diff --git a/docs/a11y-audit-2026-05-01.md b/docs/a11y-audit-2026-05-01.md
deleted file mode 100644
index 3c34ba3..0000000
--- a/docs/a11y-audit-2026-05-01.md
+++ /dev/null
@@ -1,118 +0,0 @@
-# Frontend a11y audit — 2026-05-01
-
-Surfaces audited: index.html (CSS theme + components), sortof-app.jsx (~1467 lines), tweaks-panel.jsx (dev-only, gated behind `?tweaks=1`).
-
-Scope: every UI surface where state, severity, or category is conveyed to the user. Findings ranked by user impact.
-
-## Palette decision
-
-Okabe-Ito (CVD-safe) lifted to dark-mode lightness so each accent color clears ≥4.5:1 against `--bg-1` (oklch 0.21). Hues kept at Okabe-Ito's chosen 30°-spaced anchors so the *pairs* (red/green especially) remain distinguishable under deuteranopia/protanopia/tritanopia.
-
-```
---acc-success: oklch(0.78 0.13 165)   /* bluish-green, "Okabe-Ito green" lifted */
---acc-warn:    oklch(0.82 0.15 75)    /* orange-yellow, warning */
---acc-error:   oklch(0.70 0.18 35)    /* vermillion, error */
---acc-info:    oklch(0.78 0.13 230)   /* sky blue, info/links/buttons */
-```
-
-Old `--acc-green` (yellow-green, hue 155) rolls over to `--acc-success`. Old `--acc-red` (hue 25) → `--acc-error` (hue 35, more chroma). Old `--acc-amber` and `--acc-blue` keep their hues but bump chroma. Names changed from `green/amber/red/blue` (hue-based) to `success/warn/error/info` (semantic) so accidental "green = good" coupling breaks; backwards-compat aliases keep existing references working until next sweep.
-
-## Foreground ramp lift
-
-Current `--fg-3` (oklch 0.45) on `--bg-1` (oklch 0.21) is ~2.7:1 — **WCAG AA fail** for body text. Used for tagline, label-meta, branch-name, code-block muted text, footer, etc. — that's the "gray on gray" the user reported.
-
-| Token | Before | After | Used for |
-|---|---|---|---|
-| `--fg`   | 0.95 | 0.95 (unchanged) | Primary text |
-| `--fg-1` | 0.78 | 0.82 | Secondary text (panel headings) |
-| `--fg-2` | 0.60 | 0.72 | Tertiary text (labels, tags). Now ~5.5:1 — passes AA. |
-| `--fg-3` | 0.45 | 0.60 | **Decorative only** — chevrons, separators, dot-leds. Now ~4.4:1 — passes AA for non-text usage. |
-
-Rule: any element with readable text content (>1 word) uses `--fg-2` minimum. `--fg-3` is reserved for non-text decoration (chevrons, divider dots, separators). Audited each prior `--fg-3` usage and reclassified accordingly (see fix list below).
-
-## Findings
-
-### Critical (color-only signals, fail per AudioEye rule "never rely on color alone")
-
-| # | Where | Current | Fix |
-|---|---|---|---|
-| C1 | `.status-pill.cached/queued/parse/expanding/unknown/nonmod` (index.html:302-314) | Color-coded label + tiny dot. The label text says "12 cached" / "5 queued" — that's a count + role label, but the role itself is text. Acceptable per AudioEye rule (count ≠ encoding). However the **dot-led** is purely color. | Add a per-state glyph prefix to the dot-led: `●` (cached), `◐` (queued, blink), `◓` (draining), `▸` (expanding), `?` (unknown), `−` (nonmod). Glyph is the primary signal; color reinforces. |
-| C2 | StatusStrip terminal pill text — `state === 'failed'` shows "job failed" with `.idle` class (index.html:308 + sortof-app.jsx:231) | Plain text, no icon. Indistinguishable from `idle` ("ready when you are") at a glance. | Prefix `✗ ` for failed, `✓ ` for done/success, `▸ ` for cold, `…` for idle. |
-| C3 | `.warn-section .badge` red vs amber (index.html:578-592) | Red and amber rounded badges visually differ only by hue. Palette change helps but adds no glyph. | Prefix the count with `!` (red/error) or `⚠` (amber/warn). Both badges become `! 3` or `⚠ 2` — count is still the load-bearing info, glyph disambiguates severity. |
-| C4 | `.warn-list .w-tag` red vs amber (index.html:621-622) | Tag text is colored ("MISSING" red, "CYCLE" amber). Tag itself is the label; color is reinforcement. | Acceptable. But the **tag color alone** distinguishes severity within the list. Add a leading glyph: `! MISSING`, `⚠ CYCLE`, `⚠ CONFLICT`. |
-| C5 | `.copy-btn.copied` (index.html:409) | Pure color shift to green. The `IconCheck` glyph IS shown when copied (sortof-app.jsx:130), so glyph signal exists. | Acceptable. Verify the IconCheck strokes pick up `currentColor` so palette change propagates. |
-| C6 | `.warn-branch-btn.picked` (index.html:695) | Pure color shift to green + `★ ` star prefix in JSX (sortof-app.jsx:411). | ★ glyph already encodes "picked"; pass. |
-| C7 | `.diff-stat.add/rm/mv` (index.html:495-498) | Color + the prefix glyphs `+`, `−`, `↕` in JSX. | Glyphs already encode meaning; color reinforces; pass. |
-| C8 | `err-banner` and `cold-banner` (sortof-app.jsx:680-688, 666-673) | "err" / "cold" text tag + message. No icon. The amber/red border conveys severity. | Add `⚠ ` glyph to err-tag content, `❄ ` to cold-tag (or `⏳`). |
-| C9 | `.sort-btn[disabled]` (index.html:269-274) | Opacity drop + line color. No iconic disabled signal. | Acceptable (dimmed appearance plus the `disabled` cursor is the convention). Verify `disabled` attr is set, not just CSS. |
-| C10 | `.cancel-btn` hover state (index.html:327) | Hover turns red. No glyph. | Add `✗` prefix to button label: `✗ cancel`. Already-red on hover then doesn't carry meaning alone. |
-
-### Important (focus, hover, contrast)
-
-| # | Where | Current | Fix |
-|---|---|---|---|
-| I1 | No `:focus-visible` rules anywhere | Browser-default focus ring on inputs only; buttons get nothing on keyboard nav. | Add a global `:focus-visible` rule with 2px outline + 2px offset, color `--acc-info`, applied to all interactive elements (`button, a, [role="button"], input, textarea, select, summary, [tabindex]`). |
-| I2 | Hover-only color shifts on chrome elements (e.g. `.icon-btn:hover`) | Color contrast pre-hover may pass; mouse-only convention. | Pair hover with subtle background tint (already in some places), keep. |
-| I3 | `.tagline` color: `var(--fg-3)` (index.html:102) — **gray on gray**. | Tagline is decorative; ratio fails AA but content is non-essential. | Lift to `--fg-2` per the ramp rule. |
-| I4 | `.label-meta` color: `var(--fg-3)` (index.html:190) — line meta info "12 lines" is informational text. | Bump to `--fg-2`. |
-| I5 | `.branch-name` `var(--fg-3)` (index.html:448) — mod display name in picker | Information-bearing text. Bump to `--fg-2`. |
-| I6 | `.branch-deps`/`.branch-pos` `var(--fg-3)` (index.html:449-450) | Information-bearing. Bump to `--fg-2`. |
-| I7 | `code-block .ink-sep`/`.ink-mut` `var(--fg-3)` (index.html:389-390) | Code separator/muted ink — decorative + structural. Lifted `--fg-3` (0.60) is now AA-OK; keep. |
-| I8 | Footer: `var(--fg-3)` (index.html:140) — text "based on..." / "a thing by..." | Information-bearing text. Bump to `--fg-2`. |
-| I9 | `.cb-meta`, `.cb-key`, table count, table .chev all `--fg-3` | Mixed. Counts and keys are information; chevrons are decoration. Bump information-bearing to `--fg-2`. |
-| I10 | `.warn-list .w-tag` (default, no level class): `var(--fg-2)` | Already at fg-2; passes after the ramp lift. |
-
-### Minor (cosmetic, nice-to-have)
-
-| # | Where | Current | Fix |
-|---|---|---|---|
-| M1 | Links: `border-bottom: 1px dotted` (index.html:65) | Underline equivalent. OK. | Change dotted → solid on hover for sharper feedback. |
-| M2 | `cancel-btn` no width-match for sort-btn neighbors | Cosmetic. | Skip. |
-| M3 | `.cat.patch`/`.cat.map`/`.cat.lib` pills | Pill text *is* the label ("patch"/"map"/"lib"); color is reinforcement. | Verify new palette mappings hold. |
-
-### Out-of-scope / requires backend support
-
-None. All findings are frontend-resolvable.
-
-## Per-component fix triples (post-fix state signals)
-
-Each interactive component now emits at minimum `(color, icon/glyph, text)`:
-
-| Component | Color | Glyph/Icon | Text |
-|---|---|---|---|
-| Status pill (cached) | success | `●` | "12 cached" |
-| Status pill (queued) | warn | `◐` (blinking) | "5 queued" |
-| Status pill (draining) | info | `◓` (blinking) | "3 draining" |
-| Status pill (expanding) | info | `▸` (blinking) | "expanding collection…" |
-| Status pill (unknown) | error | `?` | "1 unknown" |
-| Status pill (nonmod) | fg-2 | `−` | "1 non-mod" |
-| Status pill (idle) | fg-2 | `…` | "ready when you are" |
-| Status pill (done) | success | `✓` | "done. N mods, W warnings" |
-| Status pill (failed) | error | `✗` | "job failed" |
-| Status pill (cold) | warn | `▸` | "cache miss — be patient" |
-| Status pill (error) | error | `✗` | "something went sideways" |
-| Warning badge (red) | error | `!` | "3" |
-| Warning badge (amber) | warn | `⚠` | "2" |
-| Warning row (missing) | error | `!` | "MISSING" + msg |
-| Warning row (cycle/conflict) | warn | `⚠` | "CYCLE"/"CONFLICT" + msg |
-| Err banner | error | `⚠` | "err" + msg + retry button |
-| Cold banner | warn | `❄` | "cold" + msg |
-| Cancel button | error (hover) | `✗` | "cancel" |
-| Copy button (default) | info | IconCopy | "copy" |
-| Copy button (copied) | success | IconCheck | "copied" |
-| Branch row (picked) | success | `★` (in label) | mod_id text |
-| Diff stat (add) | success | `+` | count |
-| Diff stat (rm) | error | `−` | count |
-| Diff stat (mv) | warn | `↕` | count |
-
-## Acceptance check
-
-- [x] Every state signal is now (color × glyph × text); never color alone.
-- [x] All accent colors clear ≥4.5:1 against `--bg-1`.
-- [x] All text-bearing fg tokens (`--fg`, `--fg-1`, `--fg-2`) clear ≥4.5:1.
-- [x] `--fg-3` reserved for non-text decoration, lifted to ~4.4:1 anyway as a hedge.
-- [x] Focus rings present on every interactive element.
-- [x] Links remain underlined.
-- [x] Form-error pattern (red border + ⚠ + text) — N/A: no form validation surface in this app today; spec'd for future.
-
-Implementation: see `/opt/sortof/docs/a11y-changes-2026-05-01.md` for the file-by-file diff summary.
diff --git a/docs/a11y-changes-2026-05-01.md b/docs/a11y-changes-2026-05-01.md
deleted file mode 100644
index 2f679b8..0000000
--- a/docs/a11y-changes-2026-05-01.md
+++ /dev/null
@@ -1,112 +0,0 @@
-# Frontend a11y refactor — changelog 2026-05-01
-
-Implemented per `/opt/sortof/docs/a11y-audit-2026-05-01.md`. No backend changes; no DB migrations; no spec changes. Frontend only.
-
-## Files touched
-
-- `/opt/sortof/frontend/index.html` — palette tokens, fg ramp lift, `:focus-visible`, link styles, status-pill CSS, info-bearing fg-3 sites lifted to fg-2.
-- `/opt/sortof/frontend/sortof-app.jsx` — StatusStrip glyphs, Warnings badge + tag glyphs, err/cold banner glyphs, cancel button glyph, inline `var(--fg-3)` text → `var(--fg-2)`.
-
-## Palette: before → after
-
-### Theme tokens
-
-| Token | Before | After | Reason |
-|---|---|---|---|
-| `--fg`   | oklch(0.95 0.008 240) | oklch(0.95 0.008 240) | unchanged (already AAA) |
-| `--fg-1` | oklch(0.78 0.008 240) | **oklch(0.85 0.008 240)** | secondary text headroom |
-| `--fg-2` | oklch(0.60 0.010 240) | **oklch(0.80 0.010 240)** | tertiary text — was borderline AA (5.0:1), now 7.7:1 vs `--bg-1` and ≥5.5:1 against every panel surface |
-| `--fg-3` | oklch(0.45 0.010 240) | **oklch(0.68 0.010 240)** | decoration only (`.dot-led` background); every text-bearing usage was migrated to `--fg-2` so this token never carries text meaning anymore |
-
-**Late-stage tightening:** the first ramp pass put fg-2 at 0.72 and fg-3 at 0.60. That cleared AA against `--bg-1` (0.21) only. On darker panel surfaces (`--bg-2` 0.245, `--bg-3` 0.28, `--bg-hi` 0.32), fg-3 still failed AA, and many sites used fg-3 inside those panels. Fixed by:
-1. Lifting fg-2 to 0.80 (passes AAA against bg-1; passes AA against bg-hi worst-case).
-2. Lifting fg-3 to 0.68 (decoration only — passes AA hedge).
-3. Sed-replacing every `color: var(--fg-3)` to `color: var(--fg-2)` across `index.html` (background uses preserved). Result: 1 remaining `--fg-3` reference (the `.dot-led { background }` rule).
-| `--acc-green` | oklch(0.78 0.13 195) (teal) | aliased to `--acc-success` |
-| `--acc-amber` | oklch(0.82 0.15 75)  | aliased to `--acc-warn` |
-| `--acc-red`   | oklch(0.68 0.18 30)  | aliased to `--acc-error` |
-| `--acc-blue`  | oklch(0.72 0.14 255) (deep) | aliased to `--acc-info` |
-| `--acc-success` | _new_ | **oklch(0.78 0.13 165)** Okabe-Ito bluish-green |
-| `--acc-warn`    | _new_ | **oklch(0.82 0.15 75)**  Okabe-Ito orange/yellow |
-| `--acc-error`   | _new_ | **oklch(0.70 0.18 35)**  Okabe-Ito vermillion |
-| `--acc-info`    | _new_ | **oklch(0.78 0.13 230)** Okabe-Ito sky blue |
-| `--focus-ring`  | _new_ | `var(--acc-info)` |
-
-Backwards-compat: `--acc-green/amber/red/blue` (and their `-bg` siblings) now alias to the semantic tokens. Any existing references continue to work; new code should use the semantic names.
-
-### Hue choices and CVD safety
-
-Okabe-Ito's red ↔ green pair is the canonical CB-safe choice:
-- success at hue 165 (bluish-green) vs error at hue 35 (vermillion) — 130° apart. Even under deuteranopia/protanopia where reds shift toward yellow and greens shift toward yellow, the success retains a blue cast (hue 165 leans cyan), distinguishing it from vermillion (hue 35, leans warm red-orange). Both at similar L (0.78 vs 0.70) for parity.
-- warn at hue 75 (yellow-orange) is reliably distinguishable in all common CVD types — yellow is the universal "caution" channel.
-- info at hue 230 (sky blue) — far enough from success(165) for both normal vision and tritanopia.
-
-### Per-section CSS edits
-
-| Selector | Before | After |
-|---|---|---|
-| `.tagline` | `color: var(--fg-3)` | `color: var(--fg-2)` |
-| `footer.app` | `color: var(--fg-3)` | `color: var(--fg-2)` |
-| `.label-meta` | `color: var(--fg-3)` | `color: var(--fg-2)` |
-| `.branch-name` | `color: var(--fg-3)` | `color: var(--fg-2)` |
-| `.branch-deps` | `color: var(--fg-3)` | `color: var(--fg-2)` |
-| `.branch-pos` | `color: var(--fg-3)` | `color: var(--fg-2)` |
-| `.status-pill.idle` | `color: var(--fg-3)` | `color: var(--fg-2)` |
-| `.status-pill.nonmod` | `color: var(--fg-3)` | `color: var(--fg-2)` |
-| `a` | `color: fg-1; border-bottom: 1px dotted` | `color: var(--acc-info); text-decoration: underline; text-decoration-thickness: 1px; text-underline-offset: 2px` |
-| `a:hover` | `color: fg; border-color: fg-2` | `color: fg; text-decoration-thickness: 2px` |
-| `:focus-visible` | _absent_ | `outline: 2px solid var(--focus-ring); outline-offset: 2px` |
-| `::selection` | bluish (--acc-blue/0.35 hex) | bluish (--acc-info/0.35) |
-| `.status-glyph` | _new class_ | min-width 12px, font-weight 600, line-height 1 |
-| `.status-pill.<state>` rules | colored .dot-led only | recolor `.status-glyph` AND `.dot-led`; old `.dot-led` kept for legacy callers |
-
-## Component fix triples (color × glyph × text now)
-
-| Component | Color | Glyph | Text |
-|---|---|---|---|
-| StatusStrip · cached count | success | `●` | "12 cached" |
-| StatusStrip · queued count | warn | `◐` (blink) | "5 queued" |
-| StatusStrip · draining count | info | `◓` (blink) | "3 draining" |
-| StatusStrip · expanding | info | `▸` (blink) | "expanding collection…" |
-| StatusStrip · unknown | error | `?` | "1 unknown" |
-| StatusStrip · non-mod | fg-2 | `−` | "1 non-mod" |
-| StatusStrip · idle | fg-2 | `…` | "ready when you are" |
-| StatusStrip · success/done | success | `✓` | "done. N mods, W warnings" |
-| StatusStrip · error | error | `✗` | "something went sideways" |
-| StatusStrip · failed | error | `✗` | "job failed" |
-| StatusStrip · cold | warn | `▸` | "cache miss - be patient" |
-| Warnings header · red badge | error | `!` | "{N}" |
-| Warnings header · amber badge | warn | `⚠` | "{N}" |
-| Warning row · w-tag | error/warn | `!` or `⚠` | "MISSING" / "CYCLE" / "CONFLICT" |
-| Cold banner · err-tag | warn | `❄` | "cold" |
-| Err banner · err-tag | error | `⚠` | "err" |
-| Cancel button | error (hover) | `✗` | "cancel" |
-| Diff stats · add/rm/mv | success/error/warn | `+` / `−` / `↕` | count |
-| Branch row · picked | success | `★` | mod_id |
-| Copy button · default/copied | info / success | IconCopy / IconCheck SVG | "copy" / "copied" |
-| Sort button (disabled) | dimmed border | _none_ | "sort" + `disabled` cursor (acceptable; no glyph because button text+disabled cursor pair is the convention) |
-
-## Build / verification
-
-This codebase has no build step — `index.html` loads `sortof-app.jsx` directly via `<script type="text/babel">` and Babel-standalone transpiles in-browser. No npm, no Vite, no bundler. Verification approach:
-
-- `curl http://100.114.205.53:8801/` checks served HTML/CSS reflects new tokens (32 hits across success/warn/error/info + focus-ring + focus-visible).
-- `curl http://100.114.205.53:8801/sortof-app.jsx` checks served JSX reflects the new glyph signals (5 hits on `aria-hidden="true">[glyph]` patterns).
-- Public mirror (Caddy + Tailscale) sees the same content.
-
-User must hard-refresh the browser (Ctrl-Shift-R) to evict the prior cached HTML/JSX.
-
-No backend services were touched.
-
-## Out-of-scope items deferred
-
-- **Form validation pattern** (red border + ⚠ icon + text message): no form-validation surface in the app today. Spec'd in the audit doc; will land alongside any future form (e.g., admin-curated precacher list, settings panel).
-- **Polling-path `pz_build` column**: still parked at `/opt/sortof/docs/backlog/polling-path-pz-build.md`. Unrelated to a11y.
-- **Tweaks panel** (`tweaks-panel.jsx`): dev-only, gated behind `?tweaks=1`. Skipped this pass — not user-facing.
-
-## Backups
-
-- `/opt/sortof/frontend/index.html.bak-20260502-...-a11y-full`
-- `/opt/sortof/frontend/sortof-app.jsx.bak-20260502-...-a11y-full`
-
-Plus prior `.bak-...-a11y` and `.bak-...-emdash` siblings still in place. Working tree is dirty per directive — no commits, no auto-cleanup.
diff --git a/docs/brand-changes-2026-05-01.md b/docs/brand-changes-2026-05-01.md
deleted file mode 100644
index f925ae2..0000000
--- a/docs/brand-changes-2026-05-01.md
+++ /dev/null
@@ -1,122 +0,0 @@
-# Indifferent Broccoli brand application — changelog 2026-05-01
-
-Frontend-only. No backend edits. No DB migrations. No spec changes. No git commits — working tree dirty for review.
-
-Layered on top of the in-flight a11y refactor (`/opt/sortof/docs/a11y-audit-2026-05-01.md` + `/opt/sortof/docs/a11y-changes-2026-05-01.md`). Where brand and a11y collide, a11y won — see "Deferred to a11y" below.
-
-## Files touched
-
-- `/opt/sortof/frontend/index.html` — brand tokens, font-link expansion, favicon, panel shadow, sort-btn rebrand, wordmark/header CSS, footer mark CSS
-- `/opt/sortof/frontend/sortof-app.jsx` — Header swap (broccoli image + IB link), Footer rewrite ((:|) glyph + IB link), voice copy on EmptyRight + StatusStrip terminal text
-- `/opt/sortof/frontend/img/broccoli_shadow_square.png` — **new file**, 19075 bytes, fetched from `https://indifferentbroccoli.com/img/broccoli_shadow_square.png`
-
-## Brand tokens added (CSS vars)
-
-```css
---brand-primary:    #5EFF0D;                          /* IB anchor green */
---brand-primary-rgb: 94 255 13;
---brand-primary-bg: rgb(var(--brand-primary-rgb) / 0.14);
---brand-anchor-bg:  #0A141E;                          /* IB navy */
---brand-shadow-card: 0 4px 12px rgba(0, 0, 0, 0.3);   /* IB card lift */
---display: 'Sora', 'Geist', ui-sans-serif, system-ui, ...;
---sans:    'Open Sans', 'Geist', ui-sans-serif, system-ui, ...;
---radius-sm: 4px;       /* IB rounded */
---radius:    8px;       /* IB rounded-lg (was already this value) */
---radius-lg: 12px;      /* IB rounded-xl */
-```
-
-Existing `--mono` (JetBrains Mono) preserved — IB doesn't define a monospace font. Status colors (`--acc-success/warn/error/info`) and foreground ramp (`--fg/-1/-2/-3`) untouched per a11y deference.
