Merge remote-tracking branch 'origin/ad2'

.claude/memory/MEMORY.md

@@ -160,3 +160,4 @@
 - [CT Thoughts backlog](feedback_ct_thoughts_backlog.md) — ClaudeTools harness ideas go in docs/CT_THOUGHTS.md (trigger "ct thought:"); CT analogue of RMM_THOUGHTS. Don't build until explicit go. First entry = ClaudeTools 3.0 web co-work vision.
 - [AI-auth product boundary](project_ai_auth_product_boundary.md) — ClaudeTools/ClaudeTools 3.0 = internal-only, per-person subscription OAuth ok; GuruRMM = sellable, customer brings own API key (never ACG's subscription); backend dev = internal. Anthropic ToS bans subscription auth in third-party products.
 - [RMM SYSTEM context can't see user mapped drives](feedback_rmm_system_context_mapped_drives.md) — RMM runs as SYSTEM; `Test-Path F:\` etc. is False even when the user's mapped/redirected drive exists. Diagnose mapped-drive/redirect issues in `context:user_session`. Elevated apps (e.g. QB DB Server Manager "unable to retrieve root folder") need `EnableLinkedConnections=1` + reboot.
+- [AD2 = Dataforth-ops fork](project_ad2_dataforth_fork.md) — branch ad2 = main + thin Dataforth layer; keep fork edits ADDITIVE (Dataforth context in clients/dataforth/CLAUDE.dataforth.md, NOT .claude/CLAUDE.md); rebase onto main directly when sync.sh self-lock hits; no vault/jq/sops/age on this box.

.claude/memory/project_ad2_dataforth_fork.md

@@ -0,0 +1,19 @@
+---
+name: project_ad2_dataforth_fork
+description: AD2 is the Dataforth-operations fork (branch ad2); how it relates to main and how to sync it cleanly
+metadata:
+  type: project
+---
+
+AD2 (192.168.0.6, Dataforth domain controller) runs the **`ad2` branch** — a fork dedicated to Dataforth operations. Its `/sync` model is: `git rebase origin/main` then `git push origin ad2`, so `ad2` = `main` + a thin layer of Dataforth-specific commits.
+
+**Keep the fork layer ADDITIVE** — never edit shared fleet files (especially `.claude/CLAUDE.md`) on `ad2`, or every sync re-conflicts. On 2026-06-17 the old fork edit of `.claude/CLAUDE.md` was relocated: `.claude/CLAUDE.md` now tracks the lean fleet doc (from main), and Dataforth operational context (network, credentials, pipeline, batch-file versions) lives in **`clients/dataforth/CLAUDE.dataforth.md`**. Read that file for Dataforth context.
+
+**Sync gotchas on AD2:**
+- `sync.sh` is NOT fork-aware on the PUSH step: it pushes `main` (`error: src refspec main does not match any`), so `/sync` and `/save` auto-sync ALWAYS fail at Phase 4 on this fork. It DOES rebase + commit fine. After running it, push manually: `git push --force-with-lease origin ad2` (force needed because the rebase rewrote history). The documented fork flow (fetch → rebase origin/main → push origin ad2) is the reliable path.
+- `sync.sh` cannot overwrite itself while it is the executing script (Windows file lock) → the rebase step fails mid-run with "unable to create file .claude/scripts/sync.sh: Permission denied" the FIRST time main has a new sync.sh. When that happens: `git reset --hard HEAD`, `git clean -fd` (removes the partial origin/main checkout debris), then run `git rebase origin/main` **directly** (not via sync.sh), and force-push with `--force-with-lease`.
+- Submodule `projects/msp-tools/guru-connect` fails to clone from 172.16.3.20 (ACG-internal, unreachable from Dataforth LAN) — non-fatal sync warning.
+- Python was absent until 2026-06-17 (installed 3.12.8, `py` launcher); identity.json was created then too (`user=mike`, `machine=AD2`).
+- Missing tooling: `jq`, `sops`, `age`. No vault cloned (`D:/vault` absent) → vault sync is N/A here. coord_api (172.16.3.30) is unreachable from the Dataforth LAN.
+
+Related: [[project_ad2_context.md]]

