Correct and extend CLAUDE.md from a real debugging…

Details

Repairs a botched npm→pnpm find-replace (13 occurrences of `ppnpm`/`pppnpm`,
including `pppnpm install`) and folds in what the v3 publication-link
investigation actually established.
Corrections:
- "Validating in this environment" claimed the sandbox usually can't reach the
  live site or Supabase. Both were reachable this session, and assuming otherwise
  costs the strongest validation route there is. Replaced with two probe commands
  (verified verbatim) and the real blocker: the toolchain — a sandbox may have no
  bundler/Jekyll gems and Node 18 vs the required 24, so no Jekyll build at all.
- Documents the harness that validated the link fix: live production markup with
  every /assets/js/** request answered from the local _site build, so the page
  runs locally compiled code against real Supabase data. Keeps the fully offline
  sass+static-server harness as the fallback, and points at the worked examples
  in the git-ignored .verify/.
New load-bearing rules:
- The `db://` placeholder invariant: a pre-resolution renderer must never
  sanitize a placeholder (use dbSafeLinkHref, not dbSafeExternalUrl) because
  applyDbLinks finds work via [href^="db://"] — the mistake that dead-ended all
  27 v3 publication links. Also: maskable-vs-external is data-driven (documents +
  media_assets vs links), not a naming convention.
- Sass manifest import order is load-bearing (v3/tokens first, v3/responsive last).
- Root tsconfig.json only sets `include`; real options live in config/tsconfig.json.
- Both Claude Code hooks resolve by repo-relative path, so they only fire from the
  repo root and must not be shadowed by a same-named nested script.
- HTMLProofer rules from .cursor/rules/site.mdc (never url-ignore a URL; keep
  local.sh in sync), which were never carried into CLAUDE.md.
Fills gaps: check_runtime_console.mjs + the GA4 scripts, the full db:* set and
which two need `uv`, why --config _config_ci.yml is required and that
remote_theme is fetched at build time, preview-v3.yml's artifact-only preview,
and agent.yml/.agent/ so its autonomous PRs aren't mistaken for intended work.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZejPEHvD8ombiu37aHbGY

Files changed (1)