{
  "file_path": "D:\\Python\\Quantum\\NGUYEN.md",
  "old_string": "## 4. ATTACK TRACKS\n- **A. Certificate extension** (moments, windows, SDP, prime pairs)\n- **B. Spectral / Hilbert\u2013P\u00f3lya** (quantum formalism from R1; Gabor\n  frame \u2194 self-adjoint operator; Berry\u2013Keating; de Branges)\n- **C. Positivity criteria** (Weil growing support, Li coefficients,\n  de Bruijn\u2013Newman \u039b = 0)\n- **D. Formal verification** (Lean 4 skeletons for every lemma)",
  "new_string": "## 4. ATTACK TRACKS\n- **A. Certificate extension** (moments, windows, SDP, prime pairs)\n- **B. Spectral / Hilbert\u2013P\u00f3lya** (quantum formalism from R1; Gabor\n  frame \u2194 self-adjoint operator; Berry\u2013Keating; de Branges)\n- **C. Positivity criteria** (Weil growing support, Li coefficients,\n  de Bruijn\u2013Newman \u039b = 0)\n- **D. Formal verification** (Lean 4 skeletons for every lemma)\n\n## 4A. KNOWLEDGE INTEGRATION & EXTERNAL RESEARCH (STANDING ORDER)\nGoal reminder: solve RH by COMBINING all knowledge at our disposal.\n1. **Use the full equation inventory.** Every attack must actively consider\n   the complete toolset \u2014 quantum formalism (R1), analytic number theory\n   (R2, R4), spectral theory, random matrix theory, physics equations\n   (physics.info) \u2014 and seek cross-domain combinations, never stay inside\n   a single track by default.\n2. **Cross-pollination check.** Before abandoning any approach, ask: which\n   OTHER track's machinery could close this gap? Log cross-track ideas in\n   the session journal even when not pursued.\n3. **Web research before obstruction.** When knowledge is missing, research\n   the web (arXiv, surveys, MathOverflow, LMFDB, OEIS) BEFORE declaring a\n   dead end. Record every external source used \u2014 URL, what was taken, date \u2014\n   in the derivation/result file; paper-worthy sources go to references.bib.\n4. **Master tool index.** research/derivations/D-001 (built in Phase 0.1)\n   is the living index of all usable equations/tools; every newly\n   discovered tool is added there so no later session rediscovers it."
}

{
  "filePath": "D:\\Python\\Quantum\\RH-WEBSITE.md",
  "oldString": "- **Email notification (2026-08-28):** every submission also emails\n  `dan@researchai.dev` via the server's local Exim (`EMAIL_HOST=127.0.0.1:25`,\n  From `noreply@researchai.dev`) \u2014 production only, `FEEDBACK_NOTIFY_EMAIL`\n  lives in the deployed settings patch (unset locally = no-op);\n  `fail_silently` + try/except so mail can never break a submission.\n  (MX for researchai.dev is MS365; SPF `include:secureserver.net` covers\n  this host; DMARC passes via SPF alignment.)",
  "newString": "- **Email notification (2026-08-28, VERIFIED live):** every submission also\n  emails `dan@researchai.dev` via the server's local Exim\n  (`EMAIL_HOST=127.0.0.1:25`, From `noreply@researchai.dev`) \u2014 production\n  only, `FEEDBACK_NOTIFY_EMAIL` lives in the deployed settings patch (unset\n  locally = no-op); `fail_silently` + try/except so mail can never break a\n  submission. (MX for researchai.dev is MS365; SPF `include:secureserver.net`\n  covers this host; DMARC passes via SPF alignment.)\n  - \u26a0 GOTCHA (found + fixed 2026-08-28): cPanel **Email Routing** for\n    researchai.dev MUST be **Remote Mail Exchanger**. As a hosted domain it\n    defaulted to local, so Exim never consulted the public MX and\n    `/etc/valiases/researchai.dev` silently DISCARDED `dan@` (cPanel Track\n    Delivery showed \"Discard\"; MS365 quarantine empty because MS365 never\n    saw the mail). Verified after the switch by a live feedback-form test +\n    a direct smtplib test over SSH \u2014 both received in the MS365 inbox.\n  - OPS NOTE: the SSH shell is CageFS-jailed \u2014 it CANNOT see\n    `/etc/valiases`, `/etc/localdomains`, or `/var/log/exim_mainlog`\n    (all \"No such file\"). Delivery verification is inbox receipt + cPanel\n    Track Delivery; SMTP-path testing works (127.0.0.1:25 accepts).",
