Admin OP Phase 1: fix empty Categories / Contributors / Validation facets

[jung-thomas]

Tutorials Admin OP — Phase 1: fix the three empty facets

Fixes the three empty facets on the Tutorials admin Object Page. Root cause in every case: the admin UI was wired correctly, but the fetch/publish pipeline never populated the backing entity with data it already had.

Design spec: docs/superpowers/specs/2026-08-31-tutorials-admin-op-enhancements-design.md
Plan: docs/superpowers/plans/2026-08-31-tutorials-admin-op-phase1-empty-facets.md

What changed (3 workstreams, 16 TDD tasks)

WS1 — Categories self-heal

• Publish creates Tutorials rows via direct INSERT, bypassing the CAP after('CREATE') classifier hook, so TutorialCategories stayed empty. Added a fire-and-forget classifyAndPersist('tutorial', id) after publish upserts a tutorial (srv/lib/content-publish-session.js), .catch-wrapped so it never throws into the publish tx.

WS2 — Contributors (with GitHub links)

• New columns login/avatarUrl/profileUrl on TutorialContributors (+ HANA migration version=3).
• <slug>.contributors.json fetch sidecar (full git contributor list, ≤10) → non-fatal publish client → server REPLACE handler srv/lib/contributors-publish.js (POST /content/publish-contributors).
• Object Page LineItem now shows login as a DataFieldWithUrl linking to github.com/<login>, mirroring the live tutorial page.

WS3 — All validation rules (not just AI)

• The facet was bound to ValidateAnswerSpecs, which by design only stores AI-graded questions. Added a new read-only entity TutorialValidationRules (+ migration version=1) holding the FULL parsed rules.vr set.
• collectAllRules() in scripts/parsers/rules.ts → <slug>.validation-rules.json sidecar → publish client → server REPLACE handler srv/lib/validation-rules-publish.js (POST /content/publish-validation-rules).
• New "All Validation Rules" facet; existing AI facet relabeled "AI-Graded Validation" (kept). AI-graded reference answers stay server-only (correctAnswer: null in the all-rules set).

Review

Executed via subagent-driven development: fresh implementer + task review per task, plus a final whole-branch review (Opus) — APPROVE, no Critical/Important findings. All REPLACE-per-slug isolation, auth (contentAuthMiddleware + Authorization: Bearer), migration coherence, and cross-task pipeline seams verified end-to-end. Both new srv/lib/*-publish.js added to the tutorials-srv-qa cp-list.

Unit tests: 11 new files / 15 new tests, all green; full npm test shows 0 test failures (the 17 file-level errors are pre-existing hugo-apps dep-resolution issues unrelated to this branch).

Deploy-time runbook (required — not code)

1. Run the 3 deferred hybrid guards in a bound HANA env (test/hybrid/publish-{categories,contributors,validation-rules}.test.js).
2. One-time category backfill: confirm seed embeddings (embedAllSeeds), then scripts/backfill-categories.cjs.
3. Two migrations deploy: TutorialContributors ALTER (v3) + TutorialValidationRules CREATE (v1).

Follow-ups (non-blocking, from final review)

• Misleading comment at publish-content.ts:1357 (references a nonexistent "ContributorCache" entity).
• Optional DRY: the two publish clients / two server handlers are near-identical by design.

Not in this PR

Phase 2 (media facet + freshness header) and Phase 3 (KG facet) plans are written and ready to execute on this same branch/spec.