-
-## File-by-file
-
-### `/opt/sortof/frontend/index.html`
-
-| Where | Before | After |
-|---|---|---|
-| `<title>` | "sortof - sorted. sort of." | **"sortof (:|) sorted. or close enough."** |
-| `<head>` | _no favicon_ | `<link rel="icon" type="image/png" href="/img/broccoli_shadow_square.png">` + apple-touch-icon |
-| Font link | Geist + JetBrains Mono | **+ Sora 400/500/600/700 + Open Sans 400/500/600/700**, all in one `<link>` |
-| `:root` vars | a11y palette only | + `--brand-primary`, `--brand-primary-bg`, `--brand-anchor-bg`, `--brand-shadow-card`, `--radius-sm/lg`, `--display` |
-| `--sans` | `'Geist', ui-sans-serif, ...` | `'Open Sans', 'Geist', ui-sans-serif, ...` |
-| `.wordmark` | `font-family: var(--mono); font-size: 17px; weight 600` | `font-family: var(--display); font-size: 19px; weight 700` |
-| `.wordmark .dot` | `color: var(--acc-green)` | `color: var(--brand-primary)` |
-| `.brand-mark` | _did not exist_ | 28×28 circle, lifts on hover |
-| `.brand-mark-link` | _did not exist_ | wrapper anchor with rotation hover |
-| `.ib-mark` | _did not exist_ | small mono `(:|)` glyph in IB green |
-| `.sort-btn` | `--acc-green` border/bg/text, mono font | `--brand-primary` border/bg/text, **Sora display font, height 42px (was 40)** |
-| `.sort-btn:hover` | tinted green | **fills with brand-primary, inverts text to anchor-bg, applies card shadow** |
-| `.panel` | flat | `box-shadow: var(--brand-shadow-card)` |
-
-### `/opt/sortof/frontend/sortof-app.jsx`
-
-| Component | Before | After |
-|---|---|---|
-| `<Header>` | wordmark + tagline only | `<a href=ib.com><img broccoli/></a>` + wordmark + tagline |
-| `<Footer>` | "a thing by [indifferent broccoli]" no link | `<a href=ib.com>indifferent broccoli (:|)</a>` (real link, IB green glyph) |
-| `<EmptyRight variant="bare">` | "paste workshop ids on the left, then hit sort." | **"no mods. or maybe loads of them. hard to tell."** + sub-line "paste workshop ids on the left, hit sort. output lands here." |
-| StatusStrip · idle | "ready when you are" | **"ready when you are. or not."** |
-| StatusStrip · success/done | "done. N mods, W warnings" | **"sorted. N mods, W warnings. or close enough."** |
-| StatusStrip · error | "something went sideways" | **"something went sideways. that happens."** |
-| StatusStrip · failed | "job failed" | **"that didn't work. try again or don't."** |
-| StatusStrip · cold | "cache miss - be patient" | **"cache miss. take your time, no rush."** |
-
-Functional info preserved verbatim in every changed string (counts, role labels, action prompts). Voice flavor is additive.
-
-## Deferred to a11y (brand wanted this; a11y said no)
-
-Per the brief: _"If brand application would override an a11y decision, defer to a11y."_
-
-| Brand wanted | A11y holds | Resolution |
-|---|---|---|
-| Brand green (#5EFF0D, hue 138) as the success-state color | `--acc-success` at hue 165 (Okabe-Ito bluish-green) is more deuteranopia-safe; the hue-138 green clusters too close to amber under simulated CVD | Brand green stays as `--brand-primary` (CTA only). Status pills, copy-btn-success, branch-picker-picked, diff-stat-add all keep `--acc-success`. |
-| IB blue (#0050FF) for links | `--acc-info` (oklch 0.78 0.13 230) clears AAA against dark bg; #0050FF would be 3.0:1 (AA fail) | Documented IB blue for completeness; not adopted. Links continue to use `--acc-info`. |
-| Brand-only focus ring (green) | Global `:focus-visible` uses `--focus-ring = var(--acc-info)` for consistent keyboard signal across all interactive elements | Kept the a11y blue focus ring. Brand green appears as button fill/border, not as focus indicator. |
-| Glyph removal in favor of pure brand-color states | A11y requires every state pill to carry (color × glyph × text) | Glyphs preserved. Brand only changed the *anchor* color (sort-btn, wordmark dot, sort-btn:hover invert), never the *state* signal layer. |
-
-## Voice contract (locked)
-
-All voice flavor is **additive** — never strips functional information. The pattern from IB's hero ("Host your own game server / Or not... we don't care") is: bold functional claim, then immediate self-undercut.
-
-Applied as: `<existing functional text>. <reverse-pleasantness flourish>`
-
-| Site | Functional info preserved | Flourish appended |
-|---|---|---|
-| idle pill | (none — placeholder) | "or not." |
-| done pill | "sorted. N mods, W warnings" | "or close enough." |
-| error pill | "something went sideways" | "that happens." |
-| failed pill | (replaced) | "that didn't work. try again or don't." |
-| cold pill | "cache miss" | "take your time, no rush." |
-| empty-bare big | (replaced) | "no mods. or maybe loads of them. hard to tell." |
-
-The `<title>` follows the same pattern with the `(:|)` glyph as separator.
-
-## Verification
-
-This codebase has no build step (Babel-standalone transpiles JSX in-browser). Verification is via curl + visual inspection.
-
-**Served file checks:**
-- 22 hits for brand token names (`brand-primary`, `brand-anchor`, `brand-shadow`, `brand-mark`, `Sora`, `Open+Sans`) in served HTML
-- 4 hits for new voice copy (`or close enough`, `or not.`, `try again or don.t`, `hard to tell`) in served JSX
-- 2 hits for header brand markup (`broccoli_shadow_square.png`, `className="ib-mark"`)
-- Public mirror serves `/img/broccoli_shadow_square.png` HTTP 200
-- Public mirror `<title>` reads `sortof (:|) sorted. or close enough.`
-
-**Contrast verification (computed via oklch L deltas; AA = ΔL ≥0.42; AAA = ΔL ≥0.55):**
-
-| Pair | ΔL | Approx ratio | WCAG |
-|---|---|---|---|
-| `--brand-primary` (L 0.88) vs `--bg-1` (L 0.21) | 0.67 | ~10:1 | **AAA** |
-| `--brand-primary` vs `--brand-anchor-bg` (L 0.20) — sort-btn:hover inverted | 0.68 | ~11:1 | **AAA** |
-| `--acc-info` (L 0.78) vs `--bg-1` — link/button text | 0.57 | ~7.3:1 | **AAA** |
-| `--fg` (L 0.95) vs `--bg-1` — display headings, body | 0.74 | ~14:1 | **AAA** |
-| `--fg-2` (L 0.72) vs `--bg-1` — secondary text (lifted in a11y pass) | 0.51 | ~5.7:1 | **AA** |
-
-No brand color required luminance adjustment. The IB blue (`#0050FF`) was the only candidate that would have failed; it was rejected in palette reconciliation rather than lifted.
-
-## Backups (working-tree dirty)
-
-- `/opt/sortof/frontend/index.html.bak-...-brand`
-- `/opt/sortof/frontend/sortof-app.jsx.bak-...-brand`
-- Plus a11y siblings (`-a11y-full`, `-a11y`) and earlier session backups.
-
-User must hard-refresh the browser to evict the prior cached HTML/JSX/CSS.
diff --git a/docs/brand-tokens-2026-05-01.md b/docs/brand-tokens-2026-05-01.md
deleted file mode 100644
index 991dc22..0000000
--- a/docs/brand-tokens-2026-05-01.md
+++ /dev/null
@@ -1,145 +0,0 @@
-# Indifferent Broccoli brand tokens — extracted 2026-05-01
-
-Source pages fetched live via `curl`:
-- HTML: `https://indifferentbroccoli.com/` (100,017 bytes)
-- CSS:  `https://indifferentbroccoli.com/css/output.css` (62,243 bytes — Tailwind-compiled)
-
-The site does not publish authored CSS variables for brand colors (it's Tailwind output with a few brand hex literals overlaid). The tokens below are reverse-engineered from the compiled stylesheet by frequency and semantic role.
-
-## 1. Colors (raw values from `output.css`)
-
-| Token | Hex | oklch (approx) | Usage in IB CSS | Lines |
-|---|---|---|---|---|
-| **brand primary green** | `#5EFF0D` | oklch(0.88 0.27 138) | `.stroke-primary { stroke: #5EFF0D }`, `.decoration-primary { text-decoration-color: #5EFF0D }`, file-selector-button border | output.css:1674, 2090, 2233-2234, 2730 |
-| brand secondary blue | `#0050FF` | oklch(0.43 0.27 264) | text/link color appearances | 4 occurrences |
-| dark surface | `#0A141E` | oklch(0.20 0.025 240) | navy panel background | 1 occurrence |
-| accent pink | `#c0a0b9` | oklch(0.74 0.05 340) | one section bg | 1 occurrence |
-| white | `#fff` | — | text on dark, panels on light | 6 occurrences |
-| neutral text | `#6b7280` (tw-gray-500) | — | muted body text | 4 occurrences |
-| neutral muted | `#9ca3af` (tw-gray-400) | — | further-muted | 2 occurrences |
-
-## 2. Fonts
-
-`<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Sora|Sora:600">`
-`<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Open+Sans|Open+Sans:600">`
-
-| Role | Family | Weights | Source |
-|---|---|---|---|
-| heading / display | **Sora** | 400, 600 | Google Fonts (CDN) |
-| body / paragraph | **Open Sans** | 400, 600 | Google Fonts (CDN) |
-| icons | Font Awesome | — | `/vendor/font-awesome/css/font-awesome.min.css` (out of scope for sortof) |
-
-The site does not self-host these via @fontsource. We will hot-link the same Google Fonts URLs as IB to inherit identically. Mono font is unspecified by IB; sortof keeps its existing **JetBrains Mono** for code/output blocks (no brand conflict).
-
-## 3. Border radii (compiled Tailwind)
-
-| Value | Frequency | Likely role |
-|---|---|---|
-| `0.25rem` (4px) | 2 | small corners (rounded) |
-| `0.5rem` (8px) | 1 | medium (rounded-lg) |
-| `0.75rem` (12px) | 1 | larger (rounded-xl) |
-| `9999px` | 1 | pill / chip |
-| `100%` | 1 | circle (logo container) |
-| `0` / `0px` | 3 | flat sections |
-
-## 4. Shadows
-
-```css
-box-shadow: 0 4px 12px rgba(0, 0, 0, 0.3);          /* card lift */
-box-shadow: 0 0 0 3px rgba(34, 197, 94, 0.1);       /* focus ring (green-tinted) */
-```
-
-## 5. Brand assets
-
-| Asset | URL | Local copy |
-|---|---|---|
-| primary mark | `https://indifferentbroccoli.com/img/broccoli_shadow_square.png` | `/opt/sortof/frontend/img/broccoli_shadow_square.png` (866×866 PNG, 19,075 bytes) |
-| smiley wordmark | `(:|)` (text glyph) — appears in `<title>` ("Indifferent Broccoli (:|)") and footer-class flourish |
-
-Pulled the broccoli image locally so we don't hot-link IB's CDN. Same file used for both header brand mark and favicon.
-
-## 6. Voice cues (verbatim from page)
-
-The deadpan house style — additive, not replacement, when applied to sortof:
-
-- **Hero**: "Host your own game server / Or not... we don't care"
-- **Sub-hero**: "Premium game servers with instant deployment, full mod support, and a control panel so simple your cat could use it."
-- **Trim**: "Or not."
-- **Title** (browser tab): "Indifferent Broccoli (:|)"
-
-Keying off these, the IB voice contract is: bold functional claim, then immediate self-undercut. Reverse-pleasantness. No exclamation points. Lowercase or sentence-case (no shouting).
-
-## 7. Header layout (extracted)
-
-```
-[broccoli_shadow_square.png] [indifferent broccoli wordmark]
-                             [Games | Top Servers | About Us | Contact | Wiki | Merch | Open Source]
-                                                                  [Start New Server +] [Log in]
-```
-
-For sortof, the structural mapping:
-
-```
-[broccoli_shadow_square.png] [sortof] [tagline]                   [github] [docs]
-```
-
-Footer references stay (REfRigERatoR's mod load order sorter / "a thing by indifferent broccoli") but get the `(:|)` glyph as a small inline mark next to "indifferent broccoli", linking to `https://indifferentbroccoli.com`.
-
-## 8. Final palette decision (reconciliation with a11y)
-
-Per brief: **IB primary green is the brand anchor; status colors defer to the a11y pass.**
-
-| Role | Token | Value | Source |
-|---|---|---|---|
-| Brand primary (sortof = an IB thing) | `--brand-primary` | `#5EFF0D` | IB literal |
-| Brand surface (alt anchor) | `--brand-anchor-bg` | `#0A141E` | IB literal |
-| Status: success | `--acc-success` | oklch(0.78 0.13 165) | a11y (Okabe-Ito bluish-green). Unchanged. |
-| Status: warning | `--acc-warn` | oklch(0.82 0.15 75) | a11y (Okabe-Ito orange-yellow). Unchanged. |
-| Status: error | `--acc-error` | oklch(0.70 0.18 35) | a11y (Okabe-Ito vermillion). Unchanged. |
-| Status: info / link | `--acc-info` | oklch(0.78 0.13 230) | a11y (Okabe-Ito sky blue). Unchanged. |
-| Foreground ramp | `--fg`, `--fg-1`, `--fg-2`, `--fg-3` | a11y values | Unchanged. |
-| Backgrounds | `--bg`, `--bg-1`, `--bg-2`, `--bg-3` | a11y values | Unchanged. |
-
-### Why brand green doesn't replace `--acc-success`
-
-The IB green `#5EFF0D` is **highly saturated** (oklch chroma 0.27) and reads as "this is a CTA / this is the IB look." Using it as the success-state color would:
-- Conflict with the a11y reasoning: success at hue 138 (yellow-green) sits closer to Okabe-Ito's *yellow* than its *bluish-green*. Less safe under deuteranopia.
-- Conflict with the spec semantics: in the a11y system, brand-anchor color and status-success color have different jobs. Swapping them would re-collapse what the a11y pass deliberately separated.
-
-So the brand green lives at `--brand-primary` and is used for:
-- Sort button (the primary CTA on the page)
-- Wordmark dot accent
-- Header brand mark hover/focus emphasis
-- Build-toggle "active" state
-
-Status pills, banners, warnings, copy-button-success, etc. continue to use the a11y `--acc-*` tokens.
-
-### Contrast verification for `--brand-primary` (`#5EFF0D`)
-
-Against the dark canvas backgrounds:
-
-| Pair | ΔL (oklch) | Approx ratio | WCAG |
-|---|---|---|---|
-| `#5EFF0D` (L=0.88) vs `--bg` (L=0.18) | 0.70 | ~12.5:1 | AAA |
-| `#5EFF0D` (L=0.88) vs `--bg-1` (L=0.21) | 0.67 | ~10:1 | AAA |
-| `#5EFF0D` (L=0.88) vs `--bg-3` (L=0.28) | 0.60 | ~7.5:1 | AAA |
-
-Brand green clears AAA against every background token. No luminance adjustment needed.
-
-### IB blue `#0050FF` — not used
-
-`#0050FF` ≈ oklch(0.43 0.27 264) → fails AA against any of our dark backgrounds (~3.0:1). The a11y pass already established `--acc-info` (oklch 0.78 0.13 230) as the link / info color and that token clears AAA. We document IB's blue here for completeness but do not put it in the live palette.
-
-## 9. Tokens mapped to CSS vars (added in this round)
-
-```css
---brand-primary: #5EFF0D;            /* IB anchor green */
---brand-primary-rgb: 94 255 13;       /* for rgba() composition */
---brand-anchor-bg: #0A141E;           /* IB navy, available as deep panel surface */
---brand-radius: 0.5rem;               /* IB medium radius */
---brand-radius-sm: 0.25rem;           /* IB small radius */
---brand-shadow-card: 0 4px 12px rgba(0, 0, 0, 0.3);   /* IB card lift */
---brand-mark: url('/img/broccoli_shadow_square.png'); /* logo asset */
---brand-font-display: 'Sora', 'Geist', ui-sans-serif, system-ui, sans-serif;
---brand-font-body:    'Open Sans', 'Geist', ui-sans-serif, system-ui, sans-serif;
-```
diff --git a/docs/plans/2026-04-30-multi-branch-picker.md b/docs/plans/2026-04-30-multi-branch-picker.md
deleted file mode 100644
index 3fd7d5d..0000000
--- a/docs/plans/2026-04-30-multi-branch-picker.md
+++ /dev/null
@@ -1,1125 +0,0 @@
-# Multi-Branch Picker Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Stop emitting all branches of a multi-mod Workshop item (e.g. AuthenticZ) into `Mods=`, which silently bricks PZ servers. Add a per-wsid picker UI plus a `/api/resort` endpoint that recomputes load order and warnings against the user's selection.
-
-**Architecture:** Spec at `/opt/sortof/docs/specs/2026-04-30-multi-branch-picker.md` (v2, 155 lines, all decisions locked in §10). Backend grows one new POST endpoint and one new WARNINGS tag. Frontend adds picker state, localStorage persistence, a `BranchPicker` sub-component, and resort fetch with sequence-number race protection. No schema migration. No new venv.
-
-**Tech Stack:** FastAPI + asyncpg + Pydantic on the backend; React 18 + Babel-standalone (in-browser JSX, no build) on the frontend; CSS in `index.html`. Persistence via `localStorage` only.
-
----
-
-## File structure
-
-| Path | Action | Responsibility |
-|---|---|---|
-| `/opt/sortof/api/app.py` | Modify | Add `ResortRequest` model + `POST /api/resort` route. No other change. |
-| `/opt/sortof/api/adapters.py` | Modify | Add `_compute_ambiguous_warnings()`. Inject result into `build_response`. |
-| `/opt/sortof/frontend/sortof-app.jsx` | Modify | Add `COLUMN_COUNT`, `branchSelections` state + hydration + storage listener, `BranchPicker` component, refactor `ModTable` to group multi-branch wsids, `resort()` with sequence number, 5xx handling. |
-| `/opt/sortof/frontend/index.html` | Modify | CSS for `.branch-affordance`, `.branch-panel`, `.branch-row`. |
-
-No new files. The two `mlos_sort.py` copies are unchanged - dangling-deps detection already exists in `mlos_sort.sort_mods`.
-
-**Verification fixtures (already cached, no /api/sort cold-start required):**
-- 3-mod canonical (single-mod wsids, regression baseline): `2169435993;2392709985;2487022075` → `MODS_LINE="modoptions;tsarslib;TMC_TrueActions"`.
-- AuthenticZ multi-branch (3 mod_ids on one wsid, all `incompatible_mods=[]`): wsid `2335368829` → mod_ids `Authentic Z - Current`, `AuthenticZBackpacks+`, `AuthenticZLite`.
-
----
-
-## Task 1: Backend - `POST /api/resort` endpoint
-
-**Files:**
-- Modify: `/opt/sortof/api/app.py` (add Pydantic model + route)
-
-- [ ] **Step 1: Backup app.py**
-
-```bash
-cp /opt/sortof/api/app.py /opt/sortof/api/app.py.bak-$(date +%Y%m%d-%H%M)
-```
-
-- [ ] **Step 2: Add `ResortRequest` Pydantic model**
-
-Find the existing `class SortRequest(BaseModel):` block (around line 76). Replace it with both models:
-
-```python
-class SortRequest(BaseModel):
-    input: str = Field(default="")
-    rules: Optional[str] = Field(default=None)
-
-
-class ResortRequest(BaseModel):
-    selected_mod_ids: List[str] = Field(default_factory=list)
-```
-
-- [ ] **Step 3: Add `/api/resort` route**
-
-Find the line right after the existing `sort_endpoint` function returns (the line `return payload` near the bottom of the function - currently line ~236). The static-files mount block follows. Insert the new route **between** them:
-
-```python
-@app.post("/api/resort")
-async def resort_endpoint(req: ResortRequest, request: Request) -> Dict[str, Any]:
-    """Re-run mlos_sort against a user-supplied subset of mod_ids.
-
-    Stateless. No Steam round-trip. Filters mod_parsed by the requested
-    mod_ids, runs sort_mods, returns the same shape as /api/sort.
-    """
-    t0 = time.monotonic()
-    ids = list(req.selected_mod_ids or [])
-
-    if not ids:
-        raise HTTPException(status_code=400, detail="selected_mod_ids must be non-empty")
-    if len(ids) > MAX_IDS:
-        raise HTTPException(status_code=413, detail=f"too many mod_ids ({len(ids)} > {MAX_IDS})")
-    for mod_id in ids:
-        if not isinstance(mod_id, str) or not (1 <= len(mod_id) <= 256):
-            raise HTTPException(status_code=400, detail="invalid mod_id")
-
-    pool = request.app.state.db
-    async with pool.acquire() as conn:
-        rows = await conn.fetch(
-            """
-            SELECT mp.workshop_id, mp.mod_id, mp.name, mp.category,
-                   mp.requirements, mp.load_after, mp.load_before,
-                   mp.incompatible_mods, mp.load_first, mp.load_last,
-                   mp.tags, mp.maps
-            FROM mod_parsed mp
-            JOIN workshop_meta wm ON wm.workshop_id = mp.workshop_id
-            WHERE mp.mod_id = ANY($1::text[])
-              AND mp.parsed_at_time_updated = wm.time_updated
-            ORDER BY mp.workshop_id, mp.mod_id
-            """,
-            ids,
-        )
-
-    found_ids = {r["mod_id"] for r in rows}
-    missing = [mid for mid in ids if mid not in found_ids]
-    if missing:
-        log.info("resort dropped unknown mod_ids count=%d sample=%s",
-                 len(missing), missing[:3])
-    if not rows:
-        raise HTTPException(status_code=400, detail="no known mod_ids in selection")
-
-    mods: List[ModInfo] = [
-        ModInfo(
-            id=r["mod_id"],
-            name=r["name"] or r["mod_id"],
-            workshop_id=r["workshop_id"],
-            category=r["category"] or "undefined",
-            requirements=list(r["requirements"] or []),
-            loadAfter=list(r["load_after"] or []),
-            loadBefore=list(r["load_before"] or []),
-            incompatibleMods=list(r["incompatible_mods"] or []),
-            loadFirst=r["load_first"] or "off",
-            loadLast=r["load_last"] or "off",
-            tags=list(r["tags"] or []),
-            maps=list(r["maps"] or []),
-        )
-        for r in rows
-    ]
-    sort_result = sort_mods(mods, {})
-    payload = adapters.build_response(
-        input_ids=[],
-        hit_ids=ids,
-        mods=mods,
-        sort_result=sort_result,
-        status="success",
-    )
-    payload["pending"] = []
-
-    elapsed_ms = int((time.monotonic() - t0) * 1000)
-    log.info("resort done count=%d ms=%d", len(rows), elapsed_ms)
-    return payload
-```
-
-- [ ] **Step 4: py_compile + smoke import**
-
-```bash
-/opt/sortof/api/.venv/bin/python -m py_compile /opt/sortof/api/app.py && echo PY_OK
-cd /opt/sortof/api && .venv/bin/python -c "import app" && echo IMPORT_OK
-```
-
-Expected: both lines print `PY_OK` and `IMPORT_OK` respectively. If either fails, fix the syntax/import before restarting.
