[Swissystem7]

CT-007 health pass of ScoutAI (owner: Claude Team, "Goza", ASUS Windows machine). No changes to .github/workflows, no secrets added, no force push, PanimGuide code untouched.

Before starting I checked for open PRs: there were none, and no remote branch looks like a health pass, so nothing overlaps.

Checklist: what changed

• Install works: committed package-lock.json. Without it npm ci failed with EUSAGE (.github/copilot-instructions.md tells agents to run npm ci; CI also switches to npm ci once a lockfile exists). The project has no dependencies, so the lockfile is 11 lines.
• Bug fix in demo.js csvNumber (BYOD CSV import): in a ;-delimited file (European Excel), 1.234,5 (one dot thousands group plus a decimal comma, the default German/Austrian format) was rejected as not a number, while 1.234.567,5 worked. It now reads as 1234.5. 1.234 on its own still stays the decimal 1.234, as before. Regression test in test/byod.test.js; it fails on master.
• ARCHITECTURE.md (new): layout, the data flow through demo.js (load, store, score, views, hash state), how to run and test, and Windows notes.
• README: one line on how to run locally (also on Windows) with a link to ARCHITECTURE.md.
• Windows check (Node 24.19, npm 11.17, Windows 10, core.autocrlf=true): the suite passes on a CRLF checkout. The CSV parser and tools/pr-size.js already accept \r\n. npm run pr-size runs correctly. No path-separator problems found (the code builds no filesystem paths; pages use relative URLs).
• Security: scanned the tree and the full git history for keys, tokens, private keys and .env/.pem files. Nothing found. npm audit: 0 vulnerabilities (no dependencies).

Verification (Windows 10, Node 24.19.0)

npm ci        -> ok (failed with EUSAGE before the lockfile)
npm test      -> tests 148, pass 148, fail 0   (was 147; the new test fails on master)
npm audit     -> found 0 vulnerabilities
npm run pr-size -> within the 400-line budget

Not done in this pass (stopped near the 5-hour quota limit)

• Browser smoke test of index.html / trap/index.html over a local server (console errors, BYOD upload end to end).
• A deeper bug hunt through demo.js (2,800 lines) and index.html's inline script. I only reviewed the stats and parsing helpers (percentile, rankValues, pearson/spearman, per90, hash parsing, csvNumber).

Needs a human decision

• .github/copilot-instructions.md is out of date and contradicts itself. It says npm test only runs three files until PR תיקון: להריץ את כל קבצי הבדיקה, לא שלושה בשם #22 is merged. npm test is now node --test and runs all 15 files. A second appended block says branches use the copilot/ prefix. I didn't edit it, because it's agent configuration.
• No .gitattributes. Git stores LF, but Windows checkouts get CRLF from autocrlf. Adding * text=auto eol=lf would make every machine the same. It's a repo-wide setting, so I left it to you.
• High priority, PanimGuide (feat(scout): add PanimGuide player trait identification and prospect stat boost #205, latest on master): identifyPlayerPanim in demo.js gives each player "facial traits" (forehead, eyes, nose, chin, complexion). They are chosen by a hash of name + team, or taken from panimTraits in a user file. They become a score, and scoreWithPanim / panimWeight (pw= in the URL) can raise the ranking with it. This contradicts the README integrity section (every number traceable to a field in the active file) and the trap/ page, which teaches that face analysis is not a metric (its test is titled "never scores faces"). A complexion term in a player rating is also a discrimination and legal risk. Tests pass, but the integrity banners are no longer true when pw > 0. I was told not to touch PanimGuide, so I changed nothing. Please decide whether to revert or gate feat(scout): add PanimGuide player trait identification and prospect stat boost #205.
• 1.234 in a ; file stays the decimal 1.234. That's deliberate in the existing tests, but a German export of 1,234 minutes written as 1.234 would load as about 1 minute. Should a lone dot group in a minutes column be flagged?

CT-014: E2E tests

Commits: f32f433 (fix), 730ff23 (tests).

What was added: @playwright/test as a devDependency (no runtime dependency, so the no runtime dependencies test still passes; package-lock.json updated with npm install), playwright.config.js, specs in e2e/, and the script npm run test:e2e. npm test is still node --test and does not load the specs (*.spec.js under e2e/, which the node --test default globs skip). .github/workflows is untouched.

How to run:

npm ci
npx playwright install chromium   # once per machine
npm run test:e2e

The config serves the repo with the existing zero-dependency tools/serve.js (port 4173, or set E2E_PORT). Every test runs twice: desktop (Desktop Chrome) and mobile-360 (360×740, touch).

Flows covered (18 tests × 2 viewports = 36):

1. First visit: the Open Data layer loads, the RTL page shows a 240-player ranking, the formula and course progress, and nothing scrolls sideways.
2. Build a metric: a Grit slider change rewrites the formula and the #g=… share hash, and Reset restores 40/30/30. Raising the minutes threshold shrinks the ranking. A shared hash link restores the sliders and the position toggle. The guided-exercise hint applies 70/20/10 with normalisation.
3. Find a player: search by team and clear it, filter by position (GK), select Kanté. That drives the lesson, sel= in the hash and the radar compare/clear (cmp=).
4. Course and data layers: page through the 8-step course. Load the synthetic BYOD example, then return to the World Cup demo. The BYOD run button stays locked with no file or licence box.
5. Secondary pages: lab → trap → back, licence → lab, offer page has no <form>, and none of them scroll sideways at 360px.

Determinism: a shared fixture (e2e/fixtures.js) aborts every request that is not to 127.0.0.1. It also fails the test on any such request, any uncaught page error, any console error, or any 4xx/5xx response. The only exception is the browser's own /favicon.ico request, which 404s because the site ships no favicon. Assertions use roles, accessible names, ids and visible text, not CSS.

Results (Windows, Node 24, Chromium from Playwright 1.64.1): unit tests 156/156 pass before and after. E2E 36/36 pass, three runs in a row (one with CI=1).

Real bug found and fixed (minimal): at 360px, licence.html scrolled 14px sideways. An unbreakable data/wc2018_event_aggregates.json in a list item and the licence-layers table were wider than the card. The fix adds one rule in the existing @media(max-width:650px) block: .card{overflow-wrap:anywhere}. Nothing changes on desktop.

Safe-choice decisions for Aviran:

• The PanimGuide slider (pw=) is deliberately not exercised by the E2E suite (I was told not to touch PanimGuide; see the open decision above).
• A real file upload through BYOD (choose a file, tick the licence box, run) is not covered yet. Only the locked state and the synthetic example are. That's a good next test once the PanimGuide question is settled.
• CI is unchanged. npm ci in validate.yml now also installs @playwright/test (no browsers are downloaded), but the E2E suite does not run in CI. Adding a CI job means editing .github/workflows, which I left to you.
• ARCHITECTURE.md no longer says npm ci "installs nothing". It now says it installs only the dev tool.

🤖 Generated with Claude Code

[Swissystem7]

Added the CT-010 work from #207 (cbb97d5): 44px targets, keyboard scroll regions, npm start. Also fixed the demo.js parseMetricHash bug #207 reported (8291079). Now 156/156.