100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
TudorandClaude Opus 5	264edd2e3a	fix(airflow): a login that survives a container restart ... The simple auth manager generates a random password on first start and writes it to a file, so every restart of the api-server invalidated the last one and the password had to be dug out of the container logs again. The stack now writes that file itself from AIRFLOW_ADMIN_PASSWORD before exec'ing the api-server. Airflow generates nothing when the file already exists, so the login is whatever the stack environment says it is. Written with python rather than echo, so json.dumps escapes a password containing quotes, backslashes or non-ASCII correctly — verified against `p@ss "wo\rd' £5`, which round-trips intact. An unset AIRFLOW_ADMIN_PASSWORD raises KeyError and the container exits. Falling back to a generated password would silently undo the point of the change, and a compose-level `:?` gives the same refusal a readable reason. This does mean the variable MUST be set in Portainer before the next deploy of either stack. Not affected by the two Docker gotchas in the upstream docs: this image has no USER directive so it runs as root, and the file is rewritten from the environment on every start rather than persisted on a volume. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-31 17:38:42 +01:00
TudorandClaude Opus 5	cd2cbe7be6	build(pipeline): install the destinations tap in the image ... meltano install would resolve it from pip_url, but five of the six custom taps are also installed explicitly and a new plugin failing to appear is not something you want to debug from a deploy log. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-31 17:37:46 +01:00
TudorandClaude Opus 5	cbe3a9a772	fix(destinations): the table said 'withheld' for a category that just doesn't apply ... The Share column keyed off `percentage === null`, which is true for not_applicable as well as suppressed, so a destination that does not apply to the school was labelled as one DfE withheld — while the Pupils column in the same row rendered blank. Two columns, one row, disagreeing about what the row was, and one of them making a claim about DfE that wasn't true. Both columns now derive from `status`, which is the distinction the mart, the SQLAlchemy model and the serialiser all preserve deliberately: published shows the figure, suppressed shows the withheld badge, not_applicable shows an em-dash with a title saying so. A published count with no published percentage now derives its share from the cohort rather than falling through to a marker — both halves are published, so nothing withheld is involved, and it is the same derivation the bar widths already use. Verified the new tests fail against the old logic before keeping them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-30 21:48:39 +01:00
TudorandClaude Opus 5	2e9b5c83c5	fix(destinations): the masking pass can no longer exit unsafely ... Review found _mask_for_disclosure could return with its invariant broken and say nothing. add_companion only ever withheld a *published* cell, so a group with one suppressed category and every other one not_applicable — routine in special schools and AP, where few categories apply — left the loop with the lone suppressed cell still solvable. Reproduced on a nine-pupil cohort: one hidden cell, cohort served, residual intact. A disclosure-control pass that fails silently is worse than none, because everything downstream trusts it. The loop now runs until the invariant holds and escalates when no companion exists: the pupil group is dropped from the payload, and an empty block serialises as None so the section is absent rather than an empty shell. disclosure_invariant_holds() is exported so tests assert it directly instead of re-deriving it, and an exhaustive test sweeps all 81 suppression patterns of a four-category group. Also fixes a test that set up six measures and checked one: the loop was `for measure in ["school_sixth_form"]`. It now checks every measure, and against the real invariant — none hidden, or at least two, rather than "at least two", which the five published measures would have failed. No regression on real data: 262 mainstream secondaries, all-pupils bar still drawable on 94%, zero invariant violations, one disadvantaged group dropped by the new escalation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-30 21:35:03 +01:00
TudorandClaude Opus 5	102397fe69	fix(destinations): withhold at the API, not just in the chart ... Code review found the disclosure the whole design was meant to prevent. R1 was written as a rendering rule and implemented as one: canRenderBar stopped the bar being drawn, but GET /api/schools/{urn} still carried the cohort and every published category. cohort - sum(published) returned Whitley Bay's withheld further-education figure exactly — 18 pupils — to any caller, and the RSC payload put it in the browser too. app.py already stated the principle for admission_distance: this endpoint is public and unauthenticated, so a field left in the payload is a published field. The same reasoning applies here and did not get applied. _mask_for_disclosure now closes both identities before serialisation — categories sum to the cohort, and disadvantaged + other = all — by adding secondary suppression until every row and column hides none or at least two. My first attempt picked the smallest published cell as the companion and a new test caught it choosing a zero, which protects nothing: the residual still resolved to 18. The companion must carry pupils. DfE's own aggregates are no longer served. Nothing rendered them, and one spanning a single suppressed component names it. Cost, measured over 262 mainstream secondaries: the all-pupils bar survives on 94% rather than 100%. Zero lone-suppressed groups remain. The e2e helper now tells a missing feature apart from missing data: it fails if the API serves no destinations key at all, and skips if the key is served but the annual DAG has not populated the marts. Failing on the second would redden the staging gate for unrelated commits. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-28 19:58:02 +01:00
Tudor	68a192e430	Merge remote-tracking branch 'origin/main' into feat/ks4-destinations ... # Conflicts: # nextjs-app/__tests__/components/darkThemeSafety.test.ts	2026-08-28 18:45:27 +01:00
TudorandClaude Opus 5	ccd5074c90	test(e2e): destination journeys, including the no-bar rule ... The helper throws rather than skipping when no school returns a destinations block: a silent skip would let a real regression in the sections ride along unnoticed, which is why the distance journeys were changed the same way in 4f01fbd. The disadvantaged journey computes the residual itself and asserts it appears nowhere on the page — the one number the section must never state. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-28 16:16:25 +01:00
TudorandClaude Opus 5	2b4cf20d75	feat(destinations): the post-16 section, replacing the placeholder ... The 'Post-16 destination data coming soon' note is deleted rather than reworded: for a school with no sixth form the truthful statement is that the question does not apply, and a placeholder there implies something is missing. hasSixthForm and .sixthFormNote go with it — nothing else used them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-28 16:15:21 +01:00
TudorandClaude Opus 5	cef2f77149	feat(destinations): the After Year 11 section ... Question cards over one bar, with the cards acting as a lens on the bar rather than a summary beside it — focusing a card dims everything it is not made of, so the grouping we chose is inspectable rather than asserted. The bar renders only when canRenderBar allows it. Where a category is withheld the section says so and shows the table instead: the categories sum to the cohort, so a bar drawn from the published segments leaves a gap whose width is the withheld figure. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-28 16:14:13 +01:00
TudorandClaude Opus 5	68b6417149	feat(destinations): types and secondary section flags ... Destinations are secondary-only, so the flags go on computeSecondaryFlags rather than computeSchoolFlags. A phase counts as present only when some pupil group carries categories — an empty block would otherwise open a nav entry pointing at a section that never renders. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-28 16:11:37 +01:00
TudorandClaude Opus 5	c5719ef362	feat(destinations): serve destinations without closing the gaps ... The serialiser carries status through and computes no totals of its own. The only aggregates in the payload are ones DfE published itself; whether showing one is safe depends on how many of its components are suppressed, which the frontend decides. The batch guard grows from six tables to eight. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-28 16:10:29 +01:00
TudorandClaude Opus 5	5e5b61987a	feat(destinations): marts, with R3 masking applied at the boundary ... Disadvantaged and other-pupils partition the whole and the all-pupils figure is published, so publishing both halves recovers the suppressed one. The mask is applied in the mart rather than the API so no consumer added later can reach an unmasked combination. The R1 test is a warn, not an error: DfE publishes the recoverable combination and the mart's job is to carry it faithfully. Refusing to close the gap is the API's job and the frontend's. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-28 16:08:20 +01:00
TudorandClaude Opus 5	c564566432	feat(destinations): staging models that keep 'withheld' distinct from 'absent' ... safe_numeric maps every EES sentinel to NULL, which is right for attainment and wrong here: one of those states has to print 'withheld' and the other has to print nothing. A status column carries the difference. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-28 16:07:17 +01:00
TudorandClaude Opus 5	9188626051	feat(destinations): a tap that preserves the suppression sentinel ... EES writes 'c' where a figure is withheld and the categories sum to the cohort, so counts and percentages are emitted as text with the sentinel intact. safe_numeric must never be pointed at them. School rows and the England reference need different establishment pins: at national level selective schools, studios and UTCs are separate populations rather than labels, so leaving establishment open multiplies 30 rows into 190. Two queries per period, each keeping its own level. Verified against the live API for 2022/23: 135,240 school records over 4,508 schools, exactly 30 each, no duplicate keys, 31,382 sentinels kept. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-28 16:06:37 +01:00
TudorandClaude Opus 5	7ae9ecdc36	feat(destinations): colour tokens, with the absence hatched not coloured ... Activity not captured includes independent schools and moving abroad, so a red segment would be a factual error. The hatch doubles as the secondary encoding that rescues the neutral/blue pair, which separates at only dE 7.6 as flat fills. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-28 15:58:25 +01:00
TudorandClaude Opus 5	1980d79eee	feat(destinations): the disclosure rules, as executable guards ... The destination categories sum to the cohort and DfE publishes the cohort total, so a lone suppressed cell is recoverable by subtraction. canAggregate, canRenderPublishedAggregate and canRenderBar are what stop a consumer doing that; toBarSegments throws rather than leaving a readable gap. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-28 15:57:46 +01:00
TudorandClaude Opus 5	9423f11567	docs(destinations): implementation plan, ten tasks ... Ordered so the disclosure guards land first and everything downstream consumes them: lib/destinations.ts, tokens, tap, staging, marts, API, then the two sections and the journeys. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-28 15:56:36 +01:00
TudorandClaude Opus 5	576013d627	docs(destinations): design for KS4 and post-16 destination measures ... The published files suppress individual cells, not whole cohorts, and the categories sum to the cohort — so on 22% of mainstream secondaries the withheld figure can be recovered by subtraction. Three disclosure rules fall out of that, and the rest of the design is downstream of them. Verified against the EES API rather than assumed: both datasets carry school-level rows keyed by URN, with the disadvantage split and every destination category the display needs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvdDKvFFSZuMVDH5fEyTob	2026-08-28 15:28:09 +01:00
TudorandClaude Opus 5	a7829d591a	fix(map): the popup never took the dark theme ... leaflet.css paints `background: white; color: #333` on the popup card and its tip. LeafletMapInner binds themed content into it — the school name and the headline figure are var(--text-primary) — so in dark mode #E9EEF0 landed on #FFFFFF at 1.17:1. The two things the popup exists to say were the two least readable things on the page. Every other foreground in that popup failed too, from the same cause: the muted phase line at 2.90:1, the vs-national delta at 1.94:1, the Ofsted badge at 1.74:1. Moving the surface onto --bg-card fixes all of them at once — 13.52, 5.45, 8.14 and 9.11:1 respectively. In light mode --bg-card is #FFFFFF, so the popup renders exactly as it did. globals.css already pulls the rest of Leaflet's chrome onto the tokens, and says why: "this matters most in dark mode, where Leaflet's white attribution bar would otherwise sit on a near-black page." The popup was simply missed. The View Details button needed its own fix. It pairs background:var(--status- above) with a literal white label, which theming the card does not reach: --status-above is #36743F in light but #7FCB8A in dark, taking the label from 5.63:1 to 1.94:1. --text-inverse is the token for ink on a saturated fill, and the popup's own Ofsted badge already uses it. darkThemeSafety already guards this defect class, but only inside .module.css. Neither half of this one lives there — the surface is a third party's, the text is inline in a TSX template — so it scanned clean throughout. Two rules added for the layer it could not see. Fixing the grouped-selector blind spot in its rules() helper was needed to write them: taking only a selector's last line discarded every selector in a grouped rule but the final one, which makes a safety guard fail open. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FuPUioHpxtaiDNagQvjxyM	2026-08-27 22:34:18 +01:00
