test(zoom-client): rerun timer-core and club-card-sets on dev before release

e2e/zoom-client/INDEX.md

@@ -4,15 +4,15 @@ Read this first. Update it in the same PR as any spec change.
 
 | Spec | Status | Verified | Covers |
 |---|---|---|---|
-| [timer-core](timer-core.md) | stale | b029a29, 2026-11-13 | start/colours/finish, resume after close; `audience_size` on `timer_started` for hosts, omitted for non-hosts (#107); the Live tab's suggestions, stage picker and FINISH refuse an agenda row that needs a role (#91 follow-up: TC-13 ran green on 5de8185; the other steps last ran on b029a29, before that LiveTab change) |
+| [timer-core](timer-core.md) | current | 905d8d1, 2026-11-13 | start/colours/finish, resume after close; `audience_size` on `timer_started` for hosts, omitted for non-hosts (#107); the Live tab's suggestions, stage picker and FINISH refuse an agenda row that needs a role (#91 follow-up). TC-09 and TC-12 (human) not run |
 | [agenda-import](agenda-import.md) | current | b029a29, 2026-11-13 | Simple Format import takes exact role names from the bracket text and highlights the rest for a manual pick; imported and picked roles' thresholds on real video (#77, #91) |
 | [zoom-deeplink](zoom-deeplink.md) | draft | never | "Open in Zoom" deeplink resolves and launches this build's app (dev vs production client id) |
 | auth-identity | **not migrated** | — | source: `docs/ZOOM_TEST_PLAN.md` Steps 1, 1b |
 | [connection-notice](connection-notice.md) | draft | never | guest-mode banner and "Approve Toastmusters Timer in Zoom" modal at open; raised mid-session when Zoom drops the grant, modal held until the timer stops (#85) |
 | [reauth-landing](reauth-landing.md) | stale | never | install landing: `tt_approved` mark, `?welcome=new` / `?welcome=back`, "You're reconnected" and Open in Zoom; a marked browser's bare `/` redirects to `/reconnect` (`/?home` and the `zoom.` host do not); where Zoom lands a guest after approving (#96) |
 | [contact-capture](contact-capture.md) | draft | never | Zoom email/name capture: authorize, "Stay in touch" card, browser and web sign-in doors, purge on uninstall (#83) |
 | [timer-sounds](timer-sounds.md) | draft | never | Pro sounds: card-change chime (1/2/3 notes), break music during Take a Break, locked for free plans, audible through Share sound (#105) |
-| [club-card-sets](club-card-sets.md) | stale | 23091dc, 2026-11-12 | an admin or editor shares a custom card set with the club; another club device downloads it and shows it on real video; own choice kept; members can't publish; console removal; lapse; republish prunes the old image (plan 10 Phase 1). CC-08 and CC-06's forced 403 not run yet; CC-02's label changed in the next commit and needs a rerun |
+| [club-card-sets](club-card-sets.md) | current | 905d8d1, 2026-11-13 | an admin or editor shares a custom card set with the club; another club device downloads it and shows it on real video; own choice kept; members can't publish; console removal; lapse; republish prunes the old image (plan 10 Phase 1). CC-07 and CC-08 not run on 905d8d1, and CC-06's member 403 never yet (a guest got 401) |
 | pro-club | **not migrated** | — | source: `docs/ZOOM_TEST_PLAN.md` P1–P7, plus the internal Club Pro plan (`06-zoom-client-test-plan-club-pro.md`); reference run `test-runs/2026-09-28-club-pro/run.md` |
 | webhooks-lifecycle | **not migrated** | — | source: `docs/ZOOM_TEST_PLAN.md` Steps 4, 5, 6 |
 

e2e/zoom-client/club-card-sets.md

@@ -1,7 +1,7 @@
 ---
 id: club-card-sets
 title: Club card sets (share card artwork with the club)
-status: stale
+status: current
 covers:
   - worker/club-cards.js
   - packages/shared/clubCards.js
@@ -21,8 +21,8 @@ needs:
   - Zoom account A, an admin or editor of that club (club-member record)
   - a second computer or browser profile, B, with no cards of its own
   - ENTITLEMENT_ENFORCE "1" on dev for CC-08 only (ask first; revert after)
-verified_at: 23091dc
-verified_on: 2026-11-12
+verified_at: 905d8d1
+verified_on: 2026-11-13 (Zoom 7.2.5, macOS 26.7.2, dev 3ce801a6)
 ---
 
 # Club card sets (share card artwork with the club)
@@ -77,7 +77,8 @@ Evidence: `toastmaster_card_source` is `club`, then `own`.
 ### CC-06 · auto · Members cannot publish
 Do: on a device signed in as a club member (not editor or admin), open Card Images.
 Expect: no **Share with my club** button on any custom set.
-Evidence: a forced `PUT /api/club/cards` from that device returns 403.
+Evidence: a forced `PUT /api/club/cards` from that device returns 403. From a guest club device
+with no Zoom session (the web app as B), the same request returns 401 before the role check.
 
