🤝 Handover — pick up QuizWizz from here

This is the one page to read before touching the WRDP bench. It says what is true right now, which rules are not optional, what is still open and where to start, and how to prove you did not break anything. It is a standing page: when the state changes, change this page and say when. Dated receipts stay immutable; this page links to them.

State in one breath

2026-09-08 live punchlist repair is the newest dated audit-as-of record: 39 working identities, reconciled shell gates, corrected f/g/Fresh-Surfaces/Editor runtime receipts, an offline-proved dirty-baseline plugin packet, a sealed after-only 39-file harness supplement and a 50-asset local public-safe corpus. It does not replace planning authority or establish human acceptance, release eligibility, mirror authority or production publication. Since then, the 2026-09-14 backup exposure cleanup removed 58 untracked .bak* droppings from the web-served plugin tree (private copies with SHA-256 parity under evidence/2026-09-14-bak-exposure-cleanup/) and widened the public vhost’s droppings deny to suffixed backup names, leaving plugin source bytes unchanged. Round F, UX repair round, then did change plugin source: eight reviewer rows and both metric rows closed, one measured regression found and repaired inside the round, shell 1..98/0 and eight bounded browser chunks plus a post-chip re-gate, and the tracked-modified count raised from 41 to 49. Mirror HEAD is still 715474f and nothing was staged; no human acceptance and no release eligibility. Phase G, the 2026-09-14 Settings premium restyle, is the newest change to plugin source: the Settings panel restyled to one Apple inset-grouped visual language across six scored vision rounds plus a CSS-only focus amendment, six owned files (five sheets and the settings view, class attributes only), shell 1..98/0 and four bounded browser chunks at 47/47, 7/7, 7/7 and 10/10, and the tracked-modified count raised from 49 to 51. It did not converge and it holds no human acceptance. One amendment followed it on the same day: the operator explicitly approved the smallest bounded JavaScript correction, so the round’s freeze on assets/js/qwizz-admin-settings.js was lifted for one change only — a focus listener per [data-workspace-tab] at :1485-1491 that scrolls a focused off-screen segment into view (inline: 'start', live bundle SHA-256 a7b6768e…). That closed the keyboard gate: the re-run walk measures 0 missing indicators and 0 clipped rings across 36 Settings-owned stops at both viewports, and the bundle re-passes legacy 47/47, uiux-perfection a-d 7/7 and h-j 7/7, the five-selector admin chunk 10/10 and shell 1..98/0, with 94 backup rows / 10 by user 1 and option SHA 89877cf6… unchanged. It is recorded in section 11 of the phase G receipt and UIUX-SET-02 is now shipped; the tracked-modified count stays 51 because that file was already a modified row. Both disposable admins are gone — qwvisual-20260914 (1171) at the end of phase G and its re-created replacement (1208) after the amendment walk — so the next round creates its own. Round H, the production wiki build, is the only planned round still open.