  "originalFile": "# RH-WEBSITE.md \u2014 NGUYEN-RH-1 Research Website\n# Standing plan + operations document. READ FIRST when doing website work.\n# Created: 2026-08-19 | Status: ACTIVE | Version: 1.0\n# ============================================================\n\n## 0. \u26d4 HARD RULE \u2014 READ FIRST (user directive, 2026-08-19)\n**DO NOT WRITE to any research document.** The research archive\n(NGUYEN.md, STATE.md, everything under `research/`, git history) is the\nsingle source of truth and is modified ONLY by the research agent per\nNGUYEN.md \u00a78.4. Website work may touch ONLY:\n- `D:\\Python\\Quantum\\web\\`          (all website code, data, logs)\n- `D:\\Python\\Quantum\\RH-WEBSITE.md` (this file)\n\nThe website reads research files exclusively through READ-ONLY handles:\nSQLite via `mode=ro` URI, text files opened `'r'`. Feedback submissions\ngo to `web/feedback/` + `web/feedback.db` \u2014 never into `research/`.\nWhen committing, stage ONLY `web/` and `RH-WEBSITE.md` by name.\n\n## 1. PURPOSE\nPublic-facing-style (localhost-only) interactive dashboard for the\nNGUYEN-RH-1 Riemann Hypothesis research project. Goals:\n- Landing page explaining RH and the research mission to a general audience.\n- Live progress: current stage, next action, metrics \u2014 auto-updating as the\n  research agent writes to the file system.\n- Browsable archive: results, experiments (+ interactive charts),\n  derivations, graveyard, journal, resources atlas, paper status.\n- Feedback channel: visitors submit comments/suggestions; searchable;\n  researcher reviews them to help the research.\n\n## 2. ARCHITECTURE\n- Location: `D:\\Python\\Quantum\\web\\` \u2014 Django project `rhweb`, app `dashboard`.\n- Interpreter: project `.venv` (`./.venv/Scripts/python.exe`).\n  Deps: `web/requirements-web.txt` (Django, markdown).\n- Server: `python web/manage.py runserver 127.0.0.1:8001` \u2014 localhost only.\n- Frontend: vanilla JS + vendored Plotly.js (interactive charts) +\n  vendored MathJax (tex-chtml) for math in markdown. NO CDN dependency.\n- Live updates: frontend polls `GET /api/status/` every 3 s; the endpoint\n  reports file mtimes + parsed STATE.md + active run-logs + new-feedback\n  count + summary_stats (checklist counters, phase table, collection\n  counts); changed panels refresh in place. No WebSockets/Redis.\n\n### Data flow (all read-only on research/)\n| Source | How read | Used by |\n|---|---|---|\n| STATE.md | parse `## SECTION` blocks ('r') | Dashboard, status bar |\n| NGUYEN.md | checklist \u00a75 `- [x]/[~]/[ ]` counts; \u00a77 ledger | Dashboard metrics, Roadmap |\n| research/research.db | sqlite3 `file:...?mode=ro` | Ledger, Experiments, Derivations, Graveyard, Journal indexes |\n| research/numerics/data/*.json | json.load ('r') | Experiment cards (checks, key values, caveats) |\n| research/numerics/data/*.csv | csv module, downsampled | Plotly charts, table previews |\n| research/**/*.md | python-markdown + math-protect | Archive pages |\n| research/numerics/data/*-run.log | tail (last N lines) | Live Runs page |\n| git log | `git log --oneline` subprocess (read-only) | Dashboard activity feed |\n\n## 3. FILE MAP\n```\nweb/\n\u251c\u2500\u2500 manage.py\n\u251c\u2500\u2500 lockcheck.py              # \u00a70 verification: proves the server never\n\u2502                             #   blocks writers (run: .venv python