[Jumpstile]

Summary

• Add the versioned one-guide/v1 JSON schema and deterministic, read-only projection for Live Now, Starting Soon, item details, and exactly eight built-in Slice-1 categories: live-now, starting-soon, wrestling, football, baseball, soccer, movies, and news.
• Serve GET/HEAD routes from the verified immutable accepted XMLTV generation. Requests do not fetch providers or mutate accepted/source state; response fields are bounded and redacted.
• Keep API identity content-derived and deterministic; preserve distinct safe channel offerings; leave unavailable provenance, entitlement, freshness, confidence, DVR, and timeshift unknown.
• Warm navigation uses a disposable projection cache keyed by repository root and accepted pointer/manifest identity. Pointer integrity is checked before reuse; warm requests avoid rereading/reparsing accepted XMLTV.
• No SQLite/Postgres introduced. The existing landing UI does not yet render One Guide.
• Missing accepted pointer/generation or accepted XMLTV unavailable/NotGenerated takes the HTTP 503 one-guide-unavailable path. A valid accepted guide with no matching current programmes remains HTTP 200 with an empty result.
• Hockey, auto racing/motorsports, and other category expansion are explicitly out of scope for PR feat(one-guide): add read-only accepted-guide API #199 and remain follow-on work (Guide Quality & Category Discovery — high-confidence classification, category hubs, and couch-first What's On views #191).

Verification

• Exact pushed head: 16e30826c909ea05a1312fab42c2ef6570f2eeea (source/test fix dfe645d227a3bcdad1ab7496ee46d01dc9f6c637; final commit adds documentation only).
• Focused OneGuide/WebServer: 61/61 passed.
• Full Pester: 869 passed, 0 failed, 0 skipped across the full unit suite.
• Config schemas: 9/9 passed. Markdown hygiene: 118 files. Markdown links: 415 resolved. PSScriptAnalyzer: 0 Error findings.
• GUI TypeScript typecheck passed; GUI Vitest 86/86 passed; Tauri Rust 24/24 passed.
• Prior verified 3,000-programme warm p95 remains applicable because the final fix changes only unavailable-state branching before XMLTV parsing/projection: Live Now 91.71 ms, Category 83.20 ms, Details 15.58 ms.
• Exact-head hosted CI run 36704580666: SUCCESS.
• Exactly one independent GPT-6 Sol HIGH read-only review is required on exact head 16e30826... before merge.

Limits

• Accepted merged XMLTV does not preserve provider identity per programme, so HTTP offerings use the accepted-guide source label and safe channel references.
• No browser One Guide UI, playback, provider integration, LAN access, or persistence/index is added.
• No merge performed yet.

Closes #198

[Jumpstile]

GPT-6 Sol architecture review — PR #199 exact head 2d16d68

DISPOSITION=HOLD

Blockers

1. HTTP paging: Start-ChannelForgeWebServer.ps1 passes only Url.AbsolutePath, discarding the query string before One Guide can parse limit / offset. Pass the query through and prove paging + invalid-query rejection over real HTTP.
2. Unsupported item correlation: current projection merges same-title, same-time programmes without evidence they represent one canonical event. Prevent unsupported merges while preserving proven multi-offering grouping.
3. Event classification: category-only sports/wrestling programmes can be labeled Event; do not infer event kind from category alone. Remove/use the evidence-aware kind logic correctly.
4. Accepted-guide metadata truthfulness: HTTP reparses accepted XMLTV, which does not preserve promotion or per-programme provenance. Make the HTTP contract/tests truthful rather than implying those fields survive.
5. Identifier redaction: safe-looking source/channel/promotion identifiers may still expose unlabeled account/token-like identifiers. Use opaque public references at this boundary.
6. Navigation cost: every request reparses accepted XMLTV and rebuilds/sorts the projection before paging. That conflicts with Appliance Performance Gate — instant-feeling guide, navigation, search, and launch on SER8 #193's no-full-reparse-per-navigation rule. Establish a bounded accepted-snapshot read path and measure realistic HTTP requests before merge.

Accepted findings

• SOURCE_OF_TRUTH=PASS: reads use verified immutable accepted generation; no second authority, no source fetch, no writes.
• DETERMINISM=PASS.
• Live Now semantics [start, stop) accepted.
• Starting Soon semantics (now, now + 2h] accepted.
• Unknown entitlement/freshness/confidence/DVR/timeshift are not fabricated.
• Public ItemId / OfferingId hashes are domain-separated and are not acceptance hashes.
• No SQLite/Postgres change is warranted in this slice.
• SIMPLICITY=PASS.
• SECURITY_REDACTION=FAIL due blocker 5.
• PERFORMANCE_RISK=HIGH because the 8-row in-process benchmark is not realistic HTTP/accepted-XMLTV navigation evidence.

Next slice after remediation

Render one read-only Live Now list in the existing browser from the versioned API.

No files were changed during this review.

