docs(agents): the repairs Phase 1 state, the PB merge gate and the open auth exposure

AGENTS.md

@@ -354,18 +354,40 @@ Design: `docs/superpowers/specs/2026-11-05-repairs-app-design.md`. The
 planned phone app lives at `/repairs-app`, not built yet.
 
 - Status vocabulary `new → assessing → quoted → approved → in_progress →
-  completed` (+ `cancelled`) is guarded by `ALLOWED_TRANSITIONS` in
-  `src/lib/server/repairs-service.ts`. The **labels are duplicated in
-  three places** — `repairs/page.tsx`, `repairs/[id]/page.tsx` and the
-  PDF map in `repairs-service.ts` — with three different sets of words.
-  Don't add a fourth; the spec consolidates them into
-  `src/lib/repair-status.ts`.
-- `repairs.order` and `orders.is_repair_order` **exist and are never
-  written**. The order ↔ repair match is designed but not built.
+  completed` (+ `cancelled`) lives in **`src/lib/repair-status.ts`** —
+  one shared vocabulary holding the labels, the badge variants, the
+  allowed transitions and the transition guard. The service imports the
+  guard from there; the two office pages import the labels from there.
+  There is exactly ONE `assertRepairTransition` in `src/` — do not add
+  a second. The repair request PDF still carries its own older label map
+  on purpose; Phase 3 rebuilds that document.
+- **`repairs.order` and `orders.is_repair_order` are still never
+  written in practice.** `linkRepairToOrder()` in the service writes
+  both, but it has no caller until Phase 3 wires it into order creation.
 - A Repair Request is a **paper document for the supplier**, not a
   delivery note. Repairs do not flow through the customer-DN pipeline.
 - `createCustomerQuoteFromRepair` refuses to overwrite an existing
   `customer_quote` link unless `replace: true` is passed.
+- **MERGE GATE — four PocketBase fields must exist before this code
+  runs:** `repairs.supplier_scope`, `repairs.signed_request`,
+  `orders.repair`, `giellie_chats.mode`. **PB drops unknown fields
+  SILENTLY**, so a missing field is NOT an error: the create returns 200
+  and the supplier scope is gone, the signed copy is accepted and not
+  stored, and the agent is told the upload worked. Add the fields FIRST,
+  then verify by round-tripping a save — do not wait for an error, there
+  will not be one.
+- **The repairs REST family has no session check** (pre-existing; found
+  2026-11-06). All six routes under `/api/v1/repairs/` read and write
+  through the PocketBase superuser client with no credential check. The
+  `(app)` layout gates the PAGES client-side; the API is not gated. The
+  `repairs.*` MCP tools ARE gated by `assertAgentAuth`. Operator
+  decision pending on adding a session check to all six routes together.
+- Phase 1 of the repairs work landed on `main` 2026-11-06 (`9358b37`):
+  the shared vocabulary, the service layer (`supplier_scope`,
+  `signed_request`, `getRepairStatusCounts`, `linkRepairToOrder`),
+  the REST routes (including `GET /api/v1/repairs/status-counts`), and
+  eight `repairs.*` MCP tools. The phone app at `/repairs-app` is
+  Phase 2 and does not exist yet.
 
 # The POS counter never sells at R0