[plainprogrammer]

Closes #231
Refs #218, #219

Records the maintainer's rulings from #219 (1–3) and #218 (6) in docs/architecture/scanner.md, corrects one comment, and adds one guard example. No spec and no ADR (routing confirmed by the coordinator); no shipped spec is edited (spec 027 D4).

What changed

• docs/architecture/scanner.md
  • The CSP extras (object-src, base-uri, form-action, frame-ancestors, font-src, img-src's data: and blob:) are recorded as policy decided by Scanner: three behaviours no spec describes (CSP's extra directives, the OCR worker's lifetime, a name candidate's printing) #219 ruling 1, alongside spec 007 AC-2.4, its contract and ADR 0001.
  • One OCR worker per page load is a new invariant (spec 007 FR-2; Scanner: three behaviours no spec describes (CSP's extra directives, the OCR worker's lifetime, a name candidate's printing) #219 ruling 2).
  • The read-set preference for a name candidate's printing is a Decisions entry (Scanner: three behaviours no spec describes (CSP's extra directives, the OCR worker's lifetime, a name candidate's printing) #219 ruling 3), pointing at spec/models/mtg/reading_spec.rb.
  • Measurement mode's strip, photo and replay routes answer local requests only, on top of the mode being on, because they skip sign-in (Accounts and sessions: six behaviours no spec describes #218 ruling 6).
  • Each statement names its issue; Accounts and sessions: six behaviours no spec describes #218 and Scanner: three behaviours no spec describes (CSP's extra directives, the OCR worker's lifetime, a name candidate's printing) #219 are in Sources; the "no spec source" marks are replaced.
• app/javascript/scanner/recognition.js: the header comment no longer says the worker is "kept across Turbo visits".
• spec/requests/scanner/measurements_spec.rb: one new example for the replay page and upload (non-local gets 404, a signed-out local request works).
• app/controllers/concerns/scanner_page.rb, spec/requests/footer_spec.rb: comments cite Scanner: three behaviours no spec describes (CSP's extra directives, the OCR worker's lifetime, a name candidate's printing) #219 ruling 1.
• docs/architecture/tenancy-and-accounts.md: ruling 6 leaves the "no spec source" list (three behaviours remain there). I merged origin/main after Sign-up refuses a missing password confirmation; record the rate-limit store as a rule #230 and kept its wording.
• docs/lessons/2026-11-09-no-spec-source-claims-need-the-contracts-and-sibling-docs.md

Evidence the guards can fail (temporary edits, reverted, not committed)

• CSP: no new example, because spec/requests/footer_spec.rb ("under the scanner's Content-Security-Policy") already matches the whole header exactly, including data: and blob:. With policy.frame_ancestors :self deleted from ScannerPage, both of its examples fail (2 examples, 2 failures).
• Local-only replay: with before_action :require_local_request deleted from ReplaysController, only the new example fails (18 examples, 1 failure). The existing AC-5.6 example covers the strip and photo routes only.

Implementation review

Read-only, Opus. Verdict: NEEDS CHANGES, all wording or test-comment findings, fixed in 9fe4912 and e947f03. It checked the four measurement controllers, the CSP directives and its spec, the OCR worker's lifetime, name_printings, and the spec citations.

• Major: three "no spec source" claims were false. Spec 007's contract lists the policy header and marks the replay and strips local-only, and spec 009's contract gives Other printings' 404. The doc now says "in the contract, in no criterion"; only the photos route has no spec text.
• Major: tenancy-and-accounts.md still said ruling 6 had no source (a table row and the counts); fixed.
• Minor: the sign-in invariant ignored the local-only routes; "nothing is kept across visits" overreached, since the worker is never terminated; "pinned by" overstated what reading_spec.rb pins (English-only isn't pinned, and a card with no English printing isn't a candidate); the new example's comment gave sign-in as its reason while the example was signed in (now it signs out before the last request).

No second review round was run: the fixes were wording and one example line.

Verification

• bin/rspec --dry-run: 2839 examples, 0 failures; the full bin/ci passed in the pre-push hook on 4c99247.
• Not checked in a browser: no view, partial, stylesheet or UI copy changed, so the design-system skill wasn't used.

Owed to the maintainer

• Other printings' 404 is now cited to spec 009's contract (no criterion); no change needed unless you want it as a criterion.
• Merge note for the tenancy doc: the "no spec source" count there is now three; later merges recompute it from the clauses left.

🤖 Generated with Claude Code