web/lockcheck.py)\n\u251c\u2500\u2500 requirements-web.txt\n\u251c\u2500\u2500 rhweb/                  # project: settings.py, urls.py, wsgi.py\n\u251c\u2500\u2500 dashboard/\n\u2502   \u251c\u2500\u2500 research_data.py    # ALL read-only parsers (single module to audit \u00a70)\n\u2502   \u251c\u2500\u2500 models.py           # Feedback + VisitorLog models (web/feedback.db ONLY)\n\u2502   \u251c\u2500\u2500 middleware.py       # VisitorLogMiddleware (access log \u2192 feedback.db)\n\u2502   \u251c\u2500\u2500 admin.py            # Django admin: feedback triage + visitor log views\n\u2502   \u251c\u2500\u2500 views.py            # pages (feedback POST also emails dan@researchai.dev)\n\u2502   \u251c\u2500\u2500 api.py              # /api/health, /api/status, /api/logtail\n\u2502   \u251c\u2500\u2500 urls.py\n\u2502   \u251c\u2500\u2500 templates/dashboard/*.html\n\u2502   \u2514\u2500\u2500 static/dashboard/{style.css, app.js, vendor/plotly.min.js, vendor/tex-chtml.js}\n\u251c\u2500\u2500 feedback/               # one JSON per submission (dual storage)\n\u251c\u2500\u2500 feedback.db             # SQLite index for search (Django default DB)\n\u2514\u2500\u2500 logs/                   # server.log, healthcheck.log\n```\n\n## 4. PAGES (left sidebar)\n1. **Home** `/` \u2014 RH explainer, mission, 4 attack tracks, success ladder.\n2. **Dashboard** `/dashboard/` \u2014 current stage (STATE.md), next action,\n   progress metrics (phases bar, tasks done/total, ledger size), git feed.\n3. **Roadmap** `/roadmap/` \u2014 NGUYEN.md \u00a75 checklist rendered w/ status.\n4. **Search** `/search/` \u2014 global archive search (see \u00a77 note): AND-of-terms\n   case-insensitive scan across all MD_COLLECTIONS markdown; snippets with\n   line numbers + highlighted matches; results hits link to /ledger/R-NNN/.\n5. **Results Ledger** `/ledger/` + `/ledger/R-NNN/` \u2014 claims + honesty tags.\n6. **Experiments** `/experiments/` + `/experiments/E-NNN/` \u2014 sidecar cards;\n   Plotly charts from CSVs (config in research_data.CHARTS); pass/fail badges.\n7. **Scripts & Data** `/scripts/` + `/scripts/<stem>/` \u2014 all experiment\n   scripts; per-script data files (experiment-table links \u222a exact-stem\n   matches) shown as paginated spreadsheet tables (500 rows/page, sticky\n   header + row-number gutter, numeric right-align) + JSON sidecars +\n   collapsible verbatim source-code view.\n8. **Derivations** `/derivations/` + detail \u2014 37 D-files, math rendered.\n9. **Graveyard** `/graveyard/` \u2014 documented dead ends.\n10. **Journal** `/journal/` + detail \u2014 session narratives.\n11. **Resources** `/resources/` + detail \u2014 43-note RH-equivalence atlas.\n12. **Paper** `/paper/` \u2014 paperA.tex status (first 80 lines), paper-folder\n    inventory.\n13. **Lean Proofs** `/lean/` + `/lean/<file>/` + `/lean/audit/<txt>/` \u2014\n    formal-verification transparency: toolchain + totals, axiom-policy card,\n    LiClosed.lean verbatim, the 7-perimeter defs extracted verbatim,\n    per-file declaration tables + source, #print-axioms audit transcripts.\n14. **Live Runs** `/live/` \u2014 tail view of *-run.log, 3 s polling.\n15. **Feedback** `/feedback/` \u2014 submit form + search (text, category, status).\n16. **Conversations** `/conversations/` \u2014 browse the Nguyen CLI conversation\n    index (`~/.nguyen/projects/D--Python-Quantum/agent.db`, outside the repo,\n    opened read-only): session list; per-session message cards with\n    thinking/tool blocks (collapsible), FTS search + kind filters; single\n    message view `/conversations/<spk>/msg/<id>/` with prev/next arrows,\n    arrow-key navigation, jump-to-id, raw JSON row view.