 ### CC-07 · human · An admin removes the set from the console
 Do: on the web, open `/club/admin` as the club admin. Under Card set, press **Remove card set**.
@@ -109,4 +110,9 @@ Evidence: `PUT /api/club/cards` → 200; KV `club-cards:<clubId>` names only the
 - Card sets are one per club for now (open question 2 in the plan).
 - The Live tab refusing an agenda row that needs a role (#91, `LiveTab.jsx`). Reviewed
   2026-11-13: it changes which speaker loads, not the card artwork or its push; no step here
-  loads an agenda row. See [timer-core](timer-core.md) TC-13. Not rerun for it.
+  loads an agenda row. See [timer-core](timer-core.md) TC-13.
+
+Run 2026-11-13 (dev tip 905d8d1, dev 3ce801a6, A = Zoom desktop, B = web app in a browser
+profile): CC-01…CC-05 and CC-09 passed; CC-02 now labels the set "<club> cards" (null label in
+KV). CC-06 only from B, a guest with no Zoom session: 401, not the member 403. CC-07 (console
+sign-in) and CC-08 (lapsing the club) not run. Log: test-runs/2026-11-13-pre-master-specs/run.md.

e2e/zoom-client/timer-core.md

@@ -1,7 +1,7 @@
 ---
 id: timer-core
 title: Core timer in the Zoom client
-status: stale
+status: current
 covers:
   - apps/zoom-app/src/context/TimerContext.jsx
   - apps/zoom-app/src/components/LiveTab.jsx
@@ -14,8 +14,8 @@ automated:
 needs:
   - dev deployed
   - camera on, in a meeting
-verified_at: b029a29
-verified_on: 2026-11-13 (Zoom 7.2.5, macOS 26.7.2, dev a249d5d7)
+verified_at: 905d8d1
+verified_on: 2026-11-13 (Zoom 7.2.5, macOS 26.7.2, dev 3ce801a6)
 ---
 
 # Core timer in the Zoom client
@@ -158,8 +158,9 @@ Club's role list, so the lines were "Bob (1min Role)", "Alex (Table Topics)", "A
 Tip)" and the default role was ChairToast1. After FINISH the dropdown stayed on 1min Role.
 PostHog had `timer_started` / `speech_finished` for Bob only. The stage's speaker list needed a
 second click (the first focused the panel). Log: test-runs/2026-11-13-91-live-tab-needs-role/run.md.
-The other steps last ran on b029a29, before this LiveTab change, so the spec stays `stale`
-until they rerun on it.
+Run 2026-11-13 (dev tip 905d8d1, dev 3ce801a6 with `FLAGS_FORCE` "1", Zoom on macOS): TC-01…TC-08,
+TC-10, TC-11 and TC-13 passed with the same substitutions; TC-09 and TC-12 not run (human).
+Log: test-runs/2026-11-13-pre-master-specs/run.md.
 
 ## Not covered
 - Colour accuracy on every camera/background setting.
@@ -171,7 +172,7 @@ until they rerun on it.
 - Agenda import, and the roles it assigns to imported lines (`importBulkSpeakers` in
   `TimerContext.jsx`). See [agenda-import](agenda-import.md). Reviewed against #91
   (2026-11-13): that PR changes only `importBulkSpeakers` here; no step above uses it.
-  TC-01…TC-08, TC-10 and TC-11 reran green on it (b029a29) the same day.
+  TC-01…TC-08, TC-10, TC-11 and TC-13 reran green on dev 905d8d1 the same day.
 - A failed participant read at START (`timer_started` still sent, no `audience_size`). The
   Zoom client can't be made to fail it on demand; `LiveTab.test.jsx` covers it (#107 AC-5).
 - A club card set arriving, changing or going away while the app is open. `LiveTab.jsx`