.claude/memory/project_dsca33_45_resolved_via_hoffman.md

@@ -17,11 +17,28 @@ Mined **56 of 58 models** straight from Hoffman into `projects/dataforth-dos/dsc
 Coverage: ~7,157 units already correct + live on Hoffman (no action); ~1,580 not-yet-uploaded units
 need rendering from the mined templates + AD2's already-derived slotMaps.
 
-AD2 handoff + the critical gate: `projects/dataforth-dos/DSCA33-45-HOFFMAN-RECOVERY-2026-06-18.md`.
-**Critical:** validate each model's render byte-for-byte against its Hoffman original BEFORE enabling
-live DSCA33/45 rendering — once the renderer returns non-null, the pipeline stops skipping these and
-will re-push/UPDATE the 7,157 good originals on the next cycle (safe only if the render matches).
+**STATUS — DONE on AD2 (2026-06-18, commits up to `4615877f` on `ad2`):** the AD2 session wired the
+mined templates into the renderer, reverse-engineered the DSCA33/45 accuracy-block formatting, and
+published the gap. **54 of 56 models validated byte-for-byte vs the live Hoffman originals** and
+marked `validated:true` in `dsca33-45-templates.json` (the per-model render gate — a model renders
+only when validated). **1,452 truly-new certs published to Hoffman (created=1452, updated=0,
+errors=0)** — published absent-only (probed each serial with a GET; the stale inventory means
+`api_uploaded_at IS NULL` does NOT mean "absent from Hoffman", so never trust it for this) so ZERO
+originals were overwritten. Still null/unpublished: **DSCA33-04A** + **DSCA33-1891** (each one accuracy
+cert at a rounding boundary where `Math.fround` rounds opposite the original — left UNvalidated), and
+the 2 no-original models **DSCA33-1948 / DSCA45-1746** (24 units). The 126 already-live gap units were
+left untouched.
 
-Hoffman read API: `GET https://www.dataforth.com/api/v1/TestReportDataFiles/{serial}` (returns
-`{SerialNumber,Content,CreatedAtUtc,UpdatedAtUtc}`); creds vault `clients/dataforth/hoffman-product-api`.
-Miner: `projects/dataforth-dos/tools/mine-hoffman-dsca.py`. AD2 access notes: [[ad2-ssh-mtu-blackhole]].
+Render specifics now in `templates/datasheet-exact.js`: DSCA3345_TEMPLATES takes precedence over the
+stale staged-extraction entries; `formatAccuracyLineDSCA3345` (mADC calc stored in A -> x1000; DSCA33
+meas unscaled, DSCA45 meas scaled; DSCA33 unsigned stim/calc/meas, DSCA45 signed + integer-Hz stim;
+fround); leading-zero drop only when the value overflows the 6-char field; DSCA33 "Check List" header;
+section sub-heads (Zero-Crossing/TTL) get no status. Tools: `validate-dsca3345.js` (oracle gate),
+`slotmap-from-hoffman.js`, `publish-dsca3345-gap.js`.
+
+Handoff doc (historical): `projects/dataforth-dos/DSCA33-45-HOFFMAN-RECOVERY-2026-06-18.md`. Hoffman
+read API: `GET https://www.dataforth.com/api/v1/TestReportDataFiles/{serial}`; creds vault
+`clients/dataforth/hoffman-product-api` (on AD2 the deployed uploader token at
+`C:\ProgramData\dataforth-uploader\credentials.json` works for reads too — no vault needed). Miner:
+`projects/dataforth-dos/tools/mine-hoffman-dsca.py`. AD2 access notes: [[ad2-ssh-mtu-blackhole]],
+[[ad2-comms-via-sync-only]].