\n\n## 5. FEEDBACK SYSTEM\n- Submit: name (optional), category (general/suggestion/question/correction/\n  track-A/B/C/D), text. CSRF-protected; autoescaped on render.\n- Dual storage (mirrors NGUYEN.md \u00a78.2): JSON file per submission in\n  `web/feedback/FB-<utc>-<id>.json` + row in `web/feedback.db`.\n- Search: full-text (name+text) + category/status filters.\n- Statuses: new \u2192 reviewed \u2192 acted-on (status changes are website data,\n  allowed under \u00a70; researcher notes field for follow-up).\n- **Email notification (2026-08-28):** every submission also emails\n  `dan@researchai.dev` via the server's local Exim (`EMAIL_HOST=127.0.0.1:25`,\n  From `noreply@researchai.dev`) \u2014 production only, `FEEDBACK_NOTIFY_EMAIL`\n  lives in the deployed settings patch (unset locally = no-op);\n  `fail_silently` + try/except so mail can never break a submission.\n  (MX for researchai.dev is MS365; SPF `include:secureserver.net` covers\n  this host; DMARC passes via SPF alignment.)\n\n## 5A. ADMIN BACKEND + VISITOR LOG (2026-08-28)\n- **Django admin at `/admin/`** \u2014 the researcher's private backend:\n  Feedback changelist (list-editable status, filters, search, date\n  hierarchy) + VisitorLog changelist (read-only, append-only).\n  Login: user `dan` + the same password as the SSH account (user choice\n  2026-08-28). Superuser created over SSH via\n  `DJANGO_SUPERUSER_*` env vars + `createsuperuser --noinput`.\n- **Visitor log:** `dashboard/middleware.py` VisitorLogMiddleware appends\n  one row per public GET/POST to `dashboard_visitorlog` in feedback.db:\n  created, ip, method, path, query, referrer, user_agent, is_bot (UA regex).\n  Skips `/static/`, `/api/` (3 s polling would flood it), `/admin/`,\n  `/favicon.ico`; exceptions swallowed \u2014 logging never breaks a page.\n  Raw Apache log also readable at `~/access-logs/researchai.121swr.com-ssl_log`\n  (researchai.dev traffic logs under the cPanel auto-subdomain).\n- Admin statics: collected into docroot `/static/admin/` via\n  `collectstatic` on the server (127 files, 2026-08-28).\n- OPS GOTCHAS (learned 2026-08-28): (1) in paramiko `exec_command` shells\n  `$PWD` is NOT set \u2014 use absolute paths in PYTHONPATH, plus\n  `DJANGO_SETTINGS_MODULE=rhweb.settings` for bare-python scripts;\n  (2) any POST to the live site needs an `Origin: https://researchai.dev`\n  header or Django CSRF 403s (admin login, feedback); (3) server-side\n  management: `cd $SITE && PYTHONPATH=$SITE/app/vendor:$SITE/app/web\n  /opt/alt/python311/bin/python3.11 app/web/manage.py <cmd>`.\n\n## 6. OPERATIONS\n### 6.1 Session-start protocol (website work)\n1. Read this file.\n2. Run `./.venv/Scripts/python.exe web/healthcheck.py --restart`\n   (checks /api/health + all routes + status-API freshness; restarts the\n   server if unreachable). Fix any failing route before other work.\n3. Check the watchdog is alive: `web/logs/watchdog.log` tail should show\n   entries within the last ~10 min; if not, restart it (\u00a76.2b).\n4. Review new feedback: `web/feedback.db` status='new' (or the /feedback/\n   page); surface relevant items to the user.\n5. Improvement pass (standing order, user 2026-08-19): look for at least\n   one interface or data-presentation improvement per session; log ideas\n   in \u00a78 below and implement the worthwhile ones.\n### 6.2 Start server (detached, sandbox DISABLED \u2014 long-run rule)\n```\ncd D:\\Python\\Quantum && ./.venv/Scripts/python.exe web/manage.py runserver \\\n  127.0.0.1:8001 >> web/logs/server.log 2>&1   # DETACHED_PROCESS\n```\n### 6.2b Watchdog (always-on monitoring, started 2026-08-19)\n`web/watchdog.py` runs detached between sessions: every 300 s it runs the\nhealth checks and restarts the server if unreachable. Logs:\n`web/logs/watchdog.log` + `web/logs/healthcheck.log`.