Merge branch 'v3' into claude/klicker-auto-migrations-90b73c

Author: rschlaefli

.agents/skills/devrouter/SKILL.md

@@ -7,7 +7,7 @@ description: Diagnose and repair a broken KlickerUZH development environment. Us
 
 Run the checks **in order** — later checks assume earlier ones pass. Background facts live in the wiki: [docs/getting-started.md](../../../docs/getting-started.md).
 
-Provenance: checks 1–6 were executed and verified on macOS (2026-07-07). Steps marked **config-derived** were read from config, not executed — treat their exact output as unconfirmed.
+Provenance: checks 1–5 and 7–9 were executed and verified on macOS (2026-07-07). Check 6's process reconciler was executed in the Linux devcontainer image, and its host-side devrouter lifecycle was verified from a clean linked worktree on macOS (2026-07-13). Other steps marked **config-derived** were read from config, not executed — treat their exact output as unconfirmed.
 
 ## Agent ground rules
 
@@ -32,7 +32,7 @@ Wrong major (e.g. 9.x from a stale Volta shim; `VOLTA_FEATURE_PNPM` unset) **sil
 | `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` under `CI=true` | restore lockfile (check 1), install without `CI=true`                          |
 | ~19 packages fail `pnpm run check`                  | `pnpm run build` once (generates Prisma client, codegen, dists), then re-check |
 
-Healthy sequence from scratch: `pnpm install` → `pnpm run build` → `pnpm run check` (verified ~20s / ~1.5min / clean).
+Healthy sequence from scratch inside the devcontainer: `pnpm install` → `pnpm run build` → `pnpm run check` (verified ~20s / ~1.5min / clean). The root build script forces `NODE_ENV=production`, including when the devcontainer exports `NODE_ENV=development` for its live apps. A production build can replace Next.js dev output; run `devrouter ensure .` afterward so the exact checkout runtime is health-checked and recovered when needed.
 
 ## Check 3 — stale GraphQL codegen
 
@@ -53,22 +53,25 @@ If `apps/analytics` complains about schema drift or a schema edit isn't visible:
 lsof -nP -iTCP:5432 -sTCP:LISTEN   # repeat for 6379 6380 6381 7077 8888 80 443
 ```
 
-`Bind for :::5432 failed: port is already allocated` means another stack holds the port — stop it or don't start the colliding service. Plain localhost and legacy host-based paths publish fixed ports, so only one such stack runs per machine. For parallel devcontainer worktrees, keep the base `.devcontainer/docker-compose.yml` port-free and use `.devcontainer/docker-compose.devrouter.yml`, which exposes `${WORKSPACE:-klicker-uzh}-app` / `${WORKSPACE:-klicker-uzh}-db` aliases on `devnet`. Start/register linked worktrees with the same token, e.g. `WORKSPACE=<slug> devpod up .` and `devrouter app run <app> --workspace <slug>`. Use `.devcontainer/docker-compose.localhost.yml` only for the one-at-a-time localhost fallback. If manage media uploads fail with an Azure Blob CORS error while GraphQL auth still works, check the storage account before changing app CORS. The media library uploads directly from the browser to Azure Blob Storage via SAS, so the Blob service CORS rule must allow the actual devrouter origin (`https://manage.klicker.localhost` or `https://manage.klicker.<workspace>.localhost`). Use exact origins for production/staging accounts; for a dedicated dev storage account, a dev-only `https://*.localhost` rule keeps parallel worktrees usable.
+`Bind for :::5432 failed: port is already allocated` means another stack holds the port — stop it or don't start the colliding service. Plain localhost and legacy host-based paths publish fixed ports, so only one such stack runs per machine. Parallel devcontainer worktrees use the port-free base compose file plus `.devcontainer/docker-compose.devrouter.yml`; the one-at-a-time fallback uses `.devcontainer/docker-compose.localhost.yml`. If manage media uploads fail with an Azure Blob CORS error while GraphQL auth still works, check the storage account before changing app CORS. The media library uploads directly from the browser to Azure Blob Storage via SAS, so its CORS rule must allow the actual local origin. Use exact origins for production/staging accounts and dev-only localhost rules for a dedicated dev storage account.
 
 ## Check 6 — infra bring-up / server status (headless-safe)
 
 Depending on your environment path:
 
-### Path A: Inside Devcontainer
+### Path A: Managed devcontainer
 
-The container manages infra services and app servers automatically in the background. Check logs and process status:
+Run the ownership-aware lifecycle check from the host, then inspect the exact container through devrouter:
 
