[DONE] patternflow.work 를 Cloudflare 로(#250)가 원래 레포 dev 위에 겹침 없이 다시 얹힌다

CODE_OF_CONDUCT.md → .github/CODE_OF_CONDUCT.md

@@ -4,7 +4,7 @@ This applies everywhere Patternflow people meet: this repository (issues, pull r
 
 ## How we treat each other
 
-The rule was written before there was anything to build, as a short poem, and it is the sixth section of the [manifesto](docs/manifesto.md#6-how-we-treat-each-other). In full:
+The rule was written before there was anything to build, as a short poem, and it is the sixth section of the [manifesto](../docs/manifesto.md#6-how-we-treat-each-other). In full:
 
 > 아무것도 몰라도, 하고자 한다면 만들 수 있습니다.
 > 도와주는 게 당연합니다. 고마운 게 당연합니다.

.github/ISSUE_TEMPLATE/config.yml

@@ -13,7 +13,7 @@ contact_links:
     url: https://discord.gg/Vr9QtsxeTk
     about: New here? Join the server, then jump into the channels above.
   - name: Getting help — every venue in one table
-    url: https://github.com/engmung/Patternflow/blob/main/SUPPORT.md
+    url: https://github.com/engmung/Patternflow/blob/main/.github/SUPPORT.md
     about: Where to ask what, including the venue that works where Discord is blocked.
   - name: Contributing guide
     url: https://github.com/engmung/Patternflow/blob/main/CONTRIBUTING.md

.github/PULL_REQUEST_TEMPLATE.md

@@ -9,5 +9,10 @@
 ## Tested
 <!-- How did you check it works? (built locally, flashed the board, ran the site…) -->
 
+## Which row
+<!-- Which row of the table in CONTRIBUTING.md (https://github.com/engmung/Patternflow/blob/main/CONTRIBUTING.md#where-your-contribution-goes) this is: a guide fix, a feature, a remix… -->
+
 ---
 - [ ] Touches `web/` → it builds (`npm run build`)
+- [ ] Touches `firmware/` → every composition builds (`./firmware/bundles/build.sh all`), and the core still names no feature (`python firmware/toolchain/check_boundaries.py`)
+- [ ] Touches a markdown file → its relative links resolve (`python3 .github/scripts/check_links.py`)

SECURITY.md → .github/SECURITY.md

@@ -7,13 +7,13 @@ Please report privately through [GitHub's report form](https://github.com/engmun
 ## What is in scope
 
 - **The community site** ([community.patternflow.work](https://community.patternflow.work)): accounts and sessions, uploads, the sandboxed iframe that runs published patterns, moderation.
-- **The browser flasher and update handoff** ([patternflow.work/flash](https://patternflow.work/flash), `/update`): the firmware images it serves and where they come from.
+- **The browser flasher and update handoff** (the **Flash Patternflow** button on [patternflow.work/pattern](https://patternflow.work/pattern) and in the Play guide, which installs the images under `/flash/`; and [`/update`](https://patternflow.work/update)): the firmware images they serve and where they come from.
 - **The build worker** that turns a pattern into a `.pfm` module on the community host.
 - **Published firmware images.** They must not carry credentials. Three early releases did carry the maintainer's Wi-Fi credentials, which is why the release workflow now refuses an image built with `patternflow_secrets.h`. If you find one that slipped through, that is a report.
 
 ## What is a documented trust model, not a vulnerability
 
-The device's HTTP server on the LAN has **no authentication**: anyone on the same network can call any `/api/*` route, including `POST /update`. This is deliberate and documented in [docs/rest-api.md](docs/rest-api.md#transport) — the panel is an instrument on a home or venue network, with the same posture as ArduinoOTA's default. `PF_WEBUPDATE_ALWAYS_ARMED 0` is the one lever that narrows it. Reports that amount to "the LAN API is open" will be closed with a pointer here; reports of a way to reach that API from *outside* the LAN, or from a web page on another origin, are in scope.
+The device's HTTP server on the LAN has **no authentication**: anyone on the same network can call any `/api/*` route, including `POST /update`. The same holds on the panel's own hotspot (`patternflow-xxxx`, raised when it finds no network it knows), whose password is the documented default `patternflow` until it is changed on the Wi-Fi page. This is deliberate and documented in [docs/rest-api.md](../docs/rest-api.md#transport) — the panel is an instrument on a home or venue network, with the same posture as ArduinoOTA's default. `PF_WEBUPDATE_ALWAYS_ARMED 0` is the one lever that narrows `/update`; the hotspot takes its own password, or is switched off, on the Wi-Fi page. Reports that amount to "the LAN API is open" will be closed with a pointer here; reports of a way to reach that API from *outside* the LAN, or from a web page on another origin, are in scope.
 