\nStart detached: `subprocess.Popen([sys.executable, 'web/watchdog.py'], ...)`\nwith DETACHED_PROCESS (same pattern as \u00a76.2).\n### 6.3 Restart / health\n- Stop: find PID via `netstat -ano | findstr :8001`, `taskkill /PID <pid> /F`.\n- **Restart required after ANY code OR template change** (templates are\n  cached in-process \u2014 a home.html edit did not appear until restart,\n  2026-08-19). Static CSS/JS changes serve immediately \u2014 BUT runserver\n  sends no cache headers, so browsers heuristic-cache them: after ANY\n  style.css/app.js change, ALSO bump the `?v=` query on both tags in\n  `templates/dashboard/base.html` (convention: date-serial, e.g.\n  `?v=20260827-2`) or visitors keep running stale assets (hamburger\n  breakage, 2026-08-27).\n  NOTE: port is **8001** since 2026-08-19 \u2014 port 8000 is reserved for the\n  user's other service (do not use it).\n- Log tail: `web/logs/server.log`.\n- First run after code change to models:\n  `./.venv/Scripts/python.exe web/manage.py migrate`.\n### 6.4 Updating the site when research data changes shape\n- New experiment: automatic (db + sidecars). Charts: add entry to\n  `research_data.CHARTS` (x/y columns, type).\n- New markdown folders: register in `research_data.MD_COLLECTIONS`.\n- Never patch around \u00a70 \u2014 if a feature needs research-archive writes,\n  STOP and ask the user.\n### 6.5 Lock-safety guarantees (verified 2026-08-19, web/lockcheck.py)\n- Text/md/CSV/log reads use Python 'r' handles (Windows share mode allows\n  concurrent writers) and close immediately after each read.\n- research.db / agent.db opened SQLite mode=ro per query, closed in finally;\n  shared read lock exists only for the duration of each SELECT (ms).\n- Server runs --noreload: no autoreload file watchers held open.\n- git log is read-only plumbing (no index lock).\n- Empirical: 24 s of 4-thread HTTP load across all heavy pages while taking\n  120 DB write locks (BEGIN IMMEDIATE/ROLLBACK) + 360 write-intent file\n  opens on STATE.md, NGUYEN.md, CSVs, run-logs \u2014 zero conflicts, zero stalls.\n\n### 6.6 Production deployment \u2014 researchai.dev (live since 2026-08-27)\nThe public site runs on a shared Apache host via a CGI adapter; the local\nrepo is NOT modified for deployment (staging copy carries the prod patches).\n- **FTP login (user directive 2026-08-27: stored here for future use):**\n  - Server: `121swr.com` port 21 (plain FTP / explicit FTPS).\n    \u26a0 `ftp.121swr.com` does NOT exist in DNS \u2014 use `121swr.com`.\n  - Username: `[ftp-user]@researchai.dev`\n  - Password: `[REDACTED]`\n  - FTP root = web docroot. `SITE CHMOD` works; MFMT honored (preserves\n    mtimes \u2014 upload.py already sets them).\n- **SSH login (user directive 2026-08-28: stored here for future use):**\n  - IP address: `208.109.226.46`, port `22`\n  - cPanel username: `[cpanel-user]`\n  - Password: `[REDACTED]`\n  - The NGUYEN-RH-1 website lives in `~/public_html/researchai.dev`\n    (corrected 2026-08-28 \u2014 NOT the account `/public_html` root).\n  - **\u2b50 STANDING DIRECTIVE (user, 2026-08-28): use SSH/SFTP instead of\n    FTP for ALL server ops from now on** (uploads, updates, shell work) \u2014\n    it supersedes the FTP/upload.py workflow below. Verified working\n    2026-08-28 (password auth, CloudLinux EL8). `paramiko 5.0.0` is\n    installed in the project `.venv` for scripted SSH/SFTP.\n- \u26a0 This file now contains live credentials: **NEVER upload RH-WEBSITE.md\n  to the web host** (it is not in the deploy set \u2014 keep it that way).