Future-proofing the web: every bad decision, on the record.

Terminal allow-list vs server-exec confusion

Two separate pages — /terminal (CryptArt Commander v0.1) and /commander (commander-client.tsx) — each carry their own duplicated local-only command table, while their names, MOTDs, and marketing copy ("power-user CLI", "system telemetry", "trigger game QA runs") imply real server power. Both are offline sandboxes with no eval, no fetch, no server calls. The danger is future-shaped: a contributor reading the name instead of the header comment wires server exec into either file believing the brand promises it, or users trust the terminal with work it cannot do. Fix needs a single canonical local-shell implementation plus a naming decision — owned by A3, so filed, not touched.

Desktop provisioning coupling (copy ↔ API drift)

app/desktop/page.tsx mixes marketing prose, provisioning how-to, and the live pod manager in one file, with RunPod template names (runpod/kasm-docker:cuda11, runpod-desktop), CPU caps ("20 GB disk max"), and cheapest-stock defaults baked into page copy next to a live POST /api/desktop/provision path. The moment RunPod changes a template, cap, or family name, the prose lies while the API moves on — and stale provisioning advice bills real money. Provisioning facts belong behind the API (or a catalog read), with the page rendering them, never hard-coding them. Desktop-owned scope: filed, not touched.

Swarm public-state limits (counts churn, leak surface)

Envelopes, STATUS.json, and QUEUE.md live under public/swarm — world-readable by design, which is correct for coordination but means two structural risks: (a) STATUS.json counts churn under concurrent agents and node scripts/verify-devswarm.mjs goes RED on counts staleness again and again (see QUEUE history), training lanes to ignore a red gate; (b) a world-readable bus invites a future secret paste (key, token, email) that crawlers then index. Counts need steward-side derivation (or the verifier needs to stop asserting them); the no-secrets rule needs a scanner, not just a header comment. Steward-owned: filed, not touched.

Route sprawl (61 top-level app dirs, ~298 API routes)

Roughly sixty-one top-level app route directories and on the order of three hundred API route files, including near-duplicate surfaces: /terminal vs /commander (two local sandboxes), /runpods vs the /desktop pod manager (two pod lists), /squads listed in two nav groups. Every new route multiplies nav, sitemap, robots DISALLOW, and docs wiring — all manual, all drifting. Needs a steward ruling: canonical-route policy, duplicate redirects, and generated (not hand-maintained) sitemap/robots inputs. Filed, not touched.

robots.ts DISALLOW list is manual and drifts

app/robots.ts hand-lists gated, ephemeral, and legacy-mirror paths (/account, /api/, /auth/, /v1-legacy/, /games/html/, /ai/, /temp/, …). Each new gated or ephemeral route must be hand-added or crawlers index it. The AI-crawler allow-list is the same story in reverse. Durable fix is deriving disallow entries from route metadata/conventions at build time. Explicitly off-limits to this lane — filed to the integrator, not touched.