working through a review

docs/plan.md

@@ -911,6 +911,155 @@ A consolidated checklist covering all phases:
 
 ---
 
+## 17. Post-Review Action Items (Fresh Pass)
+
+*Findings from a fresh codebase review (shell, components, backend, git
+history). Ordered by impact within each tier. Each item ships as a concrete,
+checkable change — no redesigns.*
+
+### 17.1 Repo hygiene (do first — cheap)
+
+- [x] **Rewrite `README.md`.** It is still the Vite template boilerplate
+      ("React + TypeScript + Vite") and describes nothing about DM-Pal.
+      Replace with: one-paragraph pitch, screenshot, `npm run tauri dev`
+      quickstart, prerequisites (Ollama), where data lives, license note.
+      Highest-ROI 20-minute task in the repo.
+- [x] **Scrub PII from `scripts/apple-signing.env.example`.** It contains a
+      real Apple ID email (`james.twose2711@gmail.com`) in a tracked file.
+      Replace with `you@example.com`.
+- [x] **Delete dead scaffold: `src/components/Greet.tsx` + the `greet`
+      Tauri command in `src-tauri/src/lib.rs`.** Leftover from
+      `npm create tauri-app`; nothing in the shell references Greet.
+      Verify with `rg Greet` first.
+- [x] **Fix pointless ternary in `App.tsx` NavButton:**
+      `<item.icon size={item.view === "tables" ? 18 : 18} />` — both
+      branches are 18. Just `size={18}`.
+- [x] **Collapse the three nav→kind maps in `App.tsx`** (`PREFILLABLE`,
+      `PREFILLABLE_TOOLS`, `viewMaxWidth`) into a single
+      `Record<View, { kind?, Comp?, maxWidth }>` and derive the inverse
+      map for `rehydrate`. Today adding a tool means editing five places;
+      this makes it one.
+
+### 17.2 Tests & CI (Milestone 7, currently unshipped)
+
+- [x] **`src/lib/encounter-budget.ts` self-check.** Non-trivial combat
+      math with no test. Add an `assert`-based `demo()` / one small
+      `test_encounter_budget.ts` so a tweaked XP number fails loudly.
+- [x] **Dice-parser test.** `DiceRoller` parses `NdX±M`, advantage
+      (`kh1`/`kl1`), templates — a parser bug = wrong rolls at the table.
+      One `test_dice.ts` asserting `{count, sides, mod, keep}` for
+      `4d6+3`, `2d20kh1`, `1d20-2` is the smallest thing that catches
+      regressions. (Rust side has good `generations` + image-base64
+      tests; frontend has almost none — only `worldMap.ts`.)
+- [ ] **Gitea Actions CI** (not GitHub — repo ships via `scripts/gitea-release.sh`).
+      A `.gitea/workflows/ci.yml` running `oxlint`, `tsc -b`, the three
+      `node scripts/check-*.ts` self-checks, and `cargo test` on each push.
+      Even lint-only is better than none. Same YAML syntax as GitHub
+      Actions, just a different directory.
+- [ ] **Code signing + notarization** for macOS and Windows.
+- [ ] **Auto-updater** via `tauri-plugin-updater` (+ delta updates for
+      model packs), then package with `npm run tauri build`.
+
+### 17.3 Features still missing (verified unchecked in §16)
+
+- [ ] **Quest branching graph (`reactflow`).** Quests are a linear
+      carousel today. Branching quests with conditional edges ("if they
+      spare the bandit → step 3; if they kill him → step 5") are what
+      make a quest *designer* vs a quest *outliner*. The single biggest
+      remaining "wow" gap in the generators.
+- [ ] **World hierarchy tree** (continent → country → region → city).
+      Today `WorldBuilder` emits a flat `regions[]` + `landmarks[]`
+      pinned on a map, with no nesting or "drill into a region to
+      generate its sub-regions." A collapsible tree on the left of the
+      existing two-pane layout turns World Builder from a one-shot
+      generator into a living campaign bible.
+- [x] **Lore directory picker.** Doc said "needs tauri-plugin-dialog" —
+      but the plugin is **already installed and used** in
+      `SettingsPanel`. This is unblocked: add an "Add directory…" button
+      in `LorePanel` that calls `open({ directory: true })` and walks
+      `*.md`/`*.txt`. Low effort, high value for DMs with an existing
+      world-bible folder.
+- [ ] **Real ambience packs + custom sound import (Soundboard).** Ship
+      2–3 CC0 loops (Freesound/Pixabay) in `public/sounds/`, keep
+      synthesis as fallback, and add drag-an-MP3 onto a tile. The