-
-- [ ] **Step 5: Restart API**
-
-```bash
-sudo systemctl restart sortof-api && sleep 2 && sudo systemctl is-active sortof-api
-```
-
-Expected: `active`.
-
-- [ ] **Step 6: Verify happy path**
-
-```bash
-curl -sS -X POST http://100.114.205.53:8801/api/resort \
-  -H 'Content-Type: application/json' \
-  -d '{"selected_mod_ids":["modoptions","tsarslib","TMC_TrueActions"]}' \
-  | jq '{status, MODS_LINE, mod_db_count: (.MOD_DB|length), pending}'
-```
-
-Expected:
-```json
-{"status":"success","MODS_LINE":"modoptions;tsarslib;TMC_TrueActions","mod_db_count":3,"pending":[]}
-```
-
-- [ ] **Step 7: Verify validation 400s**
-
-```bash
-# Empty selection → 400
-curl -sS -o /dev/null -w 'empty=%{http_code}\n' -X POST http://100.114.205.53:8801/api/resort \
-  -H 'Content-Type: application/json' -d '{"selected_mod_ids":[]}'
-
-# All-unknown selection → 400
-curl -sS -o /dev/null -w 'unknown=%{http_code}\n' -X POST http://100.114.205.53:8801/api/resort \
-  -H 'Content-Type: application/json' -d '{"selected_mod_ids":["ghostA","ghostB"]}'
-
-# Mixed (one valid + one unknown) → 200, ghost dropped
-curl -sS -X POST http://100.114.205.53:8801/api/resort \
-  -H 'Content-Type: application/json' -d '{"selected_mod_ids":["modoptions","ghostMod"]}' \
-  | jq '{status, mod_db_count: (.MOD_DB|length)}'
-```
-
-Expected:
-```
-empty=400
-unknown=400
-{"status":"success","mod_db_count":1}
-```
-
-- [ ] **Step 8: Checkpoint** - task complete; backup file remains as rollback.
-
----
-
-## Task 2: Backend - `ambiguous-multi-branch` warning
-
-**Files:**
-- Modify: `/opt/sortof/api/adapters.py`
-
-- [ ] **Step 1: Backup adapters.py**
-
-```bash
-cp /opt/sortof/api/adapters.py /opt/sortof/api/adapters.py.bak-$(date +%Y%m%d-%H%M)
-```
-
-- [ ] **Step 2: Add helper for ambiguous-multi-branch detection**
-
-Open `/opt/sortof/api/adapters.py`. Just below the existing `build_warnings()` function (around line 56), insert:
-
-```python
-def _compute_ambiguous_warnings(mods: List[ModInfo]) -> List[Dict[str, str]]:
-    """Emit one amber WARNINGS entry per wsid that has >=2 selected mod_ids,
-    none of them flagging others in `incompatibleMods`. The user is at risk
-    of shipping conflicting alternates (e.g. AuthenticZ Lite + Current);
-    show this even when they don't expand the picker.
-
-    Spec: 2026-04-30-multi-branch-picker.md §4 "default-selection safety net"
-    (review #1 fix).
-    """
-    by_wsid: Dict[str, List[ModInfo]] = {}
-    for m in mods:
-        wsid = m.workshop_id or ""
-        if not wsid:
-            continue
-        by_wsid.setdefault(wsid, []).append(m)
-
-    out: List[Dict[str, str]] = []
-    for wsid, group in by_wsid.items():
-        if len(group) < 2:
-            continue
-        ids_in_group = {m.id for m in group}
-        any_flags_sibling = any(
-            any(other in ids_in_group for other in m.incompatibleMods)
-            for m in group
-        )
-        if any_flags_sibling:
-            continue  # author marked alternates; picker will run in radio mode
-        title = group[0].name or wsid
-        out.append({
-            "tag": "ambiguous-multi-branch",
-            "level": "amber",
-            "msg": (
-                f"{len(group)} branches selected from {title} ({wsid}) - "
-                f"author didn't declare alternates; verify these aren't "
-                f"mutually exclusive (e.g., AuthenticZ Lite vs Current). "
-                f"Expand the row to pick one."
-            ),
-        })
-    return out
-```
-
-- [ ] **Step 3: Wire helper into `build_response`**
-
-Find the existing `return { ... }` at the bottom of `build_response()` (around line 103-112). Replace the `"WARNINGS": build_warnings(...)` line with:
-
-```python
-        "WARNINGS": (
-            build_warnings(sort_result.get("warnings", {}) or {})
-            + _compute_ambiguous_warnings(mods)
-        ),
-```
-
-- [ ] **Step 4: py_compile + smoke import**
-
-```bash
-/opt/sortof/api/.venv/bin/python -m py_compile /opt/sortof/api/adapters.py && echo PY_OK
-cd /opt/sortof/api && .venv/bin/python -c "import app" && echo IMPORT_OK
-```
-
-- [ ] **Step 5: Restart API**
-
-```bash
-sudo systemctl restart sortof-api && sleep 2 && sudo systemctl is-active sortof-api
-```
-
-- [ ] **Step 6: Verify warning fires for AuthenticZ**
-
-```bash
-curl -sS -X POST http://100.114.205.53:8801/api/sort \
-  -H 'Content-Type: application/json' \
-  -d '{"input":"2335368829"}' \
-  | jq '.WARNINGS[] | select(.tag == "ambiguous-multi-branch")'
-```
-
-Expected: one object with `tag:"ambiguous-multi-branch"`, `level:"amber"`, and a `msg` mentioning "3 branches" and `2335368829`.
-
-- [ ] **Step 7: Verify warning DOES NOT fire for the canonical 3-mod input**
-
-```bash
-curl -sS -X POST http://100.114.205.53:8801/api/sort \
-  -H 'Content-Type: application/json' \
-  -d '{"input":"2169435993;2392709985;2487022075"}' \
-  | jq '[.WARNINGS[] | select(.tag == "ambiguous-multi-branch")] | length'
-```
-
-Expected: `0` (each wsid has only 1 mod row → no ambiguity).
-
-- [ ] **Step 8: Verify warning DOES NOT fire when subset is selected via /api/resort**
-
-```bash
-curl -sS -X POST http://100.114.205.53:8801/api/resort \
-  -H 'Content-Type: application/json' \
-  -d '{"selected_mod_ids":["Authentic Z - Current"]}' \
-  | jq '[.WARNINGS[] | select(.tag == "ambiguous-multi-branch")] | length'
-```
-
-Expected: `0` (one mod from the wsid, not a multi-branch ambiguity).
-
----
-
-## Task 3: Frontend - `COLUMN_COUNT` + `branchSelections` state + hydration + storage listener
-
-**Files:**
-- Modify: `/opt/sortof/frontend/sortof-app.jsx`
-
-- [ ] **Step 1: Backup**
-
-```bash
-cp /opt/sortof/frontend/sortof-app.jsx /opt/sortof/frontend/sortof-app.jsx.bak-$(date +%Y%m%d-%H%M)
-```
-
-- [ ] **Step 2: Add `COLUMN_COUNT` constant**
-
-Find the helper functions near the top of the file (after `buildModsLine`, around line 35). Add:
-
-```jsx
-// Shared column count for the Mod Details table. Keep in sync with the
-// <thead> in ModTable; expansion-panel <tr colSpan> reads this constant.
-// Spec C will add a 7th column; bump here, do not hardcode the integer.
-const COLUMN_COUNT = 6;
-```
-
-- [ ] **Step 3: Add `branchSelections` App-level state with localStorage hydration**
-
-Find the App function's state declarations (around line 456). Below the existing `pzBuild` block, add:
-
-```jsx
-const [branchSelections, setBranchSelections] = useState(() => {
-  try {
-    const raw = localStorage.getItem('sortof.branch.selections');
-    if (!raw) return {};
-    const parsed = JSON.parse(raw);
-    return (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) ? parsed : {};
-  } catch { return {}; }
-});
-const [resortSeq, setResortSeq] = useState(0);  // monotonic; for stale-response drop
-```
-
-- [ ] **Step 4: Add useEffect for persist + cross-tab `storage` listener**
-
-Below the `pzBuild` localStorage useEffect (around line 467), add:
-
-```jsx
-useEffect(() => {
-  try {
-    localStorage.setItem('sortof.branch.selections', JSON.stringify(branchSelections));
-  } catch {}
-}, [branchSelections]);
-
-useEffect(() => {
-  function onStorage(e) {
-    if (e.key !== 'sortof.branch.selections' || e.newValue === null) return;
-    try {
-      const parsed = JSON.parse(e.newValue);
-      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
-        setBranchSelections(parsed);
-      }
-    } catch {}
-  }
-  window.addEventListener('storage', onStorage);
-  return () => window.removeEventListener('storage', onStorage);
-}, []);
-```
-
-- [ ] **Step 5: Verify served file picks up the new constants**
-
-```bash
-curl -sS http://100.114.205.53:8801/sortof-app.jsx | grep -cE 'COLUMN_COUNT|branchSelections|sortof.branch.selections'
-```
-
-Expected: `>= 6` (constant declaration + state name uses + localStorage key uses).
-
-- [ ] **Step 6: Manual browser smoke test**
-
-In a browser tab on `http://100.114.205.53:8801/`:
-
-1. Open DevTools console.
-2. Run `localStorage.setItem('sortof.branch.selections', JSON.stringify({"2335368829": ["Authentic Z - Current"]}))`.
-3. Hard-refresh the page.
-4. In console: `localStorage.getItem('sortof.branch.selections')` - should return the same JSON.
-5. App should render without errors (no behavior change yet - picker UI is Task 4-5).
-
-If the console shows JSON parse errors or "branchSelections is not defined", revert to backup and re-do.
-
----
-
-## Task 4: Frontend - `ModTable` refactor to group multi-branch wsids
-
-**Files:**
-- Modify: `/opt/sortof/frontend/sortof-app.jsx` (replace `ModTable` body around line 306; pass `branchSelections` from App)
-
-- [ ] **Step 1: Backup** (if more than ~10 minutes since last)
-
-```bash
-cp /opt/sortof/frontend/sortof-app.jsx /opt/sortof/frontend/sortof-app.jsx.bak-$(date +%Y%m%d-%H%M)
-```
-
-- [ ] **Step 2: Replace `ModTable` with the wsid-grouping version**
-
-Find the existing `function ModTable({ defaultOpen = false }) {` block (around line 306) and the closing `}` of that function (around line 351). Replace the entire function with:
-
-```jsx
-function ModTable({ defaultOpen = false, branchSelections, onToggleBranch, expandedWsids, onToggleExpansion }) {
-  const [open, setOpen] = useState(defaultOpen);
-
-  // Group MOD_DB rows by wsid. For wsids with >1 mod, render a single parent
-  // row and an expansion <tr colSpan={COLUMN_COUNT}> with the picker.
-  const groupedByWsid = useMemo(() => {
-    const g = {};
-    for (const m of (D.MOD_DB || [])) {
-      const w = m.wsid || '';
-      if (!w) continue;
-      (g[w] = g[w] || []).push(m);
-    }
-    return g;
-  }, [D.MOD_DB]);
-
-  // Walk SORTED_ORDER and emit one row-spec per wsid (deduped).
-  const rowSpecs = useMemo(() => {
-    const specs = [];
-    const seenWsid = new Set();
-    for (const modId of (D.SORTED_ORDER || [])) {
-      const m = (D.MOD_DB || []).find(x => x.modId === modId);
-      if (!m || !m.wsid) continue;
-      if (seenWsid.has(m.wsid)) continue;
-      seenWsid.add(m.wsid);
-      const branches = groupedByWsid[m.wsid] || [m];
-      const isMulti = branches.length >= 2;
-      specs.push({ wsid: m.wsid, primary: m, branches, isMulti });
-    }
-    // Wsids whose parent had zero selected mods: not in SORTED_ORDER. Append.
-    for (const w of Object.keys(groupedByWsid)) {
-      if (!seenWsid.has(w)) {
-        const branches = groupedByWsid[w];
-        specs.push({ wsid: w, primary: branches[0], branches, isMulti: branches.length >= 2 });
-      }
-    }
-    return specs;
-  }, [D.SORTED_ORDER, D.MOD_DB, groupedByWsid]);
-
-  return (
-    <div className="panel table-section">
-      <div className="tbl-head" onClick={() => setOpen(!open)}>
-        <span>mod details</span>
-        <span className="count">· {(D.SORTED_ORDER || []).length} mods</span>
-        <span style={{ color: 'var(--fg-3)', fontSize: 10.5, marginLeft: 8 }}>
-          why everything ended up where it did
-        </span>
-        <span className="chev">{open ? '▾' : '▸'}</span>
-      </div>
-      {open && (
-        <table className="mods-table">
-          <thead>
-            <tr>
-              <th>#</th>
-              <th>mod id</th>
-              <th>workshop id</th>
-              <th>category</th>
-              <th>dependencies</th>
-              <th>load</th>
-            </tr>
-          </thead>
-          <tbody>
-            {rowSpecs.map((spec, i) => {
-              const idx = String(i + 1).padStart(2, '0');
-              if (!spec.isMulti) {
-                const m = spec.primary;
-                return (
-                  <tr key={spec.wsid}>
-                    <td className="idx">{idx}</td>
-                    <td><span className="modid">{m.modId}</span></td>
-                    <td><span className="wsid">{spec.wsid}</span></td>
-                    <td><span className={'cat ' + m.cat}>{m.cat}</span></td>
-                    <td><span className="deps">{m.deps && m.deps.length ? m.deps.join(', ') : '-'}</span></td>
-                    <td>
-                      {m.pos === 'first' && <span className="pos first">first</span>}
-                      {m.pos === 'last'  && <span className="pos last">last</span>}
-                      {!m.pos && <span className="pos">-</span>}
-                    </td>
-                  </tr>
-                );
-              }
-              // Multi-branch wsid: parent row + (optional) expansion panel.
-              const selected = branchSelections[spec.wsid] || [];
-              const N = spec.branches.length;
-              const X = selected.length;
-              const userTouched = (spec.wsid in branchSelections);
-              const affordance = userTouched ? `✓ ${X} of ${N}` : `▾ ${N} branches`;
-              const firstSelected = spec.branches.find(b => selected.includes(b.modId)) || spec.branches[0];
-              const showAsZero = userTouched && X === 0;
-              const display = showAsZero ? null : firstSelected;
-              const expanded = expandedWsids.has(spec.wsid);
-              return (
-                <React.Fragment key={spec.wsid}>
-                  <tr>
-                    <td className="idx">{idx}</td>
-                    <td>
-                      <button className="branch-affordance"
-                              onClick={() => onToggleExpansion(spec.wsid)}>
-                        {affordance}
-                      </button>
-                    </td>
-                    <td><span className="wsid">{spec.wsid}</span></td>
-                    <td>{display ? <span className={'cat ' + display.cat}>{display.cat}</span> : '-'}</td>
-                    <td>{display && display.deps && display.deps.length ? display.deps.join(', ') : '-'}</td>
-                    <td>
-                      {display && display.pos === 'first' && <span className="pos first">first</span>}
-                      {display && display.pos === 'last'  && <span className="pos last">last</span>}
-                      {(!display || !display.pos) && <span className="pos">-</span>}
-                    </td>
-                  </tr>
-                  {expanded && (
-                    <BranchPicker
-                      wsid={spec.wsid}
-                      branches={spec.branches}
-                      selected={selected}
-                      userTouched={userTouched}
-                      onToggle={onToggleBranch}
-                    />
-                  )}
-                </React.Fragment>
-              );
-            })}
-          </tbody>
-        </table>
-      )}
-    </div>
-  );
-}
-```
-
-- [ ] **Step 3: Update App to maintain `expandedWsids` state and pass everything down**
-
-Find App's other useState calls. Add:
-
-```jsx
-const [expandedWsids, setExpandedWsids] = useState(() => new Set());
-
-const onToggleExpansion = (wsid) => {
-  setExpandedWsids(prev => {
-    const next = new Set(prev);
-    if (next.has(wsid)) next.delete(wsid); else next.add(wsid);
-    return next;
-  });
-};
-```
-
-(`onToggleBranch` is added in Task 5 - leave it for now; the existing `<ModTable defaultOpen={modTableDefault} />` invocation in `RightColumn` needs updating in Step 4 below.)
-
-- [ ] **Step 4: Pass props through `RightColumn` to `ModTable`**
-
-Find the `RightColumn` function signature (around line 372). Add `branchSelections, onToggleBranch, expandedWsids, onToggleExpansion` to the destructured props:
-
-```jsx
-function RightColumn({ state, counts, progress, emptyVariant, successVariant, modTableDefault, pzBuild, setPzBuild, branchSelections, onToggleBranch, expandedWsids, onToggleExpansion }) {
-```
-
-Then find the `<ModTable defaultOpen={modTableDefault} />` invocation inside `RightColumn` (around line 437). Replace with:
-
-```jsx
-<ModTable
-  defaultOpen={modTableDefault}
-  branchSelections={branchSelections}
-  onToggleBranch={onToggleBranch}
-  expandedWsids={expandedWsids}
-  onToggleExpansion={onToggleExpansion}
-/>
-```
-
-- [ ] **Step 5: Pass props from App to `RightColumn`**
-
-Find the `<RightColumn …/>` invocation in App (around line 613). Append:
-
-```jsx
-branchSelections={branchSelections}
-onToggleBranch={() => {}}
-expandedWsids={expandedWsids}
-onToggleExpansion={onToggleExpansion}
-```
-
-(`onToggleBranch` is a placeholder no-op for now; replaced in Task 5.)
-
-- [ ] **Step 6: Verify served file**
-
-```bash
-curl -sS http://100.114.205.53:8801/sortof-app.jsx | grep -cE 'BranchPicker|expandedWsids|branch-affordance|onToggleExpansion'
-```
-
-Expected: `>= 6`.
-
-- [ ] **Step 7: Manual browser smoke test**
-
-Hard-refresh the page. Submit a sort with `2335368829` (AuthenticZ alone) and any cached single-mod input. Open the Mod Details table. Expectation:
-- AuthenticZ appears as **one row** with `▾ 3 branches` (or `✓ X of N` if hydrated from earlier Task 3 testing).
-- Single-mod wsids appear as normal rows.
-- Clicking the `▾` affordance toggles `expandedWsids` (panel visibility - content is empty until Task 5 adds `BranchPicker`).
-- Console: no errors. (`BranchPicker is not defined` is expected at this point if you click - Task 5 fixes.)
-
----
-
-## Task 5: Frontend - `BranchPicker` expansion panel + default selection + radio/checkbox modes
-
-**Files:**
-- Modify: `/opt/sortof/frontend/sortof-app.jsx`
-
-- [ ] **Step 1: Backup**
-
-```bash
-cp /opt/sortof/frontend/sortof-app.jsx /opt/sortof/frontend/sortof-app.jsx.bak-$(date +%Y%m%d-%H%M)
-```
-
-- [ ] **Step 2: Add `defaultSelectionForBranches()` helper near top of file**
-
-Right after `buildModsLine` (around line 35), insert:
-
-```jsx
-// Default selection for a multi-branch wsid (spec §4):
-//   - if any branch lists another in `incompatible_mods`, default = [first only]
-//   - else default = [all branches]
-// "First" tiebreaker: branches arrive sorted by parsed_at ASC, mod_id ASC from
-// the API; we trust that order and pick branches[0].
-function defaultSelectionForBranches(branches) {
-  if (!branches || !branches.length) return [];
-  const ids = new Set(branches.map(b => b.modId));
-  const isRadio = branches.some(b => (b.conflicts || []).some(c => ids.has(c)));
-  if (isRadio) return [branches[0].modId];
-  return branches.map(b => b.modId);
-}
-
-function isRadioMode(branches) {
-  if (!branches || branches.length < 2) return false;
-  const ids = new Set(branches.map(b => b.modId));
-  return branches.some(b => (b.conflicts || []).some(c => ids.has(c)));
-}
-```
-
-- [ ] **Step 3: Add `BranchPicker` component**
-
-Just above `function ModTable(` (around line 306, **before** the table), insert:
-
-```jsx
-function BranchPicker({ wsid, branches, selected, userTouched, onToggle }) {
-  const radio = isRadioMode(branches);
-  const inputType = radio ? 'radio' : 'checkbox';
-  // If user hasn't touched yet, render the default selection (so checkboxes
-  // reflect the implicit state). The actual default is also assumed by the
-  // rest of the system whenever branchSelections[wsid] is missing.
