# Workflow reference

## Inspect and preserve pins

Read `go.mod` and `go.sum`; never infer a version from marketing copy. Confirm:

```sh
himesan version --json
himesan check --json ./path/to/templates
```

If the repository pins Beta 1 runtime and Beta 2 compiler, install in this
order without using `@latest`:

```sh
go get gamertan.com/sandwich-hime/sando@v1.0.0-beta.1
go install gamertan.com/sandwich-hime/cmd/himesan@v1.0.0-beta.2
```

If the nested runtime is temporarily missing from a module cache, run the exact
`go mod download gamertan.com/sandwich-hime/sando@<pinned-version>` and retry.
Do not delete a user's global module cache.

## Authorized generation

1. Edit `.sando`, never `.sando.go`.
2. Run the exact installed/pinned `himesan generate` against the intended path.
3. Run `himesan check --json`.
4. Run the repository's normal `go test ./...`, `go vet ./...`, and build or
   verifier commands. Do not claim `check` performs Go type checking.
5. Review generated diffs and trust warnings.

## Review-only work

Do not generate. Use `himesan check --json`, inspect source and generated
provenance, and report stale output rather than repairing it. Never run
`himesan dev` for an untrusted repository; it invokes the Go toolchain and
executes the project's program.

## Migration

Model pages, layouts, and partials as typed component functions. Move dynamic
values through explicit parameters and compose with `<?~`. Keep the existing
router, status codes, headers, caching, and deployment code in ordinary Go.
Add adversarial tests for text, attributes, URLs, trust capabilities, and
writer errors before replacing an existing renderer.

## Platforms

Use the project's shell verifier on Linux/macOS and PowerShell verifier on
native Windows when supplied. Preserve CRLF files, use native filesystem paths,
and compare generated bytes rather than assuming path separators are portable.