TudorandClaude Opus 5	7a16b1b52f	fix(admissions): flag-off pages must not speak for the council ... The secondary admissions section words the absence of a cut-off distance: "<LA> has not published a cut-off distance for this school." That sentence is true when the authority publishes nothing. It is false when the authority does publish and the admission_distance flag is simply off — and off is the current state, so every secondary page with an EES admissions row has been making a claim about a council on our behalf. The backend already draws the distinction the copy needs. /api/schools/{urn} omits the admission_distance key entirely while the flag is dark rather than sending null, precisely so that "we are not publishing cut-offs" stays distinguishable from "this school has no cut-off"; lib/types.ts says so in as many words. The page then collapsed the two with `?? null` before the section ever saw them. So stop collapsing it: thread the raw field to SecondarySchoolSections and word the absence only when the feature is on. Null still gets the sentence naming the authority — that case is unchanged and still tested. Primary pages are unaffected: AdmissionsSection carries no absence copy and renders nothing when there is no figure. DistanceSection already treated absent and null alike; only its type widens. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FuPUioHpxtaiDNagQvjxyM	2026-08-27 21:17:16 +01:00
TudorandClaude Opus 5	e820e7fecd	fix(analytics): the funnel source read a referrer that never changes ... The staging E2E gate has been red since #132 merged (run 1064, and 1066 after it): "a school reached from a location page is attributed to it, not to direct" expects `place`, receives `direct`. #132 fixed a real bug — `/schools/` had no case and fell through to `direct` — but the mechanism underneath it never worked. getNavigationSource read document.referrer, which the browser writes only when a *document* loads. Every internal navigation here is an App Router soft navigation: history.pushState, no new document, so document.referrer goes on naming whatever opened the tab for the whole session. Verified on staging: load /schools/brentwood, click a school, the URL becomes /school/… and document.referrer is still "". So `from` reported `direct` for essentially every in-app journey, not just the ones through the location layer — search, rankings, compare and detail were all being counted as "typed the URL". The unit suite passed throughout because every case set document.referrer directly, which only happens on a full page load. The fix is a module-level trail written by RouteTrail, a render-nothing client component in the root layout. Its lifetime is exactly right: it survives soft navigation, and it dies on a real document load — which is precisely when document.referrer becomes meaningful again, so the two cover each other with no overlap. Reading it skips entries equal to the current path rather than taking the second-to-last. That makes the answer independent of whether the layout effect or the page effect ran first — React orders those by tree position, which is not a contract worth resting a measurement on — and it gives the right answer both when the user returns to a page they came from and on a hard load of a school page. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FuPUioHpxtaiDNagQvjxyM	2026-08-27 09:22:37 +01:00
TudorandClaude Opus 5	9a1f56c431	feat(places): say what each school is, not only how it scored ... The location tables carried one column: a percentage. A parent shortlisting from a town page is asking a different question first — does it take my child's age, is it a faith school, does it have a nursery — and the page could not answer any of it. Primary tables gain Ages, Religious character, Nursery and Constituency; secondary tables the same minus Nursery, which is a question about a different intake. An all-through school renders in both groups, so its nursery shows under primary alone. The measure moves to the second column rather than the last. Six columns overflow a phone and .tableWrap turns that into a horizontal swipe; with the measure last, the one number the page exists for is the one scrolled off the screen. Cell rules are the ones the school page already uses, so the two surfaces cannot disagree about the same school: "Does not apply", "None" and "Not applicable" all read as no religious character, and the en-dash age normalisation moves into formatAgeSpan, which formatAgeRange now delegates to. Backend: nursery_provision and parliamentary_constituency were not in the place response. Both are optional GIAS mart columns that data_loader degrades to NULL, and the `in rows.columns` guard keeps a mart the pipeline has not rebuilt working. Also fixes a live bug on the same line: SCHOOL_COLUMNS already ends with latitude and longitude, and the endpoint concatenated them again, so pandas dropped one of every duplicated pair and warned "columns are not unique" on each request. Ordered de-duplication removes the warning and the silent drop. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FuPUioHpxtaiDNagQvjxyM	2026-08-27 08:49:14 +01:00
TudorandClaude Opus 5	d1a8596208	feat(analytics): measure the location layer, and stop calling it direct ... The location pages were only half-tracked. Umami counts a pageview for each of the ~3,900 URLs automatically, but nothing else: components/ places contained no track() call, and place_viewed was not even a declared event name. The part that mattered was worse than a gap. getNavigationSource mapped a same-origin referrer to a funnel source and had no case for /schools/, so every school view arriving through the location layer fell through to 'direct' — the bucket you read as "typed the URL, no referrer". W2's whole purpose is funnelling search traffic onto school pages, so the one measurement that says whether it worked was reporting the wrong answer, and reporting it confidently. Verified live against staging: expected "place", received "direct". /schools/ is checked before /school/. They differ by one letter and mean different things — the location layer versus a single school — and a prefix test in the wrong order silently merges them. place_viewed carries kind, slug, phase and school_count. kind is the reason it exists: whether to keep investing in these pages turns on which sort earns engagement, and a pageview cannot say, because all four families share the /schools/ prefix and only the registry knows which is which. It is a client component because PlaceView is a server component; one line in PlaceView covers all four families, since they all render through it. Both E2E journeys were verified failing against staging first — one because place_viewed does not exist there, the other on the exact "place" vs "direct" mismatch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-27 08:23:21 +01:00
TudorandClaude Opus 5	0804566736	fix(test): drop a committed scratch probe, and close a hole in the guard ... Code review, all three findings valid. e2e/tests/__m.spec.ts was a throwaway probe used to measure the mobile hero geometry. It asserts nothing, so it could never fail; it carried a leftover `pick('form').constructor === Object ? null : null` that is null either way and throws if no form matches; and it should never have been committed. Deleted. It survived because `rm -f e2e/tests/__m.spec.ts` ran with the shell already inside e2e/, so the path resolved to e2e/e2e/tests/... — which does not exist, and rm -f is silent about that. `git add -A` then swept it in. I checked `git diff --stat` before committing, which lists only tracked modifications and never shows an untracked file; `git status --short` would have. The scoping guard compared the last line of a rule's prelude against the literal '.filterBar', so a regression written as a selector list — `.filterBar, .other { padding }`, or the same split across two lines — would have walked straight past the test meant to catch it. Selectors are now split on commas and matched individually, and comments are stripped first so a brace inside one cannot desynchronise the parse. Verified against all three shapes: bare, inline comma list, and multi-line comma list. Each is caught; each passes again once reverted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 21:49:48 +01:00
TudorandClaude Opus 5	55363cbd18	fix(suggest): the dropdown reopened on top of the search results ... Three staging-gate failures, two of them one real bug. After a search, the results-page bar still holds the term in its input, so on every render the query was >= 2 characters and the suggestion list opened again — on top of the very results the search had just produced. Playwright reported it as "<li role=option ...> intercepts pointer events" while trying to click the first result; a reader would simply have found their first result unclickable. Both the school-detail and hero-map journeys failed on it, and neither is about autosuggest. Suggestions now answer typing, not the mere presence of a value: `hasTyped` gates the hook, is set on change, and is cleared when a search is submitted or a suggestion is chosen. A pre-filled input makes no request and shows no list. Third failure was my test, not the product. An unphased place page renders one table per phase, and an all-through school legitimately appears in both — so the page's school links were never one alphabetical run. The assertion collected them all together and only passed because no town it picked had held an all-through school. When the data gave Abbots Langley one, Breakspeare School appeared in the primary table and again in the secondary, and the test failed on correct behaviour. It now checks each table separately, and passes against the data that broke it. Guards: a jest test that a pre-filled input neither fetches nor opens (verified by reverting — it is the only one that fails), and an E2E journey that submits a search and then requires the first result to be clickable, which is the reader-facing version of the same thing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 21:38:16 +01:00
TudorandClaude Opus 5	0b15497c09	fix(search): the mobile hero search was indented by a card's padding ... Measured at 390px: the headline and lede sit at x=34, while the search box, the hint and the location link all sat at x=48 and the field was 28px narrower than the copy above it. The 14px came from `@media (max-width: 768px) { .filterBar { padding: 0.875rem } }`. That rule is for the results filter bar, which is a card — background, border, shadow — and needs inner padding. The hero search is not a card: .heroMode strips all of it, padding included. Both selectors are specificity (0,1,0), so source order decides, and .heroMode only wins because it is declared right after .filterBar. A bare .filterBar rule inside a media query comes later and silently wins instead. The two rules directly below this one in the same block were already written as `.filterBar:not(.heroMode)`; this one was missed. Scoping it aligns the search box, hint and location link to the same left edge as the headline and gives the field back its 28px. The location link also carried its own 6px of button padding, so its label started further right than the hint even once the boxes agreed. Pulled back with a negative margin, which keeps the tap target. The guard is a stylesheet test: the failure is a plausible-looking layout rather than a broken one, so nothing short of measuring or looking would catch it. Verified by reverting: it names ".filterBar sets padding". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 21:32:41 +01:00
TudorandClaude Opus 5	3236efa846	fix(map): the hero map's fade to the header was hardcoded white ... The fade between the map band and the school header ramped through rgba(255,255,255,...) and landed on var(--bg-card). In the light theme that is white into white and invisible, as designed. In the dark theme it climbed to 95% WHITE and then met a near-black card, putting a bright band across the full width exactly where the map should dissolve into the title. Fading to the colour the gradient lands on is the whole trick, and it only works if that colour is a token — so --bg-card-rgb now exists in both theme blocks, matching the --hero-ground-rgb precedent. Two more defects in the same file, same cause, found while in there: The controls floating over the map paired a hardcoded white background with color: var(--text-primary), which resolves to #E9EEF0 in dark — near-white text on a near-white button. These deliberately do NOT follow the theme, because the map tiles are light in both, so the ink is now literal too and says why. A themed token is the wrong tool for a surface that never changes. The loading skeleton swept 50% white across var(--bg-secondary), which is a bright flash every 1.4s on a dark page. It now sweeps toward the card colour, a shade lighter than the ground in both themes. The guard is a stylesheet test rather than a render test, because the bug is invisible in the theme it was written for. Verified by reverting each fix in turn: it names .fade and .openHint exactly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 21:20:57 +01:00
TudorandClaude Opus 5	d5a6db289d	fix(suggest): let the dropdown out of the hero panel ... .heroPanel had overflow: hidden to clip its artwork and scrim to the rounded corners. It clipped the suggestion dropdown too. Measured on staging with the flag on: the list runs 482 to 802, the panel ends at 624 — so 178px of 320 was cut off, about half the options, with nothing on screen to say anything was missing. The two things that actually needed clipping now round themselves: .heroArt gets border-radius: inherit plus its own overflow, and the ::before scrim inherits the radius. Below 860px the artwork is a band flush with the top of the panel rather than a layer covering it, so it takes the top two corners only — inheriting all four would leave it floating with rounded corners against the copy. Nothing else depended on the panel clipping: .valueProps below it is entirely static, so a positioned dropdown paints above it without a z-index fight. The regression test asserts the LAST option is the element actually painted at its own coordinates. toBeVisible() would not have caught this — it checks for a non-empty box and visibility, and an ancestor's overflow clips neither. elementFromPoint catches clipping and occlusion alike. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 21:10:32 +01:00
