Fix review issues #59-#74: exports, build robustness, link check, a11y, docs

[TMHSDigital]

Fixes the code and doc findings from the 2026-10-04 repo review. No entry's licence data changes.

Closes #59, closes #60, closes #61, closes #62, closes #63, closes #64, closes #65, closes #66, closes #68, closes #69, closes #70, closes #71, closes #73, closes #74.

Code

• feed: Atom feed has no <author>, so it fails RFC 4287 validation #59: feed.xml has a feed-level <author>, as RFC 4287 requires.
• build: llms-full.txt link regex disagrees with renderInline and can crash the build after the page gate #60: llms.mjs now reads links with the shared LINK_RE from markdown.mjs, so a balanced-paren href can't crash the build after the page gate.
• markdown: renderInline restore loop never terminates on input containing NUL slot tokens #61: renderInline strips NUL before using it as the slot marker. The validator rejects C0 control characters (with file:line).
• exports: catalog.csv doesn't neutralise cells that start with = + - @ (spreadsheet formula injection) #62: catalog.csv puts an apostrophe before cells that start with = + - @, tab or CR.
• a11y: shortlist button's accessible name doesn't contain its visible label (WCAG 2.5.3) #63: the shortlist button's accessible name is Add to shortlist: <name> / On shortlist: <name>, so it matches the visible text (WCAG 2.5.3).
• validate: enforce the entry id charset, and make every Markdown walker skip the same folders #64: a new site/lib/entry-files.mjs is the one entry walker for build, validate, sync-counts and check-links. Hidden and _scratch folders are skipped everywhere. Kebab-case ids are enforced.
• links: harden check-links.mjs (multi-part TLDs, raw URLs in the issue body, private hosts) #65: the pure link-check logic is in site/lib/link-check.mjs, with tests.
  • Hosts under co.uk, github.io and similar suffixes are compared correctly.
  • URLs in the report issue are inert code spans.
  • V16 rejects localhost, .local and IP-literal URLs.
• site: client lookups use plain objects (prototype keys), and the shortlist export assumes a trailing slash #66: client lookup maps have no prototype, and the shortlist export normalises the trailing slash.
• new-entry creates a missing category folder and points at the quick check.

Docs

• docs: add a visible 'not legal advice' notice to the README and licence guide #68: "Not legal advice" is in the README, docs/licenses.md, every page footer and the CREDITS export.
• positioning: say why to use this over magictools / awesome-gamedev, and credit magictools #71: the README says why to use this over magictools and awesome-gamedev, and credits magictools.
• docs: ROADMAP has stale category counts and lists search as planned though it shipped #69: ROADMAP no longer has hard-coded counts, and search and the accessibility fixes are listed under Done.
• docs: make the contributor path consistent (README steps, TEMPLATE status, CONTRIBUTING rules) #70:
  • README steps now include the category README row and npm run counts.
  • TEMPLATE starts at needs-review.
  • CONTRIBUTING's "What does not" list is split into "Accepted with caveats" and "What does not".
  • npm test && npm run validate is named as the quick local check (PR template too).
• docs: tidy public docs (trust-score link, research index, internal specs) #73:
  • Specs moved from docs/superpowers/specs/ to docs/design/ and are listed in the layout.
  • research-index is out of the user guides.
  • trust-score is labelled as a review rubric.
• seo: add WebSite / Dataset JSON-LD to the homepage #74: the homepage has WebSite (with SearchAction) and Dataset JSON-LD.

Left open on purpose

• tests: cover exports, check-links, sync-counts, new-entry and the client search #67: partly done. Exports, link-check, the walker, the markdown edge cases and V16 are now tested. Client JS, sync-counts and new-entry still have no tests.
• community: Code of Conduct sends incident reports to public issues #72: the Code of Conduct needs a private contact address, which is the maintainer's call.
• perf: homepage ships the catalog twice (pre-rendered HTML + data.js) #75: cutting homepage weight needs a decision on pre-rendering every row versus slimming data.js.

Verification (local)

• checks.test: 124 assertions pass (5 new for V16).
• lib.test: 350 assertions pass (about 40 new).
• validate: 392 entries, no broken links.
• build: 392 entry pages. The new <author>, JSON-LD and aria-labels show up in site/dist.

🤖 Generated with Claude Code