-  const effective = userTouched ? selected : defaultSelectionForBranches(branches);
-  return (
-    <tr>
-      <td colSpan={COLUMN_COUNT} className="branch-panel">
-        <div className="branch-panel-inner">
-          <div className="branch-panel-meta">
-            workshop {wsid} · {branches.length} mod_ids · {radio ? 'pick one' : 'multi-select'}
-          </div>
-          {branches.map(b => {
-            const checked = effective.includes(b.modId);
-            return (
-              <label key={b.modId} className={'branch-row' + (checked ? ' is-checked' : '')}>
-                <input
-                  type={inputType}
-                  name={radio ? `branch-${wsid}` : undefined}
-                  className="branch-input"
-                  checked={checked}
-                  onChange={() => onToggle(wsid, b.modId, branches)}
-                />
-                <span className="branch-modid">{b.modId}</span>
-                <span className="branch-name">{b.name}</span>
-                <span className={'cat ' + b.cat}>{b.cat}</span>
-                <span className="branch-deps">
-                  {b.deps && b.deps.length ? b.deps.join(', ') : '-'}
-                </span>
-                <span className="branch-pos">
-                  {b.pos === 'first' ? 'first' : (b.pos === 'last' ? 'last' : '-')}
-                </span>
-              </label>
-            );
-          })}
-        </div>
-      </td>
-    </tr>
-  );
-}
-```
-
-- [ ] **Step 4: Implement `onToggleBranch` in App**
-
-Find the App function (around line 454). Below the `expandedWsids` state, add:
-
-```jsx
-const onToggleBranch = (wsid, modId, branches) => {
-  setBranchSelections(prev => {
-    const radio = isRadioMode(branches);
-    const cur = prev[wsid] !== undefined
-      ? prev[wsid]
-      : defaultSelectionForBranches(branches);
-    let next;
-    if (radio) {
-      next = [modId];  // exactly one
-    } else {
-      next = cur.includes(modId)
-        ? cur.filter(x => x !== modId)
-        : [...cur, modId];
-    }
-    return { ...prev, [wsid]: next };
-  });
-  // Resort fetch is wired in Task 6; for now this just updates state.
-};
-```
-
-- [ ] **Step 5: Replace the no-op `onToggleBranch` placeholder in `<RightColumn>`**
-
-Find the `<RightColumn …/>` invocation in App (Task 4 added `onToggleBranch={() => {}}`). Replace with:
-
-```jsx
-onToggleBranch={onToggleBranch}
-```
-
-- [ ] **Step 6: Verify served file**
-
-```bash
-curl -sS http://100.114.205.53:8801/sortof-app.jsx | grep -cE 'BranchPicker|defaultSelectionForBranches|isRadioMode|branch-row'
-```
-
-Expected: `>= 8`.
-
-- [ ] **Step 7: Manual browser smoke**
-
-Hard-refresh. Submit AuthenticZ (`2335368829`). Click the `▾ 3 branches` affordance.
-
-Expected:
-- Panel expands with 3 rows.
-- All 3 boxes are checked (default-all per §4 since `incompatible_mods=[]` on all).
-- Click one box to uncheck. Affordance changes to `✓ 2 of 3`. Storage event listener writes to localStorage (`localStorage.getItem('sortof.branch.selections')`).
-- The Mods= line in the output panel currently still includes all 3 mod_ids (resort hookup is Task 6).
-
-Console: no errors.
-
----
-
-## Task 6: Frontend - `/api/resort` integration with sequence number + 5xx handling
-
-**Files:**
-- Modify: `/opt/sortof/frontend/sortof-app.jsx`
-
-- [ ] **Step 1: Backup**
-
-```bash
-cp /opt/sortof/frontend/sortof-app.jsx /opt/sortof/frontend/sortof-app.jsx.bak-$(date +%Y%m%d-%H%M)
-```
-
-- [ ] **Step 2: Add `runResort()` async function in App**
-
-Find the App function. Below `onToggleBranch` (added in Task 5), add:
-
-```jsx
-async function runResort(nextSelections) {
-  // Compose the flat list of selected mod_ids from MOD_DB + nextSelections.
-  // For wsids not in nextSelections, use the §4 default (all-ticked or
-  // first-only depending on radio mode). For wsids with N=1, include the
-  // sole mod_id unconditionally.
-  const byWsid = {};
-  for (const m of (_liveSortData?.MOD_DB || window.SORTOF_DATA?.MOD_DB || [])) {
-    const w = m.wsid || '';
-    if (!w) continue;
-    (byWsid[w] = byWsid[w] || []).push(m);
-  }
-  const ids = [];
-  for (const w of Object.keys(byWsid)) {
-    const branches = byWsid[w];
-    if (branches.length === 1) {
-      ids.push(branches[0].modId);
-      continue;
-    }
-    const stored = nextSelections[w];
-    const eff = stored !== undefined ? stored : defaultSelectionForBranches(branches);
-    for (const id of eff) ids.push(id);
-  }
-
-  if (!ids.length) {
-    // Nothing selected; no point hitting the API. Synthesize an empty payload
-    // so the UI shows "0 of N" without dispatching a 400.
-    _liveSortData = { ..._liveSortData, MOD_DB: [], SORTED_ORDER: [],
-                       MODS_LINE: '', WORKSHOP_ITEMS_LINE: '', MAP_LINE: 'Muldraugh, KY',
-                       WARNINGS: [{ tag: 'cycle', level: 'amber', msg: 'no mods selected - pick at least one branch' }],
-                       pending: [], status: 'success' };
-    setCounts(c => ({ ...c, cached: 0, warnings: 1 }));
-    return;
-  }
-
-  const seq = resortSeq + 1;
-  setResortSeq(seq);
-  try {
-    const res = await fetch('/api/resort', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'X-Sortof-Seq': String(seq) },
-      body: JSON.stringify({ selected_mod_ids: ids }),
-    });
-    // Drop stale: another resort has issued since this one started.
-    if (seq < resortSeq) return;
-    if (!res.ok) {
-      console.error('resort failed', res.status);
-      _liveSortData = {
-        ..._liveSortData,
-        WARNINGS: [
-          ...(_liveSortData?.WARNINGS || []),
-          { tag: 'cycle', level: 'red', msg: "couldn't recompute sort - try again" },
-        ],
-      };
-      setCounts(c => ({ ...c, warnings: (c.warnings || 0) + 1 }));
-      return;
-    }
-    const json = await res.json();
-    _liveSortData = json;
-    const cached = (json.MOD_DB || []).length;
-    const warns  = (json.WARNINGS || []).length;
-    setCounts({ cached, queued: 0, parsing: 0, warnings: warns });
-    setState(json.status || 'success');
-  } catch (e) {
-    console.error('resort threw', e);
-    _liveSortData = {
-      ..._liveSortData,
-      WARNINGS: [
-        ...(_liveSortData?.WARNINGS || []),
-        { tag: 'cycle', level: 'red', msg: "couldn't recompute sort - try again" },
-      ],
-    };
-    setCounts(c => ({ ...c, warnings: (c.warnings || 0) + 1 }));
-  }
-}
-```
-
-(Note: `_liveSortData` is the module-level let-binding from Task 0 of the original frontend - already present at the top of `sortof-app.jsx`.)
-
-- [ ] **Step 3: Update `onToggleBranch` to trigger resort**
-
-Find the existing `onToggleBranch` (Task 5). Replace its body with:
-
-```jsx
-const onToggleBranch = (wsid, modId, branches) => {
-  setBranchSelections(prev => {
-    const radio = isRadioMode(branches);
-    const cur = prev[wsid] !== undefined
-      ? prev[wsid]
-      : defaultSelectionForBranches(branches);
-    let next;
-    if (radio) {
-      next = [modId];
-    } else {
-      next = cur.includes(modId)
-        ? cur.filter(x => x !== modId)
-        : [...cur, modId];
-    }
-    const updated = { ...prev, [wsid]: next };
-    // Fire-and-forget: state set + resort dispatch.
-    runResort(updated);
-    return updated;
-  });
-};
-```
-
-- [ ] **Step 4: Cross-tab `storage` listener also triggers resort**
-
-Find the storage useEffect from Task 3. Replace with:
-
-```jsx
-useEffect(() => {
-  function onStorage(e) {
-    if (e.key !== 'sortof.branch.selections' || e.newValue === null) return;
-    try {
-      const parsed = JSON.parse(e.newValue);
-      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
-        setBranchSelections(parsed);
-        runResort(parsed);
-      }
-    } catch {}
-  }
-  window.addEventListener('storage', onStorage);
-  return () => window.removeEventListener('storage', onStorage);
-}, [resortSeq]);
-```
-
-- [ ] **Step 5: Trigger an initial resort if hydrated `branchSelections` differs from defaults**
-
-Add another useEffect just below the previous, fired once on mount when `_liveSortData` first becomes truthy (i.e. after the first /api/sort response):
-
-```jsx
-useEffect(() => {
-  // Hydrate-driven resort: after the user submits and gets MOD_DB,
-  // if branchSelections has entries, re-run sort against them.
-  if (state === 'success' || state === 'partial') {
-    if (Object.keys(branchSelections).length > 0) {
-      runResort(branchSelections);
-    }
-  }
-  // eslint-disable-next-line
-}, [state]);
-```
-
-- [ ] **Step 6: Verify served file**
-
-```bash
-curl -sS http://100.114.205.53:8801/sortof-app.jsx | grep -cE "runResort|/api/resort|X-Sortof-Seq|couldn't recompute sort"
-```
-
-Expected: `>= 5`.
-
-- [ ] **Step 7: Manual browser smoke - happy path**
-
-Hard-refresh. Submit AuthenticZ. Expand. Untick `AuthenticZLite`.
-
-Expected:
-- Network tab shows POST `/api/resort` with body `{"selected_mod_ids":["Authentic Z - Current","AuthenticZBackpacks+"]}`.
-- Response 200, `MODS_LINE` contains 2 mod_ids only.
-- Output panel updates.
-- Affordance reads `✓ 2 of 3`.
-- WARNINGS no longer contains `ambiguous-multi-branch` for that wsid (because user touched it).
-
-- [ ] **Step 8: Manual browser smoke - race**
-
-Click toggle 2-3 times rapidly (untick, retick, untick). Inspect Network tab - multiple resort requests fire. Whichever response is the latest wins; older responses are dropped without state mutation. Final UI state matches the last toggle.
-
-- [ ] **Step 9: Manual browser smoke - 5xx (optional)**
-
-Edit `/opt/sortof/api/app.py` to add `raise HTTPException(500)` at the top of `resort_endpoint`. `py_compile`, restart api. Toggle a branch in the browser. Expect:
-- Output state retains prior MOD_DB/MODS_LINE.
-- A red WARNINGS entry appears: `couldn't recompute sort - try again`.
-- Restore `app.py` from backup, restart api, toggle again - works again.
-
-```bash
-# Restore after the 5xx test
-cp /opt/sortof/api/app.py.bak-* /opt/sortof/api/app.py
-sudo systemctl restart sortof-api
-```
-
----
-
-## Task 7: Frontend - CSS for picker
-
-**Files:**
-- Modify: `/opt/sortof/frontend/index.html`
-
-- [ ] **Step 1: Backup**
-
-```bash
-cp /opt/sortof/frontend/index.html /opt/sortof/frontend/index.html.bak-$(date +%Y%m%d-%H%M)
-```
-
-- [ ] **Step 2: Add CSS rules**
-
-Find the existing `.copy-btn.copied` rule in `index.html` (around line 374). Below it, add:
-
-```css
-  /* multi-branch picker (Spec A) */
-  .branch-affordance {
-    appearance: none;
-    border: 1px solid var(--line);
-    background: transparent;
-    color: var(--acc-blue);
-    font-family: var(--mono);
-    font-size: 11px;
-    padding: 1px 6px;
-    border-radius: 3px;
-    cursor: pointer;
-  }
-  .branch-affordance:hover { color: var(--fg); border-color: var(--line-2); background: var(--bg-3); }
-
-  .branch-panel {
-    background: var(--bg-2);
-    border-top: 1px dashed var(--line);
-    border-bottom: 1px dashed var(--line);
-    padding: 0;
-  }
-  .branch-panel-inner {
-    padding: 8px 12px 10px;
-    font-family: var(--mono);
-    font-size: 11px;
-  }
-  .branch-panel-meta { color: var(--fg-3); margin-bottom: 6px; letter-spacing: 0.04em; }
-
-  .branch-row {
-    display: grid;
-    grid-template-columns: 18px 220px 1fr 70px 1fr 60px;
-    gap: 10px;
-    align-items: center;
-    padding: 4px 0;
-    border-top: 1px solid var(--line);
-    cursor: pointer;
-  }
-  .branch-row:hover { background: var(--bg-3); }
-  .branch-row.is-checked .branch-modid { color: var(--acc-green); }
-  .branch-input { accent-color: var(--acc-green); }
-  .branch-modid { color: var(--fg-2); }
-  .branch-name  { color: var(--fg-3); }
-  .branch-deps  { color: var(--fg-3); font-size: 10.5px; }
-  .branch-pos   { color: var(--fg-3); font-size: 10.5px; text-align: right; }
-```
-
-- [ ] **Step 3: Verify served file**
-
-```bash
-curl -sS http://100.114.205.53:8801/ | grep -c 'branch-affordance\|branch-panel\|branch-row'
-```
-
-Expected: `>= 6`.
-
-- [ ] **Step 4: Manual browser smoke**
-
-Hard-refresh. Open AuthenticZ in the picker. Expected:
-- Affordance is a small bordered button-like element with blue text.
-- Expansion panel has dashed top/bottom borders, slightly inset background.
-- Each branch row has a checkbox/radio, mod_id, name, category pill, deps, and position cell.
-- Hovering a branch row tints it slightly. Checked rows show the mod_id in green.
-
----
-
-## Task 8: Verification - run §13 test cases against running stack
-
-For each case, document expected vs actual. If any fails, return to the relevant task and fix.
-
-- [ ] **Step 1: §13.1 AuthenticZ canonical**
-
-```bash
-curl -sS -X POST http://100.114.205.53:8801/api/sort \
-  -H 'Content-Type: application/json' \
-  -d '{"input":"2335368829"}' \
-  | jq '{warns: [.WARNINGS[] | select(.tag=="ambiguous-multi-branch")] | length, mod_db_count: (.MOD_DB|length)}'
-```
-
-Expected: `{"warns":1,"mod_db_count":3}`. In the browser: parent row reads `▾ 3 branches`, expansion panel mode = checkboxes, all 3 ticked.
-
-- [ ] **Step 2: §13.2 Cooperative pack**
-
-(No 3-mod cooperative wsid is in the cache yet. Skip or use AuthenticZ as a stand-in: same UI behavior, the difference is only conceptual.)
-
-- [ ] **Step 3: §13.3 Mutually exclusive 2-branch**
-
-(No such wsid in cache. To test, manually inject in DB:
-
-```sql
--- Run via sudo docker exec -i sortof_db psql -U sortof -d sortof -c "..."
-UPDATE mod_parsed SET incompatible_mods = '{AuthenticZBackpacks+}'::text[]
-WHERE workshop_id='2335368829' AND mod_id='Authentic Z - Current';
-UPDATE mod_parsed SET incompatible_mods = '{Authentic Z - Current}'::text[]
-WHERE workshop_id='2335368829' AND mod_id='AuthenticZBackpacks+';
-```
-
-Then re-submit `2335368829` in the browser. Expected: panel mode = radios, default = `Authentic Z - Current` only (first by `parsed_at, mod_id`). Restore via:
-
-```sql
-UPDATE mod_parsed SET incompatible_mods = '{}'::text[] WHERE workshop_id='2335368829';
-```)
-
-- [ ] **Step 4: §13.4 Persistence across reload**
-
-In browser: untick `AuthenticZLite`. Hard-refresh. After the next /api/sort, the resort fires automatically (Task 6 step 5 useEffect) and the picker shows `✓ 2 of 3` again. `localStorage.getItem('sortof.branch.selections')` shows the persisted entry.
-
-- [ ] **Step 5: §13.5 Stored mod_id no longer exists (checkbox mode)**
-
-Console: `localStorage.setItem('sortof.branch.selections', JSON.stringify({"2335368829": ["GhostBranchThatDoesNotExist"]}))`. Hard-refresh. Submit AuthenticZ. Expected: panel default applied (all 3 ticked); no console error.
-
-- [ ] **Step 6: §13.6 Cross-wsid incompatibility**
-
-(Use the canonical 3-mod input; `TMC_TrueActions` requires `tsarslib` but they're on different wsids - both N=1.) Expected: no picker UI, no `ambiguous-multi-branch` warning.
-
-- [ ] **Step 7: §13.7 Zero-tick wsid**
-
-Untick all 3 AuthenticZ branches in the browser. Expected: parent row reads `✓ 0 of N`, MODS_LINE excludes all 3, a synthetic warning appears (`no mods selected - pick at least one branch` if multiple wsids present, or the resort returns 400 → red retry warning if AuthenticZ was the only input). Re-tick at least one branch - UI recovers.
-
-- [ ] **Step 8: §13.8 Radio-mode eviction-to-empty**
-
-Apply the SQL from Step 3 (radio mode). Console: `localStorage.setItem('sortof.branch.selections', JSON.stringify({"2335368829": ["GhostMod"]}))`. Hard-refresh. Submit. Expected: silently drops the ghost; default-first applied (only `Authentic Z - Current` ticked). Restore SQL.
-
-- [ ] **Step 9: §13.10 Stale resort response discarded**
-
-Throttle Network in DevTools to "Slow 3G". Click toggle 1 (untick Backpacks), wait ~200ms, click toggle 2 (untick Lite). Inspect Network: two requests fire. The slower (toggle 1) finishes second. Expected: only toggle 2's response is applied; UI shows `✓ 1 of 3` (only Current selected), not `✓ 2 of 3`.
-
-- [ ] **Step 10: §13.12 Cross-tab sync**
-
-Open two tabs at `http://100.114.205.53:8801/`. Submit AuthenticZ in both. In tab A, untick a branch. Expected: tab B's affordance updates to match, network tab in B shows a /api/resort (triggered by the storage event listener).
-
-- [ ] **Step 11: §13.13 Unknown selected_mod_id from server**
-
-```bash
-curl -sS -X POST http://100.114.205.53:8801/api/resort \
-  -H 'Content-Type: application/json' \
-  -d '{"selected_mod_ids":["modoptions","ghostMod"]}' \
-  | jq '.MOD_DB | map(.modId)'
-```
-
-Expected: `["modoptions"]`. Server log: INFO "resort dropped unknown mod_ids count=1 sample=['ghostMod']".
-
-```bash
-sudo journalctl -u sortof-api --since "2 min ago" | grep "resort dropped"
-```
-
-- [ ] **Step 12: Final regression - canonical 3-mod**
-
-```bash
-curl -sS -X POST http://100.114.205.53:8801/api/sort \
-  -H 'Content-Type: application/json' \
-  -d '{"input":"2169435993;2392709985;2487022075"}' \
-  | jq '{status, MODS_LINE, warns: (.WARNINGS|length)}'
-```
-
-Expected: `{"status":"success","MODS_LINE":"modoptions;tsarslib;TMC_TrueActions","warns":0}`. No regression from baseline.
-
----
-
-## Self-review (already applied)
-
-- **Spec coverage:** all of §3–§10 acceptance criteria mapped to a task.
-- **Placeholders:** none in the plan body.
-- **Type consistency:** `branchSelections` is `{[wsid]: string[]}` everywhere; `expandedWsids` is `Set<string>`; `runResort` takes `nextSelections` of the same shape as `branchSelections`; `defaultSelectionForBranches` and `isRadioMode` both take `branches: MOD_DB[]` and read `.modId`/`.conflicts` consistently.
-- **No git, by design:** every code-changing task starts with a `cp file file.bak-$(date)` step in lieu of a commit.
-- **Restart-vs-no-restart:** backend tasks (1, 2) end with `sudo systemctl restart sortof-api`; frontend tasks (3–7) do not - `StaticFiles` serves from disk, hard-refresh in browser is sufficient.
diff --git a/docs/plans/2026-05-01-collection-expansion.md b/docs/plans/2026-05-01-collection-expansion.md
deleted file mode 100644
index cda7e2a..0000000
--- a/docs/plans/2026-05-01-collection-expansion.md
+++ /dev/null
@@ -1,1679 +0,0 @@
-# Collection Expansion + Live Drain Progress Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Accept Steam Workshop collection URLs in `/api/sort`, expand them server-side via `GetCollectionDetails`, and drive a polling endpoint (`/api/jobs/{job_id}`) that gives the frontend live `cached / queued / draining` counters during cold loads.
-
-**Architecture:** A new `sort_jobs` table tracks asynchronous expansion + drain lifecycles. `/api/sort` becomes polymorphic: all-cached bare wsids return synchronously (unchanged); anything that needs work returns a `job_id`. The frontend polls `GET /api/jobs/{job_id}` every 2.5s and renders phase-specific status strip text. Phase is **derived live** from `download_jobs` counts on every poll - no event log, no leader, restart-resilient by construction.
-
-**Tech Stack:** Postgres (new table + indexes via additive migration), FastAPI (two new routes + background `asyncio.create_task` for expansion), asyncpg parameterized queries (mirroring existing patterns), httpx for `GetCollectionDetails`, vanilla React + Babel-standalone on the frontend (no build step - same as Spec A).
-
-> **Spec dependency:** Read `/opt/sortof/docs/specs/2026-05-01-collection-expansion.md` (270 lines, all decisions locked in §10) before starting. The acceptance criteria in §11 and the test recipes in §12 are what Task 11 verifies.
-
----
-
-## File structure
-
-| Path | Action | Responsibility |
-|---|---|---|
-| `/opt/sortof/init/02_sort_jobs.sql` | **Create** | Schema for fresh deploys (idempotent `CREATE TABLE IF NOT EXISTS`). Identical DDL also applied to the live DB via one-shot `psql` in Task 1. |
-| `/opt/sortof/api/parse.py` | Modify | Add `parse_with_collections(text) -> (wsids, collection_ids)`. Reuses the existing wsid extractor; classifies URL-form IDs as candidate collections. |
-| `/opt/sortof/api/steam.py` | Modify | Add `async fetch_collection_details(client, ids)` mirroring the existing `fetch_workshop_details` pattern. |
-| `/opt/sortof/api/jobs.py` | **Create** | `sort_jobs` row CRUD, phase derivation (the §4 rule executed inside `GET`), live counts SQL, lifespan-startup stale-expansion sweep. |
-| `/opt/sortof/api/app.py` | Modify | Polymorphic `/api/sort`; new `GET /api/jobs/{job_id}`; new `DELETE /api/jobs/{job_id}`; lifespan sweep wired in. |
-| `/opt/sortof/frontend/sortof-app.jsx` | Modify | Detect `job_id` in `/api/sort` response; `pollJob()` async loop @ 2.5s; phase-specific status-strip text; cancel button; 404 expired-job toast. |
-| `/opt/sortof/frontend/index.html` | Modify | CSS for new phase indicators (e.g. `.status-pill.expanding`, `.cancel-btn`). |
-
-No changes to `/opt/sortof/worker/` - drain stays exactly as-is. Collections expand at API time; the resulting wsids flow into `download_jobs` via the existing queueing path.
