SCHEMA_FILE}\n${schema}\n`;
+    // Bound the schema block by the same cap as everything else — a pathologically large schema
+    // (a many-entity app accretes one table per feature here) must not return unbounded evidence.
+    // The schema is priority evidence, so it gets first claim on the budget; if it alone overflows,
+    // truncate it (the FK we care about is near its own table, not at the very end) rather than drop it.
+    const block =
+      raw.length > maxChars ? `${raw.slice(0, maxChars)}\n…[truncated]` : raw;
 
     blocks.push(block);
     totalLen += block.length;
diff --git a/packages/core/tests/boringstack-build.test.ts b/packages/core/tests/boringstack-build.test.ts
index 77989e27..f7fd3a2a 100644
--- a/packages/core/tests/boringstack-build.test.ts
+++ b/packages/core/tests/boringstack-build.test.ts
@@ -1348,6 +1348,39 @@ describe("readResourceCode — feeds the completeness judge", () => {
       await rm(dir, { recursive: true, force: true });
     }
   });
+
+  test("an oversized schema is itself bounded (never returns unbounded evidence)", async () => {
+    // The schema gets first claim on the budget, but must still respect the ~96000-char cap — a
+    // many-entity app accretes a table per feature into app.schema.ts, so it can't be pushed
+    // unchecked. If the schema alone overflows, it's truncated rather than dropped or unbounded.
+    const dir = await mkdtemp(join(tmpdir(), "tsforge-rrc-bigschema-"));
+
+    try {
+      await mkdir(join(dir, "apps/api/src/api/task"), { recursive: true });
+      await mkdir(join(dir, "apps/api/src/clients/postgres/schema"), {
+        recursive: true,
+      });
+      // ~130k-char schema — larger than the whole budget on its own.
+      await writeFile(
+        join(dir, "apps/api/src/clients/postgres/schema/app.schema.ts"),
+        `// SCHEMA_HEAD_MARKER\n${"s".repeat(130000)}\n`
+      );
+      await writeFile(
+        join(dir, "apps/api/src/api/task/task.service.ts"),
+        "export const svc = 'FEATURE_MARKER';\n"
+      );
+
+      const code = await readResourceCode(dir, "Task");
+
+      // Bounded: total stays within cap + the truncation marker (a small constant).
+      expect(code.length).toBeLessThan(96000 + 100);
+      // The head of the schema (where its own table/FK sits) is preserved.
+      expect(code).toContain("SCHEMA_HEAD_MARKER");
+      expect(code).toContain("…[truncated]");
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
 });
 
 describe("readResourceCode — budget + ordering (root-cause coverage)", () => {

From 8d2d8040fbfdf231eb96f93e5fa28552466f8a23 Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 17:17:58 +0200
Subject: [PATCH 19/20] fix(judge): window an oversized schema around the
 feature's own table + reserve budget (panel r2)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

r2 correctly flagged that the r1 naive head-cap was worse than the disease: (1) tables accrete in
build order so the feature under review sits near the END — head-first truncation dropped the exact
belongsTo FK the change exists to surface; (2) letting the schema take the whole budget starved the
feature implementation the judge must also evaluate (a fresh 'implementation not shown' false-PARK).

New sliceSchemaForJudge (pure, tested): schema ≤ budget → whole; else a window CENTERED on this
feature's `export const <camel> =` table (its columns + FK), head fallback only if the export can't
be located. readResourceCode reserves at most HALF the budget for the schema, so feature code is
never starved. Honest JSDoc. Tests: oversized schema with the feature's FK at the TAIL still surfaces
the FK AND feature code AND stays bounded; +3 direct sliceSchemaForJudge unit tests. Validate green (3227).
---
 packages/core/src/loop/boringstack/build.ts   | 60 ++++++++++++++-----
 packages/core/tests/boringstack-build.test.ts | 56 +++++++++++++----
 2 files changed, 92 insertions(+), 24 deletions(-)

diff --git a/packages/core/src/loop/boringstack/build.ts b/packages/core/src/loop/boringstack/build.ts
index 8ebf3a6a..006f4681 100644
--- a/packages/core/src/loop/boringstack/build.ts
+++ b/packages/core/src/loop/boringstack/build.ts
@@ -179,13 +179,48 @@ export function scopeFor(name: string): string[] {
   ];
 }
 
