portfolio-next/docs/HANDOFF.md

Handoff — 2026-11-11 (after the audit session)

Where development stopped, and how to pick it up. Delete or rewrite this file when the next session starts. Everything a new agent needs from the 2026-11-11 session is in this file or in a file it points to.

2026-11-12: spec 009 merged (CV-first /work/)

Spec 009 (docs/specs/009-work-page-cv-first.md, mockup mockups/work-k2.html) was designed with the owner, built (Opus 5.5 subagent, checked by the main session), previewed on a copy of the real content, adjusted once (only the placement of a highlight is orange) and merged into main locally with his approval. The content for it (recognition.yml, courses.yml, featured ranks 1–6 + showcases, the spreadsheet in sources/) is committed and merged into main of ~/portfolio-next-content locally. Neither repo is pushed until the owner says so; push the app first (an older app ignores the new content files, but the new page wants them). Axe checks run in e2e/a11y.spec.ts with color-contrast disabled until the dim tokens are retuned (docs/TODO.md).

State in one paragraph

The site is live at lucaswinther.info (behind Cloudflare) since the DNS cutover on 2026-11-10; the 2021 site is at old.lucaswinther.info. On 2026-11-11 the whole app was audited (docs/audits/2026-11-11-audit.md, 24 findings, a status on each row); a stack of six branches fixed nine of them and added two built specs and one unbuilt spec. The owner approved the merge and the push the same day: everything below is on main and on Gitea. The audit's status column names the branch each fix was made on; those branches are merged.

What was merged on 2026-11-11 (one stack, each branch built on the one above)

#	Branch	What it holds	Verified
1	chore/audit-2026-11-11	The audit report; a pointer in docs/TODO.md	docs only
2	fix/audit-quick-wins	Findings 2 (no fonts inlined into CSS), 6 (Ghost fetched page by page), 7, 18, 19, 21	typecheck, bun test 189
3	chore/specs-006-007	Specs 006 and 007	docs only
4	feat/start-page-without-react	Spec 006: the start page ships no React; one plain preference switch on every page (finding 3)	typecheck, bun test 201, Playwright 133 passed / 9 skipped
5	feat/link-previews-sitemap-feed	Spec 007: canonical + Open Graph tags, /sitemap.xml, three Atom feeds, SITE_URL (findings 8, 9)	typecheck, bun test 236, Playwright 133 / 9
6	feat/simple-side-index	Spec 008 and its plan (not built), the /simple mockups, this handoff	docs and mockups only

Specs 006 and 007 were implemented by Opus 5.5 subagents from the specs; the main session re-ran typecheck and bun test on each branch and checked the built output. The Playwright numbers are the subagents' runs. If Playwright shows "Page crashed", the machine is short of memory: rerun with --workers=2.

Before the merge, on the tip: typecheck clean, bun test 236 pass (after one unexplained hang of a fixture build under heavy machine load, see docs/TODO.md → Tests), Playwright 133 passed / 9 skipped, and the Docker image built and passed scripts/smoke-test.sh locally.

Not verified anywhere: how LinkedIn and Bluesky render the previews; the cassette's play button (no fixture or real song has an audio file; it was checked by hand in a browser).

After the merge

• The plans for 006 and 007 were removed before the merge; docs/plans/008-simple-side-index.md stays (not built).
• CI builds and publishes the image from main; production picks up a new image through the homelab config (~/lucwin-config/config, the owner's; off limits to agents without asking). Check the live /status (runningAppVersion) to see which commit runs, and /sitemap.xml and /feed.xml once it is the new one.
• Merges are local, no pull requests, never force-push. The owner approves each merge and each push himself; an approval for one does not cover the next.