TudorandClaude Opus 5	0fa1a292c7	fix(api): bound what a forged CF-Connecting-IP can buy ... Code review, both findings valid. The design doc claimed Cloudflare "replaces the header, so a browser cannot forge it", and that only the X-Forwarded-For fallback was forgeable. That is true only for traffic that actually passed through Cloudflare, and nothing in this process can verify that it did. Reaching the origin directly, both headers are equally attacker-controlled — and rotating CF-Connecting-IP mints a fresh rate-limit bucket per request, defeating per-client limits on every endpoint including the DataFrame-heavy /api/schools. Against abuse that is worse than the shared bucket it replaced, which at least capped everyone together. So the ceiling comes back. I dropped it earlier arguing it belonged at Cloudflare; that argument assumed the keying was sound, and it is not. GlobalRateLimitMiddleware counts all /api/ traffic in a fixed window against a total, independent of client identity, outermost so it refuses before any work happens. Written by hand because slowapi cannot express a global cap: default_limits and application_limits are both keyed by key_func, and the latter needs middleware this app does not install. It does not make the header trustworthy — it makes trusting it survivable. The real fix is Authenticated Origin Pulls or an origin firewall, now documented in DEPLOY.md as the open gap it is. 127.0.0.1 is exempt: the healthcheck curls localhost from inside the container, and starving it would restart the container and turn a load spike into an outage loop. Keyed on the peer address, never the Host header, which the caller sets. Second finding: suggest_schools_typesense promised "never raises" while the parsing loop sat outside the try, so int(None) on a malformed document would have made a keystroke a 500. The loop now skips bad rows rather than dropping the whole list — and a hit with no document no longer becomes a suggestion pointing at /school/0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 20:56:32 +01:00
TudorandClaude Opus 5	d2115364ae	test(e2e): autosuggest journeys, gated on the flag ... Feature state is read from its observable effect — whether the search box is a combobox — because /api/flags is denied to the public on purpose. Same approach as the distance journeys. The three endpoint tests are ungated: /api/suggest is live whether or not the UI is, which is what lets it be smoke-tested in an environment where the feature is still dark. The flag-off journey asserts the plain search still works, not just that the combobox is absent. Verified against staging, where the flag is off: it passes and the flag-on journey correctly skips. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 20:39:33 +01:00
TudorandClaude Opus 5	28cf0a342c	feat(suggest): wire autosuggest into the search box behind a flag ... Off means off — no combobox role, no listener, no fetch. A test asserts the absence of the request, not just the absence of the dropdown, because a hidden-but-fetching control would still be spending the rate limit on a feature nobody can see. Enter with no active option falls through to the form's submit handler and searches the typed text exactly as before. The existing behaviour is preserved, not replaced, and that has its own test. Suppressed once the value parses as a postcode: the box takes a name OR a postcode, and suggesting schools during postcode entry fights the user. .omniBoxContainer gains position: relative — the dropdown is absolutely positioned and without it would have anchored to the page instead. Four render sites, all wired: page.tsx renders HomeView in the success path AND the catch fallback, and HomeView renders FilterBar as hero AND sticky. Missing any one would make the flag silently do nothing somewhere. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 20:38:52 +01:00
TudorandClaude Opus 5	d88e77f459	feat(suggest): the dropdown, with combobox ARIA ... Presentational only — it fetches nothing and owns no state, so the fetching rules and the ARIA rules can be read separately. onMouseDown, not onClick. The input's blur handler closes the list and blur fires before click, so a click handler never runs: the classic bug where a dropdown works perfectly by keyboard and is dead to the mouse. The plan's CSS guessed at token names like --color-surface. The real tokens are --bg-card, --border, --text-muted, --bg-secondary and --shadow-soft, and all five are redefined in the dark theme — invented names would have silently fallen back to hardcoded light values and broken dark mode. Local authority is rendered because there are many schools called 'St Mary's'; a list without it is unusable for exactly the query autosuggest exists to serve, which is what the test asserts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 20:36:39 +01:00
TudorandClaude Opus 5	06eb433db5	feat(suggest): debounced, abortable suggestion hook ... The AbortController is correctness, not economy. Without it a slow response for 'st' can land after the fast one for 'st marys' and replace a correct list with a stale one — the classic autosuggest race. No cache: 'no-store', unlike the compare modal's search. This is the one endpoint where prefix queries repeat most across users, so discarding the browser cache and the backend's ETag 304s would be throwing away the cheapest win available. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 20:35:27 +01:00
TudorandClaude Opus 5	1a6d349dad	feat(suggest): GET /api/suggest, cacheable and DataFrame-free ... A dedicated endpoint rather than a mode of /api/schools, because that path filters and sorts 25,000 pandas rows per query while holding the GIL — affordable once per search, not once per keystroke. A test asserts the distinction directly by making load_school_data raise and requiring the endpoint to answer anyway. Nothing errors on ordinary input: a short query, no matches, or Typesense being down are all 200 with an empty list. Cached deliberately. Prefix queries repeat enormously across users and school names change once a year, so s-maxage plus the existing ETag middleware turns most keystrokes into 304s. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 20:34:34 +01:00
TudorandClaude Opus 5	75d3534d82	feat(suggest): Typesense rows for autosuggest, no DataFrame ... search_schools_typesense returns URNs, which forces the caller to hydrate from the 25,000-row in-memory frame. Every field a suggestion needs is already in the Typesense document, so this returns documents and the caller needs no pandas at all — the difference between a query that can run per keystroke and one that cannot. Never raises. Typesense unreachable or erroring gives an empty list, because a dropdown that quietly stops appearing is the right failure for a keystroke path. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 20:33:42 +01:00
TudorandClaude Opus 5	ff041544f2	fix(api): rate-limit per caller, not per proxy ... The limiter keyed on request.client.host, which in staging and prod is the Next container — the backend has no published ports and nothing else can reach it. So every browser user on the site shared one 60/minute bucket per route. Measured against staging: 70 concurrent requests to /api/schools returned exactly 60 OK and 10 refused, from one machine. CF-Connecting-IP first. Cloudflare fronts both environments and overwrites any client-supplied value, which a parsed X-Forwarded-For chain does not guarantee. The XFF fallback is forgeable only from inside the Docker network. Named rather than hidden: the shared bucket was an accidental global throttle on a single-process backend, and correct per-user keying removes it. A real global ceiling belongs at Cloudflare, which is already in the path; slowapi cannot express one without a second Limiter and middleware this app does not install. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 20:32:58 +01:00
TudorandClaude Opus 5	59265f78b6	docs(flags): Unleash does not create flags by itself ... The runbook said a flag 'appears in the Unleash UI after the backend has evaluated it once'. That is wrong. SDKs read definitions from the server and never register anything, and metrics for an unknown flag are discarded — so a declared flag is evaluated on every request, stays False forever, and never shows up until someone creates it by hand. Found the way these things usually are: staging had been running the flag code for a while and the UI was still empty. Also names the environment trap while here — each stack's token is scoped to one environment, so toggling the other does nothing visible and looks like the flag is broken. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 20:11:45 +01:00
TudorandClaude Opus 5	6e0a278340	docs(suggest): implementation plan, eight tasks ... Self-review caught three defects in the plan. .omniBoxContainer, the wrapper the dropdown positions against, does not declare position: relative — without it the list anchors to the page. The postcode suppression test typed character by character, so it would have asserted no request while 'NW1' legitimately fires one; it now sets the value in one go. And the Enter-submits-search assertion needed waitFor, because updateURL pushes inside startTransition. Task 1 is the one to review hardest: it is the only unflagged change and it alters rate limiting for every endpoint. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 19:48:39 +01:00
TudorandClaude Opus 5	e651dd0d65	docs(suggest): the in-app global ceiling would not have worked ... Reading slowapi rather than assuming: default_limits and application_limits are both evaluated with the same key_func, so they are per-client across routes, not global. And application_limits only apply 'if in_middleware' — this app installs no SlowAPIMiddleware, so they would never have fired at all. A genuine global cap would need a second Limiter with a constant key plus that middleware. Cloudflare is already in the path on both environments and does this at the right layer, so the ceiling is named as a follow-up there rather than built badly here. The risk that leaves is stated plainly in the risks section instead of being papered over with a mechanism that does not do the job. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 19:44:21 +01:00
TudorandClaude Opus 5	22c113fc29	docs(suggest): design for school autosuggest ... The load-bearing finding is not about autosuggest. The rate limiter keys on request.client.host, which in staging and prod is the Next container — so all browser users share one 60/min bucket per route. Measured against staging: 70 concurrent requests gave exactly 60 x 200 and 10 x 429. Eight concurrent searchers would 429 the site once each keystroke costs a request, so the keying fix is part of this work. Both environments are behind Cloudflare, which sets CF-Connecting-IP and overwrites any client-supplied value — trustworthy in a way a parsed X-Forwarded-For chain is not, and the backend is unreachable except through the Next proxy. Named honestly: the shared bucket has been an accidental global throttle on a single-process backend, so correct per-user keying removes a protection. A global ceiling ships with it rather than instead of it. Suggestions come from Typesense alone. The existing search path filters a 25,000-row DataFrame per query, which is exactly the cost a keystroke endpoint cannot pay, so there is deliberately no DataFrame fallback. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-26 19:41:00 +01:00
TudorandClaude Opus 5	413d86cc3c	chore(flags): wire UNLEASH_URL and the SDK cache volume into the stacks ... Both variables default to empty, so an environment without Unleash has every flag off — the correct dark state rather than a boot failure. The cache volume is the mitigation for the one real regression risk in this design: the SDK evaluates everything False until it syncs, so a backend cold-starting with an empty cache while Unleash is unreachable would make a *released* feature disappear. On a named volume the disk cache survives a restart. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-23 10:58:29 +01:00
TudorandClaude Opus 5	4f01fbdedb	test(e2e): make the distance journeys fail loudly, not skip quietly ... The existing distance journeys all skip when no school has a published figure, which is right when the feature is off — and wrong when it is supposed to be on and is silently broken, because that shows up as a green run full of skips. The new gate fails in exactly that case. Feature state is read from the data, not from /api/flags: the public proxy denies that path on purpose, since it names unreleased features. Presence of the admission_distance key is the observable effect. Verified against staging, where the feature is currently on: the on-gate passes, the off-gate skips, the existing eight distance journeys are unaffected. One honest caveat — the /api/flags check passes on staging today because that image predates the endpoint, not because the denylist works. The denylist itself is covered by the jest unit test; this is defence in depth and becomes a real assertion once deployed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-23 10:57:34 +01:00
TudorandClaude Opus 5	c3ba7aae0d	feat(flags): ship last-distance-offered dark behind a flag ... One gate, at the source. The frontend needs no change: DistanceSection already returns null when distance_m is missing, and the admissions block already conditions on (admissions || admissionDistance). Only 57 local authorities publish cut-offs, so the off-path is the commonest path on the site and is well covered already. Absent, not null. /api/schools/ is public and unauthenticated, so a field left in the payload is a published field — the reasoning already recorded in c9a1892 when history was withheld. The two are also different claims: null says this school has no cut-off, absent says cut-offs are not being published at all. The frontend type now says so. The feature is on main and live on staging and has never reached production, which is what makes it the right first consumer: the flag lets the code promote without the feature appearing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-23 10:56:33 +01:00
TudorandClaude Opus 5	54a30de0d8	feat(flags): server-side getFlags for the frontend ... Ships without a consumer, deliberately. The first flag needs none — the backend withholds the field and the page follows — but 'UI elements on existing pages' is one of the three surfaces this capability exists for, and a flag layer that cannot gate one is incomplete. Never throws: an unreadable flag is a dark one, which matches the backend's fail-closed default. A page that 500s because the flags endpoint blinked would be a worse outcome than a hidden feature. Reading flags pins the calling route to a 300s ISR floor, since Next takes the lowest revalidate among a route's fetches. That matches what /school/[slug] already sits at, and it is the same property that makes a flip propagate without a webhook. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-23 10:55:32 +01:00