+/**
+ * Reduce the shared Drizzle schema to at most `budget` chars for the judge, KEEPING the region
+ * around THIS feature's own table (`export const <camel> =`). A many-entity app accretes one table
+ * per feature into the shared schema in build order, so the feature under review — and its
+ * `belongsTo` FOREIGN KEY, which is declared inside its own table block — typically sits near the
+ * END; naive head-first truncation would drop the exact FK evidence the judge needs. When the
+ * schema fits the budget it's returned whole; otherwise a window is centered on the feature's table
+ * (falling back to the head only if the table export can't be located). Pure — unit-testable.
+ */
+export function sliceSchemaForJudge(
+  schema: string,
+  tableExport: string,
+  budget: number
+): string {
+  if (schema.length <= budget) {
+    return schema;
+  }
+
+  const anchor = schema.indexOf(`export const ${tableExport} `);
+
+  if (anchor < 0) {
+    return `${schema.slice(0, budget)}\n…[truncated]`;
+  }
+
+  // Center the window on the table: keep a third of the budget of context before it (its imports /
+  // referenced tables) and the rest from the table onward (its columns + FK).
+  const start = Math.max(0, anchor - Math.floor(budget / 3));
+  const end = Math.min(schema.length, start + budget);
+  const head = start > 0 ? "…[truncated]\n" : "";
+  const tail = end < schema.length ? "\n…[truncated]" : "";
+
+  return `${head}${schema.slice(start, end)}${tail}`;
+}
+
 /**
  * Read the generated resource code from the filesystem for the completeness judge.
  * Concatenates the shared Drizzle schema (so the judge can see the feature's table + FKs and
  * verify `belongsTo` relationships), the API resource (.ts), and the UI feature (.ts/.tsx/.jsx,
- * test/story files excluded) source, capped at ~96000 characters. The schema is emitted FIRST and
- * counted against the budget up front so it is never truncated; React components (.tsx/.jsx) are
- * ordered ahead of other feature files so a large API can't exhaust the budget before the judge
+ * test/story files excluded) source, capped at ~96000 characters. The schema is emitted FIRST but
+ * bounded to at most HALF the budget (`sliceSchemaForJudge`, windowed around this feature's table)
+ * so it can never starve the implementation the judge must evaluate; React components (.tsx/.jsx)
+ * are ordered ahead of other feature files so a large API can't exhaust the budget before the judge
  * sees the UI. Returns empty string if nothing exists.
  */
 export async function readResourceCode(
@@ -310,19 +345,16 @@ export async function readResourceCode(
   // "belongs to a project" but cannot see the FK, so it false-REJECTS a fully-correct feature
   // ("schema not shown, relationship cannot be verified") — parking a built resource the model
   // can't fix because there is nothing to fix (observed live: the todos Project/Task build, where
-  // the DB table + task_project_id_fkey existed and worked, yet the judge parked it). Show the
-  // schema FIRST and count it against the budget up front so it is NEVER truncated away — the FK
-  // evidence must always reach the judge. Best-effort: a non-boringstack layout (or a schema not
-  // yet generated) simply has no such file and the judge sees the feature code alone, as before.
+  // the DB table + task_project_id_fkey existed and worked, yet the judge parked it). Emit the
+  // schema FIRST, but bounded to at most HALF the budget and WINDOWED around this feature's own
+  // table (sliceSchemaForJudge) — so the FK reaches the judge without either (a) being truncated
+  // head-first away when the schema is large, or (b) starving the feature implementation the judge
+  // must also see. Best-effort: a non-boringstack layout (or a schema not yet generated) simply has
+  // no such file and the judge sees the feature code alone, as before.
   try {
     const schema = await readFile(join(cwd, APP_SCHEMA_FILE), "utf-8");
-    const raw = `// ${APP_SCHEMA_FILE}\n${schema}\n`;
-    // Bound the schema block by the same cap as everything else — a pathologically large schema
-    // (a many-entity app accretes one table per feature here) must not return unbounded evidence.
-    // The schema is priority evidence, so it gets first claim on the budget; if it alone overflows,
-    // truncate it (the FK we care about is near its own table, not at the very end) rather than drop it.
-    const block =
-      raw.length > maxChars ? `${raw.slice(0, maxChars)}\n…[truncated]` : raw;
+    const sliced = sliceSchemaForJudge(schema, camel, Math.floor(maxChars / 2));
+    const block = `// ${APP_SCHEMA_FILE}\n${sliced}\n`;
 