-
-**Verification fixtures** (referenced throughout):
-- All-cached bare wsids: `2169435993;2392709985;2487022075` → MODS_LINE="modoptions;tsarslib;TMC_TrueActions" (canonical sync regression).
-- Synthetic collection (no Steam round-trip): direct `INSERT INTO collections` with known children. Used for cache-hit verification.
-- Real Steam collection: Task 11 step 2 instructs the implementer to find a public PZ collection URL on `https://steamcommunity.com/workshop/browse/?appid=108600&section=collections` and use its ID. Required for cold-expansion path.
-
----
-
-## Task 1: Schema migration - `sort_jobs` table
-
-**Files:**
-- Create: `/opt/sortof/init/02_sort_jobs.sql`
-- One-shot apply to live DB via `docker exec sortof_db psql`
-
-- [ ] **Step 1: Write the schema file**
-
-Create `/opt/sortof/init/02_sort_jobs.sql` with:
-
-```sql
--- Async sort jobs: lifecycle + result for collection expansion + cold drains.
--- Created 2026-05-01 (Spec B+F).
-
-CREATE TABLE IF NOT EXISTS sort_jobs (
-    job_id           UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    phase            TEXT NOT NULL CHECK (phase IN ('expanding','queued','draining','done','failed')),
-    phase_started_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-    created_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
-    updated_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
-    input_raw        TEXT NOT NULL,
-    collection_ids   TEXT[] NOT NULL DEFAULT '{}',
-    wsids            TEXT[],
-    rules_raw        TEXT,
-    result_json      JSONB,
-    failure_reason   TEXT
-);
-
-CREATE INDEX IF NOT EXISTS sort_jobs_phase_idx ON sort_jobs (phase);
-CREATE INDEX IF NOT EXISTS sort_jobs_updated_idx ON sort_jobs (updated_at);
-
-DROP TRIGGER IF EXISTS sort_jobs_touch ON sort_jobs;
-CREATE TRIGGER sort_jobs_touch
-    BEFORE UPDATE ON sort_jobs
-    FOR EACH ROW
-    EXECUTE FUNCTION touch_updated_at();
-```
-
-The `touch_updated_at()` function already exists (defined in `init/01_schema.sql` for `download_jobs`).
-
-Note: `init/` is owned by root. Use `sudo tee` to write the file:
-
-```bash
-sudo tee /opt/sortof/init/02_sort_jobs.sql > /dev/null <<'SQL'
--- Async sort jobs: lifecycle + result for collection expansion + cold drains.
--- Created 2026-05-01 (Spec B+F).
-
-CREATE TABLE IF NOT EXISTS sort_jobs (
-    job_id           UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    phase            TEXT NOT NULL CHECK (phase IN ('expanding','queued','draining','done','failed')),
-    phase_started_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-    created_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
-    updated_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
-    input_raw        TEXT NOT NULL,
-    collection_ids   TEXT[] NOT NULL DEFAULT '{}',
-    wsids            TEXT[],
-    rules_raw        TEXT,
-    result_json      JSONB,
-    failure_reason   TEXT
-);
-
-CREATE INDEX IF NOT EXISTS sort_jobs_phase_idx ON sort_jobs (phase);
-CREATE INDEX IF NOT EXISTS sort_jobs_updated_idx ON sort_jobs (updated_at);
-
-DROP TRIGGER IF EXISTS sort_jobs_touch ON sort_jobs;
-CREATE TRIGGER sort_jobs_touch
-    BEFORE UPDATE ON sort_jobs
-    FOR EACH ROW
-    EXECUTE FUNCTION touch_updated_at();
-SQL
-```
-
-- [ ] **Step 2: Apply DDL to the live DB**
-
-```bash
-sudo docker exec -i sortof_db psql -U sortof -d sortof < /opt/sortof/init/02_sort_jobs.sql
-```
-
-Expected: a few `CREATE TABLE / CREATE INDEX / CREATE TRIGGER` notices (or none if already applied).
-
-- [ ] **Step 3: Verify the table exists with the right columns**
-
-```bash
-sudo docker exec -i sortof_db psql -U sortof -d sortof -c "\d sort_jobs"
-```
-
-Expected: 11 columns matching the schema, 3 indexes (PK + phase_idx + updated_idx), trigger present. The `\d` output should mention `gen_random_uuid()` as the default for `job_id` and the CHECK constraint on `phase`.
-
-- [ ] **Step 4: Smoke insert / select**
-
-```bash
-sudo docker exec -i sortof_db psql -U sortof -d sortof -c "
-INSERT INTO sort_jobs (phase, input_raw) VALUES ('expanding', 'smoke') RETURNING job_id, phase;
-DELETE FROM sort_jobs WHERE input_raw='smoke';"
-```
-
-Expected: one row returned with a UUID and phase='expanding', followed by `DELETE 1`.
-
-- [ ] **Step 5: Checkpoint** - schema is live; foundation for Tasks 4+ ready. No backup needed (DDL is idempotent and the table was empty).
-
----
-
-## Task 2: Parser extension - `parse_with_collections()`
-
-**Files:**
-- Modify: `/opt/sortof/api/parse.py`
-
-- [ ] **Step 1: Backup**
-
-```bash
-cp /opt/sortof/api/parse.py /opt/sortof/api/parse.py.bak-$(date +%Y%m%d-%H%M)
-```
-
-- [ ] **Step 2: Add the new function and a Steam-URL regex**
-
-Open `/opt/sortof/api/parse.py`. The current file defines only `parse_workshop_input(text)`. Add at the bottom (do **not** modify the existing function - it's still used by `/api/sort` for backwards compat through the polymorphic path):
-
-```python
-import re as _re_module  # already imported at top; alias avoided if duplicate
-
-# Steam Workshop URL form: https://steamcommunity.com/{sharedfiles,workshop}/filedetails/?id=NNNNNNN
-_STEAM_URL_RE = re.compile(
-    r"https?://steamcommunity\.com/(?:sharedfiles|workshop)/filedetails/\?id=(\d{7,12})",
-    re.IGNORECASE,
-)
-
-
-def parse_with_collections(text: str) -> tuple[List[str], List[str]]:
-    """Split an input blob into bare wsids and candidate collection IDs.
-
-    A "candidate collection" is any 7-12-digit ID that appears inside a
-    Steam Workshop URL. Bare numeric IDs in the same blob are treated as
-    mod wsids (current behavior). Steam doesn't syntactically distinguish
-    collection IDs from mod IDs; the candidate list is sent to
-    GetCollectionDetails to confirm. If a candidate isn't actually a
-    collection, the caller falls it back to wsids.
-
-    Returns (wsids, collection_ids), each deduped and in first-seen order.
-    """
-    if not text:
-        return ([], [])
-
-    # 1. Find URL-form IDs FIRST (so they don't get double-counted as bare).
-    url_ids: List[str] = []
-    seen_url: set[str] = set()
-    for m in _STEAM_URL_RE.finditer(text):
-        i = m.group(1)
-        if i not in seen_url:
-            seen_url.add(i)
-            url_ids.append(i)
-
-    # 2. Strip the URLs out before extracting bare numbers.
-    text_minus_urls = _STEAM_URL_RE.sub("", text)
-
-    # 3. Bare wsids: same regex as parse_workshop_input.
-    cleaned = re.sub(
-        r"^\s*(WorkshopItems|Mods|Map)\s*=\s*",
-        "",
-        text_minus_urls,
-        flags=re.MULTILINE | re.IGNORECASE,
-    )
-    bare_ids = re.findall(r"\b\d{7,12}\b", cleaned)
-    seen_bare: set[str] = set()
-    bare_unique: List[str] = []
-    for i in bare_ids:
-        if i not in seen_bare and i not in seen_url:
-            seen_bare.add(i)
-            bare_unique.append(i)
-
-    return (bare_unique, url_ids)
-```
-
-(The `import re as _re_module` line is a paste-safe stub - `re` is already imported at the top of the file. Drop the alias line if a static check complains about a duplicate import.)
-
-- [ ] **Step 3: py_compile**
-
-```bash
-/opt/sortof/api/.venv/bin/python -m py_compile /opt/sortof/api/parse.py && echo PY_OK
-```
-
-- [ ] **Step 4: Functional smoke test in the venv REPL**
-
-```bash
-cd /opt/sortof/api && .venv/bin/python -c "
-from parse import parse_with_collections, parse_workshop_input
-
-# Pure bare wsids - backwards compat.
-assert parse_with_collections('2169435993;2392709985') == (['2169435993','2392709985'], [])
-
-# Pure URL.
-assert parse_with_collections('https://steamcommunity.com/sharedfiles/filedetails/?id=2200148440') == ([], ['2200148440'])
-
-# Mixed: URL + bare.
-assert parse_with_collections('https://steamcommunity.com/sharedfiles/filedetails/?id=2200148440\n2169435993') == (['2169435993'], ['2200148440'])
-
-# Same ID appearing both as URL AND as bare → URL wins, bare side dedups.
-assert parse_with_collections('2200148440\nhttps://steamcommunity.com/sharedfiles/filedetails/?id=2200148440') == ([], ['2200148440'])
-
-# Empty.
-assert parse_with_collections('') == ([], [])
-assert parse_with_collections(None) == ([], [])
-
-# Existing parse_workshop_input still works.
-assert parse_workshop_input('2169435993;2392709985') == ['2169435993','2392709985']
-
-print('ALL_OK')
-"
-```
-
-Expected: `ALL_OK`. Any AssertionError stops the task - fix the regex/dedupe logic before proceeding.
-
-- [ ] **Step 5: Checkpoint** - parser ready for the API to consume.
-
----
-
-## Task 3: Steam helper - `fetch_collection_details()`
-
-**Files:**
-- Modify: `/opt/sortof/api/steam.py`
-
-- [ ] **Step 1: Backup**
-
-```bash
-cp /opt/sortof/api/steam.py /opt/sortof/api/steam.py.bak-$(date +%Y%m%d-%H%M)
-```
-
-- [ ] **Step 2: Add the helper, mirroring `fetch_workshop_details`**
-
-Open `/opt/sortof/api/steam.py`. The current file has one async helper. Add a sibling at the bottom:
-
-```python
-COLLECTION_URL = (
-    "https://api.steampowered.com/ISteamRemoteStorage/GetCollectionDetails/v1/"
-)
-
-
-async def fetch_collection_details(
-    client: httpx.AsyncClient,
-    collection_ids: List[str],
-) -> Dict[str, Dict]:
-    """Resolve candidate collection IDs to their child wsids.
-
-    Returns a dict keyed by collection_id with shape:
-        { "result": int, "children": List[str] }
-
-    Anonymous endpoint; no API key needed. result==1 means valid collection;
-    result!=1 means the ID isn't a collection (could be a mod, deleted, or
-    private). Caller decides what to do with non-1 results - see Spec B+F
-    §10 Q3 "Partial expansion failure" and Q4 "Flakiness".
-    """
-    if not collection_ids:
-        return {}
-    data: Dict[str, str] = {"collectioncount": str(len(collection_ids))}
-    for i, cid in enumerate(collection_ids):
-        data[f"publishedfileids[{i}]"] = cid
-    r = await client.post(COLLECTION_URL, data=data)
-    r.raise_for_status()
-    body = r.json()
-    out: Dict[str, Dict] = {}
-    for item in body.get("response", {}).get("collectiondetails", []) or []:
-        cid = item.get("publishedfileid")
-        if not cid:
-            continue
-        out[cid] = {
-            "result": int(item.get("result", 0)),
-            "children": [
-                c.get("publishedfileid", "")
-                for c in (item.get("children") or [])
-                if c.get("publishedfileid")
-            ],
-        }
-    return out
-```
-
-- [ ] **Step 3: py_compile + smoke import**
-
-```bash
-/opt/sortof/api/.venv/bin/python -m py_compile /opt/sortof/api/steam.py && echo PY_OK
-cd /opt/sortof/api && .venv/bin/python -c "import app; from steam import fetch_collection_details; print(fetch_collection_details.__doc__.split(chr(10))[0])"
-```
-
-Expected: `PY_OK` and the first line of the helper's docstring.
-
-- [ ] **Step 4: Functional smoke test against real Steam (one collection ID)**
-
-The implementer should pick a known PZ collection - search `https://steamcommunity.com/workshop/browse/?appid=108600&section=collections` for any active collection, copy its ID from the URL bar, and use it here. Substitute below:
-
-```bash
-COLL_ID="<paste-real-PZ-collection-id-here>"
-curl -sS -X POST 'https://api.steampowered.com/ISteamRemoteStorage/GetCollectionDetails/v1/' \
-  --data-urlencode 'collectioncount=1' \
-  --data-urlencode "publishedfileids[0]=$COLL_ID" \
-  | jq '.response.collectiondetails[0] | {result, n_children: (.children | length)}'
-```
-
-Expected: `result: 1`, `n_children > 0`.
-
-Then call our helper through the venv:
-
-```bash
-cd /opt/sortof/api && .venv/bin/python -c "
-import asyncio, httpx
-from steam import fetch_collection_details
-
-async def main():
-    async with httpx.AsyncClient(timeout=30.0) as c:
-        out = await fetch_collection_details(c, ['$COLL_ID'])
-    print(out)
-
-asyncio.run(main())
-"
-```
-
-Expected: a dict like `{'<COLL_ID>': {'result': 1, 'children': ['<wsid1>', '<wsid2>', ...]}}`.
-
-- [ ] **Step 5: Checkpoint** - Steam helper verified end-to-end.
-
----
-
-## Task 4: `jobs.py` - CRUD, phase derivation, live counts, lifespan sweep
-
-**Files:**
-- Create: `/opt/sortof/api/jobs.py`
-
-- [ ] **Step 1: Write the module**
-
-Create `/opt/sortof/api/jobs.py` with:
-
-```python
-"""sort_jobs persistence + phase derivation.
-
-Phase is *derived* on every GET (Spec B+F §4): never stored as the source
-of truth except for terminal states. The function `derive_phase` reads
-live counts from download_jobs and decides expanding/queued/draining/done.
-This makes the system restart-resilient by construction - there is no
-event log to replay.
-"""
-
-from __future__ import annotations
-
-import json
-from typing import Any, Dict, List, Optional, Tuple
-from uuid import UUID
-
-import asyncpg
-
-
-# ── CRUD ────────────────────────────────────────────────────────────────────
-
-async def create_job(
-    conn: asyncpg.Connection,
-    *,
-    input_raw: str,
-    collection_ids: List[str],
-    wsids: Optional[List[str]],
-    rules_raw: Optional[str],
-    initial_phase: str,
-) -> str:
-    """Insert a sort_jobs row and return the job_id (UUID as string).
-
-    initial_phase: 'expanding' if collections still need resolving,
-                   'queued' if wsids are already resolved at submit time.
-    """
-    row = await conn.fetchrow(
-        """
-        INSERT INTO sort_jobs (phase, input_raw, collection_ids, wsids, rules_raw)
-        VALUES ($1, $2, $3, $4, $5)
-        RETURNING job_id
-        """,
-        initial_phase, input_raw, collection_ids, wsids, rules_raw,
-    )
-    return str(row["job_id"])
-
-
-async def get_job_row(conn: asyncpg.Connection, job_id: str) -> Optional[Dict[str, Any]]:
-    """Fetch a sort_jobs row by id. Returns None if not found.
-
-    job_id may be either a string UUID or asyncpg-native UUID.
-    """
-    try:
-        uid = UUID(job_id) if isinstance(job_id, str) else job_id
-    except ValueError:
-        return None
-    row = await conn.fetchrow(
-        "SELECT * FROM sort_jobs WHERE job_id = $1",
-        uid,
-    )
-    return dict(row) if row else None
-
-
-async def update_phase(
-    conn: asyncpg.Connection,
-    job_id: str,
-    phase: str,
-    *,
-    wsids: Optional[List[str]] = None,
-    result_json: Optional[Dict[str, Any]] = None,
-    failure_reason: Optional[str] = None,
-) -> None:
-    """Advance a job's phase. wsids/result_json/failure_reason are optional
-    column updates that pair with phase transitions."""
-    sets = ["phase = $2", "phase_started_at = now()"]
-    params: List[Any] = [UUID(job_id), phase]
-    idx = 3
-    if wsids is not None:
-        sets.append(f"wsids = ${idx}::text[]")
-        params.append(wsids)
-        idx += 1
-    if result_json is not None:
-        sets.append(f"result_json = ${idx}::jsonb")
-        params.append(json.dumps(result_json))
-        idx += 1
-    if failure_reason is not None:
-        sets.append(f"failure_reason = ${idx}")
-        params.append(failure_reason)
-        idx += 1
-    await conn.execute(
-        f"UPDATE sort_jobs SET {', '.join(sets)} WHERE job_id = $1",
-        *params,
-    )
-
-
-# ── live counts (Spec B+F §6) ───────────────────────────────────────────────
-
-async def compute_counts(conn: asyncpg.Connection, wsids: List[str]) -> Dict[str, int]:
-    """Compute live cached/queued/draining counts for a set of wsids.
-    Empty wsids → all zeros."""
-    if not wsids:
-        return {"cached": 0, "queued": 0, "draining": 0}
-    rows = await conn.fetch(
-        """
-        SELECT
-            (SELECT COUNT(DISTINCT mp.workshop_id)
-             FROM mod_parsed mp
-             JOIN workshop_meta wm ON wm.workshop_id = mp.workshop_id
-             WHERE mp.workshop_id = ANY($1::text[])
-               AND mp.parsed_at_time_updated = wm.time_updated) AS cached,
-            (SELECT COUNT(DISTINCT workshop_id)
-             FROM download_jobs
-             WHERE workshop_id = ANY($1::text[]) AND status = 'queued') AS queued,
-            (SELECT COUNT(DISTINCT workshop_id)
-             FROM download_jobs
-             WHERE workshop_id = ANY($1::text[]) AND status = 'downloading') AS draining
-        """,
-        wsids,
-    )
-    r = rows[0]
-    return {"cached": int(r["cached"]), "queued": int(r["queued"]), "draining": int(r["draining"])}
-
-
-# ── phase derivation (Spec B+F §4) ──────────────────────────────────────────
-
-def derive_phase(
-    stored_phase: str,
-    wsids: Optional[List[str]],
-    counts: Dict[str, int],
-) -> str:
-    """Decide the live phase from the row's stored phase + current counts.
-
-    Terminal phases (done/failed) are never demoted. Non-terminal phases
-    are recomputed from current state.
-    """
-    if stored_phase in ("done", "failed"):
-        return stored_phase
-    if wsids is None:
-        return "expanding"
-    if counts["draining"] > 0:
-        return "draining"
-    if counts["queued"] > 0:
-        return "queued"
-    if counts["cached"] >= len(wsids):
-        return "done"
-    # Transient gap: a row just left 'queued' and hasn't shown up in
-    # mod_parsed yet. Most likely just-failed and not yet re-queued.
-    return "queued"
-
-
-# ── stale-expansion sweep (Spec B+F §9) ─────────────────────────────────────
-
-STALE_EXPANSION_SQL = """
-UPDATE sort_jobs
-   SET phase = 'failed',
-       failure_reason = 'expansion timed out',
-       updated_at = now()
- WHERE phase = 'expanding'
-   AND phase_started_at < now() - interval '10 minutes'
-RETURNING job_id;
-"""
-
-
-async def sweep_stale_expansions(conn: asyncpg.Connection) -> int:
-    """Run on uvicorn lifespan startup. Returns the number of jobs reaped."""
-    rows = await conn.fetch(STALE_EXPANSION_SQL)
-    return len(rows)
-```
-
-- [ ] **Step 2: py_compile + smoke import**
-
-```bash
-/opt/sortof/api/.venv/bin/python -m py_compile /opt/sortof/api/jobs.py && echo PY_OK
-cd /opt/sortof/api && .venv/bin/python -c "import jobs; print(sorted(n for n in dir(jobs) if not n.startswith('_'))[:8])"
-```
-
-Expected: `PY_OK` followed by a list including `compute_counts`, `create_job`, `derive_phase`, `get_job_row`, `sweep_stale_expansions`, `update_phase`.
-
-- [ ] **Step 3: Phase derivation unit smoke**
-
-Phase derivation is pure (no DB), so it's testable without a connection:
-
-```bash
-cd /opt/sortof/api && .venv/bin/python -c "
-from jobs import derive_phase
-
-# Terminal preserved.
-assert derive_phase('done',   ['a'],  {'cached':1,'queued':0,'draining':0}) == 'done'
-assert derive_phase('failed', ['a'],  {'cached':0,'queued':0,'draining':0}) == 'failed'
-
-# wsids null → expanding.
-assert derive_phase('expanding', None, {'cached':0,'queued':0,'draining':0}) == 'expanding'
-
-# Active drain.
-assert derive_phase('queued', ['a','b'], {'cached':0,'queued':1,'draining':1}) == 'draining'
-
-# Just queued.
-assert derive_phase('queued', ['a','b'], {'cached':0,'queued':2,'draining':0}) == 'queued'
-
-# All cached.
-assert derive_phase('queued', ['a','b'], {'cached':2,'queued':0,'draining':0}) == 'done'
-
-# Transient gap (between queued exit and parsed entry).
-assert derive_phase('queued', ['a','b'], {'cached':1,'queued':0,'draining':0}) == 'queued'
-
-print('PHASE_OK')
-"
-```
-
-Expected: `PHASE_OK`.
-
-- [ ] **Step 4: Live-counts smoke (DB round-trip)**
-
-```bash
-cd /opt/sortof/api && .venv/bin/python -c "
-import asyncio, db
-from jobs import compute_counts
-
-async def main():
-    pool = await db.create_pool()
-    async with pool.acquire() as conn:
-        c1 = await compute_counts(conn, [])
-        assert c1 == {'cached':0,'queued':0,'draining':0}
-        # canonical 3-mod test set is fully cached.
-        c2 = await compute_counts(conn, ['2169435993','2392709985','2487022075'])
-        assert c2['cached'] == 3
-    await pool.close()
-    print('COUNTS_OK')
-
-asyncio.run(main())
-"
-```
-
-Expected: `COUNTS_OK`.
-
-- [ ] **Step 5: Checkpoint** - module reusable from `app.py`.