\n- Architecture: `.htaccess` routes non-file requests to `/app.cgi`\n  (wsgiref CGIHandler \u2192 Django WSGI); statics in `/static/` served by\n  Apache; all code/data under `/app/` (blocked by rewrite rule +\n  `/app/.htaccess` Require all denied). Server Python:\n  `/opt/alt/python311/bin/python3.11` (3.11.15); vendored Django 5.2.17 +\n  markdown in `/app/vendor/`. agent.db lives at `/app/web/database/agent.db`.\n- Staging + tooling: `D:\\Python\\quantum-deploy\\` \u2014 `docroot/` (server\n  mirror), `upload.py` (resumable 6-thread FTP, size-skip + MFMT; run\n  DETACHED \u2014 CLI kills foreground Bash at ~2 min), `fix_mtimes.py`,\n  `smoke_test.py`, `verify_site.py`. FTP password is passed via the\n  `FTP_PASS` env var, never written into the scripts.\n- Re-deploy: re-copy web/+research/+STATE.md+NGUYEN.md into\n  `docroot/app/`, re-apply the deployed-only patches (prod settings.py,\n  AGENT_DB path, scripts badges, Paper nav link hidden \u2014 user directive\n  2026-08-27, route stays live), then `FTP_PASS=... python upload.py`.\n\n## 7. IMPROVEMENT BACKLOG (standing order \u2014 review each session)\n\u26d4 DELIBERATE EXCLUSION (user directive, 2026-08-27):\n`research/correspondence/` (the Lagarias F-D package) is PRIVATE until\nthe user decides to publish \u2014 do NOT build any website view of it, and\ndo not re-propose it in coverage audits. Everything else in the\nresearch archive was verified fully covered by the site on 2026-08-27.\n\nIdeas not yet implemented, ranked by value:\n1. Conversations: \"new activity\" badge when agent.db grows between polls.\n2. Experiments: diff view when a sidecar's checks change between runs.\n3. Charts: E-019 zero-flow needs series-column grouping support.\n4. Search snippets: highlight ALL query terms in each snippet (currently\n   only the term at the snippet's anchor position gets <mark>).\n5. Mobile: plain .tbl tables inside cards can overflow very narrow\n   screens \u2014 wrap like .table-scroll.\nDone:\n- 2026-08-27: MM-DD-YYYY date format + nowrap date columns (user request) \u2014\n  new dashboard/templatetags/usdate.py filter applied to every UI date\n  render across 17 templates (Updated columns, file-detail lines,\n  Roadmap/Paper \"Last updated\", ledger/experiment/session dates); date\n  table cells get class=\"date\" with .tbl td.date{white-space:nowrap} so\n  hyphens no longer break the line; app.js freshness line formats\n  MM-DD-YYYY HH:MM:SS UTC. Archive markdown content dates stay verbatim\n  ISO (\u00a70 verbatim rule \u2014 UI chrome only). Asset version bumped\n  (?v=20260827-5). OPS NOTE: a server generation started BEFORE the new\n  templatetags/ dir existed 500s on {% load usdate %} (stale importlib\n  dir cache) \u2014 healthcheck --restart is mandatory after adding\n  templatetags modules; the watchdog self-healed this instance.\n- 2026-08-27: topbar search box on every page (user request) \u2014 compact\n  GET form in the sticky topbar (right side), submits to /search/?q=\u2026;\n  prefilled on the search page itself; topbar now flex with the task\n  text ellipsized; on \u2264900px the \"Current task:\" label hides and the\n  input narrows. Full-site crawl the same day: 300 pages, all 200, no\n  broken internal links (2 flagged /conversations/ pages were false\n  positives \u2014 archived session content literally contains traceback\n  text). Asset version bumped (?v=20260827-4).\n- 2026-08-27: Lean Proofs section `/lean/` (user request, full design) \u2014\n  transparency cards (toolchain v4.33.0-rc2, axiom policy, 29 files /\n  27,906 lines / 879 decls / 5 skeleton-only sorries / 22 audits / 483\n  audited decls), LiClosed.lean verbatim inline, the 7-perimeter def\n  blocks extracted verbatim with plain-language notes, per-file detail\n  pages (parsed declaration table + full source), audit transcript\n  viewer. Sorries counted as proof-terms only (by-sorry / :=-sorry) \u2014\n  matches the documented \"1 Suzuki + 4 valley\" exactly; the session-013\n  audit's 5 sorryAx labelled \"intended skeletons\" (not a failure).