TudorandClaude Opus 5	c30ad1db07	feat(flags): serve /api/flags, and keep the public proxy off it ... The endpoint and its exposure control ship together on purpose. The moment /api/flags exists, app/api/[...path] forwards it — and the response names every unreleased feature the codebase knows about, along with whether it is on. Publishing that is the opposite of shipping dark. Denied on an exact first-segment match, not a prefix, so /api/flagship does not go down with /api/flags. Next reads the endpoint server-side over the Docker network, which never transits the public proxy. jest.setup.js now guards its browser globals. It runs for every suite, including the one that declares @jest-environment node to exercise the route handler — NextRequest needs Fetch API globals jsdom lacks, and there is no window there to define matchMedia on. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-23 10:54:26 +01:00
TudorandClaude Opus 5	7424cef7c6	feat(flags): the registry and a fail-closed Unleash client ... Unleash holds flag state; it does not hold the list of flags. REGISTRY is that list, because the SDK evaluates an unknown flag to False and without a registry that is an undeclared False — indistinguishable from a typo in a flag name. Fail-closed throughout, and never raises: an unset UNLEASH_URL, an unreachable server, a client that throws, an undeclared name — all False. A flag layer that can 500 a request path or stop the API booting is worse than one that is switched off. Every flag defaults to False, with no per-flag override, because a flag that defaults on is a kill switch and this is deliberately not one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-23 10:52:55 +01:00
TudorandClaude Opus 5	01ccbb8e82	feat(flags): add the Unleash stack and its runbook ... Its own Portainer stack, belonging to neither application stack: a staging redeploy must not be able to disturb production's flag state. One instance serves both. OSS Unleash ships development and production environments with environment-scoped client tokens, so the same flag holds independent state in each — which is what lets a feature be on in staging, where the E2E journeys exercise it, while production stays dark. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-23 10:51:35 +01:00
TudorandClaude Opus 5	c339c2f1a1	docs(flags): implementation plan, eight tasks ... Task 1 is the Unleash stack and ends with a human step — the Portainer deploy and the token generation cannot be automated from here. Nothing else blocks on it: an unset UNLEASH_URL means every flag is False, which is what local development and CI get, so the whole suite runs without a flag server existing. Self-review caught three defects in the plan itself. get_supplementary_data takes (db, urn), not (urn), and the test DataFrame was minimised to the point where the endpoint would have failed for reasons unrelated to flags — both now copy the known-good shape from test_school_details.py. The proxy test needs the node jest environment, since NextRequest wants Fetch API globals jsdom does not provide. And the e2e off-state check hardcoded a URN, so a 404 page would have satisfied it without proving anything. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-23 10:46:15 +01:00
TudorandClaude Opus 5	e2ca3d79f9	docs(flags): drop the webhook — the seven-day premise was wrong ... Next uses the LOWEST revalidate among a route's fetches, not the segment value. School pages fetch school details at 300s and place pages fetch national averages at 3600s, so the effective ISR period is five minutes and one hour respectively — not the seven days the segment declares. A flag flip therefore propagates on its own, well inside the monthly, by-hand cadence these flags are for. That deletes two webhook integrations, a revalidate route, a secret-in-query-string scheme, an idempotency requirement, and the rule that every fetch carry a cache tag — which was the part most likely to rot as fetches are added. Two constraints survive: a flag must never gate content on a force-static page, because app/admissions never revalidates; and a route-family flag must rebuild the sitemap, deferred with the route case since no flag in scope touches it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-23 10:40:35 +01:00
TudorandClaude Opus 5	c2364bf09e	docs(flags): design for a ship-dark feature flag layer ... Unleash self-hosted in its own Portainer stack, with FastAPI holding the only SDK and Next reading flags through a tagged fetch. The two hard parts are consequences of putting flag state in a service rather than the repo: main stops being the whole truth about what is on, and a flag can now change without the deploy that would have cleared the caches. A code-declared registry bounds the first; webhook-driven revalidateTag handles the second. Cache tagging is deliberately coarse — every server fetch carries the flags tag, not just the flags fetch itself. The first consumer proves why: admission_distance changes the shape of /api/schools/{urn}, so a narrow purge would leave ~25,000 school pages serving the pre-flip render for a week, invisibly. First consumer is the last-distance-offered feature, which is on main and staging and has never reached production. It needs one gate, at the API, because the frontend already no-ops on a missing field. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-23 09:47:58 +01:00
TudorandClaude Opus 5	d1358cc00f	fix(places): phase links must stay in their own namespace ... Every place page built its phase links as /schools/[slug]/[phase], the shape that belongs to towns alone. On an authority page that pointed into the town namespace. For 87 of the 151 authorities the target does not exist and the link 404s; for the other 64 it resolves to the town of the same name — a different set of schools, which is precisely the near-duplicate the two namespaces were introduced to prevent. On an outcode page it 404s outright. Two causes behind it, both a rule written twice and inherited by only one of the places that needed it. The authority phase route was in the spec and dropped by the plan, which built the three bare routes and no fourth. The sitemap is generated from the place registry, which was right about them all along, so 302 authority phase URLs have been submitted to Google and every one 404s. Adding the route makes the sitemap true and serves a real query — admissions are authority-run, so "primary schools in Kent" is how a parent searches before they have settled on a town. The outcode variants were the opposite: the registry computed phases for outcodes although the spec gives them no route, and the sitemap knew to skip them while the API did not. The registry now decides alone, and the sitemap's duplicate of that rule is gone. Also: an authority under the five-school threshold has no page, so the API sends a null slug for it and the page names it without linking. Two English authorities are in that position. It was unreachable in today's data — verified across the EC and TR outcodes — but the thin place redirect would have sent a reader to a 404 the year it isn't. The e2e journey now walks every /schools link a page of each family emits and requires a 200, which is the check that was missing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-22 17:22:11 +01:00
TudorandClaude Opus 5	9cc87c41bb	fix(places): a phase page needs results, not merely publishable schools ... Asked where schools with no results should sit in an alphabetical list, and found that some pages were almost entirely made of them. The per-phase threshold counted schools that were publishable — a result OR an Ofsted grade — while a phase page exists for its results column. /schools/kent/primary published with none of its five rows carrying a result; Minehead had one of seven, Buntingford one of five. Forty-four phase pages were majority-blank. It is the same rule as "no page without a local average", which was written into the spec as a thin-page control and never extended per phase. The threshold now counts schools with a result for that phase. It gates whether the page exists; it does not filter rows — a page that publishes still lists every school of the phase, because someone looking up a school by name has to find it whether or not it published results. 126 of 1,012 variant pages stop publishing: 62 primary, 64 secondary. Every one of them was a table with too little in it to be worth a page. The ordering itself is unchanged: pure A-Z, blanks interleaved. A school sits where its name says it does, and at roughly a tenth of rows that reads fine. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-22 00:14:31 +01:00
TudorandClaude Opus 5	8967966eef	feat(places): list schools alphabetically on place pages ... Someone on a place page is usually looking for a school they can name, so the order should serve scanning for it rather than ranking. /api/rankings keeps its league-table ordering; this is a place-page decision, not a site-wide one. Sorted case-insensitively, or a capitalised name would sort ahead of every lowercase one. The change made five pieces of copy untrue, so they go with it. The phase variant titled itself "— Ranked", and all four route families described themselves as "ranked by SATs and GCSE results". A page that opens by claiming an order it does not keep is worse than one that claims nothing. The ItemList markup carried `position` with no declared order, which reads as a ranking. It now declares ItemListOrderAscending, so the structured data says what the table does. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-22 00:09:58 +01:00
TudorandClaude Opus 5	4e82e6c916	fix(e2e): three assertions that were wrong about correct behaviour ... The staging gate was red on three journeys. All three were faults in the tests; the site was behaving correctly in each case. Next normalises canonical URLs against trailingSlash:false, so the homepage ships "https://www.schoolcompare.co.uk" with no slash while every other route keeps its path. Both address the same document. The test hardcoded the slash and so failed only on the root — /rankings and /admissions passed throughout, which is what made it look like a homepage bug rather than a test bug. Compared with trailing slashes stripped from both sides. The robots.txt assertion matched "Disallow: /" anywhere in the file and tripped over the AI-crawler groups Cloudflare injects — ClaudeBot, GPTBot, Amazonbot and six others all carry a blanket disallow, deliberately, and none of them is Googlebot. It now parses the file into user-agent groups and checks only the "*" group, which is also the thing the test was always trying to say: Google may crawl the page, so it can see the noindex header. Both were the same mistake as the doubled brand: asserting a naive string rather than the semantics, and asserting against what the code assembles rather than what the page renders. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 23:51:34 +01:00
TudorandClaude Opus 5	bb2f7a5841	fix(places): address review, and merge places GIAS spells more than one way ... Two findings from review on #121, plus a third the review prompted. The cap at three authorities silently dropped the fourth in exactly the case where the information matters most — a genuinely fragmented place — and contradicted the stated goal of naming every authority a place sits in. It is gone. The share rule was always the real limit and already bounds the list at ten. Measured against the live corpus, one town would have been truncated today: LONDON, split evenly between Hackney, Lambeth, Westminster and Lewisham. parent_authority used mode() while authorities used value_counts(), and on an exact tie pandas does not guarantee the two pick the same name, so the 301 could have pointed somewhere other than the authority named first on the page. The parent is now derived from authorities[0]: one computation, one answer. It also inherits the sentinel filter, so a place can no longer redirect to /schools/authority/does-not-apply. Chasing the truncation case surfaced a worse bug. Places were grouped by raw town value, but the registry is keyed by slug, and GIAS spells the same place several ways. Five town slugs come from more than one spelling: "London" (1,819 schools) and "LONDON" (12) both slugify to `london`, so the later group simply overwrote the earlier one — /schools/london could have shown twelve schools, silently, depending on row order. Weston-super-Mare was split 14/19 across two spellings and Newcastle-under-Lyme across three. Grouping is now by slug, and the display name is the most common spelling. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 22:42:18 +01:00
TudorandClaude Opus 5	1cb5314c53	feat(places): name every authority a place sits in ... SW19 is mostly Merton but partly Wandsworth, and the page said only Merton. The cause was one field doing two jobs: _parent_authority takes the modal authority, which is right for a 301 target and wrong as a statement about where a place is. This is not a corner case. A quarter of viable outcodes (425 of 1,760) and a third of viable towns (263 of 783) cross an authority boundary — Bedford the town spans Bedford and Central Bedfordshire. Place now carries `authorities`, every authority holding at least a tenth of the schools and at least two of them, largest first. parent_authority stays single and unchanged, because a redirect still needs one target. The share threshold exists because GIAS carries postcode errors: EN6 lists two Shropshire schools among fourteen in Hertfordshire, and a bare "any authority present" rule would print those as though they were real. A place too small or too fragmented to clear the threshold still names its largest, so the page never goes silent about where it is. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 22:40:58 +01:00
TudorandClaude Opus 5	dbb74d9b60	fix(places): align the measure column's heading with its values ... The heading sat on the right edge of the column and every value on the left. A specificity collision, not a layout problem: the two were aligned by different selectors and only one of them won. .table td (0,1,1) text-align: left <- won for the value .num (0,1,0) text-align: right <- lost .table th:last-child (0,2,1) text-align: right <- won for the heading The heading and the value cell now share one class and one rule, so they cannot drift apart again whatever else changes around them. The column also stretched to half the table. It now hugs its content with width:1% and nowrap, so the school name takes the remaining width — which is what made the gap read as misalignment on a wide screen, and what crowded the name column on a narrow one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 22:15:02 +01:00
