Phase 2: UI foundation → feature-complete MUSH client (web preview + Android)

.gitignore

@@ -1,6 +1,7 @@
 bin/
 obj/
 .vs/
+.idea/
 *.user
 
 # Machine-specific tool paths (Android SDK / JDK)

.superpowers/sdd/lineC-history-report.md

@@ -0,0 +1,73 @@
+# Line C — SessionHistory FTS5 Implementation Report
+
+**Date:** 2026-06-30  
+**Branch:** feat/phase2-ui-foundation  
+**Status:** DONE
+
+---
+
+## What was built
+
+`SharpClient.Data.SessionHistory : ISessionHistory` — full-text search over session
+history lines using SQLite FTS5 via `Microsoft.Data.Sqlite` raw SQL.
+
+### Files created / modified
+
+| File | Action |
+|------|--------|
+| `src/SharpClient.Data/SessionHistory.cs` | Created |
+| `src/SharpClient.Data/SharpClient.Data.csproj` | Added `Microsoft.Data.Sqlite` 10.0.9 explicit top-level reference |
+| `tests/SharpClient.Data.Tests/SessionHistoryTests.cs` | Created |
+| `.superpowers/sdd/lineC-history-report.md` | Created (this file) |
+
+---
+
+## Design decisions
+
+### FTS5 table schema
+```sql
+CREATE VIRTUAL TABLE IF NOT EXISTS session_history
+USING fts5(character_id UNINDEXED, line, sequence UNINDEXED);
+```
+- `character_id UNINDEXED` — stored but not tokenised; exact-match filter not needed (search is global, then filtered by caller if required).
+- `sequence UNINDEXED` — stored for potential future use; always written as `0` because the authoritative monotonic sequence is the FTS5 implicit `rowid`.
+- `CREATE VIRTUAL TABLE IF NOT EXISTS` is called on every operation (cheap, idempotent) — avoids maintaining a mutable per-instance flag and the IDisposable burden a SemaphoreSlim would impose.
+
+### Sequence derivation
+`HistoryHit.Sequence` = FTS5 `rowid` read back in `SELECT character_id, line, rowid`. The implicit rowid is SQLite's internal auto-increment integer, which is guaranteed monotonically increasing for append-only use. No race condition because SQLite is single-writer on a local file.
+
+### FTS5 query sanitisation
+`SanitiseFtsQuery(string)` splits the user input by whitespace, doubles any embedded `"` characters (FTS5 escape convention), wraps each token in `"…"`, and joins with spaces. This produces a conjunction of FTS5 phrase literals, making all FTS5 operators (`*`, `AND`, `OR`, `NOT`, `^`, unmatched `"`) inert. Empty / whitespace-only input returns `null` and the caller returns an empty list immediately without executing a MATCH query.
+
+Example: `foo "bar` → `"foo" """bar"` (FTS5 phrases for literal `foo` and literal `"bar`).
+
+### Connection strategy
+A fresh `SqliteConnection` is opened per operation (`await using`). This is correct for a local app with no concurrency requirements; no connection pooling or shared-connection complexity needed.
+
+---
+
+## Test results
+
+| Suite | Total | Passed | Failed | Warnings |
+|-------|-------|--------|--------|----------|
+| `SharpClient.Data.Tests` | 16 | 16 | 0 | 0 |
+| `SharpClient.Tests` | 49 | 49 | 0 | 0 |
+
+### SessionHistoryTests coverage (7 + 1 bonus test)
+
+1. `AppendThenSearchReturnsMatchingLinesWithCorrectCharacterId` — basic round-trip; single term; correct CharacterId.
+2. `MultiWordSearchMatchesLinesContainingAllTerms` — two-term AND semantics.
+3. `SearchAcrossTwoCharactersReturnsCorrectCharacterIds` — per-character ID integrity.
+4. `LimitIsRespectedWhenMoreMatchesExist` — 10 inserts, limit 3 → 3 results.
+5. `SearchWithNoMatchReturnsEmptyList` — no false positives.
+6. `EmptyOrWhitespaceQueryReturnsEmptyListWithoutException` — empty string and whitespace-only.
+7. `QueryWithFtsSpecialCharactersDoesNotThrow` — `"unclosed`, `*`, `"""` all sanitised cleanly.
+8. `SequenceValuesArePositiveAndDistinctPerAppend` — rowid-based sequences are positive and unique.
+
+---
+
+## Concerns / notes
+
+- FTS5 is available in `SQLitePCLRaw.lib.e_sqlite3` (the e_sqlite3 build ships with FTS5 compiled in); tests confirm it works.
+- The `sequence UNINDEXED` column is written as `0`; if callers ever need the stored value to equal the rowid, a post-insert `UPDATE` would be needed. For now, `HistoryHit.Sequence` always comes from `rowid` via SELECT.
+- No `NuGetAuditSuppress` was needed for `Microsoft.Data.Sqlite` — the advisory only covers `SQLitePCLRaw.lib.e_sqlite3` which is already suppressed in both csproj files.