[Jumpstile]

PR #199 remediation validation — 90954ba

• Fixed deterministic no-explicit-ID row identity: same source/channel offerings group only when sanitized source-row evidence agrees; recognized and unrecognized categories, descriptions, XMLTV flags, and preserved event metadata participate. Conflicting rows remain separate and permutation-stable. Regression includes exact duplicates and a metadata conflict. Scope remains the eight One Guide Slice 1 — canonical read projection, category taxonomy, and fast read-only guide API #198 Slice-1 categories; hockey and auto-racing remain unsupported.
• Pester 5.7.1 full unit suite: 867 passed, 0 failed, 0 skipped (78 files; OS=Windows_NT; unique NUnit XML at C:/Temp/cf-pr199-final-pester-5.7.1-isolated-381595-20260929.xml). Focused OneGuide/WebServer/GeneratedReportSchemas: 65/65 passed. ScheduledRefreshRegistration: 6/6 passed.
• Config schemas passed (9 tracked config files); Markdown hygiene passed (118 files); Markdown links passed (415 links). PSScriptAnalyzer reported 0 Error-severity findings. Changed-document Prettier passed. GUI typecheck passed; Vitest 86/86 passed; Tauri Rust 24 passed. git diff --check passed. Changed-line sensitive-data heuristic scan found no findings.
• Fresh actual loopback HTTP run after source edits, isolated endpoint cold starts, 100 channels × 30 programmes = 3,000. Cold: LiveNow 18,496.37 ms, category/news 18,237.23 ms, Details 18,594.90 ms. Warm (35 samples each): LiveNow p50 63.56 ms, p95 91.71 ms; category/news p50 63.34 ms, p95 83.20 ms; Details p50 11.20 ms, p95 15.58 ms. Cold build cost remains visible; warm budgets are below the documented Appliance Performance Gate — instant-feeling guide, navigation, search, and launch on SER8 #193 ceilings.
• Documentation outcome: architecture/developer docs and docs/user/CURRENT_LIMITATIONS.md updated.

Exact-head hosted CI is pending verification. No merge requested by this comment; PR remains subject to exact-head CI and the required independent GPT-6 Sol HIGH review.

[Jumpstile]

Intent-fit audit — 90954ba

Intended behavior: One Guide is a deterministic, read-only JSON projection over the verified immutable accepted XMLTV generation. Same-source/channel rows without a CanonicalEventId share an item only when their sanitized source-row evidence matches. Cross-channel grouping still requires explicit canonical event identity. The built-in #198 category registry remains exactly eight Slice-1 keys; unsupported hockey/auto-racing were not added.

Entry points: Get-ChannelForgeOneGuide; HTTP GET/HEAD /api/one-guide/live-now, /starting-soon, /category/{key}, and /items/{item-id} via the One Guide web response/routing path.

Inspected files/evidence: src/ChannelForge/Public/Get-ChannelForgeOneGuide.ps1; tests/unit/OneGuide.Tests.ps1; tests/unit/WebServer.Tests.ps1; tests/unit/GeneratedReportSchemas.Tests.ps1; docs/architecture/ARCHITECTURE.md; docs/developer/DEVELOPER_GUIDE.md; docs/user/CURRENT_LIMITATIONS.md. The identity regression verifies conflicting metadata separation, exact-duplicate grouping, stable output under permutation, and metadata isolation. Focused tests 65/65 and full pinned Pester 5.7.1 867/867 passed; fresh actual-loopback 3,000-programme run exercised all three route types.

Safety/output boundary: Requests read only verified accepted-guide artifacts; no provider fetch, source/config write, accepted-state mutation, downstream call, or guide publication occurs. Source-row evidence contributes to deterministic identity only. Public source/channel/promotion identifiers remain opaque; emitted fields stay bounded and sanitized, with no raw provider/account/credential values or raw internal row evidence exposed. HTTP JSON remains under the versioned projection schema; no reports or files are written by this projection.

Disposition: PASS for the inspected One Guide identity/projection intent and safety boundary. No material implementation gap identified. This intent-fit result does not substitute for the separately required independent GPT-6 Sol HIGH review.

[Jumpstile]

Exact-head hosted CI — 90954ba92004b5db2bf9e3db58400e7cd58be31e

GitHub Actions run 36585448355 completed successfully: secret-scan PASS and quality-gates PASS. This run is for the pushed PR head above. Local validation evidence and the intent-fit note are in the preceding PR comments.

[Jumpstile]

Intent-fit audit — 16e30826c909ea05a1312fab42c2ef6570f2eeea

Intended behavior: One Guide is a deterministic, read-only projection of a verified accepted XMLTV generation. Unavailable accepted source state must not masquerade as a valid empty result; a valid accepted guide with no query matches remains successful and empty.

Entry points: Get-ChannelForgeWebOneGuideCatalogue and Get-ChannelForgeWebOneGuideResponse in src/ChannelForge/Private/Get-ChannelForgeWebOneGuideResponse.ps1; HTTP route dispatch remains through Get-ChannelForgeWebResponse. Regression coverage is in tests/unit/WebServer.Tests.ps1.

Evidence inspected: catalogue loader now clears its cache and throws if the accepted pointer/generation is absent, and throws if accepted XMLTV is null (lines 8–10, 31–35, 47–49). The existing response catch emits HTTP 503 one-guide-unavailable (lines 143–147). Tests assert 503 for missing accepted generation and NotGenerated XMLTV, HTTP 200/empty for an accepted guide with only an expired programme, and preserve existing corrupt/unverified-state 503 coverage. Full Pester reported 869 passed/0 failed/0 skipped; focused OneGuide/WebServer reported 61/61 passed. The three synced docs name the 503-versus-valid-empty distinction.

Safety and scope boundary: The change only tightens missing/unavailable accepted-guide handling. It does not fetch sources, recover/mutate accepted state, expose raw errors, alter the eight Slice-1 categories, or change the accepted XMLTV parsing/cache/projection hot path. The earlier realistic 3,000-programme warm benchmark remains applicable because the measured catalogue/cache path is unchanged. Hockey and auto-racing remain outside Slice 1.

Disposition: PASS for the unavailable-vs-valid-empty intent and safe boundary. This implementation intent-fit audit is not the separately required GPT-6 Sol HIGH independent exact-head review; hosted exact-head CI and that review remain pending.