Tudor	3365ebcb3a	fix(places): phase-grouped tables, plain-English measures, styled links ... Three presentation faults on the place pages, all found by looking at a rendered page rather than at a test. An unphased place page showed one primary-only measure for a list holding both phases: 8 of 27 rows on /schools/brentwood were blank, because secondaries have no reading-writing-maths score. Picking the other measure would only have inverted which rows were empty, and putting both in one column would have mixed a percentage with a 0-90 score. Each phase now gets its own table, so a blank cell means the school genuinely has no published result — which is worth saying, and now says "Not published" rather than a bare dash. "RWM expected" was invented here. The site already names the measure in METRIC_DEFINITIONS, surfaced at /api/metrics: "Reading, Writing & Maths Combined %". The heading now reads "Reading, writing & maths" with the full definition in the tooltip. Links carried no class at all, so they rendered as default blue underlined browser links beside a site that styles table links as body colour with a brand hover. They now follow RankingsView's convention, and running-copy links take the brand colour. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 21:56:06 +01:00
TudorandClaude Opus 5	24e114dee7	fix(places): stop the place titles doubling the brand ... Every place page shipped as 'Schools in Brentwood - Compare 27 Schools | schoolcompare | schoolcompare'. The root layout's title template appends '| schoolcompare' to any plain-string title, and all four place routes already carried the brand. W8 opted the other routes out with an absolute title; the place routes were written afterwards and did not inherit the lesson. ~2,600 titles affected, and the repetition pushed them past Google's truncation point, so the doubled brand displaced real words in the result. An e2e journey now asserts no title repeats the brand, across the static routes and a place page, so this cannot come back on a route added later. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 21:43:32 +01:00
TudorandClaude Opus 5	6f749ed21f	fix(places): submit and link the phase variants ... /schools/[place]/[phase] shipped as routes but reached nothing. The sitemap emitted one URL per registry entry and the registry had no phase dimension, so ~950 pages were absent from every sitemap — and PlaceView did not link them either, leaving them reachable by nothing at all. That is the query shape the baseline actually showed: 'primary schools in beccles', 'secondary schools in brentwood'. Publishing the routes without a path in meant building for the demand and then hiding from it. Place now carries phase_urns so the per-phase threshold can be applied without re-querying, the sitemap emits a variant wherever a phase clears the threshold on its own, and the API exposes the qualifying phases so the place page links only variants that exist. Outcodes are excluded: nobody searches 'primary schools in SW11' and those routes do not exist. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 20:43:07 +01:00
TudorandClaude Opus 5	d3c63ccc6d	fix(places): a locality collision must not break the sitemap ... Sitemap regeneration failed on staging. 'richmond' in the curated locality list collides with the GIAS town Richmond in North Yorkshire (37 schools), the registry raised, and the admin endpoint 500d — taking down sitemap generation for all 25,000 school pages over one bad row of curated data. The guard now skips the colliding locality and logs an error. Skipping still achieves what the guard was for — a locality never silently shadows a town — without letting curated data break the site. That matters beyond this bug: GIAS town names change with no code change here, so a raise could fire spontaneously in production later. Also removes four localities that were London boroughs rather than districts. Hackney, Islington, Greenwich and Ealing are local authorities with 104, 72, 108 and 115 schools and already have authority pages; a locality defined by two or three outcodes would have been a partial near-duplicate of one — the thin-content failure the two-namespace design exists to avoid. A test now guards the whole borough list. Validated against the live corpus: 15 localities, no town collisions, no authority duplicates, all 15 clear the threshold. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 20:20:52 +01:00
TudorandClaude Opus 5	6b871ce1e9	feat(places): ItemList and BreadcrumbList, and the e2e gate ... ItemList tells Google the page is a ranked set rather than prose; BreadcrumbList puts the place in a hierarchy. School URLs in the markup are absolute on the canonical host, since a relative URL in JSON-LD is ambiguous. Eight journeys covering all four families, the two-namespace guarantee, the threshold, the canonical, the sitemap and the local-versus-England line — the last because that comparison is the reason these pages are not a name dropped into a template. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 18:19:08 +01:00
TudorandClaude Opus 5	c981d89137	feat(places): town, locality, authority and outcode routes ... Every generateStaticParams is gated behind PRERENDER_PLACES and wrapped in the same try/catch the school route uses. The plan claimed authority pages were 'few enough to always prebuild' — but few enough still means the API must be reachable at build time, and in CI it is not: the build failed with ECONNREFUSED rather than degrading to ISR. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 18:17:57 +01:00
TudorandClaude Opus 5	de5e790112	feat(places): place page client and view component ... One component for all four families: they differ in what fills the registry, not in what the page shows, so a second would be a second place to forget the same change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 18:15:10 +01:00
TudorandClaude Opus 5	42138fc402	feat(places): submit place and outcode sitemaps ... Separate children per family so Search Console reports the location layer's indexation apart from the school pages' — which is the point of the index built in W1, and the number the stop condition watches. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 18:13:55 +01:00
TudorandClaude Opus 5	c5af476213	feat(places): /api/places registry and place detail endpoints ... The registry is cached for the process and reset by the same admin endpoint that rebuilds the sitemaps, so places and sitemap always describe the same corpus rather than drifting apart. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 18:13:05 +01:00
TudorandClaude Opus 5	de853b90b3	feat(places): London localities and postcode districts ... The GIAS town field puts 1,819 London schools under the single value 'London', so it cannot answer 'schools in Battersea' — a query that appears in the baseline. No single field can: parliamentary constituency gives Battersea but not Canary Wharf, admin_ward gives Canary Wharf but not Battersea, and neither gives Clapham or Shoreditch. So a locality is curated, defined by the postcode districts it covers, which needs no new ingestion. A locality may not shadow a published town: the registry raises rather than silently costing a page that carries real demand. One below the threshold is logged rather than raising, because a locality can legitimately be too small. The pipeline seed mirrors the module, with a test guarding the drift — the same arrangement gias_codes has, and for the same reason: the backend image does not contain pipeline/. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 18:11:56 +01:00
TudorandClaude Opus 5	759d9f5cea	feat(places): registry of towns and authorities ... Two namespaces because 67 town names collide with an authority name and neither set contains the other — postal towns cross authority boundaries, so Bedford the town holds 104 schools against the authority's 86. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 18:10:37 +01:00
TudorandClaude Opus 5	555d3f0a7d	docs(seo): implementation plan for the W2 location layer ... Seven tasks: the place registry, London localities and outcodes, the places API, per-family sitemaps, the shared place view, the four route families, and structured data plus the e2e gate. Two things the plan corrects against the spec. The backend image does not contain pipeline/, so the curated locality list cannot live only in a dbt seed — it follows the gias_codes.py precedent instead, canonical in backend with the seed as a mirror. And NationalAverages is nested by phase rather than flat, which the first draft read wrongly and would have rendered every page without its England comparison. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 18:09:35 +01:00
TudorandClaude Opus 5	ecc847091c	docs(seo): design for the W2 location layer ... Supersedes the original spec's W2. The Search Console baseline inverted its ordering: every measured location query is town or district level, none is an administrative area, and phase is part of the query rather than a filter. Two problems the original design did not anticipate. 67 viable towns share a name with a local authority, and the authority is the larger set in only 43 of them — postal towns cross authority boundaries, so neither can absorb the other. Two namespaces resolve it by construction. And the GIAS town field collapses 1,819 London schools into one value, which a curated locality-to-outcode seed solves without new ingestion. Sizing is measured against the live 25,185-school corpus rather than estimated: 783 viable towns, 1,760 outcodes, 154 authorities. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 18:09:35 +01:00
TudorandClaude Opus 5	c0547c45e5	feat(seo): rewrite the C1 snippets to earn the click (W8) ... The baseline says these pages already rank and are not clicked. 'compare school performance' sits at position 6.1 with 0.43% CTR; 'compare schools' at 7.2 with 0.87%. The brand query 'school compare' draws 9.16% from the same neighbourhood of the same results page, which rules out a ranking explanation — when the snippet gives a reason to click, it gets clicked. These SERPs are owned by the DfE's own 'Compare school performance' service. The old title put a lowercase brand nobody searches for in the most valuable pixels, then a near-paraphrase of that service's name. Beside the government's own result it read as a lookalike. Intent in the title, differentiator in the description. Titles now match what people type, and the descriptions carry the one fact gov.uk does not publish: how close you had to live to get a place. /compare deliberately takes the tool phrasing rather than the homepage's, so the two pages stop competing for one phrase. The root layout's default and Open Graph copy were saying something different again; they now agree. No hard school counts in any of it. The corpus moves with every data refresh and this repo has already shipped one copy bug of that kind. Tests guard the mechanics — SERP length, intent keyword, the differentiator, no brand-first title — and leave the wording free to iterate. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 00:21:08 +01:00
TudorandClaude Opus 5	07c97a46c5	fix(seo): a school is publishable on any year's results, not the latest ... _school_sitemap_rows tested only the latest year's row, which quietly dropped every school with results in its history but a null row for the most recent year — a school that stopped reporting, or whose figures were suppressed for small-cohort disclosure. The Mallard Academy (150367) is the case that caught it: real KS2 results for 2015-16 through 2018-19, then null rows from 2022-23 on. Its detail page shows all four years; the sitemap omitted it. Sampling 40 of the 2,206 excluded schools found 4 like this, so roughly 220 real pages were being withheld. Publishable is now a property of the school, computed across every row, while lastmod still comes from the latest row so the most recent Ofsted date wins. The field list is a module constant shared with _has_publishable_data so the two checks cannot drift. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-21 00:04:32 +01:00
TudorandClaude Opus 5	b34511e459	chore: record the branch cleanup manifest ... 79 remote branches deleted: 77 fully merged into main, plus feat/seo-crawl-hygiene and feat/england-only-corpus, whose content is preserved on feat/seo-crawl-hygiene-main (PR #110). Each line carries the SHA, so any branch can be restored with git push origin <sha>:refs/heads/<name> The 14 branches left standing all carry content that differs from main and none of them is mine to judge abandoned. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-20 23:23:30 +01:00
TudorandClaude Opus 5	1fc1e07d21	fix(seo): keep staging out of the search index ... Staging serves the same image as production off stx., with robots.txt saying Allow: / and no noindex — a fully crawlable duplicate of the site. Nothing appears indexed today, most likely because the pages canonicalise across to production, but that is a side effect rather than a control. X-Robots-Tag, not a robots.txt Disallow. Disallow blocks crawling, which is not the same as blocking indexing: a disallowed URL can still be indexed from external links, and blocking the crawl means Google never fetches the page and so never sees a noindex at all. Staging stays crawlable and answers noindex. Matched on the staging host explicitly rather than 'any host that is not production'. The inverted form would cover future environments automatically, but its failure mode is deindexing production if the Host header ever arrives rewritten by a proxy — which cannot be verified from here. This form's failure mode is a new environment being indexable until someone adds it, which is recoverable. Any new non-production hostname must be added. The journeys only ever run against staging (deploy.yml passes STAGING_BASE_URL; promote.yml smoke-polls production without Playwright), so asserting the header there is safe. The two assertions live in one test because the halves only work together. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-20 23:21:58 +01:00
TudorandClaude Opus 5	2208ad93c1	feat(seo): split the sitemap into a per-family index ... Search Console reports coverage per submitted sitemap, so one file per page family is what will make W2's location pages measurable when they land. The index's lastmod is generation time, which is the correct semantic there — unlike on a <url>, where it would be a claim we cannot support. Children sit under /sitemaps/ because Next only treats a whole bracketed path segment as dynamic; a route folder named sitemap-[...parts] would be read as a literal static segment and never match. Confirmed by the build output, which lists /sitemaps/[...parts] as a dynamic route. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-20 23:15:00 +01:00