+      difference between "demo" and "session-ready."
+- [ ] **First-run model download / license wizard.** Today a new user
+      must hand-configure API URL + model name with no guidance. A
+      one-time wizard on first launch (detect Ollama → list
+      `GET /api/tags` → pick text + image + embed model → save) collapses
+      the "open Settings, stare at empty form, give up" funnel. Reuse
+      the existing connection-test + model-list plumbing from
+      `SettingsPanel`.
+- [ ] **Image-gen into World Builder (map) + Encounter Builder**
+      (battle map + loot), per §16 item 10 — still only wired into NPC +
+      Item Forge.
+- [ ] **Handout renderer** (Markdown → PDF), still pending from §15.
+
+### 17.4 UX refinements (beyond the existing ui-ux-improvements.md)
+
+- [ ] **Campaign concept.** Everything is one global store
+      (`dm-pal-state.json`) + two global SQLite DBs; a DM running two
+      campaigns can't separate them. A lightweight "active campaign"
+      selector in the title bar that namespaces store keys + DB files
+      (`<dataDir>/<campaign>/`) unlocks multi-campaign without a schema
+      migration. The data-dir relocation machinery already exists —
+      generalize it per-campaign.
+- [x] **`?` shortcut help overlay.** Checklist marks `?` as shipped but
+      there's no visible cheatsheet — shortcuts are documented only
+      here. A small `?`-triggered modal listing
+      `⌘K / 1–9 / Space / ⌘, / ⌘S / Esc` is the difference between
+      "shortcuts exist" and "shortcuts are discoverable." ~40 lines.
+- [x] **Global streaming indicator.** `ConnectionPill` shows
+      LLM/image/lore status but there's no "an LLM call is in flight"
+      signal. During a 15s image gen the only feedback is a skeleton in
+      one card. A subtle gold pulse on the pill (or a thin top-of-window
+      progress bar) tells the DM something is working even after they've
+      navigated away from the generating tool.
+- [x] **Consistent image-gen macOS gating.** `ImageGenerator` shows a
+      clear "macOS only" message, but the `GeneratedImage` ✨ buttons
+      inside NPC/Item silently fall back. Show the same inline
+      "macOS only" notice there so a Windows DM isn't left wondering why
+      nothing happens.
+- [ ] **Finish the empty-state set for Initiative** (and verify the
+      others) — one `<p>` + CTA each, already done elsewhere.
+- [ ] **i18n** — extract strings to a `t()` helper (P3, only if shipping
+      beyond EN).
+- [ ] **Draggable bento layout** (`react-grid-layout`) with persisted
+      layout per campaign (P3).
+- [ ] **Console mode** for the dashboard — embed 2–3 chosen tools as
+      live-session cards (P3).
+- [ ] **Player view** — a web app showing the DM's screen (initiative,
+      dice) to phones on the local network (P3).
+- [ ] **Compendium integration** — pull monster stat blocks from a
+      local SRD JSON (P3).
+- [ ] **Voice-to-text** for session notes (Whisper) (P3).
+- [ ] **Macros** — named dice-roll buttons (P3).
+- [ ] **Session replay** — record rolls/initiative/soundboard state
+      and replay (P3).
+
+### 17.5 Suggested order of attack
+
+| # | Item | Effort | Impact |
+|---|------|--------|--------|
+| 1 | Rewrite README | 20 min | High |
+| 2 | Delete Greet + `greet` cmd, fix `18:18` ternary | 10 min | Low |
+| 3 | Collapse the 3 nav→kind maps into one | 30 min | Medium |
+| 4 | `encounter-budget` + dice-parser self-tests | 1 hr | Medium |
+| 5 | Lore directory picker (dialog already installed) | 1 hr | High |
+| 6 | First-run model wizard (reuse connection test) | 3 hrs | High |
+| 7 | Quest branching graph (`reactflow`) | 4 hrs | High |
+| 8 | World hierarchy tree | 3 hrs | High |
+| 9 | `?` help overlay + global streaming indicator | 1 hr | Medium |
+| 10 | Real ambience packs + sound import | 2 hrs | Medium |
+| 11 | GitHub Actions CI | 1 hr | Medium |
+| 12 | Campaign namespace selector | 4 hrs | High |
+
+Items 1–5 form a single low-risk PR: README, dead-code cleanup, map
+consolidation, two self-tests, lore directory picker — all independently
+shippable in one session.
+
+---
+
 **You're now ready to spin up your own AI-powered Dungeon Master toolkit!**
 
 Happy crafting — may your dice always land favorably! 🎲