1. Where things are

What	Where	Notes
Live bench	https://wrdp.loca.zone (loopback 127.0.0.1:51080)	admin user in .env WP_ADMIN_USER; never print WP_ADMIN_PASSWORD
Plugin source (live)	wp/wp-content/plugins/quizwizz/	bind-mounted, www-data:www-data 0644; edit via stage + install only (rule 2 below)
Plugin mirror	loca/quizwizz on git.omp.loca.zone, via ./scripts/qwgit.sh	never checkout or pull into the live tree
Shell gate	./scripts/quizwizz-probe.sh --wave all	current reconciled contract is 1..98, zero failures on the recorded idle-bench run
Browser gate	scripts/quizwizz-browser-smoke.js	inherited bounded-selector recipe; historical Sep-2 SHA be619c00… is not a current hash. Runs inside an OMP browser.run cell; bounded selectors only, never all
Current status	📍 Now	one page of measured-true facts
Canonical open-work ledger	Open work ledger	retained 154-row census and Sep-2 section 11; Sep-8 working IDs are tracked separately in the newest receipt
Gate contracts	probes	what each wave and selector decides
Latest live-punchlist receipt	Sep-8 live punchlist receipt	39 working IDs, separate from eight August canonical S03 collisions and canonical issue/cluster totals; current bounded evidence, not planning authority or blanket acceptance
Historical UI and UX receipt	2026-09-02 UI and UX perfection receipt	amended: read the SET-07 amendment first; acceptance and baseline belong to that dated round
Design authority	design board §163-198	one containment edge, no hover transforms, no transition: all, tokens not hex
Durable evidence copy	q5vault/assets/evidence/2026-09-02-uiux/	before/after JSON, measurement scripts, mutation matrix and dossier (stored as .md.txt so the wiki does not treat them as pages), TAP records, recovery record, the SET-07 screenshot. /tmp/qwux/* paths in receipts point at the same bytes but do not survive a reboot
Sep-8/9 noncanonical boundary	Sep-8 live punchlist receipt	The 19-file plugin packet passes strict offline apply/byte proof only against its exact dirty baseline; the after-only harness supplement has 39/39 copy/current parity but excludes runtime outputs/capabilities/config/PDFs. Corrected f (2026-09-09 01:11 UTC) and g (01:37 UTC) each pass 5/5, Fresh-Surfaces (00:32 UTC) passes 9/9, and the policy-aware Editor lifecycle (02:00–02:02 UTC) passes 8/8. Earlier red lifecycles and unknown capability identities remain recorded; exact cleanup applies only to each corrected current run
Gitea issues	#14 closed with evidence · #15 open · #13 open	#15 and #13 are the two live product/harness follow-ups
Wave 5 diagnostics and harness reconciliation	Wave 5 residue diagnostics	Residue components printed; --wave all is 1..98/0 again after pinning play_page_id=0 for Waves 7-9 (byte-exact restore) and re-pinning the Wave 9 tree digest to the operator’s 2026-09-09 configuration
Backup-dropping hygiene	2026-09-14 backup exposure cleanup	Zero .bak* files remain under the plugin tree. That cleanup left qwgit.sh status --short at 0 untracked and the inherited 41 tracked-modified Sep-8 files; round F then raised the tracked-modified count to 49 and phase G to 51, both with 0 untracked. Suffixed backup URLs now 404 at the nginx edge; loopback Apache still serves any raw file that exists, so never leave droppings in the bind mount
Plugin mirror drift	mirror decision sheet	./scripts/qwgit.sh status --porcelain reads 51 M, 0 ?? after phase G, against 49 after round F and 41 before both. 16 rows are post-sep8-unattributed and 9 post-packet-mutation, the latter being packet paths whose live bytes the sealed Sep-8 packet no longer describes. The canonical apply-check has not been re-run against either the round-F or the phase G tree

2. Rules learned the hard way (not optional)

1. Never save Settings as the operator (user 1). wp_qwizz_settings_backups keeps 10 rows per writer; owner 1 already holds 11. Any save as admin silently deletes operator history. It happened twice on 2026-09-02 and cost a byte-exact recovery from the nightly backup. Verify settings behaviour as a disposable admin, or do not save. The browser harness now asserts that no backup row created during a run belongs to a foreign writer — keep that assertion green. Ledger row UIUX-BACKUP-01.
2. Stage, install, lint. Copy the live file to /tmp/qwfix/<slice>/<rel>, edit there, sudo -n install -o www-data -g www-data -m 0644 <staged> wp/wp-content/plugins/quizwizz/<rel>, then sudo docker compose exec wordpress php -l wp-content/plugins/quizwizz/<rel>.php (node --check for JS). Never chmod/chown live files. Never touch vendor/, build/, provenance/, QUIZWIZZ_VERSION.
3. Gates need an idle bench. Wave 5 assertion 12 fails 1 in 6 under concurrent HTTP load and 0 in 6 idle (issue #15). Do not run probe waves while browser agents are active, and do not run two harness owners at once — broadcast PAUSE/RESUME over hub.
4. Bounded browser runs only. The browser tool kills a run at ~300 s and a killed run bypasses in-process cleanup (leaks users, drafts, rows). Chunk as legacy | autostart,auto-resume,sound-toggle,play-destination,tier-selector | welcome,superglued-rail,single-column,selection-borders,trivia-html | uiux-perfection with QWIZZ_UIUX_STEPS=a-d, e-g, h-j. If a run is killed anyway, follow the residue recovery: attribute rows by created_by and payload diff before deleting anything; nightly root backups are at /home/loca/backups/wrdp/<stamp>/.
5. A gate must not reuse the fix’s selector. SET-07 was certified fixed by an assertion that used the same CSS selector as the fix; the selector matched nothing, so the gate skipped exactly the broken elements. Measure the observable symptom (walk every candidate node, read rendered rects) and guard the denominator (checked >= N) so a probe that matches nothing can never pass. Ledger row UIUX-GATE-01.
6. Browser is authoritative for UI. DOM presence is not a verdict; cache disabled, hard reload, computed styles and rects, screenshots for anything visual. Plan line numbers drift — confirm anchors with grep before editing.
7. Vault hygiene. No / inside a wikilink alias (Quartz truncates it — write “UI and UX”), escape | in table-cell wikilinks, blank line after any raw HTML block. Validate with /home/loca/dev/wikis/build.sh wrdp --check-only; a production build needs explicit approval and a live readback with [[ count 0 outside <code>.