     blocks.push(block);
     totalLen += block.length;
diff --git a/packages/core/tests/boringstack-build.test.ts b/packages/core/tests/boringstack-build.test.ts
index f7fd3a2a..e980e037 100644
--- a/packages/core/tests/boringstack-build.test.ts
+++ b/packages/core/tests/boringstack-build.test.ts
@@ -12,6 +12,7 @@ import {
   runBoringstackBuild,
   scopeFor,
   readResourceCode,
+  sliceSchemaForJudge,
   verifyAcceptance,
   e2eParkReason,
   loadBaseline,
@@ -1349,10 +1350,11 @@ describe("readResourceCode — feeds the completeness judge", () => {
     }
   });
 
-  test("an oversized schema is itself bounded (never returns unbounded evidence)", async () => {
-    // The schema gets first claim on the budget, but must still respect the ~96000-char cap — a
-    // many-entity app accretes a table per feature into app.schema.ts, so it can't be pushed
-    // unchecked. If the schema alone overflows, it's truncated rather than dropped or unbounded.
+  test("an oversized schema is bounded AND still surfaces THIS feature's FK + feature code", async () => {
+    // The realistic large-schema shape: tables accrete in build order, so the feature under review
+    // sits near the END. The schema must (a) stay bounded, (b) NOT starve the feature code, and
+    // (c) still surface the feature's own table + FK (not be truncated head-first). This is the
+    // exact regression the naive head-cap introduced and the panel caught.
     const dir = await mkdtemp(join(tmpdir(), "tsforge-rrc-bigschema-"));
 
     try {
@@ -1360,10 +1362,15 @@ describe("readResourceCode — feeds the completeness judge", () => {
       await mkdir(join(dir, "apps/api/src/clients/postgres/schema"), {
         recursive: true,
       });
-      // ~130k-char schema — larger than the whole budget on its own.
+      // A huge schema with MANY earlier tables, and THIS feature's table (with its FK) at the very
+      // end — where accretion puts it. Head-first truncation would drop TASK_FK_MARKER.
+      const earlierTables = `// early tables\n${"e".repeat(130000)}\n`;
+      const taskTable =
+        'export const task = app.table("task", { projectId: uuid().references(() => project.id) }); // TASK_FK_MARKER\n';
+
       await writeFile(
         join(dir, "apps/api/src/clients/postgres/schema/app.schema.ts"),
-        `// SCHEMA_HEAD_MARKER\n${"s".repeat(130000)}\n`
+        `${earlierTables}${taskTable}`
       );
       await writeFile(
         join(dir, "apps/api/src/api/task/task.service.ts"),
@@ -1372,10 +1379,12 @@ describe("readResourceCode — feeds the completeness judge", () => {
 
       const code = await readResourceCode(dir, "Task");
 
-      // Bounded: total stays within cap + the truncation marker (a small constant).
-      expect(code.length).toBeLessThan(96000 + 100);
-      // The head of the schema (where its own table/FK sits) is preserved.
-      expect(code).toContain("SCHEMA_HEAD_MARKER");
+      // (a) Bounded — schema is capped at half the budget, so total stays well within the cap.
+      expect(code.length).toBeLessThan(96000 + 200);
+      // (b) Feature implementation is NOT starved — the judge still sees the code it must evaluate.
+      expect(code).toContain("FEATURE_MARKER");
+      // (c) THIS feature's table + FK survive despite living at the tail of a huge schema.
+      expect(code).toContain("TASK_FK_MARKER");
       expect(code).toContain("…[truncated]");
     } finally {
       await rm(dir, { recursive: true, force: true });
@@ -1383,6 +1392,33 @@ describe("readResourceCode — feeds the completeness judge", () => {
   });
 });
 