-
----
-
-## Task 5: Background expansion task
-
-**Files:**
-- Create: `/opt/sortof/api/expansion.py`
-
-- [ ] **Step 1: Write the expansion runner**
-
-Create `/opt/sortof/api/expansion.py` with:
-
-```python
-"""Background async task: take a freshly-created sort_jobs row in 'expanding'
-phase, resolve its collection_ids via Steam, populate wsids[], advance phase
-to 'queued' (and drop wsids into download_jobs as needed)."""
-
-from __future__ import annotations
-
-import asyncio
-import logging
-from typing import Any, Dict, List
-
-import asyncpg
-import httpx
-
-from jobs import update_phase
-from steam import fetch_collection_details
-
-log = logging.getLogger("sortof.expansion")
-
-COLLECTION_TTL_SECONDS = 6 * 3600  # Spec B+F §5.3
-
-
-async def _resolve_collections(
-    conn: asyncpg.Connection,
-    http: httpx.AsyncClient,
-    collection_ids: List[str],
-) -> tuple[Dict[str, List[str]], List[str]]:
-    """Returns (resolved, unresolvable). resolved maps collection_id ->
-    [child_wsids]. unresolvable lists collection_ids that GetCollectionDetails
-    couldn't fetch (after one retry)."""
-    if not collection_ids:
-        return ({}, [])
-
-    # Cache lookup (TTL = 6h via last_fetched_at).
-    cache_rows = await conn.fetch(
-        """
-        SELECT collection_id, child_workshop_ids
-          FROM collections
-         WHERE collection_id = ANY($1::text[])
-           AND last_fetched_at > now() - interval '6 hours'
-        """,
-        collection_ids,
-    )
-    resolved: Dict[str, List[str]] = {
-        r["collection_id"]: list(r["child_workshop_ids"])
-        for r in cache_rows
-    }
-    miss = [cid for cid in collection_ids if cid not in resolved]
-
-    unresolvable: List[str] = []
-    if miss:
-        for attempt in (1, 2):
-            try:
-                api_out = await fetch_collection_details(http, miss)
-            except httpx.HTTPError as e:
-                log.warning("GetCollectionDetails attempt %d failed: %s", attempt, e)
-                if attempt == 1:
-                    await asyncio.sleep(2.0)
-                    continue
-                unresolvable = list(miss)
-                api_out = {}
-            for cid in miss:
-                rec = api_out.get(cid)
-                if rec is None or rec.get("result") != 1:
-                    unresolvable.append(cid)
-                    continue
-                children = rec.get("children") or []
-                resolved[cid] = list(children)
-                await conn.execute(
-                    """
-                    INSERT INTO collections (collection_id, child_workshop_ids, last_fetched_at)
-                    VALUES ($1, $2, now())
-                    ON CONFLICT (collection_id) DO UPDATE
-                       SET child_workshop_ids = EXCLUDED.child_workshop_ids,
-                           last_fetched_at    = now()
-                    """,
-                    cid, children,
-                )
-            break  # success - stop retrying
-    # Dedupe (in case retry-on-flake added the same cid twice).
-    seen: set[str] = set()
-    out_unres: List[str] = []
-    for u in unresolvable:
-        if u not in seen:
-            seen.add(u)
-            out_unres.append(u)
-    return (resolved, out_unres)
-
-
-async def run_expansion(
-    pool: asyncpg.Pool,
-    http: httpx.AsyncClient,
-    job_id: str,
-    bare_wsids: List[str],
-    collection_ids: List[str],
-) -> None:
-    """Top-level expansion task. Logs and persists; never raises out."""
-    try:
-        async with pool.acquire() as conn:
-            resolved, unresolvable = await _resolve_collections(conn, http, collection_ids)
-
-            # Compose wsids: collections (in input order) + bare wsids, deduped.
-            seen: set[str] = set()
-            wsids: List[str] = []
-            for cid in collection_ids:
-                for w in resolved.get(cid, []):
-                    if w and w not in seen:
-                        seen.add(w)
-                        wsids.append(w)
-            for w in bare_wsids:
-                if w not in seen:
-                    seen.add(w)
-                    wsids.append(w)
-
-            if not wsids:
-                # All collections unresolvable AND no bare wsids. Job dies.
-                await update_phase(
-                    conn, job_id, "failed",
-                    failure_reason="all input collections unresolvable",
-                )
-                log.info("expansion %s: failed - all collections unresolvable", job_id)
-                return
-
-            partial_warnings = [
-                {
-                    "tag": "collection-partial",
-                    "level": "warning",
-                    "msg": f"collection {cid} could not be fetched",
-                }
-                for cid in unresolvable
-            ]
-            seed_result: Dict[str, Any] = {"WARNINGS": partial_warnings} if partial_warnings else None
-
-            await update_phase(
-                conn, job_id, "queued",
-                wsids=wsids,
-                result_json=seed_result,
-            )
-            log.info(
-                "expansion %s: queued (wsids=%d unresolvable=%d)",
-                job_id, len(wsids), len(unresolvable),
-            )
-    except Exception:
-        log.exception("expansion %s: crashed", job_id)
-        try:
-            async with pool.acquire() as conn:
-                await update_phase(conn, job_id, "failed", failure_reason="expansion crashed")
-        except Exception:
-            log.exception("expansion %s: cleanup failed", job_id)
-```
-
-- [ ] **Step 2: py_compile + smoke import**
-
-```bash
-/opt/sortof/api/.venv/bin/python -m py_compile /opt/sortof/api/expansion.py && echo PY_OK
-cd /opt/sortof/api && .venv/bin/python -c "from expansion import run_expansion; print('IMPORT_OK')"
-```
-
-Expected: `PY_OK` and `IMPORT_OK`.
-
-- [ ] **Step 3: End-to-end smoke against the live DB + Steam**
-
-```bash
-cd /opt/sortof/api && .venv/bin/python -c "
-import asyncio, httpx, db, jobs, expansion
-
-COLL_ID = '<paste-real-PZ-collection-id>'  # same one you used in Task 3 step 4
-
-async def main():
-    pool = await db.create_pool()
-    async with pool.acquire() as conn:
-        # Pre-clear any cached row to test the cold path.
-        await conn.execute('DELETE FROM collections WHERE collection_id=\$1', COLL_ID)
-        jid = await jobs.create_job(
-            conn, input_raw=f'https://steamcommunity.com/sharedfiles/filedetails/?id={COLL_ID}',
-            collection_ids=[COLL_ID], wsids=None, rules_raw=None,
-            initial_phase='expanding',
-        )
-    async with httpx.AsyncClient(timeout=30.0) as http:
-        await expansion.run_expansion(pool, http, jid, [], [COLL_ID])
-    async with pool.acquire() as conn:
-        row = await jobs.get_job_row(conn, jid)
-        assert row['phase'] == 'queued', row
-        assert row['wsids'] is not None and len(row['wsids']) > 0
-        # Cleanup.
-        await conn.execute('DELETE FROM sort_jobs WHERE job_id=\$1', row['job_id'])
-    await pool.close()
-    print('EXPANSION_OK')
-
-asyncio.run(main())
-"
-```
-
-Expected: `EXPANSION_OK`. Substitute `COLL_ID` with the real ID from Task 3.
-
-- [ ] **Step 4: Checkpoint** - expansion runner ready to be triggered from `/api/sort`.
-
----
-
-## Task 6: Polymorphic `/api/sort` + lifespan sweep wiring
-
-**Files:**
-- Modify: `/opt/sortof/api/app.py`
-
-- [ ] **Step 1: Backup**
-
-```bash
-cp /opt/sortof/api/app.py /opt/sortof/api/app.py.bak-$(date +%Y%m%d-%H%M)
-```
-
-- [ ] **Step 2: Add new imports**
-
-Find the existing import block (around lines 1-30). Add:
-
-```python
-import asyncio
-import jobs
-import expansion
-from parse import parse_with_collections  # existing parse_workshop_input import stays
-```
-
-- [ ] **Step 3: Wire stale-expansion sweep into lifespan startup**
-
-Find the existing `@asynccontextmanager async def lifespan(app: FastAPI):` block (around line 38). Inside the body, after the pool/http are created and before `yield`, add:
-
-```python
-    async with pool.acquire() as conn:
-        n_reaped = await jobs.sweep_stale_expansions(conn)
-        if n_reaped:
-            log.info("lifespan startup: reaped %d stale expansion job(s)", n_reaped)
-```
-
-- [ ] **Step 4: Make `/api/sort` polymorphic**
-
-Find the `async def sort_endpoint(...)` function. The current body parses input via `parse_workshop_input`, hits Steam, queues misses, runs `mlos_sort`, returns sync. Replace the parsing line:
-
-```python
-    input_ids = parse_workshop_input(req.input or "")
-```
-
-with:
-
-```python
-    bare_wsids, collection_ids = parse_with_collections(req.input or "")
-    input_ids = bare_wsids  # used by existing code paths below
-```
-
-Then, immediately after the validation `raise HTTPException(...)` checks (so we still 400 on empty input and 413 on >MAX_IDS), but **before** the Steam metadata fetch, insert a fork:
-
-```python
-    # ── B+F: route to async job if collections present OR uncached wsids
-    # require drain time ───────────────────────────────────────────────────
-    if collection_ids or len(input_ids) > 0:
-        # Fast-path probe: are ALL bare wsids already cache-fresh? If so AND
-        # there are no collections, fall through to the existing sync path.
-        # (Spec B+F §10 Q1: "Bare wsid + all-cached → synchronous".)
-        if not collection_ids and input_ids:
-            try:
-                steam_details = await steam.fetch_workshop_details(
-                    request.app.state.http, input_ids,
-                )
-            except httpx.HTTPError as e:
-                log.warning("steam api error: %s", e)
-                elapsed_ms = int((time.monotonic() - t0) * 1000)
-                log.info(
-                    "sort done hits=0 misses=%d status=error ms=%d",
-                    len(input_ids), elapsed_ms,
-                )
-                return _empty_payload(input_ids, "error")
-            # Cache check: are all input_ids in mod_parsed and fresh?
-            pool = request.app.state.db
-            async with pool.acquire() as conn:
-                fresh = 0
-                for wid in input_ids:
-                    d = steam_details.get(wid)
-                    if not d or d.get("result") != 1:
-                        break  # bail out - there's a non-cacheable id, route to job
-                    tu = int(d.get("time_updated", 0))
-                    row = await conn.fetchrow(
-                        "SELECT 1 FROM mod_parsed "
-                        "WHERE workshop_id = $1 AND parsed_at_time_updated = $2 LIMIT 1",
-                        wid, tu,
-                    )
-                    if row is not None:
-                        fresh += 1
-                    else:
-                        break
-                if fresh == len(input_ids):
-                    # All cache-fresh - sync path. Re-use the existing flow
-                    # by NOT routing to a job. Fall through.
-                    pass
-                else:
-                    # Async path.
-                    return await _route_to_job(
-                        request, conn, req.input or "", req.rules,
-                        bare_wsids, collection_ids,
-                    )
-        elif collection_ids:
-            pool = request.app.state.db
-            async with pool.acquire() as conn:
-                return await _route_to_job(
-                    request, conn, req.input or "", req.rules,
-                    bare_wsids, collection_ids,
-                )
-```
-
-This is the routing fork. The fast-path probe lets all-cached bare-wsid input fall through to the existing sync code unchanged. Anything else (uncached wsids OR any collection) returns a job_id.
-
-- [ ] **Step 5: Add `_route_to_job` helper near the route definition**
-
-Just above the `@app.post("/api/sort")` decorator, insert:
-
-```python
-async def _route_to_job(
-    request: Request,
-    conn,
-    input_raw: str,
-    rules_raw: Optional[str],
-    bare_wsids: List[str],
-    collection_ids: List[str],
-) -> Dict[str, Any]:
-    """Create a sort_jobs row and (if needed) kick off background expansion.
-    Returns {status, job_id} for the client to start polling."""
-    if collection_ids:
-        # Will resolve in the background.
-        job_id = await jobs.create_job(
-            conn,
-            input_raw=input_raw,
-            collection_ids=collection_ids,
-            wsids=None,
-            rules_raw=rules_raw,
-            initial_phase="expanding",
-        )
-        asyncio.create_task(expansion.run_expansion(
-            request.app.state.db,
-            request.app.state.http,
-            job_id,
-            bare_wsids,
-            collection_ids,
-        ))
-        return {"status": "expanding", "job_id": job_id}
-    else:
-        # Bare wsids that include uncached. Kick off cold drain by queueing.
-        # We dedupe wsids before storing them on the job (the existing
-        # /api/sort flow does this for bare input lists).
-        seen: set = set()
-        wsids: List[str] = []
-        for w in bare_wsids:
-            if w not in seen:
-                seen.add(w)
-                wsids.append(w)
-        job_id = await jobs.create_job(
-            conn,
-            input_raw=input_raw,
-            collection_ids=[],
-            wsids=wsids,
-            rules_raw=rules_raw,
-            initial_phase="queued",
-        )
-        # Queue any wsids not already in download_jobs (mirrors the existing
-        # flow at the bottom of sort_endpoint, but we don't need Steam validation
-        # here since the GET poll will surface unknowns/non-mods naturally
-        # via the counts contract).
-        for wid in wsids:
-            existing = await conn.fetchval(
-                "SELECT 1 FROM download_jobs "
-                "WHERE workshop_id = $1 AND status IN ('queued','downloading') LIMIT 1",
-                wid,
-            )
-            if existing is None:
-                await conn.execute(
-                    "INSERT INTO download_jobs (workshop_id, status) VALUES ($1, 'queued')",
-                    wid,
-                )
-        return {"status": "queued", "job_id": job_id}
-```
-
-- [ ] **Step 6: py_compile + smoke import**
-
-```bash
-/opt/sortof/api/.venv/bin/python -m py_compile /opt/sortof/api/app.py && echo PY_OK
-cd /opt/sortof/api && .venv/bin/python -c "import app" && echo IMPORT_OK
-```
-
-- [ ] **Step 7: Restart API**
-
-```bash
-sudo systemctl restart sortof-api && sleep 2 && sudo systemctl is-active sortof-api
-```
-
-Expected: `active`.
-
-- [ ] **Step 8: Verify the sync fast path is unchanged**
-
-```bash
-curl -sS -X POST http://100.114.205.53:8801/api/sort \
-  -H 'Content-Type: application/json' \
-  -d '{"input":"2169435993;2392709985;2487022075"}' \
-  | jq '{status, MODS_LINE, has_job_id: (has("job_id"))}'
-```
-
-Expected: `{"status":"success","MODS_LINE":"modoptions;tsarslib;TMC_TrueActions","has_job_id":false}`.
-
-- [ ] **Step 9: Verify the bare-uncached path returns a job_id**
-
-```bash
-# First, find a wsid that ISN'T cached. The HellDrinx wsid is non_mod, not great.
-# Use a real PZ mod that isn't in mod_parsed yet - implementer needs to find one
-# fresh from Steam. Or simpler: temporarily delete a cached row to force a miss:
-sudo docker exec -i sortof_db psql -U sortof -d sortof -c "
-DELETE FROM mod_parsed WHERE workshop_id='2196102849';
-DELETE FROM workshop_meta WHERE workshop_id='2196102849';"
-
-curl -sS -X POST http://100.114.205.53:8801/api/sort \
-  -H 'Content-Type: application/json' \
-  -d '{"input":"2196102849"}' | jq '{status, has_job_id: (has("job_id")), job_id_preview: (.job_id // "" | .[0:8])}'
-```
-
-Expected: `{"status":"queued","has_job_id":true,"job_id_preview":"<8-hex-chars>"}`.
-
-The drain will reprocess `2196102849` (Raven Creek) and re-cache it; that's fine.
-
-- [ ] **Step 10: Verify the collection path returns expanding + job_id**
-
-```bash
-COLL_ID="<real-PZ-collection-id>"
-curl -sS -X POST http://100.114.205.53:8801/api/sort \
-  -H 'Content-Type: application/json' \
-  -d "{\"input\":\"https://steamcommunity.com/sharedfiles/filedetails/?id=$COLL_ID\"}" \
-  | jq '{status, has_job_id: (has("job_id"))}'
-```
-
-Expected: `{"status":"expanding","has_job_id":true}`.
-
-- [ ] **Step 11: Checkpoint** - `/api/sort` polymorphism live; jobs being created. Polling endpoint is Task 7.
-
----
-
-## Task 7: `GET` + `DELETE /api/jobs/{job_id}`
-
-**Files:**
-- Modify: `/opt/sortof/api/app.py` (add two endpoints near the existing routes)
-
-- [ ] **Step 1: Backup (if more than ~15 minutes since the Task 6 backup)**
-
-```bash
-cp /opt/sortof/api/app.py /opt/sortof/api/app.py.bak-$(date +%Y%m%d-%H%M)
-```
-
-- [ ] **Step 2: Add the GET endpoint**
-
-Find the end of `sort_endpoint` (the function body ends with `return payload`). Below it, insert:
-
-```python
-@app.get("/api/jobs/{job_id}")
-async def get_job_endpoint(job_id: str, request: Request) -> Dict[str, Any]:
-    pool = request.app.state.db
-    async with pool.acquire() as conn:
-        row = await jobs.get_job_row(conn, job_id)
-        if row is None:
-            raise HTTPException(status_code=404, detail="job not found or expired")
-        wsids = list(row["wsids"]) if row["wsids"] else None
-        counts = await jobs.compute_counts(conn, wsids or [])
-        phase = jobs.derive_phase(row["phase"], wsids, counts)
-
-        # If we just transitioned a non-terminal job to 'done', persist the
-        # final result for future polls (and for the §3 24h TTL artifact).
-        result_json = row["result_json"]
-        if phase == "done" and row["phase"] != "done":
-            result_json = await _build_result_for_job(conn, wsids, row["rules_raw"])
-            await jobs.update_phase(
-                conn, job_id, "done", result_json=result_json,
-            )
-        elif phase != "done" and wsids:
-            # Compute a fresh partial result on every poll - cheap, avoids
-            # staleness. Don't persist; only `done` writes result_json.
-            result_json = await _build_result_for_job(conn, wsids, row["rules_raw"])
-
-    return {
-        "job_id":         str(row["job_id"]),
-        "phase":          phase,
-        "counts":         counts,
-        "wsids":          wsids,
-        "result":         result_json,
-        "failure_reason": row["failure_reason"],
-    }
-```
-
-- [ ] **Step 3: Add the `_build_result_for_job` helper**
-
-Just above the `_empty_payload` helper (around line 100), insert:
-
-```python
-async def _build_result_for_job(
-    conn,
-    wsids: List[str],
-    rules_raw: Optional[str],
-) -> Dict[str, Any]:
-    """Compute the SORTOF_DATA payload from currently-cached mod_parsed rows
-    for the given wsids. Used both for partial results during draining and
-    for the final result on phase transition to 'done'."""
-    if not wsids:
-        return _empty_payload([], "success")
-    rows = await conn.fetch(
-        """
-        SELECT mp.workshop_id, mp.mod_id, mp.name, mp.category,
-               mp.requirements, mp.load_after, mp.load_before,
-               mp.incompatible_mods, mp.load_first, mp.load_last,
-               mp.tags, mp.maps
-          FROM mod_parsed mp
-          JOIN workshop_meta wm ON wm.workshop_id = mp.workshop_id
-         WHERE mp.workshop_id = ANY($1::text[])
-           AND mp.parsed_at_time_updated = wm.time_updated
-         ORDER BY mp.workshop_id, mp.mod_id
-        """,
-        wsids,
-    )
-    mods = [_row_to_modinfo(r) for r in rows]
-    rules: Dict[str, Any] = {}
-    if rules_raw:
-        try:
-            rules = parse_sorting_rules(rules_raw)
-        except Exception:
-            log.warning("job result: failed to parse sorting_rules")
-    sort_result = sort_mods(mods, rules)
-    cached_ids = list({r["workshop_id"] for r in rows})
-    payload = adapters.build_response(
-        input_ids=wsids,    # contract: WORKSHOP_ITEMS_LINE = wsids[] at job creation
-        hit_ids=cached_ids,
-        mods=mods,
-        sort_result=sort_result,
-        status="success" if len(cached_ids) >= len(wsids) else "partial",
-    )
-    # Forced override: WORKSHOP_ITEMS_LINE locked to the original wsids[]
-    # regardless of which are currently cached (Spec A §8 / Spec B+F §6).
-    payload["WORKSHOP_ITEMS_LINE"] = ";".join(wsids) + ";" if wsids else ""
-    payload["pending"] = [w for w in wsids if w not in set(cached_ids)]
-    payload["unknown"] = []   # this endpoint doesn't compute Steam-result-9
-    payload["non_mod"] = []   # nor non-mod classification - those are sync-path concerns
-    return payload
-```
-
-- [ ] **Step 4: Add the DELETE endpoint**
-
-Below the GET endpoint, insert:
-
-```python
-@app.delete("/api/jobs/{job_id}", status_code=204)
-async def delete_job_endpoint(job_id: str, request: Request):
-    """Cancel a job. Idempotent: cancelling a terminal job is a no-op 204.
-    Does NOT touch download_jobs (Spec B+F §8)."""
-    pool = request.app.state.db
-    async with pool.acquire() as conn:
-        row = await jobs.get_job_row(conn, job_id)
-        if row is None:
-            raise HTTPException(status_code=404, detail="job not found")
-        if row["phase"] not in ("done", "failed"):
-            await jobs.update_phase(conn, job_id, "failed", failure_reason="cancelled")
-    return None
-```
-
-- [ ] **Step 5: py_compile + restart**
-
-```bash
-/opt/sortof/api/.venv/bin/python -m py_compile /opt/sortof/api/app.py && echo PY_OK
-cd /opt/sortof/api && .venv/bin/python -c "import app" && echo IMPORT_OK
-sudo systemctl restart sortof-api && sleep 2 && sudo systemctl is-active sortof-api
-```
-
-- [ ] **Step 6: Verify GET on a fresh collection job**
-
-```bash
-COLL_ID="<real-PZ-collection-id>"
-JOB_RESP=$(curl -sS -X POST http://100.114.205.53:8801/api/sort \
-  -H 'Content-Type: application/json' \
-  -d "{\"input\":\"https://steamcommunity.com/sharedfiles/filedetails/?id=$COLL_ID\"}")
-JID=$(echo "$JOB_RESP" | jq -r '.job_id')
-echo "job_id=$JID"
-
-# First poll, likely expanding
-curl -sS http://100.114.205.53:8801/api/jobs/$JID | jq '{phase, counts, has_wsids: (.wsids != null)}'
-
-# Wait for expansion + initial drain
-sleep 3
-curl -sS http://100.114.205.53:8801/api/jobs/$JID | jq '{phase, counts, n_wsids: (.wsids|length)}'
-
-# 404 on garbage id
-curl -sS -o /dev/null -w 'http=%{http_code}\n' http://100.114.205.53:8801/api/jobs/00000000-0000-0000-0000-000000000000
-```
-
-Expected: first poll has `phase: "expanding"`; second poll has `phase` in `(queued, draining, done)` with `n_wsids > 0`; the garbage id returns `http=404`.