Waiting for the owner

• Finding 5, color-scheme: dark on the work theme. A one-line change, kept out of the branches because he looks at visual changes before they are committed. It is in git stash (stash@{0}, "audit #5 …") and is exactly this, in src/site/styles/work.css line 2: [data-theme='work'] { scroll-padding-top: 72px; color-scheme: dark; }. Headless Chrome does not draw scrollbars, so the screenshots (~/work-color-scheme-before.png, -after.png) only show that the page content is unchanged; he has to look at /work/ in a real browser (scrollbar, search field).
• A changed Playwright check from spec 006. The "The 2021 site was all by hand →" line is now always in the HTML but hidden; the test in e2e/preference.spec.ts that asserted the link was absent now asserts it is not visible and not in the accessibility tree. Equivalent for visitors, but beyond what the spec allowed ("adapted only where they wait for an island"), so he was asked to confirm. No answer yet.
• Spec 007 extras beyond the spec: an SVG is never used as og:image (social sites take raster images only), og:image:alt is written when there is alt text, a malformed SITE_URL fails the build. Reported to him; no objection, no explicit yes.
• Spec 008 calls (in the spec, marked [call]): no contract bump for the optional pins block although docs/CONTENT-CONTRACT.md asks for one on a format change; off-the-clock pins are items only; project rows show the AI level instead of a date; the AI preference hides rows on /simple too. He answered "sounds good" to the summary.
• Owner-only audit findings: 1 (www.lucaswinther.info returns a Cloudflare 525) and 4 (Cloudflare raises /media/ browser caching to 20 h; fix in Cloudflare or by hashing media URLs in the app).

Spec 008 — /simple side index with pins: approved, on hold

• The owner chose mockup A and asked for pins; then said: "Write the spec and commit it, but dont complete it." A build that had just started was stopped; only the plan was committed (docs/plans/008-simple-side-index.md, nothing ticked, no code). Do not start it until he says so.
• Design truth: mockups/simple-side-a.html (a fragment, see its header comment) and mockups/shots/simple-side-a-1440.png, -390.png. The mockup has no project rows; the spec adds up to three under "work". Its label colour #a8927f on the oxblood #3a1d1a has not been contrast-checked.
• When it is built: he looks at the rendered page before the page and its CSS are committed (the plan says which parts may be committed first). Preview with a temporary copy of the real content that has the two pins (gacha-event-tracker, saltlakridserne); the real content repo gets its pins block from the owner afterwards.

Open audit findings (see the audit file for evidence and fixes)

Open and agent-doable: 10 (print styles for /simple, visual), 11 (CI check in the content repo), 12 (publish on push; touches deployment, ask first), 13 (hover lag hypothesis, to try in the hover lab), 14 (prerender on hover), 15 (theme-color), 16 (refresh race: needs a test seam in src/runtime/refresh.ts, none was found without one), 17, 20, 22, 23. Waiting or owner-only: 1, 4, 5, 24.

How the owner works (learned or confirmed this session)

• Once he approves a design, carry it through spec → plan → execution without review stops and report the decisions at the end. Exception he set himself: visual changes are rendered and shown before they are committed.
• On 2026-11-11 he said: "Once specs are written, use Opus 5.5 to complete them." The main session wrote the specs and the briefs, Opus 5.5 subagents built them (one at a time, stacked branches, because they share Base.astro), and the main session checked each result before starting the next.
• He judges by eye and reacts best to real rendered mockups on a build of the real content. He reaches this machine over WireGuard at 10.20.20.2; previews are served with bun src/cli.ts preview <dir> 4392 and screenshots go in ~/.
• Never invent facts about him. The 13 projects' dates are placeholders (2021-01-07…19), so nothing should present a "latest project" by date as fact.
• The real content is ~/portfolio-next-content (separate repo, head 2b89137); agents do not change it unasked. Build it locally with SOURCES_FIXTURES=fixtures/sources bun src/cli.ts build ~/portfolio-next-content <out> <cache>.

Where things are

• Decisions and why: docs/DECISIONS.md. Map and invariants: docs/ARCHITECTURE.md. Rules and commands: AGENTS.md. Content format: docs/CONTENT-CONTRACT.md. Deploy: docs/DEPLOY.md. Taste log and every mockup verdict: docs/inspiration.md. Backlog: docs/TODO.md (its "Before go-live (owner)" list is still his).
• Chosen mockups (visual truth): mockups/nav-d.html, mockups/tech-r3-c.html, mockups/personal-r2-b.html; for spec 008 also mockups/simple-side-a.html. The sister repo ~/commission-compass is the pattern for runtime, CI and deploy.
• Local scratch, git-ignored, safe to delete: .superpowers/, .tmp/ (including the subagents' spec006-* and spec007-* builds). Screenshots from this session are in ~/ (spec006-*.png, simple-mock-*.png, work-color-scheme-*.png); the ones that matter are also in mockups/shots/.