TudorandClaude Opus 5	24f3cb4c65	fix(seo): submit only school pages that have something to show ... Drops the schools with neither results nor an Ofsted grade, adds /admissions which was never listed, replaces the invented priority and changefreq with a lastmod taken from each school's Ofsted date. lastmod is omitted where no date is known rather than defaulted to now. An always-now lastmod is a claim Google learns to distrust; absent honestly means unknown. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-20 23:15:00 +01:00
TudorandClaude Opus 5	3816b92d06	fix(seo): noindex parameterised comparisons, keep bare /compare ... 25,193 schools make ~317 million pairs. The bare page stays indexable as the landing page for the head term; the parameter space goes noindex, follow so its outbound links still count. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-20 23:15:00 +01:00
TudorandClaude Opus 5	51ce2d6373	fix(seo): declare a canonical on every route ... The homepage read eleven search params and declared no canonical, so every filter combination was a crawlable near-duplicate of the page we most want to rank. Rankings and admissions declared none either. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-20 23:15:00 +01:00
TudorandClaude Opus 5	5ddc7314fd	fix(seo): canonicalise on the www host, which is the one that serves 200 ... The apex 301s to www at Cloudflare, but metadataBase, the school-page canonical, robots.txt's Sitemap: line and the sitemap's own <loc> entries all named the apex. Every one of those pointed Google at a redirect. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-20 23:15:00 +01:00
TudorandClaude Opus 5	3aad5101a8	fix(data): drop the Welsh school GIAS does not type as Welsh ... Beechwood College (URN 142458, Sully, CF64 5SE) survived the England-only filter. GIAS types it a Special post 16 institution (32), not a Welsh establishment (30), so filtering on establishment type alone left it behind — the last Welsh school on the site, and the reason Vale of Glamorgan was still in the authority list. The earlier verification claimed the type codes mapped onto the Welsh authorities in both directions. That was checked exhaustively for Cardiff and by count for three others; Vale of Glamorgan was never checked, and it was the one that did not hold. LA code is the reliable discriminator: GIAS gives the 22 Welsh unitary authorities the contiguous block 660-681, which English authorities never use. Filtering on postcode would have been wrong — Redbrook, Tutshill, Wyedean and two other Gloucestershire schools carry NP16/NP25 postcodes because Royal Mail areas straddle the border, and they are English schools with English data. An e2e test now pins those five so the fix cannot be simplified into a postcode filter later. The 660-681 range is documented GIAS structure this project cannot verify from its own data, so the range filters and the authority NAME checks: if the range is ever wrong, a Welsh authority reappears in assert_england_only_schools and the pipeline fails loudly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-20 22:54:24 +01:00
TudorandClaude Opus 5	69f2201244	docs(seo): correct W1 plan's sitemap child routes ... Next only treats a whole bracketed path segment as dynamic, so the planned app/sitemap-[...parts]/route.ts would have been read as a literal static folder and never matched. Children move under /sitemaps/. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-20 22:09:00 +01:00
TudorandClaude Opus 5	e6048c9ca6	docs(seo): implementation plan for W1, crawl hygiene and sitemap ... Five tasks: one canonical host, canonicals on every route, noindex on parameterised comparisons, a sitemap that drops dataless schools and invented priorities, and a per-family sitemap index. Planning turned up a fault the spec had missed: the apex 301s to www, but metadataBase, the school-page canonical, robots.txt's Sitemap: line and every sitemap <loc> named the apex. Task 1 fixes it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-20 22:05:00 +01:00
TudorandClaude Opus 5	7650b16f62	feat(data): publish England only, dropping Welsh and overseas establishments ... GIAS ships the whole UK plus overseas and offshore establishments. None of them carry comparable DfE performance data — Wales does not publish on the English measures at all — so every one of these pages rendered with null results, null Ofsted and null phase. There were 2,036 of them: 1,569 Welsh, 123 offshore (Jersey, Guernsey, Isle of Man, Gibraltar), 316 British schools overseas and 28 service children's schools. All 2,036 were being submitted to search engines, alongside 29 local authorities that existed in the filters purely to list them. Filter at the mart boundary rather than the view layer. dim_school and dim_location both exclude TypeOfEstablishment in {25, 26, 30, 37}, listed once as vars.non_england_school_type_codes. Everything downstream reads those two marts — search, the school page, /api/filters, rankings, Typesense and build_sitemap() — so one filter removes them from the site and the sitemap together, and Typesense drops them on its next rebuild since it recreates the collection and swaps the alias rather than upserting in place. coalesce rather than a bare NOT IN: a null type code would make the predicate null and drop the row silently, and an unknown type is not grounds for exclusion. No establishment has a null type today, but a future GIAS refresh could ship one and the loss would be invisible. assert_england_only_schools guards both directions: no excluded type survives in dim_school, and dim_location holds no URN dim_school lacks — the API inner-joins them, so the two filters drifting apart would silently shrink the corpus. Corpus goes from 27,229 schools to 25,193, and the authority list from 182 to 153. The 1,569 Welsh URLs now 404. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015mWQnpye9F299NVRCCSRvj	2026-08-20 21:46:28 +01:00
TudorandClaude Opus 5	9abd020967	fix(e2e): scope the Distance-tab assertion, and separate the tile figures ... The failing journey was wrong; the page was correct. Locator: getByRole('button', { name: 'Distance' }) Expected: 0 Received: 1 getByRole matches accessible names by case-insensitive SUBSTRING, so { name: 'Distance' } matched <button>Show this distance on a map</button> — the map toggle added by the same feature. The assertion was meant to say "no Distance tab in the admissions segmented control" and instead said "no button anywhere whose label contains the word distance". Now scoped to the control it is about, via its own aria-label, and read positively: the tab list must contain "This year" and must not contain "Distance". An absence check against an unscoped locator passes for the wrong reason the moment the selector stops matching, which is exactly how the regression this test guards would return unnoticed. Two sibling locators had the same weakness and are tightened: 'Check' is a prefix of the button's own busy label "Checking…", and the figure matcher accepted `(miles|m)` — a leftover from the mixed-unit era that would have kept passing if the headline regressed to metres, which is the thing #105 just fixed. Tightening that matcher surfaced a real defect behind it. The cut-off figure and its metric support are flex children with the gap drawn by CSS and nothing between them in the text layer, so the element read "0.88 miles1.4 km" — what a screen reader announces, and why a `miles\b` boundary could never match. Both templates now carry an explicit space. Whitespace text nodes are not rendered as flex items, so the reading changes and the layout does not. Verified against staging: 54/54. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WDvkyqqHABm4bmth2kjAxE	2026-08-20 21:01:28 +01:00
TudorandClaude Opus 5	ea5249a2ea	fix(admissions): state distance in miles throughout, never mixed ... The postcode check read "69 m away — inside the September 2026 cut-off of 0.17 miles". Both numbers are right and the sentence is still useless: the reader has to convert one of them to check a comparison we had already made for them. The cause was a readability rule of mine in formatCutoffDistance, which swapped to metres below 100m on the grounds that "0.04 miles" carries less than "69 m". Taken one figure at a time that holds. Taken in a sentence containing two figures it guarantees a mismatch whenever they fall either side of the threshold — and a 270m cut-off with a nearby home does exactly that. Miles now lead everywhere. It is the unit UK school admissions runs on: councils publish cut-offs in miles (90% of the collected source rows), and it is what a parent has already been quoted in their booklet and offer letter. The metric figure survives only as support beside the miles figure on the Admissions tile, where it converts the same value rather than presenting a second one to compare. Below 0.01 miles the decimal places run out rather than the unit being wrong, so a very short distance is described — "under 0.01 miles" — instead of rounding to a flat "0.00 miles", which would read as no distance at all. Both figures in the verdict now go through one formatter with no fallback that could reach for another unit. The old `?? "N m"` fallbacks on that line were a second route to the same defect and are gone. Covered by a sweep over sixty home/cut-off combinations spanning the old switch point, asserting no verdict contains a metric reading and that exactly two miles figures appear; plus the reported case pinned verbatim, and an e2e guard on the rendered verdict. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WDvkyqqHABm4bmth2kjAxE	2026-08-20 20:35:05 +01:00
TudorandClaude Opus 5	c9a1892bfb	feat(admissions): publish the latest cut-off only, holding history back ... Earlier years are to become a paid feature, so they stop being published. The load-bearing part is that this is a change to the API, not only to the page. /api/schools/{urn} is public and unauthenticated: leaving admission_distance_history in the payload while declining to render it would have handed the whole record to anyone who opened the network tab. It is withheld at the source, and the page follows. Nothing changes upstream. The tap, the plausibility band and fact_admission_distance are untouched and still load every published year, so restoring history for entitled callers is a change to one function in data_loader rather than a re-collection. What the reader now gets is the latest figure on the Admissions tile, and a Distance section that answers the question the number alone cannot: whether their own address falls inside it. Retitled to "How far away are you?", which is what it now does — the previous title described a record that is no longer there. Removed with the history: the trend chart, the year-by-year table, the per-year verdict strip, the trend summary and the coverage note, along with their CSS. The section goes from 743px to 417px. One consequence worth naming. A run of years used to soften a single close call — a home just outside one year's cut-off was usually inside another. With one year published, the "too close to call" band is the entire safety margin between a parent and a place they do not have, so the verdict now names its year, and the three outcomes are tinted apart rather than distinguished by wording alone. The existing stylesheet test earned its keep here: the three verdict classes were referenced before they were written, and it caught them. Unstyled, a "beyond the cut-off" result would have been indistinguishable from an "inside" one — the exact failure the longhand class map was written to prevent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WDvkyqqHABm4bmth2kjAxE	2026-08-20 18:44:57 +01:00
TudorandClaude Opus 5	94151c58ea	fix(admissions): move the cut-off detail into its own section ... The admissions card measured 1503px on a live school page — half the height of every section put together, and nearly three times the next largest — with its default view rendering as four tiles adrift in about 1080px of blank card. The cause was a layout trick meeting content it was never sized for. The admissions views are stacked in one grid cell so switching them never shifts layout, and the hidden ones keep their box: only visibility is dropped. That works while the views are comparable. The distance view added in #102 carries a chart, a table and a map, came to 1402px against the tile grid's 316px, and pinned every other view to its height — including the one that renders by default, which nobody had clicked. Rather than only unpinning it, the detail moves out. Every other topic on the page is a section with a nav entry, and "how close did we need to live, and would we have got in?" is a topic, not a variant reading of the intake figures. The headline number stays on the Admissions tile where the intake story is; the record behind it now lives in a Distance section directly below. admissions 1503px -> 554px distance new -> 743px (median section on the page is ~528px) Three further changes, each of which also makes the content better rather than only shorter: * The map renders on request. Before a postcode is entered it is a circle drawn round a school, and it costs a Leaflet bundle and 240px to say so; a successful check opens it automatically, which is the point at which it starts answering something. Map height 320px -> 240px. * The chart appears only at the four published years that let the summary state a direction. Below that we already refuse to call the series a trend, and a line through three points asserts one regardless of what the sentence beneath it admits. The table carries those years anyway, with the reasons a line cannot show. * Three caveat paragraphs become one. They said walking-route twice and made the same point about priorities in two voices. It now sits in CutoffDistanceDetail rather than inside the check, so it still renders for a school with coordinates missing, where there is a table but no map and no check. The new e2e guard asserts no section exceeds 2.5x the median section height. Measuring the card's internals cannot catch this: the tile grid is flex: 1, so it absorbs the stretch and every box still looks full. The first version of this test targeted an arbitrary primary, passed against the live bug, and proved nothing; pointed at a school that actually holds cut-off history it fails on staging with "#admissions is 1459px against a 526px median". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WDvkyqqHABm4bmth2kjAxE	2026-08-20 14:54:02 +01:00