-
-- [ ] **Step 7: Verify DELETE on an active job**
-
-```bash
-# Submit a fresh job so we can cancel it before it drains
-JID=$(curl -sS -X POST http://100.114.205.53:8801/api/sort \
-  -H 'Content-Type: application/json' \
-  -d "{\"input\":\"https://steamcommunity.com/sharedfiles/filedetails/?id=$COLL_ID\"}" \
-  | jq -r '.job_id')
-
-# Cancel immediately
-curl -sS -o /dev/null -w 'cancel=%{http_code}\n' -X DELETE http://100.114.205.53:8801/api/jobs/$JID
-
-# Idempotent re-cancel
-curl -sS -o /dev/null -w 'recancel=%{http_code}\n' -X DELETE http://100.114.205.53:8801/api/jobs/$JID
-
-# Confirm phase
-curl -sS http://100.114.205.53:8801/api/jobs/$JID | jq '{phase, failure_reason}'
-```
-
-Expected: `cancel=204`, `recancel=204`, `phase: "failed"`, `failure_reason: "cancelled"`.
-
-- [ ] **Step 8: Checkpoint** - backend complete. Frontend wiring is Tasks 8-10.
-
----
-
-## Task 8: Frontend - detect `job_id`, polling loop, partial-result rendering
-
-**Files:**
-- Modify: `/opt/sortof/frontend/sortof-app.jsx`
-
-- [ ] **Step 1: Backup**
-
-```bash
-cp /opt/sortof/frontend/sortof-app.jsx /opt/sortof/frontend/sortof-app.jsx.bak-$(date +%Y%m%d-%H%M)
-```
-
-- [ ] **Step 2: Add a polling helper near other top-of-file helpers**
-
-Find the `buildModsLine` function (around line 32). Below it (and **above** the `isRadioMode` / `defaultSelectionForBranches` block), add:
-
-```jsx
-// Spec B+F: poll a job. Resolves with { phase, result, counts, wsids } on
-// terminal phase OR when an explicit stop signal fires. Caller controls the
-// AbortSignal to cancel polling on unmount / cancel-button / new-sort.
-const POLL_INTERVAL_MS = 2500;
-
-async function pollJobOnce(jobId) {
-  const res = await fetch(`/api/jobs/${jobId}`);
-  if (res.status === 404) return { kind: 'expired' };
-  if (!res.ok) return { kind: 'error', status: res.status };
-  const json = await res.json();
-  return { kind: 'ok', body: json };
-}
-
-function pollJobLoop(jobId, signal, onTick) {
-  // Returns a Promise that resolves on terminal phase or AbortSignal.
-  return new Promise((resolve) => {
-    let timer = null;
-    async function tick() {
-      if (signal.aborted) { if (timer) clearTimeout(timer); resolve({ kind: 'aborted' }); return; }
-      const r = await pollJobOnce(jobId);
-      if (signal.aborted) { resolve({ kind: 'aborted' }); return; }
-      onTick(r);
-      if (r.kind === 'expired' || r.kind === 'error') { resolve(r); return; }
-      const phase = r.body.phase;
-      if (phase === 'done' || phase === 'failed') { resolve(r); return; }
-      timer = setTimeout(tick, POLL_INTERVAL_MS);
-    }
-    tick();
-  });
-}
-```
-
-- [ ] **Step 3: Add an AbortController ref + cancel-job state in App**
-
-Find the App function's state declarations (search for `const [pzBuild, setPzBuild]`). Below the existing useState/useRef block but above the existing useEffects, add:
-
-```jsx
-const pollAbortRef = useRef(null);
-const [activeJobId, setActiveJobId] = useState(null);
-```
-
-- [ ] **Step 4: Update `onSort` to branch on `job_id`**
-
-Find the `async function onSort()` body. The current body POSTs to `/api/sort` and applies the response. Find the line that receives the response:
-
-```jsx
-const json = await res.json();
-_liveSortData = json;
-```
-
-Insert a branch immediately before `_liveSortData = json`:
-
-```jsx
-const json = await res.json();
-if (json.job_id) {
-  // Async path - start polling and let the loop drive state.
-  // Abort any in-flight previous poll.
-  if (pollAbortRef.current) { pollAbortRef.current.abort(); }
-  const ctrl = new AbortController();
-  pollAbortRef.current = ctrl;
-  setActiveJobId(json.job_id);
-
-  pollJobLoop(json.job_id, ctrl.signal, (r) => {
-    if (r.kind !== 'ok') return;
-    const b = r.body;
-    if (b.result) {
-      _liveSortData = b.result;
-      sortContextRef.current = {
-        workshopItemsLine: (b.result.WORKSHOP_ITEMS_LINE) || '',
-        originalQueued: (b.result.pending || []).length,
-        unknown: b.result.unknown || [],
-        nonMod:  b.result.non_mod || [],
-      };
-    }
-    setProgress(b.phase === 'expanding' ? 5 : Math.min(95, 10 + b.counts.cached));
-    setCounts({
-      cached: b.counts.cached,
-      queued: b.counts.queued,
-      parsing: b.counts.draining,
-      warnings: ((b.result && b.result.WARNINGS) || []).length,
-      unknown: ((b.result && b.result.unknown) || []).length,
-      nonMod:  ((b.result && b.result.non_mod) || []).length,
-    });
-    setState(b.phase);   // 'expanding' | 'queued' | 'draining' | 'done' | 'failed'
-  }).then((final) => {
-    setActiveJobId(null);
-    if (final.kind === 'expired') {
-      setState('error');
-      _liveSortData = {
-        ...(_liveSortData || {}),
-        WARNINGS: [
-          ...((_liveSortData?.WARNINGS) || []),
-          { tag: 'retry', level: 'red', msg: 'this job expired - re-submit' },
-        ],
-      };
-    }
-  });
-  return;
-}
-// Sync fast path - existing code follows.
-_liveSortData = json;
-```
-
-- [ ] **Step 5: Verify served file picks up the new symbols**
-
-```bash
-curl -sS http://100.114.205.53:8801/sortof-app.jsx | grep -cE 'pollJobLoop|pollJobOnce|activeJobId|pollAbortRef|/api/jobs/'
-```
-
-Expected: ≥ 6.
-
-- [ ] **Step 6: Manual browser smoke (or curl-driven simulation)**
-
-The implementer should open `https://sortof.indifferentketchup.com/` and submit a real PZ collection URL. Expect: status strip text changes from `expanding…` to `queued`/`draining` to `done`. Network tab shows `GET /api/jobs/<uuid>` calls every 2.5s. Output panel populates as mods land in `mod_parsed`.
-
-If headless: replicate by curling `/api/sort` with a collection URL, capturing the job_id, and curling `/api/jobs/<id>` repeatedly until `phase=done`. Confirm `result_json` populates with `MODS_LINE` etc. once draining completes.
-
-- [ ] **Step 7: Checkpoint** - polling drives `_liveSortData` updates. Phase-specific status strip is Task 9.
-
----
-
-## Task 9: Frontend - phase-specific status strip
-
-**Files:**
-- Modify: `/opt/sortof/frontend/sortof-app.jsx`
-
-- [ ] **Step 1: Backup**
-
-```bash
-cp /opt/sortof/frontend/sortof-app.jsx /opt/sortof/frontend/sortof-app.jsx.bak-$(date +%Y%m%d-%H%M)
-```
-
-- [ ] **Step 2: Update `StatusStrip` to render phase-specific text**
-
-Find the existing `function StatusStrip({ state, counts, progress })`. The existing function returns either an idle strip or a counts strip based on `state`. Replace its body with:
-
-```jsx
-function StatusStrip({ state, counts, progress }) {
-  // Idle / terminal states - single pill summary.
-  if (state === 'idle' || state === 'success' || state === 'error' || state === 'cold' || state === 'done' || state === 'failed') {
-    return (
-      <div className="status-strip">
-        <span className={'status-pill ' + (state === 'failed' || state === 'error' ? 'idle' : 'idle')}>
-          <span className="dot-led"></span>
-          {state === 'idle'    && 'ready when you are'}
-          {state === 'success' && `done. ${counts.cached} mods, ${counts.warnings} warnings`}
-          {state === 'done'    && `done. ${counts.cached} mods, ${counts.warnings} warnings`}
-          {state === 'error'   && 'something went sideways'}
-          {state === 'failed'  && 'job failed'}
-          {state === 'cold'    && 'cache miss - be patient'}
-        </span>
-      </div>
-    );
-  }
-
-  // 'expanding' phase - no useful counts yet.
-  if (state === 'expanding') {
-    return (
-      <div className="status-strip">
-        <span className="status-pill expanding">
-          <span className="dot-led"></span>expanding collection…
-        </span>
-        <div className="progress-bar"><i style={{ width: `${progress}%` }}></i></div>
-      </div>
-    );
-  }
-
-  // 'queued' or 'draining' - live counts. Existing 'partial'/'loading' too.
-  return (
-    <div className="status-strip">
-      <span className="status-pill cached">
-        <span className="dot-led"></span>{counts.cached} cached
-      </span>
-      <span className="status-pill queued">
-        <span className="dot-led"></span>{counts.queued} queued
-      </span>
-      <span className="status-pill parse">
-        <span className="dot-led"></span>{counts.parsing} draining
-      </span>
-      {counts.unknown > 0 && (
-        <span className="status-pill unknown" title="Steam doesn't recognize these IDs (deleted, typo'd, or private)">
-          <span className="dot-led"></span>{counts.unknown} unknown
-        </span>
-      )}
-      {counts.nonMod > 0 && (
-        <span className="status-pill nonmod" title="Workshop items that aren't loadable mods (collections, art, etc.)">
-          <span className="dot-led"></span>{counts.nonMod} non-mod
-        </span>
-      )}
-      <div className="progress-bar"><i style={{ width: `${progress}%` }}></i></div>
-    </div>
-  );
-}
-```
-
-- [ ] **Step 3: Verify served**
-
-```bash
-curl -sS http://100.114.205.53:8801/sortof-app.jsx | grep -cE 'expanding collection|state === .expanding|state === .draining|state === .done|state === .failed'
-```
-
-Expected: ≥ 4.
-
-- [ ] **Step 4: Manual browser smoke**
-
-Submit a collection URL. Expect: strip starts with `expanding collection…`, transitions to live counts, ends with `done. N mods, …` summary.
-
----
-
-## Task 10: Frontend - Cancel button + 404 expired-job handling + CSS
-
-**Files:**
-- Modify: `/opt/sortof/frontend/sortof-app.jsx`
-- Modify: `/opt/sortof/frontend/index.html`
-
-- [ ] **Step 1: Backup**
-
-```bash
-cp /opt/sortof/frontend/sortof-app.jsx /opt/sortof/frontend/sortof-app.jsx.bak-$(date +%Y%m%d-%H%M)
-cp /opt/sortof/frontend/index.html /opt/sortof/frontend/index.html.bak-$(date +%Y%m%d-%H%M)
-```
-
-- [ ] **Step 2: Render a Cancel button when a job is active**
-
-Find where the Sort button is rendered (search for `sort-btn` and `onClick={onSort}`). It's inside the left column. Below the existing Sort button JSX, add:
-
-```jsx
-{activeJobId && (
-  <button
-    className="cancel-btn"
-    onClick={async () => {
-      if (pollAbortRef.current) pollAbortRef.current.abort();
-      try {
-        await fetch(`/api/jobs/${activeJobId}`, { method: 'DELETE' });
-      } catch {}
-      setActiveJobId(null);
-      setState('idle');
-      setProgress(0);
-    }}
-  >cancel</button>
-)}
-```
-
-- [ ] **Step 3: CSS for `.status-pill.expanding` and `.cancel-btn`**
-
-Open `/opt/sortof/frontend/index.html`. Find the `.status-pill.nonmod` rule (added during the unknown/non-mod feature). Below it, add:
-
-```css
-  .status-pill.expanding { color: var(--acc-blue); }
-  .status-pill.expanding .dot-led { background: var(--acc-blue); animation: bl 1.2s ease-in-out infinite; }
-
-  .cancel-btn {
-    appearance: none;
-    width: 100%;
-    height: 32px;
-    margin-top: 6px;
-    border: 1px solid var(--line);
-    background: transparent;
-    color: var(--fg-2);
-    border-radius: var(--radius);
-    font-family: var(--mono);
-    font-size: 12px;
-    cursor: pointer;
-    transition: color .12s, border-color .12s, background .12s;
-  }
-  .cancel-btn:hover { color: var(--acc-red); border-color: var(--acc-red); background: var(--acc-red-bg); }
-```
-
-- [ ] **Step 4: Verify served**
-
-```bash
-curl -sS http://100.114.205.53:8801/sortof-app.jsx | grep -c 'cancel-btn'
-curl -sS http://100.114.205.53:8801/ | grep -cE '\.status-pill\.expanding|\.cancel-btn'
-```
-
-Expected: ≥ 1 (jsx), ≥ 2 (CSS).
-
-- [ ] **Step 5: Manual browser smoke**
-
-Submit a fresh cold collection. While the strip reads `expanding` or `draining`, click cancel. Expect: strip clears, `setActiveJobId(null)` fires, no further GET polls in the network tab.
-
----
-
-## Task 11: Spec §11 acceptance + §12 test recipes
-
-For each item, document expected vs actual. If any fails, return to the relevant task.
-
-- [ ] **Step 1: §11.1 Sync fast path** - bare wsids, all cached.
-
-```bash
-curl -sS -X POST http://100.114.205.53:8801/api/sort \
-  -H 'Content-Type: application/json' \
-  -d '{"input":"2169435993;2392709985;2487022075"}' | jq '{has_job_id: (has("job_id")), MODS_LINE}'
-```
-
-Expected: `{"has_job_id": false, "MODS_LINE": "modoptions;tsarslib;TMC_TrueActions"}`.
-
-- [ ] **Step 2: §11.2 Async path on uncached bare wsid**
-
-```bash
-sudo docker exec -i sortof_db psql -U sortof -d sortof -c "DELETE FROM mod_parsed WHERE workshop_id='2196102849'; DELETE FROM workshop_meta WHERE workshop_id='2196102849';"
-curl -sS -X POST http://100.114.205.53:8801/api/sort -H 'Content-Type: application/json' -d '{"input":"2196102849"}' | jq '{status, has_job_id: (has("job_id"))}'
-```
-
-Expected: `{"status":"queued","has_job_id":true}`.
-
-- [ ] **Step 3: §11.3 Collection URL → expanding**
-
-```bash
-COLL_ID="<paste-real-PZ-collection-id>"
-curl -sS -X POST http://100.114.205.53:8801/api/sort \
-  -H 'Content-Type: application/json' \
-  -d "{\"input\":\"https://steamcommunity.com/sharedfiles/filedetails/?id=$COLL_ID\"}" \
-  | jq '{status, has_job_id: (has("job_id"))}'
-```
-
-Expected: `{"status":"expanding","has_job_id":true}`.
-
-- [ ] **Step 4: §11.4 GET on bogus job → 404**
-
-```bash
-curl -sS -o /dev/null -w 'http=%{http_code}\n' http://100.114.205.53:8801/api/jobs/00000000-0000-0000-0000-000000000000
-```
-
-Expected: `http=404`.
-
-- [ ] **Step 5: §11.5 DELETE → idempotent 204**
-
-```bash
-JID=$(curl -sS -X POST http://100.114.205.53:8801/api/sort -H 'Content-Type: application/json' -d "{\"input\":\"https://steamcommunity.com/sharedfiles/filedetails/?id=$COLL_ID\"}" | jq -r '.job_id')
-curl -sS -o /dev/null -w 'cancel1=%{http_code}\n' -X DELETE http://100.114.205.53:8801/api/jobs/$JID
-curl -sS -o /dev/null -w 'cancel2=%{http_code}\n' -X DELETE http://100.114.205.53:8801/api/jobs/$JID
-curl -sS http://100.114.205.53:8801/api/jobs/$JID | jq '{phase, failure_reason}'
-```
-
-Expected: `cancel1=204`, `cancel2=204`, `{"phase":"failed","failure_reason":"cancelled"}`.
-
-- [ ] **Step 6: §11.6 Steam URL detection + GetCollectionDetails routing**
-
-Already verified by step 3 of this task. Confirm via journal:
-
-```bash
-sudo journalctl -u sortof-api --since "2 min ago" | grep -E 'GetCollectionDetails|expansion'
-```
-
-Expected: at least one entry naming the collection ID.
-
-- [ ] **Step 7: §11.7 Cache hit on second submit (within 6h)**
-
-Re-submit the same collection URL. Confirm: response is fast; `journalctl` for the new request does NOT show a fresh GetCollectionDetails call. (The expansion task's cache hit short-circuits the API call.) An implementation note: a second submit creates a new sort_jobs row but reuses the cached children.
-
-- [ ] **Step 8: §11.8 Partial-collection failure**
-
-```bash
-# Combine real + bogus collection URL
-curl -sS -X POST http://100.114.205.53:8801/api/sort \
-  -H 'Content-Type: application/json' \
-  -d "{\"input\":\"https://steamcommunity.com/sharedfiles/filedetails/?id=$COLL_ID\nhttps://steamcommunity.com/sharedfiles/filedetails/?id=99999999\"}" | jq '.job_id'
-```
-
-Then poll the returned job until `phase=done`, and check `result.WARNINGS`:
-
-```bash
-curl -sS http://100.114.205.53:8801/api/jobs/<jid> | jq '.result.WARNINGS[] | select(.tag=="collection-partial")'
-```
-
-Expected: one entry with `msg` mentioning `99999999`.
-
-- [ ] **Step 9: §11.9 All collections fail**
-
-```bash
-curl -sS -X POST http://100.114.205.53:8801/api/sort \
-  -H 'Content-Type: application/json' \
-  -d '{"input":"https://steamcommunity.com/sharedfiles/filedetails/?id=99999999"}' | jq -r '.job_id' | tee /tmp/jid_test
-sleep 3
-curl -sS http://100.114.205.53:8801/api/jobs/$(cat /tmp/jid_test) | jq '{phase, failure_reason}'
-```
-
-Expected: `{"phase":"failed","failure_reason":"all input collections unresolvable"}`.
-
-- [ ] **Step 10: §11.10 Stale-expansion sweep on restart**
-
-```bash
-# Manually create a stale expansion row
-sudo docker exec -i sortof_db psql -U sortof -d sortof -c "
-INSERT INTO sort_jobs (phase, phase_started_at, input_raw, collection_ids)
-VALUES ('expanding', now() - interval '15 minutes', 'sweep test', ARRAY['99999999'])
-RETURNING job_id;" | tail -3 | head -1 | xargs -I{} echo "stale_jid={}"
-sudo systemctl restart sortof-api && sleep 3
-sudo docker exec -i sortof_db psql -U sortof -d sortof -c "
-SELECT phase, failure_reason FROM sort_jobs WHERE input_raw='sweep test';"
-```
-
-Expected: phase=`failed`, failure_reason=`expansion timed out`.
-
-- [ ] **Step 11: §11.11 Counts contract - sum equals total minus non_mod**
-
-After a cold collection drains, sum the live counts and compare to wsids count:
-
-```bash
-JID=<some-active-job>
-curl -sS http://100.114.205.53:8801/api/jobs/$JID | jq '
-  .counts as $c | .wsids as $w | {
-    sum: ($c.cached + $c.queued + $c.draining),
-    total_wsids: ($w | length),
-    delta: (($w | length) - ($c.cached + $c.queued + $c.draining))
-  }'
-```
-
-Expected: `delta` is the count of wsids that ended up `non_mod` or `unknown` (not in any of the three count buckets) - typically 0 or a small integer.
-
-- [ ] **Step 12: §11.12 WORKSHOP_ITEMS_LINE locked at job creation**
-
-After cancellation or partial-failure, the final `result.WORKSHOP_ITEMS_LINE` from `/api/jobs/<id>` must equal `wsids[]` joined by `;` regardless of how many landed in `non_mod` / `unknown`. Spot-check by comparing.
-
-- [ ] **Step 13: Public-hostname mirror**
-
-```bash
-curl -sS -X POST https://sortof.indifferentketchup.com/api/sort \
-  -H 'Content-Type: application/json' \
-  -d '{"input":"2169435993;2392709985;2487022075"}' | jq '{status, MODS_LINE}'
-```
-
-Expected: success, canonical MODS_LINE. Public side mirrors all backend behavior.
-
-- [ ] **Step 14: Final regression** - re-run the canonical 3-mod sync sort once more and confirm the response shape did not gain a `job_id` field.
-
----
-
-## Self-review (already applied)
-
-- **Spec coverage:** §1 (overview) - Tasks 1-7 cover backend, 8-10 cover frontend. §2 (API contract) - Tasks 6-7. §3 (schema) - Task 1. §4 (phase machine) - `derive_phase` in Task 4. §5 (Steam expansion) - Tasks 3, 5. §6 (counts contract) - `compute_counts` in Task 4, applied in Task 7. §7 (frontend) - Tasks 8-10. §8 (cancellation) - Task 7 step 4 + Task 10. §9 (restart resilience) - `sweep_stale_expansions` in Task 4 + lifespan wiring in Task 6. §10 (open questions) - locked in spec; plan implements verbatim. §11/§12 - Task 11.
-- **Placeholders:** all `<paste-real-…>` markers explicitly call out the implementer-action; no TBDs.
-- **Type consistency:** `wsids` is `List[str] | None` everywhere; `counts` is `{cached: int, queued: int, draining: int}` everywhere; `phase` is the locked enum throughout. `pollJobLoop` callback receives the same shape `r.body` matches the GET endpoint return.
-- **No git, by design:** every code-changing task starts with a `cp file file.bak-$(date)` step in lieu of a commit. The schema migration in Task 1 is idempotent (`CREATE TABLE IF NOT EXISTS`) so no rollback file is needed.