3. Open work — start here

The canonical rows below live in the ledger, which stays the authority on status. Confirm current anchors before acting: line numbers drift, and round F moved several of the files these rows point at.

Round F closed the whole 2026-09-02 reviewer and metric block, phase G then shipped the Settings restyle and its approved JavaScript focus fix closed UIUX-SET-02, so the pickup list below is no longer a queue of CSS and PHP chores. What is left is one operating-rule row, one diagnostic row, the owner-decidable visual rows, three phase G residuals and the production wiki build. Before selecting a slice, read the round F receipt and the phase G receipt for the current gate, metric and Settings boundaries, and the Sep-8 live punchlist receipt for the mirror blockers. Do not merge the Sep-8 working identities into canonical ledger totals.

Pick	Ledger id	What to do	Files	Gate to run after
1	UIUX-FLAKE-01 · #15	done 2026-09-14 — see Wave 5 residue diagnostics: components printed and mutation-proved; 0/18 failures idle and loaded, verdict not reproduced at 4×/8× loops; hypothesis remains unverified; next action none (no attributed component, so no product fix is indicated; #15 stays open until a loaded red names one).	scripts/quizwizz-probe.sh Wave 5 residue block	--wave 5; all-wave 1..98 re-proved on the reconciled harness
2	UIUX-REV-01 · -03 · -04 · -05 · -07 · -08	done 2026-09-14 — installed on the bench in round F across five slices; see the round F receipt section 2 for the per-slice anchors. Next action none.	includes/LanguageFlags.php, includes/Rest/AdminController.php, includes/Admin/ListTables.php, includes/Frontend/views/builder-view.php, assets/css/qwizz-finetune.css, qwizz-builder.css, qwizz-admin-editor.css, assets/js/qwizz-finetune.js, languages/	already run: legacy 47/47, admin chunk 13/13, uiux-perfection a-d/e/f/g/h-j, shell 1..98/0
3	UIUX-REV-02 · -06	done 2026-09-14 — no change required. Round F opened both named sheets and found the shadowed Settings toolbar declarations and the phantom --qw-brand branch already absent. Recorded as closed on measurement, not as shipped work. Next action none.	none	none
4	UIUX-METRIC-01 · -02	done 2026-09-14 — both stale pixel targets retired and re-scoped to the plugin-owned counter set the round-F driver measures. The re-scope is load-bearing: owned smallTargetsOwned on L1-desktop is what caught the +N chip regression. Next action none.	receipt and plan text only	none
5	UIUX-BACKUP-01	still open. Decide whether owner 1’s Settings-backup rows should be trimmed to the per-writer cap deliberately (operator ruling) so the hazard disappears; until then rule 1 stands. Neither round F, phase G nor the phase G JavaScript amendment touched it: round F and phase G ran as the disposable admin qwvisual-20260914 (1171), which phase G deleted at the end against 0 backup rows and 0 posts, and the amendment walk re-created that identity as 1208 and deleted it the same way, with zero Settings saves throughout. Each new round creates its own disposable identity.	operator decision	none
6	UIUX-P1 · UIUX-VIS-01 through UIUX-VIS-06 · UIUX-SET-03 through UIUX-SET-06	not bench work. Eleven owner-decidable visual rows: round F’s four retained design-accepted P1 symptoms and its six new P2 findings, plus phase G’s four round-6 Settings residuals (scroll-strip affordance, helper and eyebrow density, section-header insets, the core Screen Options control on mobile). Every one is a model judgement over a static screenshot, so no bench measurement moves them and no row may be implemented on the critique alone.	none until a decision is recorded	none
