Session handover — 2026-07-16

The Wix→WooCommerce lane got a home and a version-control history it never had. ADR-0012's first-milestone step 1 is done: the bmparts enrichment chain is extracted, parametrized, and proven a no-op on the pilot. The Astro lane was not touched.

Two wiki claims were corrected, and one of them was hiding something worse than the error itself.

Where to look

• New repo: DCathal/replatform-woo (private), local ~/replatform-woo. Its README carries the chain + the run recipe; docs/playbook.md carries the seven platform gotchas (ADR-0012's compounding asset, lifted out of memory wp-elementor-deploy-gotchas). ADR-0012 remains the design source of truth — the repo implements, it does not re-decide.
• ADR-0012 — new §"Build progress" (step tracker + what step 1 actually shipped and what proved it) and the dated §Correction about the wordpress "repo".
• known-patterns — one new entry: "An id the DESTINATION assigned is an INSTALL fact" (the write-side twin of the join-key rule; the key-on-a-name-the-platform-owns sub-rule; the reverse-substitution no-op proof).
• known-issues → Wix→WooCommerce lane — the corrected security item, the toolkit-vs-attic note, and two new open items (second site unexercised, $cards).
• DCathal/Replatform a28ac81 — the rescued crawler work.

What shipped

The crawler rescue (unasked for, and the most urgent thing here). crawler/lib/layout-analyser.js and lib/tag-scanner.js — the two files ADR-0012 names as load-bearing for stage 1, and the reason the pilot ran on this crawler rather than the replatform-dev fork — had never been committed. They existed on one laptop. Committed and pushed, rebased cleanly onto three commits that were on the remote from another machine (zero file overlap; nothing forced).

replatform-woo, in four commits. .gitignore first, deliberately, so no window existed in which a credential could be staged. Then the chain, then the palette/brand hoist, then the post-id resolution.

Parametrization (step 1). Gone from the scripts: the Ecwid store id + public token, a nine-role palette, the brand name, and six hardcoded Elementor post ids. All read from a gitignored config/<site>.json; the ids resolve at run time on a key the platform owns (_elementor_template_type, page_on_front, filename) — not on a post_title we would have to keep in sync, which is what the first pass planned until the live box was measured. Every lookup fails closed.

Nothing was assumed. Reverse-substitution re-derives the pristine originals byte-for-byte; a read-only harness has all 6 resolvers return the id they replaced; the nowdoc → heredoc conversion was proven by rendering both versions on PHP 8.2 and diffing (1557 bytes, identical) rather than by reasoning about $-interpolation.

Corrections

"The wordpress repo has cathal.dev.ppk committed at root." ~/wordpress is not a git repository — no .git, no remote, no history. Nothing was ever committed or pushed; the secrets never left local disk. Rotation still wise; the published secret framing was wrong. Believable because ~/wordpress/crawler is a repo with a live remote, so the phrase was true of the part that mattered. The half nobody had noticed: not being a repo is exactly why the analyser and the bmparts scripts had no history to begin with. The wrong claim was sitting on top of the real problem.

A same-session correction, caught before it shipped. The README (commit f740297) recorded the post-id fix as "resolve elementor_library by post_title". One wp post meta get killed it: Site Header is authored by no script in the toolkit. Corrected in 093bb93. Recorded because it is the protocol's own shape — a plausible remedy written by a session that had not yet measured.

Next

1. ADR-0012 step 2 — the job-spec + per-stage report JSON. $cards is the forcing question: do card mappings come from the crawl or the spec? Decide it there; do not hoist it by reflex.
2. Then steps 3–4 — stages 1–4 + the 6-matrix into the dashboard queue (no models; most of the wall-clock win), checker/fixer loop last.
3. The first finding that matters arrives on site two. Step 1 is proven not to have broken bmparts; it is unproven anywhere else (known-issues).
4. Astro lane untouched — VOD Slice F (ADR-0010) and the fcr.about video bucket remain queued in the 2026-07-15 pt3 handover.

The through-line

Check the artifact before believing the wiki about it — the third session in a row where that paid, and the first where the check was one command against a folder rather than a capture. The .ppk claim had been read, believed, and filed as a security action by two sessions; git -C ~/wordpress status refuted it instantly and, in doing so, surfaced the untracked analyser that was the actual risk.

And the step-1 half is the protocol's other rule in miniature: a fix you have not run is a hypothesis. The post_title plan was written down as the remedy before anything was measured, and it was wrong for a reason no amount of reasoning would have produced — a name we don't author is a name we can't assert.