.superpowers/sdd/lineC-worldstore-report.md

@@ -0,0 +1,108 @@
+# Line C — WorldStore Implementation Report
+
+**Date:** 2026-06-30  
+**Branch:** feat/phase2-ui-foundation  
+**Status:** DONE
+
+---
+
+## What Was Built
+
+### New Projects
+
+| Project | Path | Role |
+|---|---|---|
+| `SharpClient.Data` | `src/SharpClient.Data/` | EF Core SQLite persistence library |
+| `SharpClient.Data.Tests` | `tests/SharpClient.Data.Tests/` | TUnit integration tests |
+
+Both added to `SharpClient.slnx` under `/src/` and `/tests/` folders respectively.
+
+### Files Created
+
+- `src/SharpClient.Data/SharpClient.Data.csproj` — `net10.0` classlib; references `SharpClient.Core`; `Microsoft.EntityFrameworkCore.Sqlite 10.0.9`; targeted `NuGetAuditSuppress` for GHSA-2m69-gcr7-jv3q (see Warnings section).
+- `src/SharpClient.Data/AppDbContext.cs` — `DbContext` with `DbSet<World>`, `DbSet<Character>`, `DbSet<TriggerRule>`, `DbSet<AliasRule>`; `OnModelCreating` configures all relationships.
+- `src/SharpClient.Data/WorldStore.cs` — `IWorldStore` implementation.
+- `tests/SharpClient.Data.Tests/SharpClient.Data.Tests.csproj` — TUnit executable; `OutputType=Exe`; `TestingPlatformDotnetTestSupport=true`.
+- `tests/SharpClient.Data.Tests/WorldStoreTests.cs` — 8 tests with a `TempFileAppStorage` helper.
+
+---
+
+## EF Core Approach
+
+### Schema
+
+`TriggerRule` and `AliasRule` are shared entity types used by both `World` and `Character`. Two separate EF relationships are configured per entity type:
+
+- `World → Triggers/Aliases` via **shadow FK `"WorldId"`** (nullable) on the rule tables, `OnDelete(Cascade)`.
+- `Character → Triggers/Aliases` via **shadow FK `"CharacterId"`** (nullable) on the rule tables, `OnDelete(Cascade)`.
+
+Result: `TriggerRules` and `AliasRules` tables each have two nullable FK columns (`WorldId`, `CharacterId`). A world-scope rule has `WorldId` set and `CharacterId` null; a character-scope rule is the reverse.
+
+`World → Characters` uses the explicit `Character.WorldId` property FK.
+
+### UpdateWorldAsync Strategy
+
+**Delete-then-add with two `SaveChangesAsync` calls:**
+
+1. `_db.ChangeTracker.Clear()` — detach any previously tracked entities so the subsequent load is fresh (critical when the same `AppDbContext` was used for `AddWorldAsync`; without this, EF's identity resolution returns the already-tracked modified instance and the deletion can conflict with in-memory "Added" child entities).
+2. Load the existing `World` graph fully (all `Include`/`ThenInclude`).
+3. `Remove(existing)` — EF's client-side cascade marks all loaded children as `Deleted`.
+4. `SaveChangesAsync` — commits the deletion.
+5. `_db.ChangeTracker.Clear()` — release the deleted entities.
+6. `Add(world)` — attach the incoming graph as `Added`.
+7. `SaveChangesAsync` — commits the insertion.
+
+**Why two commits instead of one:** EF Core batches a same-PK DELETE and INSERT into a single command batch. SQLite's UNIQUE constraint fires before the row is deleted, causing `SqliteException: UNIQUE constraint failed`. Two commits guarantees the delete is physically committed before the insert.
+
