Fix timeline task completion replacing view, fix passkey registration CSRF

- Fix checkboxes in timeline calendar grid targeting #tab-content (replaced
  entire view). Now target closest .untimed-item/.calendar-event with outerHTML
- Fix passkey registration 403 by passing CSRFToken from settings handler
  and exposing it via meta tag for JS to read
- Add TDD workflow requirement to CLAUDE.md
- Tests written first (red-green): template content assertions for checkbox
  targets and CSRF token presence, handler data struct verification

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 9 insertions, 1 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index c4834a5..9bf34fd 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -30,7 +30,15 @@ This project uses a three-role development workflow. **Read your role definition
 - **Dependency Awareness:** Use `go test`, `go build`, and `lint` to verify state rather than asking the agent to "think" through logic.
 - **Proactive Checkpointing:** Treat every 3-4 turns as a potential session end. Update `SESSION_STATE.md` frequently.
 
-## Workflow: Plan-then-Execute
+## Workflow: TDD — ALWAYS Write Tests First
+**Every bug fix and feature MUST follow Test-Driven Development:**
+1. **Red:** Write a failing test that reproduces the bug or specifies the new behavior.
+2. **Green:** Write the minimum code to make the test pass.
+3. **Refactor:** Clean up if needed, keeping tests green.
+
+**No exceptions.** Do not skip to writing production code. If you find a bug, write a test that fails first, then fix it. This applies to template assertions, handler logic, store queries, and JS behavior (via template content tests).
+
+### Plan-then-Execute
 1. **Discovery:** Use terminal tools to locate relevant Go code/handlers.
 2. **Planning:** Propose a specific plan and **wait for user confirmation** before editing.
 3. **Execution:** Apply changes incrementally, verifying with `go test ./...`.