7	UIUX-SET-01 · UIUX-SET-02	UIUX-SET-02 is done 2026-09-14 — the mobile strip clip was closed by the operator-approved focus listener at assets/js/qwizz-admin-settings.js:1485-1491 (scrollIntoView({ block: 'nearest', inline: 'start', behavior: 'auto' }), live bundle a7b6768e…); the earlier inline: 'nearest' bundle was measured ineffective against the strip’s scroll-snap-type: x proximity and is preserved as keyboard-walk-js-1a3792be*.json, so do not retry either that or the reverted CSS-only scroll-snap candidate. Next action none. UIUX-SET-01 is still open and still needs a JavaScript change the approval did not cover: search-result rows concatenate label and value (searchIndexCopy at :1012-1018, consumed at :1434).	assets/js/qwizz-admin-settings.js	already run for the focus fix: legacy 47/47, uiux-perfection a-d 7/7 and h-j 7/7, the five-selector admin chunk 10/10, shell 1..98/0 and a repeat keyboard walk at 390x900 and 1280x900. For UIUX-SET-01: uiux-perfection a-d, the legacy chunk, then a repeat keyboard walk at 390x900
8	UIUX-SET-07 · UIUX-SET-08	bench-actionable harness and documentation work: add a counted Preview-modal assertion with a non-trivial denominator (today the modal is only two waitFor barriers at scripts/quizwizz-browser-smoke.js:3173-3179 and there is no UIUX (d)), and reconcile the 1..76 text that survives in the probe page and harness skill against the installed 1..98.	scripts/quizwizz-browser-smoke.js, q5vault/audits/qwizz/probes.md, .omp/skills/ harness text	the affected bounded chunk, with a mutation proof for the new assertion; --wave all unchanged at 1..98
9	round G — Settings premium panel	done 2026-09-14 — shipped on the bench as vision round 6 plus a CSS-only focus amendment, then one operator-approved JavaScript focus fix recorded in section 11 of the phase G receipt. Residuals are picks 6 through 8 above, minus UIUX-SET-02, which that fix closed. The loop did not converge and no human has accepted the surface. Next action none.	assets/css/qwizz-tokens.css, qwizz-admin-settings-core.css, qwizz-admin-settings-layout.css, qwizz-admin-settings-search-preview.css, qwizz-admin-settings-workspace.css, includes/Admin/views/settings-page.php, assets/js/qwizz-admin-settings.js	already run: legacy 47/47, uiux-perfection a-d 7/7 and h-j 7/7, the five-selector admin chunk 10/10, shell 1..98/0, re-run on the amended bundle
10	round H — final wiki build	the only planned round still open. A production build and deploy of the wiki, which needs explicit operator approval and a live readback; the phase G receipt and the ledger, handover, Now, index, changelog and probe updates around it are all written but unpublished until that build runs. Validation until then is /home/loca/dev/wikis/build.sh wrdp --check-only only.	q5vault/	build.sh wrdp --check-only before approval; live route readback after the swap

Not bench-actionable and deliberately parked: SETTINGS-ENDPOINT-CAS (#13, product defect in SettingsController::save response revision), the deferred corpus-replacement rows, and everything in the owner-decidable and terminal-blocked classes — see the ledger’s section 0 for the census.

4. Verify before you claim anything

Run from /home/loca/dev/wrdp, bench idle, only after coordinating a single harness owner. The commands below are the inherited verification recipe. The Sep-8 baseline observation was 94 assertions / 6 failures and its original TAP is lost; later reconciled Wave 9 1..21 and all-wave 1..98 are green within their shell scope. Do not turn that into browser, capability-cleanup or human acceptance.

./scripts/wrdp-health.sh                       # 7/7
./scripts/qwgit.sh status --short              # empty = live tree equals mirror HEAD; expected today: 41 " M" inherited Sep-8 files, 0 "??" (any "??" is a new dropping)
./scripts/quizwizz-probe.sh --wave <n>         # narrowest wave first
./scripts/quizwizz-probe.sh --wave all         # current contract: 1..98, failures=0