TudorandClaude Opus 5	a72323874f	feat(admissions): add the cut-off history, map and postcode check ... Completes the last-distance-offered feature against the mockup: the year-by-year record, the same numbers drawn over real streets, and the reader's own address measured against them. Serving the history The first cut deliberately served only the latest year, because a plain series would draw a trend line straight through gaps that are absences of publication, not of a cut-off. That reasoning is answered rather than abandoned: cutoffYearRows classifies every year in the span, and the chart breaks the line rather than interpolating across it. A missing year is not one fact but three. It may be unpublished; it may be a year the school was not oversubscribed; or there may be no record at all. Collapsing them into "no data" throws away the reassuring case and hides the important caveat, so each is stated in words in the table. The claim is held to what the data supports. fact_admissions.oversubscribed compares FIRST PREFERENCES against places, which does not establish that every applicant was offered one — so the copy says "places available on first preferences" and a test asserts the stronger claim never appears. The trend summary is not a verdict It names both endpoints and their years and lets the reader conclude. It is withheld below four published points, and a swing under a tenth of the earlier figure is reported as "broadly the same" rather than dressed up as a direction. The postcode check This is the only place on the site that answers a question about a family rather than a school, so most of the care went into what it refuses to say. postcodes.io returns a centroid covering roughly fifteen addresses, which against a 500 m cut-off is a fifth of the whole distance — so a margin inside 100 m returns "too close to call" rather than a place a family does not have. Unpublished years count as unknown, never as a pass. The limits are stated before the check is used, not revealed with the answer. The postcode is geocoded in the browser and never stored. Both templates Banded and selective secondaries are exactly where this matters most, so the detail is shared. The primary page gives it a third tab; the secondary page is one flat panel by design and renders it inline. Absence is explained rather than reported. A selective school's missing figure is explained by how it admits; a consistently undersubscribed school reads as good news. Also makes the batch loader's test double honour ORDER BY. It was a no-op, so "latest row per URN" was really "first row in the fixture" and the test would have passed with the sort reversed or removed. Verified: 214 frontend tests, 54 backend, 45/53 e2e green against staging (the 8 cut-off journeys skip until the DAG runs). Rendered offline against the real compiled CSS in both themes and at 390px; every new surface clears WCAG AA, measured on composited pixels. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WDvkyqqHABm4bmth2kjAxE	2026-08-16 13:42:06 +01:00
TudorandClaude Opus 5	88c653215d	feat(admissions): show the last distance offered where councils publish it ... Adds the cut-off distance a parent actually asks about — "how close do we need to live?" — end to end: a Singer tap, dbt staging and mart models, an Airflow DAG, and a tile on both detail templates. 3,597 schools across 57 local authorities carry a figure; the rest are unchanged. There is no national source for this. Each LA publishes its own cut-offs in its own format, and the collected CSV is transcribed from PDFs, spreadsheets and web pages — so most of the work here is deciding what is safe to show. Data * tap-uk-school-distance loads the CSV verbatim into raw. Keyed on (urn, year, school_name), because school_name carries the admission route: (urn, year) alone collides on 118 keys and a reload would have silently dropped every band but one. * stg_school_distance applies a 25 m – 25 km plausibility band. The source contains 0.0-mile rows (published where a school filled on a higher criterion), 1-metre cut-offs, and one reading 533 miles — ~4% of rows, all of which would put a visibly wrong number on a live page. * fact_admission_distance collapses routes to one row per school per year using the furthest, and keeps route_count so the page can say the figure is the widest of several bands rather than the one for a given child. Serving * Kept out of fact_admissions: that mart is EES-derived and near-complete for England, this one covers 57 LAs, and the two refresh independently. * Latest year only. Coverage is ragged — a school may have 2021 and 2026 and nothing between — so a history array would invite a trend line drawn through gaps that are absences of publication, not of a cut-off. * The Admissions section now renders on either source. 3% of the schools that render have a cut-off and no EES admissions row, and gating on admissions alone would have hidden the figure on those pages. Interface * The year travels with the figure everywhere it appears; a cut-off detached from its admissions round is not a fact about anything. * "Not a fixed catchment — it moves every year" sits under every instance, because that is the inference a parent will otherwise draw. * Replaces a hardcoded "Historical distance cut-off data is not available for this school" that appeared on every secondary page, including the ones whose council does publish it. The absence is now stated only when it is real, and names the authority that would hold it. The tint costs the muted tokens their AA margin: measured on the composited backdrop (not the computed one, which reports the untinted card), --text-muted falls to 4.09:1 in dark theme. The tile uses --text-secondary instead — 6.50:1 dark, 6.60:1 light. The DAG is manual, like the other annual ones: councils publish on allocation day, each on its own timetable, so there is no date worth scheduling against. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WDvkyqqHABm4bmth2kjAxE	2026-08-15 22:48:30 +01:00
TudorandClaude Opus 5	fa1abff642	chore: drop the hero byline, and refresh a figure in the UX audit notes ... Two unrelated working-tree changes, committed as one at the owner's request. Removes "Built for parents, by a parent." and its comment from the hero. It was added two commits ago; taking it out is the owner's call, and the reasons it was placed under the search rather than in the footer no longer apply. The .heroByline rules in HomeView.module.css are deliberately left in place. They are now unreferenced, but the class was purpose-built for this one line and keeping it makes restoring the byline a one-line change. If the removal is permanent, that block (and its 640px media query) should go with it. Also updates two quoted figures in the 2026-07-02 UX audit notes from "24,000+" to "27,000+". Worth noting for the record: that file documents what the page said when it was audited, and at that time it genuinely did say "24,000+" — which was itself the bug later fixed by reading unique_schools instead of a field the API never sent. Editing the quoted evidence makes the note read consistently with the current site, at the cost of no longer being a verbatim record of what was observed. Left as the owner edited it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-15 10:21:29 +01:00
TudorandClaude Opus 5	59ac9c10b9	fix(charts): make the national-average marker visible on both templates ... The marker was var(--brand) — the identical value to the bar fill it sits on. Measured by pixel-sampling every bar on both templates, in both themes: primary SatsChart .natTick 1.00:1 (6 bars) secondary .att8VizNatLine 1.00:1 Not low contrast. The same colour. It scored 5.47:1 only against the empty track, which means it was visible precisely when a school was BELOW the national average and vanished for every school at or above it — failing for exactly the schools people are looking for. No single colour fixes this, because the marker's position is data-driven: it can land on the bar, on the empty track, or across the boundary. It is now a knockout — a light core carrying a dark edge, both from tokens that flip with the theme, so one part or the other always separates: on the bar on the track light 5.47 / 9.70:1 15.17:1 dark 7.81 / 10.85:1 13.52:1 THE LEGEND DESCRIBED A CHART THAT DID NOT EXIST Both data swatches were var(--status-above) green while their bars were var(--brand) teal, and the two were identical to each other — one swatch for two series. Worse, the only swatch matching the bar colour was the one labelled "National average", so reading the chart by matching colours told you the teal bars were the benchmark. Each swatch now carries its bar's exact value, and the marker swatch mirrors the knockout. TWO SERIES, ONE COLOUR Expected and Exceeding were both var(--brand), distinguished only by row. They are a sequential pair — exceeding is the same cohort at a harder bar — so they take two steps of one hue, the harder measure being the step further from the ground in each theme. They measure 1.77:1 (light) and 1.39:1 (dark) against each other, and that is accepted rather than overlooked: two fills that must EACH clear 3:1 against the same white track are geometrically forced close together. The distinction is carried by the row labels and printed values; colour is redundant here, not load-bearing. THE TEST THAT SHOULD HAVE CAUGHT THIS The WCAG journey composites backgrounds by walking the ancestor chain, but these markers are absolutely positioned over a sibling — ancestor-walking is structurally blind to overlap, which is why this shipped in two templates and passed every gate. The new journey asks the stacking order instead, via document.elementsFromPoint. Writing it surfaced a second trap worth recording: elementsFromPoint takes viewport coordinates and returns an empty stack off-screen, and these markers sit ~1200px down. The first version defaulted an empty stack to white, which made teal-on-teal look like teal-on-white and PASS in the light theme. It now scrolls each marker into view and counts any marker it cannot resolve a backdrop for as a failure rather than a pass. Verified both directions: the new journey fails against current staging with "1.00:1 over rgb(15,118,110)" in both themes, and passes against this build with 6/6 markers measured at 5.47–15.17:1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-15 09:48:41 +01:00
TudorandClaude Opus 5	eddf74745f	feat(home): swap in the higher-fidelity hero artwork ... Same 16:9 frame, but not a drop-in replacement — the composition, palette and copy area all moved, and each one drives a change here. COPY AREA The old artwork was a flat #FDF9F3 down its whole left side. This one runs peach #FEE8D2 at the top to cream #FDF3E7 around 43% height, and below ~48% the left edge is foliage rather than cream at all. --hero-ground is resampled to #FEF2E1, the middle of the pale run where the headline and search actually sit; the scrim covers the foliage further down. Measured on rendered pixels with the text hidden, sampling the real glyph runs (via Range, not the element boxes) plus a 120px growth margin: title body byline light 13.61:1 5.74:1 6.66:1 dark 9.49:1 5.45:1 8.35:1 Body drops from 6.52:1 to 5.74:1 as the foliage comes closer, still clear. BAND CROP The schoolhouse moved to ~82% across the frame, leaving only ~140px of artwork to its right, so the band crop is anchored to the right edge and takes 1344px back — putting the school at 73%, which the build script now derives and prints rather than leaving it to drift from the CSS. The crop is also 3.2:1 rather than matching the phone. The band is not one ratio: it runs 2.4:1 on a phone to about 3.8:1 under the one-column breakpoint. Cropping at the narrow end means the wide end throws away height, which cut the flag off the roof and the base off the building. Sitting above the middle costs a little width on phones — where the crop's left is hillside — and keeps the building whole where it matters. BAND HEIGHTS Raised to 13rem (861–860px) and 10rem (≤640px). The band was widest-per-height at exactly 640px, where an 8.5rem band measured 4.2:1 — worse than any wider viewport, because the height steps down at that breakpoint while the width does not. Ratios across the range are now 2.0 / 2.6 / 3.6 / 3.1 / 3.8 rather than spiking. The search still lands at 442px on a 667px viewport. WEIGHT Source is 3.1MB; a browser fetches one file — 29–59kB on desktop, 10–14kB on a phone. Widths re-cut for the larger master: 2000/1400/1000 wide, 1344/900/600 band. Verified: 0 AA failures across both themes at 1440 / 860 / 390, every srcset entry present on disk with no orphans, tsc clean, 159/159, build green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-15 09:22:37 +01:00
TudorandClaude Opus 5	3015c37bac	feat(home): add a first-person byline under the hero search ... "Built for parents, by a parent." — the one line on the page written by a person rather than by a product. Placed under the search rather than in the footer, which is where it would have been true and unread. It does its work at the moment someone is deciding whether to trust a page full of government statistics, which is the moment they are looking at the search box. Set apart without shouting: display face, a step down in size, and a short brand rule in place of a bullet. No italic — Manrope ships none in the loaded weights, so font-style would be synthesised into a slant, the same reason .heroEmph resets it. Deliberately the only claim of its kind on the page. Every other trust signal here is about the data's provenance and is checkable against the DfE and Ofsted; this one is about who built it, and is not. So it is stated once, plainly, and never repeated — the opposite of the "Official & trusted" line it now sits near, which claimed something about the site that was not true. Measured 7.26:1 in the light theme and 8.86:1 in dark. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-15 08:59:43 +01:00