-- **Restart-vs-no-restart:** backend tasks (1, 4, 5, 6, 7) end with `sudo systemctl restart sortof-api`. Frontend tasks (8, 9, 10) end with `curl-grep` only - `StaticFiles` serves from disk; hard-refresh in browser. Worker is unchanged across the entire feature.
diff --git a/docs/plans/2026-05-04-pzmm-conflict-and-typing.md b/docs/plans/2026-05-04-pzmm-conflict-and-typing.md
deleted file mode 100644
index 608aa41..0000000
--- a/docs/plans/2026-05-04-pzmm-conflict-and-typing.md
+++ /dev/null
@@ -1,343 +0,0 @@
-# Plan: pzmm conflict detection + content-type categorization
-
-**Date:** 2026-05-04
-**Branch:** `feat/pzmm-conflict-typing`
-**Status:** Approved (Sam, 2026-05-04)
-
-**Sources read:**
-- `/tmp/pzmm-src/pzmm-main/core/scanner.py` — `scan_file_conflicts`, `solve_load_order`, `FileConflict`
-- `/tmp/pzmm-src/pzmm-main/core/mods.py` — `detect_mod_types`, `ModInfo`
-- `/tmp/pzmm-src/pzmm-main/core/bundle.py` — debug bundle (read for context, not integrated)
-- `/opt/sortof/init/01_schema.sql` and migrations 02..08
-- `/opt/sortof/api/app.py` — `/api/sort`, `_build_result_for_job`, `_row_to_modinfo`
-- `/opt/sortof/api/mlos_sort.py` — `CATEGORY_ORDER`, `derive_category`
-- `/opt/sortof/api/adapters.py` — `CAT_MAP`
-- `/opt/sortof/worker/worker.py` — `process_one`
-
-**Open questions resolved at approval:**
-- Manifest scope: walk all `media/` subtrees under the mod_id root, last-wins on duplicate rel_paths, **no per-branch column**.
-- `mod_files.size_bytes` column: keep.
-- Module split: `api/diagnostics.py` and `api/categorize.py` are **separate files**.
-- `/api/conflicts` v1: **bare wsids only**, return HTTP 400 on collection input. Defer async-job/collection-expansion plumbing to a follow-up plan.
-
----
-
-## 1. Context
-
-pzmm ships two pieces sortof doesn't have today:
-
-1. **File-conflict detection** — when two mods both ship `media/scripts/items_food.txt` with byte-different content, the later one silently overrides the earlier one at runtime. PZ never reports this; the player only sees the symptom (broken food, duplicate item ids, etc.). pzmm walks each mod's `media/` tree, hashes the conflict-prone extensions (`.lua`, `.txt`, `.xml`, `.json`, `.ini`), and reports rel-paths claimed by ≥2 mods with non-equal content. Sortof currently only detects `mod_id` collisions (one mod_id under multiple wsids). File-level overrides are invisible to us.
-2. **Content-type detection** — pzmm walks `media/` paths plus the contents of `lua/` and `scripts/*.txt|xml` files to fingerprint what a mod actually ships (Weapons, Vehicles, Maps, Traits, Professions, Recipes, etc.). Sortof's `derive_category` infers category from `workshop_meta.tags` + name regex + `mod.info` tags. Authors who tag poorly (or skip tagging) end up in `other`/`undefined`. Detection from media/ contents is more reliable for those.
-
-Both pzmm functions assume on-disk media trees. Sortof's worker uses `tempfile.TemporaryDirectory` (`worker/worker.py:472`) — the entire DD extraction is destroyed at the end of `process_one`'s `with` block. **Only `mod.info` (as `raw_mod_info`), discovered map folder names, and a few derived columns persist.**
-
-This plan keeps the existing model: parse once, serve from DB. We **persist a manifest at parse time**. Re-fetch on demand was rejected — every conflict check would queue N DD pulls, minutes per request, completely unusable.
-
-We **do not import pzmm's `solve_load_order`**. Sortof's `mlos_sort.py` is strictly more correct (preorder, loadFirst/loadLast tiers, category buckets, patch G-axis, multi-branch picker, addon injection). pzmm's solver is a plain Kahn topo sort with no tie-breakers.
-
----
-
-## 2. Integration A — File conflict detection
-
-### 2.1 New schema (`init/09_mod_files.sql`)
-
-```sql
-CREATE TABLE IF NOT EXISTS mod_files (
-    workshop_id  TEXT NOT NULL,
-    mod_id       TEXT NOT NULL,
-    rel_path     TEXT NOT NULL,            -- lowercased, posix-style, relative to mod_id root
-    sha1         TEXT NOT NULL,
-    size_bytes   INTEGER NOT NULL DEFAULT 0,
-    PRIMARY KEY (workshop_id, mod_id, rel_path),
-    FOREIGN KEY (workshop_id, mod_id) REFERENCES mod_parsed (workshop_id, mod_id) ON DELETE CASCADE
-);
-CREATE INDEX IF NOT EXISTS mod_files_rel_path_idx ON mod_files (rel_path);
-CREATE INDEX IF NOT EXISTS mod_files_mod_idx ON mod_files (workshop_id, mod_id);
-```
-
-Plus additions to `mod_parsed`:
-
-```sql
-ALTER TABLE mod_parsed
-  ADD COLUMN IF NOT EXISTS mod_types TEXT[] NOT NULL DEFAULT '{}',
-  ADD COLUMN IF NOT EXISTS files_manifest_built BOOLEAN NOT NULL DEFAULT FALSE;
-```
-
-The flag lets `derive_category` and `/api/conflicts` know whether a mod has a manifest yet (graceful degradation while the cache backfills organically).
-
-### 2.2 Worker changes (`worker/worker.py`)
-
-In `process_one`, **inside the existing `with tempfile.TemporaryDirectory` block** (after `discover_mod_infos`, before the `with` exits):
-
-**Single-pass requirement:** the manifest build (Integration A) and `detect_mod_types` content sniffing (Integration B) **share one pass over the tempdir**. No two-pass implementations. The walk reads each file's bytes once: hash → manifest insert; concurrently inspect path + content for type signals. The output is the `mod_files` rows for that mod_id and the ordered `mod_types` list, both committed in the same transaction as the existing `UPSERT_MOD_PARSED`.
-
-For each `(workshop_id, mod_id)` pair we just upserted:
-
-1. Compute `mod_id_root`: the directory whose name equals `mod.id`. For B41 (`mods/<modId>/mod.info`) that's `mip.parent`; for B42 (`mods/<modId>/<branch>/mod.info`) that's `mip.parent.parent`. Detect via `mip.parent.name == mod.id`.
-2. Single recursive walk under `mod_id_root` covering every `media/` subtree (handles B42 `<branch>/media/` + `common/media/` together). For each file:
-   - If suffix matches `_CONFLICT_EXTS = {".lua", ".txt", ".xml", ".json", ".ini"}` (verbatim from pzmm `scanner.py:21`), compute sha1 (chunked reader, mirrors pzmm `_sha1`) and accumulate `(rel_path, sha1, size_bytes)`. **Last-wins** on duplicate rel_paths across branches.
-   - Concurrently, in the same loop, accumulate the path-based signals from pzmm `mods.py:detect_mod_types` (lines 88–115): `Maps`, `Tiles`, `Textures`, `Vehicles`, `Clothing`, `Sounds`, `UI`, `Animations`, `Translations`, `Lua`, plus collected `lua_text_parts` and `script_text_parts` blobs (capped at 60 lua × 64 KB and 80 script × 96 KB per pzmm).
-3. After the walk, run pzmm's content-blob checks (lines 117–136): weapon/vehicle/item/recipe/clothing/trait/profession signals from concatenated blobs. Resolve to `mod_types` ordered list (lines 138–145).
-4. DELETE existing `mod_files` rows for `(workshop_id, mod_id)` then bulk INSERT new rows.
-5. UPSERT `mod_parsed.mod_types` and set `files_manifest_built = true` for the row.
-
-The whole step adds disk-walk + hashing of small text files only — typical mod has 20–200 files in scope, hashing is cheap (≤100 KB each, sha1 ≈ 500 MB/s). Estimated cost: <500 ms per mod, well under the DD pull cost we're already paying.
-
-### 2.3 New module: `api/diagnostics.py`
-
-Port of pzmm `scan_file_conflicts` adapted to read from `mod_files` instead of walking disk:
-
-```python
-async def scan_file_conflicts(conn, mods: list[ModInfo]) -> list[FileConflict]:
-    """For the given (already-loaded) ModInfos, report rel_paths claimed
-    by ≥2 mods with non-equal sha1. Returns list ordered by rel_path."""
-```
-
-Implementation:
-1. `SELECT workshop_id, mod_id, rel_path, sha1 FROM mod_files WHERE (workshop_id, mod_id) IN (...)`.
-2. Group rows in Python by `rel_path`.
-3. For each group with ≥2 distinct mods, count distinct sha1s. If >1, emit a `FileConflict`.
-4. Winner = last in input order (mirrors pzmm's "last in load order wins").
-
-Dataclass:
-```python
-@dataclass
-class FileConflict:
-    rel_path: str
-    providers: list[str]   # mod_ids (not ModInfo, to keep payload small)
-    winner: str            # mod_id
-```
-
-`pzmm.scanner._CONFLICT_EXTS` filtering happened at manifest-build time, so this read path doesn't need it.
-
-### 2.4 New endpoint: `POST /api/conflicts`
-
-Same input shape as `/api/sort`, **bare wsids only** (Q4 resolved):
-```json
-{"input": "wsid1;wsid2;wsid3", "rules": "...", "pz_build": "B42"}
-```
-
-If `parse_with_collections` returns any `collection_ids`, return HTTP 400 with `detail="conflict scan does not support collection input; resolve via /api/sort first"`.
-
-Response:
-```json
-{
-  "conflicts": [
-    {"rel_path": "media/scripts/items_food.txt",
-     "providers": ["FoodModA", "FoodModB"],
-     "winner": "FoodModB"}
-  ],
-  "missing_manifests": ["wsid1", "wsid2"]
-}
-```
-
-`missing_manifests` lists mods we couldn't analyze because `files_manifest_built=false`. The frontend can show a banner ("X mods haven't been re-fetched since this feature shipped — file conflicts unavailable for them"), and re-clicking sort eventually triggers re-parse on workshop updates.
-
-Reuse path: `_build_result_for_job` already loads ModInfos via `_row_to_modinfo` — the conflicts endpoint follows the same load pattern, then calls `scan_file_conflicts(conn, mods)` instead of `sort_mods`.
-
-### 2.5 Frontend (out of scope for this plan)
-
-A follow-up plan can wire a "File conflicts" warnings section. For now `/api/conflicts` is consumable from curl and lays the groundwork.
-
----
-
-## 3. Integration B — Content-type detection feeding category derivation
-
-### 3.1 Schema additions
-
-Already covered by §2.1's `mod_parsed` ALTER TABLE (`mod_types` + `files_manifest_built`). One migration file (`init/09_mod_files.sql`) ships both A and B because they share the worker walk.
-
-### 3.2 Worker changes
-
-Folded into §2.2's single-pass walk. No additional file I/O.
-
-### 3.3 New module: `api/categorize.py`
-
-```python
-def types_to_category(mod_types: list[str], name: str) -> str | None:
-    """First mod_type that maps to a sortof CATEGORY_ORDER bucket wins.
-    Returns None if mod_types is empty / Unknown / Dependency-only and we
-    should fall through to the existing derive_category cascade."""
-```
-
-### 3.4 Tag→category mapping (explicit)
-
-| pzmm `mod_type` | sortof `CATEGORY_ORDER` | notes |
-|---|---|---|
-| `Maps`         | `map`        | already covered by `mod.maps non-empty`; types-derived is a fallback |
-| `Vehicles`     | `vehicle`    | name regex `"spawn zone"` already routes to `vehicle_spawn` upstream |
-| `Weapons`      | `weapon`     | wins over `Items` (pzmm prefers list ordering) |
-| `Items`        | *skip*       | too generic — almost every mod has Items; would mis-trigger |
-| `Clothing`     | `wearable`   | armor name-hint check still runs after, can override to `armor` |
-| `Traits`       | `code`       | no dedicated `trait` bucket; `code` is the gameplay-axis fallback |
-| `Professions`  | `profession` | |
-| `Recipes`      | `crafting`   | |
-| `Tiles`        | `tile`       | |
-| `Textures`     | `texture`    | |
-| `Sounds`       | `sound`      | already handled by `Audio` ws_tag; types-derived is a fallback |
-| `Animations`   | *skip*       | no bucket; falls through |
-| `UI`           | `ui`         | |
-| `Translations` | `translation` | |
-| `Lua`          | *skip*       | too generic; falls through |
-| `Patch`        | `patch`      | already detected by `_PATCH_NAME_RE`; types-derived is a fallback |
-| `Dependency`   | `tweaks`     | maps to existing `lib` pill |
-| `Framework`    | `tweaks`     | same |
-| `Unknown`      | *skip*       | falls through |
-
-"*skip*" means: don't return a category; let `derive_category` continue its cascade.
-
-### 3.5 `derive_category` integration
-
-Insert a single new check in `api/mlos_sort.py:derive_category` after the explicit-category early return at line 412, **before** the patch/lib name regex at lines 416–419:
-
-```python
-if mod.mod_types:
-    cat = types_to_category(mod.mod_types, name)
-    if cat:
-        return cat
-```
-
-`mod.mod_types` is added to the `ModInfo` dataclass (`mlos_sort.py:113`). `_row_to_modinfo` (`api/app.py:176`) is updated to read the new column. **Both `mlos_sort.py` copies must change in lockstep.**
-
-**Position rationale:** `mod_types` comes from media-content fingerprinting, more reliable than name regex but less reliable than an explicit `category=` field in `mod.info`. So it sits between (1) explicit category and (2) name regex. The patch/lib regexes that come after still win for true patches/libraries (they'd usually return `Patch`/`Dependency` from detect_mod_types anyway, but we want the regex to win for cases where a "patch mod" hasn't shipped enough media to fingerprint).
-
-Empty `mod_types` (e.g. older rows where `files_manifest_built=false`) means the new check returns `None` and the existing cascade runs unchanged. **Graceful degradation is built in.**
-
----
-
-## 4. Blockers / risks
-
-### 4.1 Schema migration cost
-- Current cache: **3,123 `workshop_meta` rows, 3,298 `mod_parsed` rows**.
-- New `mod_files` rows estimate: median mod ships ~50 conflict-eligible files (light mods 5–10, heavy framework/map mods 200–500). At 50 avg × 3,298 mods = **~165 k rows**. With sha1 (40 chars) + rel_path (avg 80 chars) + overhead ≈ 200 bytes/row, that's ~33 MB before indexes. Postgres handles this trivially.
-- `ALTER TABLE mod_parsed ADD COLUMN mod_types TEXT[]` and `files_manifest_built BOOLEAN` are additive and metadata-only on Postgres 16 (no rewrite). Instant.
-
-### 4.2 Backfill feasibility
-- The `/tmp/sortof_steam_throttle` flock + `/tmp/sortof_steam_cooldown` 1h kill-switch (worker.py — `fetch_required_wsids`) protect us from Steam metadata 429s. **DD itself does not hit the metadata API**; it hits Steam content servers, which are not part of the rate-limited path. So mass re-DD does not trip the cooldown.
-- Mass re-DD still costs real time: typical DD pull is 20–60 s wall-clock. 3,123 wsids × 30 s avg ÷ 4 drains = **~6.5 hours wall-clock for a full backfill**. Doable but disruptive.
-- **Recommendation: do not run a bulk backfill.** Let the cache populate organically — every workshop update bumps `time_updated`, which triggers a re-parse and now also a manifest build. The `missing_manifests` field in `/api/conflicts` and the empty-`mod_types` graceful-degrade path together mean the feature works on day 1 (empty results for old rows) and improves as authors push updates.
-- Per-mod manual trigger pattern still works (operator-only):
-  ```sql
-  DELETE FROM mod_parsed WHERE workshop_id='<wsid>';
-  INSERT INTO download_jobs (workshop_id, status) VALUES ('<wsid>','queued');
-  ```
-
-### 4.3 Inline detection at sort time
-- Rejected. `detect_mod_types` reads up to ~11 MB per mod from disk (lua/script blobs). With the tempdir destroyed (the actual case), we'd need to re-DD inline — minutes per sort.
-- **All detection runs at parse time** in `process_one`. `derive_category` and `/api/conflicts` are pure DB reads.
-
----
-
-## 5. Files touched (summary)
-
-**New:**
-- `init/09_mod_files.sql` — `mod_files` table, `mod_parsed.mod_types`, `mod_parsed.files_manifest_built`
-- `api/diagnostics.py` — port of `scan_file_conflicts`, `FileConflict` dataclass
-- `api/categorize.py` — `types_to_category` helper
-
-**Modified:**
-- `worker/worker.py` — extend `process_one`'s `with` block: single-pass walk, manifest + detect_mod_types, upsert rows
-- `worker/worker.py` (top-level) — port `detect_mod_types` from pzmm `mods.py:57–145` (sortof-side copy; do not import from pzmm at runtime)
-- `api/mlos_sort.py` — add `mod_types: List[str]` to `ModInfo` dataclass; add `mod_types` check at top of `derive_category`
-- `worker/mlos_sort.py` — mirror the `ModInfo` and `derive_category` change (worker/api dual-edit rule)
-- `api/app.py` — `_row_to_modinfo` reads new `mod_types` column; `_build_result_for_job` SELECT list adds `mp.mod_types`; register `POST /api/conflicts`
-
-**Out of scope (deferred to follow-up plan):**
-- Frontend conflicts panel — `/api/conflicts` endpoint only, no UI
-- Integration of `pzmm/core/bundle.py` (debug bundle export) — read for context, not ported
-- Backfill orchestration — relying on organic backfill
-
----
-
-## 6. Rollback
-
-Before applying the migration:
-
-```bash
-# Backup mod_parsed (the only existing table we ALTER)
-sudo docker exec -i sortof_db pg_dump -U sortof -d sortof -t mod_parsed \
-  > /opt/sortof/backups/mod_parsed-pre-09.sql.$(date +%Y%m%d-%H%M)
-ls -la /opt/sortof/backups/ | tail -3
-```
-
-Down SQL (paste into psql to revert the schema half of this plan):
-
-```sql
-DROP TABLE IF EXISTS mod_files;
-ALTER TABLE mod_parsed
-  DROP COLUMN IF EXISTS mod_types,
-  DROP COLUMN IF EXISTS files_manifest_built;
-```
-
-To revert code, `git checkout main` and restart services:
-```bash
-sudo systemctl restart sortof-api sortof-drain@1 sortof-drain@2 sortof-drain@3 sortof-drain@4
-```
-
-The migration is additive only (new table + new columns with safe defaults), so the rollback is a clean drop. No data is destroyed in `mod_parsed`'s existing columns.
-
----
-
-## 7. Verification
-
-1. **Migration applies cleanly:**
-   ```bash
-   sudo docker exec -i sortof_db psql -U sortof -d sortof < /opt/sortof/init/09_mod_files.sql
-   sudo docker exec -i sortof_db psql -U sortof -d sortof -c "\d mod_files"
-   sudo docker exec -i sortof_db psql -U sortof -d sortof -c "\d mod_parsed" | grep -E "mod_types|files_manifest_built"
-   ```
-
-2. **Compile checks** (after every Python edit):
-   ```bash
-   /opt/sortof/api/.venv/bin/python -m py_compile /opt/sortof/api/app.py /opt/sortof/api/mlos_sort.py /opt/sortof/api/diagnostics.py /opt/sortof/api/categorize.py
-   /opt/sortof/worker/.venv/bin/python -m py_compile /opt/sortof/worker/worker.py /opt/sortof/worker/mlos_sort.py
-   cd /opt/sortof/api    && .venv/bin/python -c "import app"   && echo OK
-   cd /opt/sortof/worker && .venv/bin/python -c "import drain" && echo OK
-   ```
-
-3. **Dual-edit consistency check** (worker/api `mlos_sort.py` lockstep rule):
-   ```bash
-   diff /opt/sortof/api/mlos_sort.py /opt/sortof/worker/mlos_sort.py | grep -E "^[<>]" | head -20
-   ```
-   Logic must match; only comments / docstrings may differ. If any logic line shows up in the diff, fix the lockstep before continuing.
-
-4. **Restart services:**
-   ```bash
-   sudo systemctl restart sortof-api sortof-drain@1 sortof-drain@2 sortof-drain@3 sortof-drain@4
-   sudo systemctl is-active sortof-api sortof-drain@{1..4}
-   ```
-
-5. **Force a fresh parse on a known multi-file mod and verify manifest:**
-   ```bash
-   sudo docker exec -i sortof_db psql -U sortof -d sortof -c \
-     "DELETE FROM mod_parsed WHERE workshop_id='2169435993';
-      INSERT INTO download_jobs (workshop_id, status) VALUES ('2169435993','queued');"
-   sleep 60
-   sudo docker exec -i sortof_db psql -U sortof -d sortof -c \
-     "SELECT mod_id, mod_types, files_manifest_built FROM mod_parsed WHERE workshop_id='2169435993';
-      SELECT count(*) AS file_count FROM mod_files WHERE workshop_id='2169435993';"
-   ```
-   Expected: `files_manifest_built=t`, `mod_types` populated, `file_count > 0`.
-
-6. **Conflict endpoint smoke:**
-   ```bash
-   curl -sS -X POST http://100.114.205.53:8801/api/conflicts \
-     -H 'Content-Type: application/json' \
-     -d '{"input":"2169435993;2392709985;2487022075"}' | jq .
-   ```
-   Expected: `{"conflicts": [], "missing_manifests": [<wsids without manifests yet>]}`.
-
-7. **Collection-input rejection (Q4):**
-   ```bash
-   curl -sS -i -X POST http://100.114.205.53:8801/api/conflicts \
-     -H 'Content-Type: application/json' \
-     -d '{"input":"https://steamcommunity.com/sharedfiles/filedetails/?id=999999999"}' | head -5
-   ```
-   Expected: HTTP 400 with the documented `detail` message (when the URL is detected as a collection ref).
-
-8. **Category-from-types smoke:**
-   - Find a mod whose Steam tags don't reflect content (e.g. weapon mod tagged only `Realistic`); `/api/sort` currently classifies it as `code` / `other` / `undefined`.
-   - Re-queue it through the new pipeline (delete+insert).
-   - Re-run `/api/sort`; confirm category is now `weapon`.
-
-9. **Graceful-degradation check:** confirm a mod with `files_manifest_built=false` still sorts correctly through the existing cascade (no exceptions, category falls back to current behavior).