+describe("sliceSchemaForJudge — windows a large schema around the feature's own table", () => {
+  test("returns the whole schema unchanged when it fits the budget", () => {
+    const schema = 'export const task = app.table("task", {});\n';
+
+    expect(sliceSchemaForJudge(schema, "task", 96000)).toBe(schema);
+  });
+
+  test("windows around the feature's table (near the end) instead of head-truncating", () => {
+    const filler = "x".repeat(50000);
+    const schema = `${filler}\nexport const task = app.table("task", { FK_HERE });\n`;
+    const out = sliceSchemaForJudge(schema, "task", 1000);
+
+    // The FK region is kept; the (irrelevant) head is dropped with a marker.
+    expect(out).toContain("FK_HERE");
+    expect(out.startsWith("…[truncated]")).toBe(true);
+    expect(out.length).toBeLessThanOrEqual(1000 + 40);
+  });
+
+  test("falls back to a bounded head when the table export can't be located", () => {
+    const schema = "y".repeat(5000);
+    const out = sliceSchemaForJudge(schema, "missing", 1000);
+
+    expect(out.length).toBeLessThanOrEqual(1000 + 40);
+    expect(out).toContain("…[truncated]");
+  });
+});
+
 describe("readResourceCode — budget + ordering (root-cause coverage)", () => {
   test("a marker only reachable after ~85k of content survives (proves the cap is ~96k, not a small regression)", async () => {
     const dir = await mkdtemp(join(tmpdir(), "tsforge-rrc-budget-"));

From 1c297741765539ed79c498a21e87971b9c3e653a Mon Sep 17 00:00:00 2001
From: Aleksandar Grbic <ag@dreamdata.io>
Date: Wed, 29 Jul 2026 17:32:15 +0200
Subject: [PATCH 20/20] fix(judge): omit an oversized schema on a table-export
 miss (panel r3 advisory) + dual-pressure test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

r3's one real improvement: on a table-export miss in an OVERSIZED schema, sliceSchemaForJudge now
returns "" (caller omits the schema) instead of an arbitrary head slice — under the accretion model
a head slice cannot contain this feature's table anyway, so it only burned budget better spent on
feature code. Adds a dual-pressure test (oversized schema windowed to its tail FK + a real-sized
feature file, both surviving, still bounded). JSDoc made honest.

Accepted limitation (documented, NOT fixed — requires an unreal input): a schema >96k chars AND a
single feature file >~48k chars simultaneously can still drop that one file. Greenfield builds never
produce either (schemas are a few KB; files far smaller). Three consecutive panel PASSes; stopping
here rather than grind agreement-1 edges on inputs the harness cannot generate. Validate green (3228).
---
 packages/core/src/loop/boringstack/build.ts   | 20 ++++++---
 packages/core/tests/boringstack-build.test.ts | 45 +++++++++++++++++--
 2 files changed, 55 insertions(+), 10 deletions(-)

diff --git a/packages/core/src/loop/boringstack/build.ts b/packages/core/src/loop/boringstack/build.ts
index 006f4681..02404a4c 100644
--- a/packages/core/src/loop/boringstack/build.ts
+++ b/packages/core/src/loop/boringstack/build.ts
@@ -185,8 +185,11 @@ export function scopeFor(name: string): string[] {
  * per feature into the shared schema in build order, so the feature under review — and its
  * `belongsTo` FOREIGN KEY, which is declared inside its own table block — typically sits near the
  * END; naive head-first truncation would drop the exact FK evidence the judge needs. When the
- * schema fits the budget it's returned whole; otherwise a window is centered on the feature's table
- * (falling back to the head only if the table export can't be located). Pure — unit-testable.
+ * schema fits the budget it's returned whole; otherwise a window is centered on the feature's table.
+ * If the table export can't be located in an oversized schema, returns "" (the caller then omits
+ * the schema entirely rather than burning budget on an arbitrary head slice that — under the
+ * accretion model — cannot contain this feature's table anyway; feature code keeps the full budget).
+ * Pure — unit-testable.
  */
 export function sliceSchemaForJudge(
   schema: string,
@@ -200,7 +203,7 @@ export function sliceSchemaForJudge(
   const anchor = schema.indexOf(`export const ${tableExport} `);
 
   if (anchor < 0) {
-    return `${schema.slice(0, budget)}\n…[truncated]`;
+    return "";
   }
 
