Creative ideas + design notes
Commits with substantial prose (≥120 chars) — the rationale behind each move.
1b68235 · 2026-08-01 · tools-dw-hub: href-drill — card category is a filter-link + URL-addressable state
Each card's category is now an <a href="?category=…"> to its filtered view (href-drill
HARD rule); left-panel facets (category/status/type) + search are URL-addressable. Click
filters in place + reflects into the URL, cmd/ctrl-click opens the shareable href,
back-button + deep-link restore via popstate/readURL.
Verified (Playwright + basic auth, live :9950): click category 'Room Settings' -> ?category
+ grid 29->3 all-matching; deep-link restores; back-button->29; canary FLAT->DONE; 0 err.
href-drill backlog grid 7/92. TK-10089.
fda8808 · 2026-07-30 · tools-dw-hub deploy: INSTALL_CMD=true (no npm deps → npm ci fails without a lockfile)
The hub is a zero-dependency static server (server.js uses only Node built-ins),
so the default 'npm ci --omit=dev' aborted the deploy (no package-lock.json).
Set INSTALL_CMD="true" so deploys skip the no-op install.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
e4ef8df · 2026-07-30 · mood-board-studio: pre-deploy hardening (closes DTD contrarian's export/tablet dissent)
The /dtd panel voted A (deploy) but the contrarian reviewer's FIX-FIRST dissent
flagged real, localhost-unverifiable risks on the public origin. Closed all three:
1. Export no longer fails silently: canvas.toDataURL() is wrapped in try/catch —
on a SecurityError (canvas tainted) it shows a 'right-click the preview → Save
image as…' toast instead of a dead button.
2. CORS taint PREVENTED at the source: product-image src now carries a
tool-specific cache-bust param (&mbc=1) so the crossorigin=anonymous request
gets a distinct cache key and can't collide with a credentialed cdn.shopify.com
entry warmed by the storefront (the taint vector). Verified CDN still 200+ACAO
with the param; export stays untainted.
3. Tablet controls: sidebar hides <=900px (iPad portrait = 820px lost all layer
controls + Tips). Added a mobile control bar (Tap a swatch, then: To Front /
To Back / Delete / Reset) that delegates to the existing handlers.
Verified: desktop 1440 (bar hidden, 12/12 load w/ cache-bust, export OK 1.9MB);
iPad 820 (bar visible + functional — To Front changed z 1→102, no h-scroll);
0 console errors. Deploy itself remains Steve-gated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
a020519 · 2026-07-30 · Add start-fleet-persistent.sh: full Mac2 tool set reboot-persistent, secrets never in dump.pm2
Each tool self-sources secrets-manager/.env at RUNTIME in its bash child, so pm2's dump.pm2
holds only the command, never token VALUES (verified 0, was 26). Supersedes start-fleet.sh's
export-then-save leak. Boot hook com.steve.pm2-resurrect resurrects from dump.pm2 -> reboot-safe.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
b514256 · 2026-07-30 · mood-board-studio: fix mobile horizontal-scroll (public-readiness)
Now that the studio is public-facing (tools.designerwallcoverings.com), audited it
on a 390px phone viewport: the fixed 42px/.18em/nowrap wordmark forced the page to
1298px wide -> horizontal scroll (classic mobile bug). The existing @media(<=900px)
hid the sidebar but never touched the header.
Fix (scoped to <=900px, desktop untouched):
- wordmark font-size clamp(18px,6vw,34px) + reduced letter-spacing + allow wrap
- header flex-wrap so action buttons drop below the wordmark
- canvasWrap overflow:auto so board-panning stays inside the canvas, not the page
Verified :9815 @390px: horizontalScroll NO (375<390), wordmark wraps + fits, all
buttons visible; @1440: wordmark 42px/nowrap intact, sidebar visible, 12/12 load.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
a0b95db · 2026-07-30 · mood-board-studio: diversify grasscloth pool (was 7/8 Phillipe Romano)
Pool-concentration audit flagged grasscloth as vendor-heavy (2 vendors, PR x7).
Replaced 2 PR entries (Garamendi, Nantucket) with grasscloth from 2 new houses —
Matera Sisal (Fentucci) + Grasscloth Sublimer (Elitis) — both true flat
grasscloth-family textures, images verified 200 + visually confirmed flat.
Grasscloth now 4 vendors (Phillipe Romano, Groundworks, Fentucci, Elitis).
Skipped Mind the Gap Koralion (a seagrass-PRINT pattern, not a grasscloth
texture) to keep material fidelity. (grasscloth naturally stays PR-leaning — PR
is DW's private grasscloth line.)
Applied to the relocated canonical file (studio moved model-arena -> tools-dw-hub
in commit 3d80c93). Verified on live host :9815: 4 grasscloth vendors render,
12/12 photos load, 0 console errors.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3d80c93 · 2026-07-30 · Add Mood Board Studio to tools.dw hub (moved from model-arena)
Self-contained client-side design tool (83KB, no backend/Shopify writes/DB — Tier-1 SAFE
per SCOPE-tools-public.md). Served under the hub as a same-origin static tool (new href
tool-type: zero new DNS, one auth gate — SCOPE Path-A). Verified locally on :9815:
/api/tools lists it, file serves 200 behind auth / 401 without.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>