+**Why ChangeTracker.Clear() is needed:** After `AddWorldAsync`, the `world` object is tracked as `Unchanged`. The test mutates it (rename, add CharC). `FirstOrDefaultAsync` with identity resolution returns the same tracked (now `Modified`) instance. `Remove` then cascades to the `Added` CharC, producing an unexpected extra delete attempt. Clearing the tracker before the load prevents this.
+
+---
+
+## Test Results
+
+| Suite | Total | Passed | Failed |
+|---|---|---|---|
+| `SharpClient.Data.Tests` | 8 | 8 | 0 |
+| `SharpClient.Tests` (existing) | 49 | 49 | 0 |
+| `SharpClient.UI.Tests` (existing) | 2 | 2 | 0 |
+
+### Data.Tests coverage
+
+- `AddWorldThenGetWorldsReturnsFullyPopulatedGraph` — full graph (2 chars, world rules, char rules), counts correct.
+- `AddWorldRoundTripsTriggerRuleFields` — `Kind`, `Pattern`, `Action`, `ActionValue`, `Enabled=false`.
+- `AddWorldRoundTripsAliasRuleFields` — `Pattern`, `Expansion`, `Enabled=true`.
+- `AddWorldRoundTripsConnectSecretKey` — nullable string preserved.
+- `UpdateWorldRenameAndAddCharacterReflectedInGetWorlds` — rename + add character.
+- `UpdateWorldRemoveCharacterNotReturnedByGetWorlds` — removed child not returned.
+- `DeleteWorldGetWorldsReturnsEmpty` — store empty after delete.
+- `DeleteWorldCascadesChildrenNoOrphanRows` — direct counts on `Characters`, `TriggerRules`, `AliasRules` all zero.
+
+---
+
+## Warnings Resolved
+
+### NU1903 — SQLitePCLRaw.lib.e_sqlite3 vulnerability (GHSA-2m69-gcr7-jv3q)
+
+`Microsoft.EntityFrameworkCore.Sqlite 10.0.9` pulls in `SQLitePCLRaw.lib.e_sqlite3 2.1.11`, which NuGet flags as a known high-severity vulnerability. Version 2.1.11 is the **latest available release** — no patched version exists. A targeted `<NuGetAuditSuppress>` item was added to both Data and Data.Tests project files (not `Directory.Build.props`) to suppress only this specific advisory.
+
+### CA1707 — Underscore in test method names
+
+TUnit tests typically use `MethodName_State_Expected` naming. `AnalysisLevel=latest-recommended` includes CA1707 as an error. All test method names were written in `PascalCase` (e.g., `AddWorldRoundTripsTriggerRuleFields`) to match the existing test conventions in `SharpClient.Tests`.
+
+### TUnitAssertions0015 — `.IsEqualTo(true/false)` deprecated
+
+TUnit 1.57.0 requires `.IsTrue()` / `.IsFalse()` in place of `.IsEqualTo(true/false)`.
+
+### CS9051 — File-local type in public member signature
+
+`TempFileAppStorage` was initially declared `file sealed class`; changed to `internal sealed class`.
+
+### CA1001 — Type owns disposable field
+
+Keeping `AppDbContext` as a field on the test class triggers CA1001. Resolved by creating `AppDbContext` locally (via `await using`) inside each test method rather than storing it as a class field.
+
+---
+
+## Concerns
+
+None. The two-SaveChanges update approach is a known limitation (two round-trips, not a single atomic transaction). For a MUSH client settings store with no concurrent writers this is acceptable. If atomicity becomes a requirement, wrapping both commits in a `BeginTransaction` / `CommitTransaction` block is a straightforward addition.