 ## Supported versions
 

SUPPORT.md → .github/SUPPORT.md

@@ -6,12 +6,22 @@ One table for "where do I ask". Issues are for things that change this repositor
 | :--- | :--- |
 | Learn to build, play, make patterns for one or give it sound and MIDI | [The guide](https://patternflow.work/guide) — each step on a 3D Patternflow in the browser. A step that didn't get you through has a **Stuck here?** link, which opens an issue with that step filled in |
 | Get unstuck building, soldering or flashing | [Discord → hardware-help](https://discord.com/channels/1497757947827327067/1499907910707187833) — photos and quick back-and-forth |
+| Flash the DevKit for the first time, or get the panel onto Wi-Fi | [The Play guide's Flash chapter](https://patternflow.work/guide/play#flash), or [`BUILD_GUIDE.md` §8](../BUILD_GUIDE.md#8-firmware) in writing. The short version is below the table |
 | Show a pattern I made, or get feedback on one | Publish it from the [Pattern Lab](https://patternflow.work/pattern-lab) to the [Community](https://community.patternflow.work/community), then [Discord → patterns](https://discord.com/channels/1497757947827327067/1499908302962819236) |
 | Put my finished build on the [build map](https://patternflow.work/inside) | [Share your build](https://github.com/engmung/Patternflow/issues/new?template=share_build.yml) — or post it in Discord |
 | Talk about where the project should go, or find people working on the same direction | [Discord](https://discord.gg/Vr9QtsxeTk) — the dev-log and the project channels |
 | Report a bug, a wrong or missing doc, or propose a feature | [New issue](https://github.com/engmung/Patternflow/issues/new/choose) — pick the template |
 | Report a security problem | [SECURITY.md](SECURITY.md) — privately, not as an issue |
-| Contribute code, hardware files or docs | [CONTRIBUTING.md](CONTRIBUTING.md) |
+| Contribute code, hardware files or docs | [CONTRIBUTING.md](../CONTRIBUTING.md) |
+
+**The first flash, in short.**
+
+1. The DevKit out of the board, on its **left** USB-C port (labelled `USB`), with a cable that carries data — a charge-only cable is the most common reason nothing shows up — in desktop Chrome or Edge. That port is for flashing and data only; the panel is always powered through `J4`, the screw terminal.
+2. **Download mode, every first flash:** hold **BOOT**, tap **RST**, let go of BOOT. Then press **Flash Patternflow** (on the [Pattern tab](https://patternflow.work/pattern) under *Got the hardware?*, or in the Play guide) and pick the port (`USB JTAG/serial debug unit`).
+3. **The Wi-Fi step usually does not appear** after *Installation complete!* That is expected: press **RST** once, press **Flash Patternflow** again, pick the port, choose **Connect to Wi-Fi**, and after about ten seconds of scanning type your network's name exactly (capitals count; 2.4 GHz only) and its password.
+4. **If that will not take,** put the DevKit back in the board and power it: about 15 seconds after it finds no network it knows, the panel raises its own, `patternflow-xxxx` (password `patternflow`; hold **K2** to see the exact name). Not in your phone's list yet? Wait, and refresh the list. Join it (the phone will say the network has no internet, which is true; stay on it), open `http://192.168.4.1/`, and pick your network on the Wi-Fi page.
+
+A board that already runs Patternflow is updated over Wi-Fi from its console's Update page instead — download mode erases the patterns and saved networks.
 
 **If Discord is blocked where you live**, the community site still works for patterns and decks without it, and a bug or a documentation issue here reaches the maintainer the same day. A discussion venue that works everywhere is planned; until it exists, an issue is the fallback for a question too.
 

.github/workflows/drift.yml

@@ -0,0 +1,70 @@
+name: Drift checks
+
+# The tree keeps some facts in two places by hand: the BOM and the build
+# guide's parts table, a card on /editions and a folder under
+# firmware/bundles/. Each check in web/scripts/drift/ compares one such pair
+# and prints both sides when they part (docs/rfc-cleanup.md §2.4). check:ci
+# runs them too, but Web CI starts only on web/ and hardware/case/. A pull
+# request that edits only the BOM, a bundle or the changelog runs no web job,
+# and that is the pull request a drift check is for. So this one runs on every
+# pull request.
+#
+# PF_DRIFT_STRICT=1 turns a skip into a failure. At a desk a check skips a side
+# it cannot read: a tag the clone lacks, no pdftotext, no gh login. Here every
+# side can be read, so a skip means this file is missing something.
+# fetch-depth: 0 brings the tags the absolute links point at, and the base
+# commit check:human-lock compares with.
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: drift-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  issues: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web
+    env:
+      PF_DRIFT_STRICT: "1"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+
+      - name: Install dependencies
+        id: deps
+        run: npm ci
+
+      # check:bom-schematic reads the schematic's text layer with pdftotext,
+      # which the runner image does not carry.
+      - name: Install pdftotext
+        run: command -v pdftotext || { sudo apt-get update -q && sudo apt-get install -y -q poppler-utils; }
+
+      # check:roadmap asks gh for the state of each issue a roadmap node names.
+      - name: Drift checks
+        run: npm run check:drift
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+      # Not a word of the maintainer's own writing changes (§2.9). It runs
+      # after a red drift step too, so one push shows both.
+      - name: Locked text
+        if: ${{ !cancelled() && steps.deps.outcome == 'success' && github.event_name == 'pull_request' && hashFiles('web/scripts/human-lock.ts') != '' }}
+        run: npm run check:human-lock
+        env:
+          PF_LOCK_BASE: ${{ github.event.pull_request.base.sha }}

.github/workflows/web-ci.yml

@@ -33,16 +33,17 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
           cache-dependency-path: web/package-lock.json
 
       - name: Install dependencies
         run: npm ci
 
-      # Lint is a hard gate: lint errors can't reach main (warnings still pass).
+      # Lint is a hard gate, and a warning fails it like an error. The cleanup's
+      # step 3 took the site from twelve warnings to none; one more fails here.
       - name: Lint
-        run: npm run lint
+        run: npm run lint -- --max-warnings=0
 
       # `next build` type-checks only what it bundles; scripts/ and the smoke
       # suites are outside that, and a type error there used to surface as a