\n  Healthcheck now 27 routes.\n- 2026-08-27: Scripts & Data page `/scripts/` (user request) \u2014 index of all\n  45 research/numerics/scripts/*.py with their experiment links + data\n  files; detail pages render each CSV as a spreadsheet table (500-row\n  server-side pagination, sticky header, sticky row-number gutter with\n  true CSV line numbers, numeric-column right-align, hover stripes) and\n  each JSON sidecar as a collapsible pretty-printed block. Script\u2192data\n  mapping = experiments-table links \u222a exact-stem matches (verified: all\n  45 scripts resolve correctly; utility scripts show \"none registered\").\n  Routes added to healthcheck (now 24); traversal guard verified 404.\n- 2026-08-27: mobile/responsive sidebar (backlog #3) \u2014 at \u2264 900px the\n  sidebar goes off-canvas (translateX transition) behind a hamburger\n  button in the sticky topbar; backdrop tap, Escape, or any menu-link\n  click closes it; state is body.nav-open (aria-expanded wired);\n  content padding shrinks to 16px. Desktop layout unchanged.\n- 2026-08-27: dashboard + home stat counters auto-refresh (backlog #4) \u2014\n  /api/status/ now carries summary_stats(); app.js updates all counters\n  (dashboard: done/partial/open/results/experiments/feedback; home: done/\n  results/experiments/derivations/graveyard/sessions) every 3 s, and\n  rebuilds the dashboard phases table on change only (signature compare,\n  DOM-API build \u2014 no innerHTML). Static git-feed / recent-sessions tables\n  intentionally left server-rendered.\n- 2026-08-27: global search page `/search/` (backlog #1) \u2014 AND-of-terms\n  case-insensitive scan-on-query across all MD_COLLECTIONS markdown\n  (results/derivations/graveyard/journal/resources); up to 3 snippets per\n  file with line numbers + <mark> highlights; results hits mapped to\n  /ledger/R-NNN/; 100-file cap with truncation notice; sidebar entry;\n  /search/ + a sample query added to the healthcheck ROUTES (now 22).\n  Also: watchdog found dead (last log 2026-08-21) and respawned detached.\n- 2026-08-19: healthcheck.py + watchdog.py (\u00a76.1/\u00a76.2b); Home latest-result\n  card now dynamic (was hardcoded R-004); dashboard data-freshness line\n  (STATE.md/research.db/agent.db, live via polling); E-017 chart.\n- 2026-08-22: bug fixes. (1) git_log 500 on /dashboard/ \u2014 subprocess\n  decoded git's UTF-8 commit output as cp1252; reader thread died on\n  Unicode commit messages and stdout came back None. Fixed with\n  encoding=\"utf-8\", errors=\"replace\" + a None guard. (2) Roadmap Phase 2 /\n  5B checklists rendered as paragraph text \u2014 those phases have a note\n  paragraph directly above the list (no blank line) and python-markdown\n  never lets a list interrupt a paragraph (sane_lists or not). Fixed with\n  research_data._restore_interrupted_lists: inserts the missing blank line\n  before a list that follows paragraph text (skips indented item\n  continuations so existing lists stay tight; skips fenced code). Archive\n  text rendered verbatim as before \u2014 block structure only.\n- 2026-08-20: math typography pass APPLIED then REVERTED same day (user\n  directive). Context: MathJax 3.2.2 works (resources atlas has real\n  LaTeX); the research archive writes plain Unicode math, so MathJax has\n  nothing to typeset there \u2014 that is the correct, intended rendering.