Browser selectors, inside an OMP browser.run cell, admin already logged in, cache disabled:

globalThis.QWIZZ_BASE_URL = 'https://wrdp.loca.zone';
globalThis.QWIZZ_QUIZ_EDIT_ID = 99;
globalThis.QWIZZ_BROWSER_WAIT_MS = 12000;
globalThis.QWIZZ_BROWSER_GATE = 'uiux-perfection';   // or one of the other three chunks
globalThis.QWIZZ_UIUX_STEPS = 'a-d';                   // then 'e-g', then 'h-j'
return await eval(await Bun.file('/home/loca/dev/wrdp/scripts/quizwizz-browser-smoke.js').text());

Residue must be established against an attributable pre-run baseline before claiming restoration. The Sep-2 accepted baseline was 95 backup rows / ordered SHA 86100bbc…; retain it as dated history, not Sep-8 authority. Sep-8’s reconciled Library mutation packets each print residue=0, and the post-all state comparison matches Settings, 94 backups, 10 operator rows, both protected pages and zero former harness users. Those are named scopes, not a whole-window artifact inventory or global cleanup. Page-1289’s earlier modification timestamp was not restored.

• Original browser a-d passes 7/7 and original e passes 5/5. Pre-repair f remains 4/5 red, and the first post-sticky f lifecycle remains 5/6 red on capability settlement. Corrected response-observer f passes 5/5 on 2026-09-09 at 01:11:16.633–01:12:26.696 UTC, including in-viewport Cancel/Preview PDF/Print and exact removal of its one draft, one artifact and one private file. This does not resolve earlier unknown capabilities.
• Corrected g passes 5/5 on 2026-09-09 at 01:37:30.133–01:38:32.161 UTC after awaiting the initial preview capture before Replace. The first g lifecycle remains red because the harness allowed Replace to invalidate the still-pending preview; the correction changes harness ordering, not product behavior. Its current-run draft/artifact/private-file cleanup is exact.
• Fresh-Surfaces passes 9/9 on 2026-09-09 around 00:32 UTC for S03-02/03/05/06 across desktop/mobile. The first Editor lifecycle remains red because its oracle wrongly required Theme under Hidden exposure. The corrected policy-aware Editor lifecycle passes 8/8 on 2026-09-09 at 02:00:48.159–02:02:11.479 UTC for E03-08/10/11/12 across 1280×900 and 390×900, with zero console/page errors and exact current-run cleanup. Its two frames use temporary CSS paint masking and prove visible cropped geometry only; they retain spellcheck decorations and do not prove DOM/value deletion.
• The public-safe local corpus is 50 assets: 28 JSON and 22 PNG. All entries match manifest digests/lengths, all JSON parses, every asset is mode 0644 and all 22 PNG stored-byte/decoded-RGBA hashes are distinct. The first 47 entry objects remain unchanged; one Editor projection and two paint-masked frames were appended. Manifest SHA-256: a3025a433ddb8fbf6e26b30a4e2a7f2c4dcd1271ede47261fcc4edd3e076c118. This is local evidence, not publication.
• The final 19-file plugin packet remains offline-proved only against exact dirty before images and is noncanonical. The separately sealed after-only harness/worker supplement has manifest SHA-256 a7d8d50ba93dfe807070c435bc669b46dac6ebe53a7616321c63a8f56fbe6eb4, 39 source files and 39/39 copy/current parity; raw results, fixtures, capabilities, config and PDF copies are excluded, so it is source preservation rather than runtime authority.

5. Handing off again

For Sep-8, do not perform a blanket mirror commit: it is NOT PERFORMED / blocked. The durable assessment finds 13/19 dirty-baseline before files differ from canonical 715474f; disposable canonical apply-check fails in 7 paths. No actual index inspection or commit occurred. The release owner must decide inherited prerequisites and canonical target/port, then authorize narrow staging after the real index is checked for unrelated work; the per-file options are on the mirror decision sheet. v3 is an immutable interim dirty-baseline delta, not final delivery or a canonical-HEAD-applicable patch.

After that boundary is resolved, a completed slice needs the narrowest wave green, --wave all green on an idle bench, the affected bounded browser chunk green against the final source, and attributable residue restoration before a scoped mirror commit via qwgit.sh and a dated receipt plus updates to Now, the ledger and this page. Every new assertion gets a mutation proof (break it, see it red, restore byte-exact, see it green) — a test that never went red is not evidence. Bench → mirror → any archive, never the reverse; an archive cannot establish deployed bytes. No gate or mirror commit grants canonical release, production publication or human acceptance; releaseEligible: false.