oficina / docs Public

Impeccable pass: PRODUCT.md, and four design fixes on the three screens

Squash of worktree-impeccable-init (5 commits). Reviewed as one diff by
claude-fable-5 per AGENTS.md's highest-capability rule — it returned DO
NOT MERGE on the first read, and MERGE after the two blockers below were
fixed at the root. Discussion 13 is the record.

PRODUCT.md is written from repository evidence rather than an interview:
the run was unattended, which the design skill's own autonomy rule treats
as permission to infer from the brief. The file says so at the top and
marks what is a reading rather than a citation.

Four fixes, all found by running the app and measuring rendered pages at
1440px and at the 320px reflow width spec §10.3 commits to:

1. A document had no way back to the list. GET /d/{sqid} rendered
   sign-out and no link at all, so arriving by bookmark or mailed link —
   the two ways in that do not pass through GET / — stranded a person
   there. [docs-back] is a breadcrumb whose label reuses docs.list.title
   rather than inventing a key that could drift from the screen it
   points at across twelve locales. No new user-visible string.

2. Sign-in was an unlaid-out form: one email field stretched to 950px
   inside a 992px box with its submit button flush against its
   underside, zero gap. Now one 32rem measure shared by the box and its
   callouts, field and button side by side.

3. The mobile header spent 175px of a 720px viewport before the first
   document, because a fixed 14rem field could not share a 288px column
   with its button. 175px -> 133px. A wrapping flex line breaks before
   it shrinks, so the first attempt measured exactly as tall as before
   it; nowrap is what forces the field to yield width instead.

4. No favicon; /favicon.ico 404'd on every page. A hand-drawn sheet mark
   on the day theme's accent, in the shell's documented "head" block,
   defined once in the base template so all three pages inherit it.

A fifth claimed fix was withdrawn during review, and the reason is worth
keeping. It "made the whole list row clickable" — but rastrillo's own
tokens.css already ships that: [rst-row] position: relative (:500), an
un-gated :hover tint (:515), and [rst-row-main] > a::after with inset: 0
(:558), under rastrillo's comment "The name link's overlay makes the
whole row clickable without nesting one anchor inside another." Our
markup already matched. The "7% clickable" measurement came from
getBoundingClientRect on the anchor, which cannot see a positioned
pseudo-element, and the hit test that "confirmed" the fix was hitting
rastrillo's overlay — it would have passed identically beforehand, which
is the check that was never run. list.html now carries a comment saying
so, because the next reader will otherwise measure 268x16 and reach for
the same non-fix.

PRODUCT.md also asserted, present tense, that content is encrypted in
SQLite under a DEK with a plaintext byte-grep test enforcing it. Neither
is true: Store.Text's doc comment says sealing is out of scope for the
plan that built it, and no such test exists. Rewritten as the spec
commitment it is, with an explicit instruction not to describe an
instance as encrypting content at rest.

Two implementation traps recorded, both now held by a test rather than
by care:
- icon.svg's first version named a CSS custom property in an XML comment
  with its leading "--", which XML forbids. It served a flawless 200
  with the right Content-Type and byte count and no browser could parse
  it. TestIconIsWellFormedXML decodes every token.
- It was first written to internal/docs/static/, which is the editor
  build's output — the gate rebuilds there, fails on any dirt, then
  git-cleans it, so the file reddened CI and CI deleted it.
  Hand-authored assets live in brand/, and
  TestExactlyOneEditorBundleIsEmbedded asserts static/ holds nothing
  else, so this now fails in go test rather than in CI.

Rebased onto a6fa843: main gained the live-updates/SSE work while this
branch was open, which touches show.html and render.go. The merge was
textually clean, and was re-verified beyond that — gate exits 0 on the
merged tree, and in a browser the back link, the favicon on all three
pages, the 133px mobile header, the still-clickable row, and typing into
the ProseMirror editor (whose mount the live-sync work rewrote) all
behave, with no console errors or horizontal overflow at either width.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QsrkL4m68poXhtf1tGaoek