phase: 182_verbatim_show_text

**Phase 182 — final verification pass (all 8 tasks already complete; this was verification + docs + one defect fix).**

- Verified: `app/rag/verbatim.py` (locator grammar, `splitlines()` slice, line-boundary cap, `resolve_answer_blocks`), `SHOW_TEXT_TOOL` + `shown_texts`, `SHOW_TEXT_CLAUSE`, `done.answer_text` (9 fields, key dropped when empty) + `ChatMessageRecord.answer_text` (≤50, 600 000-char cap counted in the 8 M budget), `verbatim.js` + 4 `{verbatim:true}` renderers, `Containerfile` minify step, `.env.example` 3 vars.
- `uv run python -c "…answer_text, show_text_max_chars, show_text_max_blocks"` → `True 12000 5`; each negative refuses startup naming its field; `0` accepted as inert ✅
- `bash .agents/validate.sh` → **validation OK**: 4320 unit+integration tests green, `TOTAL 6849 17 → 99%` (gate app/ >90% OK), `ruff check .` "All checks passed!", `pyright` 0 errors (re-run after my edits, 08:28).
- E2E, each in isolation `--no-cov`: `test_verbatim_show_text.py` 13 passed (panel bytes == `documents.content`, server caption, clipboard == server string, `/document.html?source=…&path=…`, honest unresolved state, reload+share, `show_image` regression, flag-off app) ✅; green: `test_answer_images` `test_harness_aligned_tools` `test_agent_document_tools` `test_markdown_tables` `test_markdown_inline_links_images` `test_svg_document_preview` `test_smoke` `test_document_viewer` `test_markdown_blockquotes` `test_chat_persistence` `test_thinking_timeline` `test_chat_rag` `test_settings_mobile_value_width`.
- **Defect found & fixed (pre-existing, not phase 182):** `tests/e2e/test_admin_settings_panel.py::test_admin_sees_groups_and_source_badges` failed — its whole-page `assert "reese" not in page.content()` tripped on the shell's onboarding chips, which follow the newest saved chats in the one shared E2E DB (a leftover `reeselink.json` question from a tool suite). Scoped the strict sweep to `.settings-shell` and kept a whole-page `reese:reese` credential needle → 12 passed with the leftovers still present.
- Docs: README fixed 2 inconsistencies — Quick Start omitted the **required** `BOR_ADMIN_PASSWORD`/`BOR_SESSION_SECRET` (the app fail-loud refuses boot) and the broken anchor `#chat--` → `#chat-`; full re-read of README (1816 lines) + AGENTS confirmed the phase-182 feature/settings/log/UI-contract text matches the code, and every `.env.example` var + every `Settings` field is documented.
- Notable: kept `resolve_answer_blocks` synchronous on the SSE terminal path (bounded indexed SELECTs, matching the existing `query_log` precedent and the phase's documented fence-lookup bound); no live-infra changes made.
- Next pending phase: none — `todo/` holds only 182 (its 8 task files are in `complete/`; the harness commits + moves `00_phase.md`).

AGENTS.md

@@ -47,7 +47,30 @@
    in-flight row (`role="status"`) / alert + Retry row
    (`role="alert"`, a real `<button>`) sits inside that same bounded
    scroll panel — and the stat cards read the server's `totals`,
-   never a walk of a depth-limited tree (phase 167)) and
+   never a walk of a depth-limited tree (phase 167); an answer's
+   code block is EITHER verbatim-and-badged OR plainly the model's —
+   never a silently-substituted hybrid: the ` ```bor ` locator fence
+   renders through the ONE shared renderer as
+   `.verbatim[data-bor-locator]` with the model's body DROPPED
+   (`renderMarkdown(md, { verbatim: true })`, off by default so every
+   other surface is byte-identical), styled from palette variables only
+   with a `min(40rem, 70vh)` scroll body, a sticky `source/path`
+   caption and a `user-select: none` line-number gutter, while the
+   plain `.code-block` wrapper carries a Copy button and no badge
+   (phase 182); those placeholders hydrate against the frame's
+   `answer_text` through the ONE panel client
+   (`frontend/assets/verbatim.js` — a classic script loaded AFTER
+   `markdown.js` on the chat AND shared pages, no second locator grammar,
+   a plain string compare against the server's canonical `locator`, the
+   caption's numbers always the SERVER's extent, an unresolvable locator
+   painting the pinned sentence `I could not verify this against the
+   knowledge base` with no badge, no body and none of the model's bytes,
+   no panel left at "Retrieving the exact text…" after a terminal frame
+   (the `error` frame, the 300 s guard, Stop and the failure funnel all
+   settle it), the Copy button's clipboard content equal to the server
+   string exactly, and the shared page's panel Copy button + plain
+   `/document.html` link the ONE owner-directed exception to that page's
+   zero-controls rule) — phase 182 task 07) and
    meets WCAG 2.1 AA basics (semantic
    landmarks, labels, contrast ≥4.5:1, focus-visible, aria-live for the
    stream).
@@ -70,7 +93,10 @@
    Playwright E2E file passes **in isolation**
    (`uv run pytest tests/e2e/test_<story>.py -v --no-cov`).
 10. **Amply log, visibly feed back:** server-side, log the required
-    per-turn line (PLAN §9) **and** the per-response byte-budget line
+    per-turn line (PLAN §9 — phase 182 appends `verbatim_blocks=N` after
+    `scaffold_stripped=N`: the verbatim display blocks actually SENT on
+    the `done` frame, `0` on every turn without them, deflected included)
+    **and** the per-response byte-budget line
     (`app/core/response_budget.py` — one
     `api method=… path=… status=… bytes=… enc=… duration_ms=…` line per
     `/api/*` response, INFO at/over `BOR_LOG_LARGE_RESPONSE_BYTES`, read it