.superpowers/sdd/maui-integration-report.md

@@ -0,0 +1,86 @@
+# MAUI Integration Report — SharpClient.App
+
+## Services Added (`src/SharpClient.App/Services/`)
+
+| File | Interface | Notes |
+|------|-----------|-------|
+| `MauiAppStorage.cs` | `IAppStorage` | Returns `FileSystem.AppDataDirectory/sharpclient.db` |
+| `MauiSecretStore.cs` | `ISecretStore` | Delegates to `Microsoft.Maui.Storage.SecureStorage.Default` (Android Keystore) |
+| `MauiNotifier.cs` | `INotifier` | **Stub** — logs via `ILogger<MauiNotifier>` using `[LoggerMessage]` source-gen; push/local-notification support deferred |
+| `TelnetSessionLauncher.cs` | `ISessionLauncher` | Uses `ITelnetConnectionFactory` (Core abstraction, see below) to open a TCP telnet connection, wraps it in `Session`, auto-sends the connect string from `ISecretStore` |
+
+## Core Additions (`src/SharpClient.Core/Connection/`)
+
+| File | Purpose |
+|------|---------|
+| `ITelnetConnectionFactory.cs` | Interface: `ITelnetConnection CreateConnection()` |
+| `TelnetConnectionFactory.cs` | Wraps `ITelnetInterpreterFactory` from TNC; returns `new TelnetConnection(factory)` |
+
+**Why the extra abstraction?**  
+`ITelnetInterpreterFactory` (from TelnetNegotiationCore) resolves fine for `net10.0` but causes
+`CS0246` under `net10.0-android`. Root cause: TNC's net10.0 DLL references `Stateless,
+Version=4.0.0.0, PublicKeyToken=93038f0927583c9a`; the available `stateless` 5.20.0 package DLL
+does not carry that public-key token, so Roslyn silently fails to resolve TNC's type metadata in
+the Android compilation context. Placing the TNC-dependent class in Core (compiled for plain
+`net10.0`) avoids this; App only references Core interfaces.
+
+## DI Registrations (`MauiProgram.cs`)
+
+```
+AddTelnetClient()                                    // registers ITelnetInterpreterFactory
+IAppStorage          → MauiAppStorage               singleton
+ISecretStore         → MauiSecretStore              singleton
+INotifier            → MauiNotifier                 singleton
+AppDbContext                                         transient (SQLite, net10.0-android safe)
+IWorldStore          → WorldStore                   transient (depends on DbContext)
+ISessionHistory      → SessionHistory               transient (uses IAppStorage path directly)
+SessionManager       (concrete + ISessionManager)   singleton
+SessionsViewModel                                   singleton
+ProtocolPanelViewModel                              singleton
+WorldManagerViewModel                               transient
+ISessionLauncher     → TelnetSessionLauncher        transient
+ITelnetConnectionFactory → TelnetConnectionFactory  singleton
+ITriggerEngine       → TriggerEngine                singleton (stateless)
+IAliasEngine         → AliasEngine                  singleton (stateless)
+```
+
+Lifetimes follow the Web app pattern; `AppDbContext`/`IWorldStore`/`WorldManagerViewModel` are
+transient rather than scoped because MAUI Blazor Hybrid has no HTTP request scope.
+
+## UI Changes
+
+- `Components/_Imports.razor` — added `SharpClient.Core.*` and `SharpClient.UI.Components` usings
+- `Components/Pages/Home.razor` — renders `<SessionScreen Vm="@Vm" ProtocolVm="@ProtocolVm" />`
+- `Components/Pages/Worlds.razor` — new page at `/worlds`, renders `<WorldManager Vm="@Vm" />`
+- `Counter.razor`, `Weather.razor` — deleted
+- `Components/Layout/MainLayout.razor` — replaced with sc-nav bar (Session / Worlds links), matches Web
+- `wwwroot/app.css` — replaced with full design-token CSS from SharpClient.Web (dark theme, sc-* classes)
+- `wwwroot/index.html` — added JetBrains Mono + Space Grotesk Google Fonts `<link>`s; removed unused bootstrap reference
+
+## Android 0-Warning Build Notes
+
+- `NuGetAuditSuppress` added for `GHSA-2m69-gcr7-jv3q` (SQLitePCLRaw 2.1.11 advisory, mirrors Data project)
+- `TelnetNegotiationCore 2.5.0` added as direct `PackageReference` (required for `AddTelnetClient()` extension method; transitive exposure from Core does not flow to `net10.0-android`)
+- `MauiNotifier` uses `[LoggerMessage]` source-generation to satisfy CA1848/CA1873 (TreatWarningsAsErrors=true)
+- No broad `#pragma warning disable` or `SuppressTrimAnalysisWarnings` needed; Debug build does not run the linker
+
+## Stubbed / Deferred
+
+- **INotifier** → logs to ILogger only; replace `MauiNotifier` with a `Plugin.LocalNotification`-backed implementation when push/in-app notifications are needed
+- **Android INTERNET permission** → `AndroidManifest.xml` not modified; add `<uses-permission android:name="android.permission.INTERNET" />` before first device run
+- **EF Core migrations** → `AppDbContext.EnsureCreated()` is called lazily by `WorldStore`; no migration runner wired
+- **Preferences/Settings screen** — not implemented in this integration
+- **No demo/seed sessions** — app starts with the World Manager in its empty state
+
+## Build Result
+
+```
+dotnet build src/SharpClient.App/SharpClient.App.csproj -f net10.0-android
+  → Build succeeded.  0 Warning(s)  0 Error(s)
+
+dotnet run --project tests/SharpClient.Tests/...
+  → Passed!  total: 89  failed: 0  succeeded: 89
+
+SharpClient.UI.Tests build: 0 warnings, 0 errors
+SharpClient.Data.Tests build: 0 warnings, 0 errors
+```

SharpClient.slnx

@@ -2,9 +2,13 @@
   <Folder Name="/src/">
     <Project Path="src/SharpClient.App/SharpClient.App.csproj" />
     <Project Path="src/SharpClient.Core/SharpClient.Core.csproj" />
+    <Project Path="src/SharpClient.Data/SharpClient.Data.csproj" />
     <Project Path="src/SharpClient.UI/SharpClient.UI.csproj" />
+    <Project Path="src/SharpClient.Web/SharpClient.Web.csproj" />
   </Folder>
   <Folder Name="/tests/">
+    <Project Path="tests/SharpClient.Data.Tests/SharpClient.Data.Tests.csproj" />
     <Project Path="tests/SharpClient.Tests/SharpClient.Tests.csproj" />
+    <Project Path="tests/SharpClient.UI.Tests/SharpClient.UI.Tests.csproj" />
   </Folder>
 </Solution>