 ```bash
-pgrep -f "turbo run dev" >/dev/null && echo "Dev servers running" || echo "Dev servers NOT running"
-tail -n 50 /tmp/dev.log   # inspect server startup logs
+devrouter ensure .
+devrouter exec . -- cat /tmp/devrouter-process-klicker-dev.state
+devrouter exec . -- tail -n 50 /tmp/dev.log
 ```
 
-If servers are down, restart them: `bash .devcontainer/post-start.sh`.
+`devrouter ensure` delivers its matching process helper to the exact validated container. Released `0.0.35` fingerprints the workspace, command, adapter bytes, and declared non-secret origin allowlist. The helper replaces a stale owned process group and leaves unknown processes untouched. Host-side ensure checks all routes and can recreate one stale or unhealthy exact-path DevPod once.
+
+`devrouter doctor --repo .` provides static diagnostics. `devrouter ensure .` resolves the checkout-specific overlay and is the authoritative runtime proof.
 
 ### Path B: Host-based Setup
 

.agents/skills/klicker-environment-doctor/SKILL.md

@@ -18,9 +18,15 @@ Facts about the test landscape: [docs/testing.md](../../../docs/testing.md). Thi
 
 Never run root `pnpm run test:run` blind — its turbo fan-out includes Cypress, which needs a running seeded stack.
 
+Direct checks for `auth`, `chat`, `frontend-control`, `frontend-manage`, and `frontend-pwa` generate ignored Next route types first through each app's `check` script. Do not hand-edit or commit `next-env.d.ts`; keep it ignored and included by `tsconfig.json`. The three PWA apps use `tsconfig.check.json` to exclude `.next/dev/types` from raw `tsc`; otherwise stale dev and fresh production Pages Router validators duplicate global declarations.
+
+For Next framework or bundler changes, verify both repository-supported paths. `pnpm run build:test` uses Turbopack in all five Next apps. `pnpm run build` uses Turbopack for auth/chat and Webpack for control/manage/PWA until their service-worker integration moves to Serwist. Confirm standalone server paths for all five apps and `sw.js`, Workbox, and custom worker outputs for the three PWA apps.
+
+The Playwright build job must tar the five `.next` trees before artifact upload and extract them in each shard. Direct artifact upload dereferences Turbopack's `.next/node_modules` symlinks and can omit transitive runtime links, producing HTTP 500 before the suite starts.
+
 ## Decide whether e2e is warranted locally
 
-CI runs Cypress (8-way split) and Playwright (5-way shard) on almost every code PR — CI is the real e2e gate. Run e2e locally only when your change plausibly breaks a flow (new UI, changed selectors/`data-cy`, auth/redirect changes, activity lifecycle). If you do:
+CI runs Cypress (8-way split) and Playwright (8-way shard) on almost every code PR — CI is the real e2e gate. Run e2e locally only when your change plausibly breaks a flow (new UI, changed selectors/`data-cy`, auth/redirect changes, activity lifecycle). If you do:
 
 - You are **authorized to start the required servers for this purpose** — test stack via the e2e skills' setup instructions, plus the Hatchet general worker for publish/schedule/end flows and response-api + response processor for live-answer flows (exact triage in the e2e skills).
 - Tear down afterwards (`./_down.sh`); leave the machine as you found it.

.agents/skills/klicker-testing-verification/SKILL.md

@@ -43,7 +43,7 @@ New non-obvious patterns discovered during a task go to the matching page above
 3. Validate + format:
 
    ```bash
-   bash ~/.claude/skills/llm-wiki-okf/scripts/validate.sh docs   # if the validator is available; no trailing slash
+   bash ~/.agents/skills/rs-llm-wiki-okf/scripts/validate.sh docs   # no trailing slash
    pnpm exec prettier --write docs/
    ```
 

.agents/skills/klicker-wiki-maintenance/SKILL.md

@@ -5,15 +5,21 @@ FROM node:24.16.0-bookworm-slim
 
 ENV PNPM_HOME="/pnpm" \
     PATH="/pnpm:$PATH" \
-    DEBIAN_FRONTEND=noninteractive
+    UV_PYTHON="3.12"
+
+ARG DEBIAN_FRONTEND=noninteractive
 
 # Runtime tools: git (repo ops), openssl/ca-certificates (Prisma + TLS),
-# procps (pgrep for the post-start dev-server guard), curl (healthchecks).
+# procps (process matching), util-linux (flock/setsid), curl (healthchecks).
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
-        git openssl ca-certificates procps curl \
+        git openssl ca-certificates procps util-linux curl \
     && rm -rf /var/lib/apt/lists/*
 
+# Match the analytics image and CI so the repository-wide lint gate works in
+# the self-contained development environment.
+COPY --from=ghcr.io/astral-sh/uv:0.11.12 /uv /uvx /bin/
+
 # Install pnpm with npm (not corepack — signature verification can fail on a
 # pinned Node). Mirror the repo's packageManager pin. (GOTCHAS #8)
 RUN npm install -g pnpm@11.5.0