   // Center the window on the table: keep a third of the budget of context before it (its imports /
@@ -354,10 +357,15 @@ export async function readResourceCode(
   try {
     const schema = await readFile(join(cwd, APP_SCHEMA_FILE), "utf-8");
     const sliced = sliceSchemaForJudge(schema, camel, Math.floor(maxChars / 2));
-    const block = `// ${APP_SCHEMA_FILE}\n${sliced}\n`;
 
-    blocks.push(block);
-    totalLen += block.length;
+    // Empty slice = oversized schema whose table window couldn't be located → omit it so the
+    // feature implementation keeps the whole budget (rather than burn half on irrelevant tables).
+    if (sliced.length > 0) {
+      const block = `// ${APP_SCHEMA_FILE}\n${sliced}\n`;
+
+      blocks.push(block);
+      totalLen += block.length;
+    }
   } catch {
     // No shared schema present — skip (judge falls back to feature-only code).
   }
diff --git a/packages/core/tests/boringstack-build.test.ts b/packages/core/tests/boringstack-build.test.ts
index e980e037..ddc6bf35 100644
--- a/packages/core/tests/boringstack-build.test.ts
+++ b/packages/core/tests/boringstack-build.test.ts
@@ -1410,12 +1410,49 @@ describe("sliceSchemaForJudge — windows a large schema around the feature's ow
     expect(out.length).toBeLessThanOrEqual(1000 + 40);
   });
 
-  test("falls back to a bounded head when the table export can't be located", () => {
+  test("returns empty on a table-export miss in an oversized schema (caller then omits it)", () => {
+    // Under the accretion model, if the feature's table export isn't found, an arbitrary head slice
+    // cannot contain it anyway — so we return "" and let the caller give the whole budget to code.
     const schema = "y".repeat(5000);
-    const out = sliceSchemaForJudge(schema, "missing", 1000);
 
-    expect(out.length).toBeLessThanOrEqual(1000 + 40);
-    expect(out).toContain("…[truncated]");
+    expect(sliceSchemaForJudge(schema, "missing", 1000)).toBe("");
+  });
+});
+
+describe("readResourceCode — dual pressure (oversized schema AND sizeable feature code)", () => {
+  test("an oversized schema keeps its window AND leaves room for real-sized feature code", async () => {
+    // The case the schema-reserve exists for: schema takes ~half the budget (windowed to its table),
+    // and a sizeable-but-realistic feature file must still be admitted from the other half. Neither
+    // the FK evidence nor the implementation may be starved.
+    const dir = await mkdtemp(join(tmpdir(), "tsforge-rrc-dual-"));
+
+    try {
+      await mkdir(join(dir, "apps/api/src/api/task"), { recursive: true });
+      await mkdir(join(dir, "apps/api/src/clients/postgres/schema"), {
+        recursive: true,
+      });
+      const earlier = `// early tables\n${"e".repeat(130000)}\n`;
+      const taskTable =
+        'export const task = app.table("task", { projectId: uuid().references(() => project.id) }); // DUAL_FK_MARKER\n';
+
+      await writeFile(
+        join(dir, "apps/api/src/clients/postgres/schema/app.schema.ts"),
+        `${earlier}${taskTable}`
+      );
+      // ~30k of feature code — comfortably inside the ~48k left after the schema takes its half.
+      await writeFile(
+        join(dir, "apps/api/src/api/task/task.service.ts"),
+        `// DUAL_FEATURE_MARKER\n${"c".repeat(30000)}\n`
+      );
+
+      const code = await readResourceCode(dir, "Task");
+
+      expect(code).toContain("DUAL_FK_MARKER"); // FK evidence survives (windowed to the tail)
+      expect(code).toContain("DUAL_FEATURE_MARKER"); // feature code is NOT starved
+      expect(code.length).toBeLessThan(96000 + 200); // still bounded
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
   });
 });