TudorandClaude Opus 5	4043270a77	fix(home): stop implying we are official, and fix the mobile hero and search ... Three things, all reported from the live mobile view. WE ARE NOT AN OFFICIAL SERVICE The value prop read "Official & trusted", whose grammatical subject is this site — it reads as a claim that schoolcompare is an official service. It is not; it is an independent site that republishes official figures. Now "Built on official data", which describes the data instead. Checked every other use of the word: all nine describe the data ("official DfE figures", "the official figure isn't in") and are correct as they stand. That one title was the only place the site described itself. The footer now says it outright — "An independent site. Not affiliated with the Department for Education or Ofsted." — so it appears on every page rather than being left to inference. An e2e test asserts both halves: that the statement is present, and that no text presents the site itself as official. The disclaimer first measured 4.71:1 against a 4.5 floor. That is a fine margin for decoration and the wrong one for a line whose job is to be legible to someone checking whether this is a government site; it is now 5.59:1, quieter than the copy around it by size rather than by contrast. THE ARTWORK SAT UNDER THE SEARCH ON PHONES The DOM keeps .heroContent first so the desktop overlay does not depend on source order, which left the band stranded at the bottom of the panel, reading as a strip stuck on the end rather than a hero image. `order` moves it above the copy on phones; it is decorative and aria-hidden, so no reading order changes. Measured on a 667px viewport — the shortest phone still in use — the search button lands at 418px, comfortably inside the fold. THE SEARCH INPUT WAS UNUSABLE ON PHONES "Search schools" is a fixed 134px with white-space: nowrap, so it took 48% of the row. Measured on staging: 390px input text space 102px placeholder needs 194px 360px 72px 320px 32px At 320px you could not see what you were typing. The button now wraps to its own full-width row below 480px, which fixes 360px and up — 390px goes from 102px to 226px of text space. The pill stays a single element, so it keeps its border, shadow and :focus-within ring, and the button gains a full-width tap target. 320px is still ~30px short. Closing it needs a shorter placeholder, which three other tests match on by exact string; left alone deliberately rather than churn them for a width that is effectively gone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-14 22:59:12 +01:00
TudorandClaude Opus 5	e65688d600	fix(e2e): assert the brand lockup and touch icon as they are actually built ... The staging gate has been failing these two since the supplied logo artwork replaced the reconstruction. Both tests were still asserting the previous implementation, and both were right to fail — they were just describing something the site no longer does. the header carries the schoolcompare lockup Looked for an <svg> inside the header link. The mark is raster now: <picture><source><img src="/brand/mark.png">. Nothing matched, so the locator timed out. the brand asset set is complete and served Requested /apple-icon, which 404s. The route moved when the generated app/apple-icon.tsx became a static app/apple-icon.png — generated icons serve at /apple-icon, static ones at /apple-icon.png with a content hash. The icon was present and correctly linked the whole time. Both now read from the page instead of hardcoding the shape of the answer: the touch icon is fetched from its own <link rel="apple-touch-icon"> href, the way this test already handles og:image, so it follows whatever Next emits. The lockup assertion also got stronger rather than merely corrected. A <picture> whose sources all 404 still lays out and still satisfies toBeVisible(), so that alone would go green on a broken lockup; it now asserts naturalWidth, which only a decoded image can satisfy. Verified against staging directly: 41/41 pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-14 22:34:22 +01:00
TudorandClaude Opus 5	bdaa05cd54	style(home): lift the hero artwork's dark-theme brightness to 0.75 ... At 0.52 the scene was legible but heavily suppressed; 0.75 lets the hills, path and schoolhouse read while the white H1 stays comfortably the brightest thing on the panel. Re-measured rather than assumed, because in the dark theme the text is light and the artwork is behind it — brightening the image lowers text contrast rather than raising it. Off rendered pixels, sampling background up to 120px past each line's right edge: brightness title body 0.52 11.01:1 6.44:1 0.75 9.48:1 5.21:1 Both still clear the 4.5:1 floor, body being the binding one. The trade is recorded next to the value so the next person to reach for it knows it has a floor and not just a taste range. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-14 22:26:23 +01:00
TudorandClaude Opus 5	043506cb6b	fix(home): art-direct the hero's fallback path, and declare sharp ... Two findings from review on #93, both verified before fixing. <img src> cannot vary by viewport, so it was always the wide desktop crop. A browser taking neither AVIF nor WebP therefore fell through to the desktop frame on a phone and lost the schoolhouse — the exact failure the two-crop <picture> exists to prevent, surviving in the one path nobody looks at. The band JPEG the build script already emitted was never referenced, which was the tell. It now backs a <source media> placed after the modern formats, so they still win wherever they are supported. Verified by stripping the AVIF and WebP <source>s at runtime and letting <picture> re-resolve, which is what an old browser actually sees: phone hero-band-500.avif → hero-band-700.jpg (band crop, school kept) desktop hero-wide-1672.avif → hero-wide-1200.jpg sharp was not declared: it arrives transitively from next@16.1.6, so the documented regeneration command works today and breaks on a Next upgrade or a clean install that resolves differently. Declared in devDependencies for the same reason next.config.js already declares its traced font files rather than trusting the tracer to keep finding them. The third finding — that the hero's licence is marked unconfirmed in CREDITS.md while the artwork ships — is accurate and deliberate. It is the owner's to answer; recording it as unknown is the point of the file. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-14 22:07:01 +01:00
TudorandClaude Opus 5	3f0e05cc99	feat(home): use the supplied hero artwork instead of a drawn one ... Replaces the hand-drawn SVG landscape with the illustration supplied by the project owner. Master is assets/hero-source.png; everything under public/brand/hero-* comes from scripts/build-hero-images.js and should never be hand-edited. LAYOUT The artwork is composed as a full-bleed hero: it reserves an empty cream area down its left side for the headline. The old hero was a two-column grid with art in the right 0.88fr, which would have cropped that reserved area off and shrunk the scene into a thumbnail — the one thing the picture is built not to be. So the panel is now a single layered block: artwork behind, copy on top, and below the one-column breakpoint the artwork leaves the background and becomes a band under the search. Overlaying does not survive down to phone widths — the panel gets too narrow for the copy to stay inside the cream, so the scrim would have to cover nearly the whole image and you would be left with a tinted rectangle. Hence the switch at 860px rather than a single treatment stretched across every width. CONTRAST The copy sits on a gradient of --hero-ground, a new token sampled from the artwork's own cream (#FDF9F3) rather than from Sand. Sand is eight to thirteen points darker per channel, which leaves a visible seam straight down the hero. The scrim exists because the artwork is a fixed image on a fluid panel: past some width the headline would otherwise land on hillside green. Measured on rendered pixels, sampling background up to 120px beyond the right edge of each line, so a longer line still has margin: light title 14.36:1 body 6.52:1 dark title 11.01:1 body 6.44:1 The worst light case is hillside green showing through the scrim at 6.52:1. TWO CROPS The slot is two shapes: roughly 2.1:1–2.7:1 behind the desktop panel, and 2.6:1–4.9:1 as the band. A single file under object-fit: cover centre-crops, and at the band's extreme that slices a strip through the scene and loses the schoolhouse — exactly how the drawn hero failed on phones. <picture> switches crop, not just resolution: the band file is pre-cropped around the school and is already near 2.6:1, with the subject at ~65% across so squeezing toward 4.9:1 crops the empty sides instead. WEIGHT 1.6 MB PNG in, AVIF and WebP out; a browser fetches exactly one file — about 23–33 kB on desktop, 9–18 kB on a phone. The JPEG is only the <img> fallback. `sizes` describes the real panel box (max-width 1400 minus padding) rather than 100vw, which over-requested a candidate at every width on the LCP element. DARK THEME A raster cannot be re-graded token by token the way the drawing was, but it would reproduce the same failure — a bright illustration is the brightest object on a near-black page. It is dimmed in CSS to read as dusk, and the scrim fades it into the dark panel rather than into cream. TESTS The two illustration journeys are replaced by three, each covering a failure that still renders a valid-looking page: the artwork actually loading (naturalWidth, not src), the crop switching at the breakpoint, a modern format winning negotiation, and the dark theme dimming it. public/brand/CREDITS.md records provenance for every asset in that folder. The hero's licence line is marked unconfirmed — that one needs the owner. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-14 21:36:40 +01:00
TudorandClaude Opus 5	97ac5c9cef	fix(a11y): clear the four AA failures blocking the staging E2E gate ... Main's staging E2E has been red since #90. Two of the four failures were the staging container serving a stale image at the moment the gate ran — apple-icon and the header lockup both check out against staging now. The other two were real, and both are the same mistake: a colour pairing verified against one ground while the element sits on another. * .heroEyebrow --brand on its own 10% tint over Sand is 4.19:1. The token clears AA on Sand, but the tint darkens the ground under the label, and that composite was never the thing measured. --brand-strong is 5.85:1. * .hiwVisual The preview panel was grounded in Sand while everything inside it is a translucent status tint — and those tints are specced to clear AA over --bg-card. Over Sand the report-card chips landed at 4.22:1 and 4.29:1. The ratio depended on a background two levels up. Moving the panel to the card surface puts them at 5.69:1 and 5.81:1; a border keeps it reading as an inset frame now that panel and card share a colour. * Footer .sectionTitle --sage flips with the theme; the footer band does not (it is teal in both). So the pairing only held in one of them — the dark sage measured 4.08:1, on every page. Now --on-sunken-muted, which is what the --on-sunken-* family exists for, as Footer.tsx's own header comment already says. * .compareHeadLabel --text-muted on the header row's tint is 4.45:1 in the dark theme. Under by a hair, same cause. Now --text-secondary. The harness gained the footer, because it had no footer and so could not have caught the one failure that appeared on all three pages. Rewriting fragments now uses each CSS module's own hash — the footer rewritten with HomeView's prefix renders unstyled, which would have made any contrast measured on it meaningless while still reporting a number. Verified: 0 AA failures in both themes across the assembled page, measured with the same probe the e2e test uses, against the real compiled CSS. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-14 18:08:38 +01:00
TudorandClaude Opus 5	dc22fd2853	fix(home): correct what the landing page claims, and give it one rhythm ... The homepage made four statements that were not true, carried elements that asked nothing of anyone, and had a hero illustration that broke in both the places it had to work. Claims, all verified against the code or the API: * "24,000+ schools" (three places) against a real 27,230. The fact box meant to show the live figure rendered its own fallback on every request, because DataInfoResponse declared a `total_schools` field the API has never sent — it sends `unique_schools`. The fetch succeeded; only that field was undefined, so nothing threw and nothing failed. The interface, not the code, was the thing that was wrong. * "Up to three schools side by side" against MAX_SCHOOLS = 5, contradicting a card 400px below it that correctly said five. * "Class sizes" — data the codebase has never held. That copy line was the only hit in a full-repo grep. * Invented results and Ofsted grades attributed to two real, named schools in the compare preview. Also one feature, three words: Compare (nav), shortlist (footer), pin (cards). Settled on Compare everywhere. And <title> was the bare string "Home". Cut: the trust line (repeated the coverage figure one paragraph after the hero gave it, behind three decorative dots), the "Start exploring" row (three links to two destinations already in the nav), the six-row coverage table, and three of the four countdown cards — which gave the page's largest numeral to dates up to 245 days away, two of them offer days, which cannot be missed. All four dates remain, at proportionate weight. Value-prop titles drop from <h2> to <p>; they were outranking the page's real headings in the document outline. Rhythm: the gaps between the seven landing bands were 24/32/24/16/48/32/16px, each band setting its own margin, with four different section-header treatments between them. The page container now owns one gap, and there is one header pattern. An e2e test asserts the gaps are identical. Illustration: it kept a fixed light palette in both themes, which left a pale sky slab as the brightest object on a near-black page, out-shouting the H1 and the search box. It now reads from --ill-* tokens with a dark re-grade. And the hero slot ranges from 1.34:1 to 4.9:1 across breakpoints, which no single composition survives under `slice` — at 860x176 a 540x520 scene shows only its bottom 110 units, so the schoolhouse was cropped away entirely on phones, leaving hills and a pin pointing at nothing. There are now two compositions, each drawn against the crop window its own breakpoint produces, with CSS showing one. Both are static server-rendered SVG. The deadline bar renders on the server rather than on hydrate. The effect-based version needed a reserved height, and one guessed number cannot cover a block whose supporting line wraps differently at every width — measured, it was short at all four, shifting the page up to 108px on a phone. Verified on the built output through an offline render harness (no local server): real compiled CSS, real rendered markup, four widths, both themes. tsc clean, 159/159 unit tests, build green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-14 17:29:47 +01:00