\n  A display-formula-lifting heuristic (research_data._display_formulas +\n  .math-line styling) was built and then removed at user request:\n  **the website renders the research archive VERBATIM \u2014 no presentation\n  transforms, no conversions, no re-boxing of archive text.** Do not\n  re-attempt Unicode\u2192LaTeX conversion or formula-detection heuristics;\n  the archive's plain-Unicode math is the source of truth and its\n  verbatim display is correct by definition.\n\n## 8. BUILD STATUS\n- [x] Plan written (v1.0, 2026-08-19)\n- [x] Dependencies installed (Django 6.1, markdown 3.10.3); vendored JS\n      (plotly 2.35.2, MathJax 3.2.2 tex-chtml)\n- [x] Django scaffold (rhweb project + dashboard app)\n- [x] Parsers / views / API (research_data.py read-only layer)\n- [x] Templates / CSS / JS (12 pages, sidebar, 3 s polling, Plotly charts)\n- [x] Server verified live at 127.0.0.1:8001 \u2014 all 15 routes 200;\n      feedback POST/search verified; path-traversal guard verified;\n      smoke-test data cleaned up\n- [x] Initial commit (web/ + RH-WEBSITE.md only)\n",
  "structuredPatch": [
    {
      "oldStart": 117,
      "oldLines": 13,
      "newStart": 117,
      "newLines": 24,
      "lines": [
        " - Search: full-text (name+text) + category/status filters.",
        " - Statuses: new \u2192 reviewed \u2192 acted-on (status changes are website data,",
        "   allowed under \u00a70; researcher notes field for follow-up).",
        "-- **Email notification (2026-08-28):** every submission also emails",
        "-  `dan@researchai.dev` via the server's local Exim (`EMAIL_HOST=127.0.0.1:25`,",
        "-  From `noreply@researchai.dev`) \u2014 production only, `FEEDBACK_NOTIFY_EMAIL`",
        "-  lives in the deployed settings patch (unset locally = no-op);",
        "-  `fail_silently` + try/except so mail can never break a submission.",
        "-  (MX for researchai.dev is MS365; SPF `include:secureserver.net` covers",
        "-  this host; DMARC passes via SPF alignment.)",
        "+- **Email notification (2026-08-28, VERIFIED live):** every submission also",
        "+  emails `dan@researchai.dev` via the server's local Exim",
        "+  (`EMAIL_HOST=127.0.0.1:25`, From `noreply@researchai.dev`) \u2014 production",
        "+  only, `FEEDBACK_NOTIFY_EMAIL` lives in the deployed settings patch (unset",
        "+  locally = no-op); `fail_silently` + try/except so mail can never break a",
        "+  submission. (MX for researchai.dev is MS365; SPF `include:secureserver.net`",
        "+  covers this host; DMARC passes via SPF alignment.)",
        "+  - \u26a0 GOTCHA (found + fixed 2026-08-28): cPanel **Email Routing** for",
        "+    researchai.dev MUST be **Remote Mail Exchanger**. As a hosted domain it",
        "+    defaulted to local, so Exim never consulted the public MX and",
        "+    `/etc/valiases/researchai.dev` silently DISCARDED `dan@` (cPanel Track",
        "+    Delivery showed \"Discard\"; MS365 quarantine empty because MS365 never",
        "+    saw the mail). Verified after the switch by a live feedback-form test +",
        "+    a direct smtplib test over SSH \u2014 both received in the MS365 inbox.",
        "+  - OPS NOTE: the SSH shell is CageFS-jailed \u2014 it CANNOT see",
        "+    `/etc/valiases`, `/etc/localdomains`, or `/var/log/exim_mainlog`",
        "+    (all \"No such file\"). Delivery verification is inbox receipt + cPanel",
        "+    Track Delivery; SMTP-path testing works (127.0.0.1:25 accepts).",
        " ",
        " ## 5A. ADMIN BACKEND + VISITOR LOG (2026-08-28)",
        " - **Django admin at `/admin/`** \u2014 the researcher's private backend:"
      ]
    }
  ],
  "userModified": false,
  "replaceAll": false
}