SPEC v0.40: K3's report recorded (D-201 to D-207), web card pages as built

K3 (card purchases on the web, landed faeb752; web gate 70 files, 684 tests,
build ok; contracts-check 157):
- SPEC §15.6 W-21 to W-23 as built, with W-5's ?cardPurchase= prefill and link,
  W-6's card line, W-13's "Anslut kort" row; §15.5 the card snapshot; §15.3
  the shared card pieces (api/cards.ts, fixtures, dev proxy, three icons) and
  matchCardPurchase ported; §11.1, §11.2 K3 row, §11.3, §14.7, §15.9; v0.40 row.
- decisions D-201 to D-207 (refresh while fetching, query names, https-only
  auth_url, attempt outcome, W-5 purchase errors, date forms, S-27 on the web);
  D-208 to D-210 unused.
- HANDOFF: K0 to K3 landed, v1.0.4 deployed, v1.0.5 being built, kvitt-164 on
  the Pi; pending owner steps PLAN-K2 §8, PLAN-K3 §8, PLAN-K1 §8 steps 5 to 7;
  K3's open questions; next free D-212, v0.41.
- web/README.md: card routes, the card snapshot, query names, the new icons;
  prompts/README.md: K2 and K3 done.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

prompts/README.md

@@ -42,8 +42,8 @@ Plans in the same wave can run in parallel (they own disjoint paths, SPEC §14.7
 | 7 | M11 Import history | `M11.md` | M9, M10 | none |
 | 8 | K0 Card purchases spike (local test app, D-176) | `K0.md` | SPEC v0.35; the owner's Enable Banking account, application and key (PLAN-K0 §8) | done 2026-10-24 (app `2ce317f`; report `docs/spikes/K0-enable-banking.md`; answers in SPEC v0.36, D-177 to D-180) |
 | 9 | K1 Card purchases: server (schema 4, E-36 to E-44) | `K1.md` | SPEC v0.36 (K0's answers) | done 2026-10-24 (landed `671c00d`; report recorded in SPEC v0.38, D-181 to D-188) |
-| 9 | K2 Card purchases: Android (`:feature:cards`, Room 2) | `K2.md` | SPEC v0.36; rebases on K1 before its gate | K1, K3; lands after K1 |
-| 9 | K3 Card purchases: web (W-21 to W-23) | `K3.md` | SPEC v0.36; rebases on K1 and K2 before its gate | K1, K2; lands after K2 (card strings) |
+| 9 | K2 Card purchases: Android (`:feature:cards`, Room 2) | `K2.md` | SPEC v0.36; rebases on K1 before its gate | done 2026-10-24 (landed `a8f91ee`; report recorded in SPEC v0.39, D-191 to D-200) |
+| 9 | K3 Card purchases: web (W-21 to W-23) | `K3.md` | SPEC v0.36; rebases on K1 and K2 before its gate | done 2026-10-24 (landed `faeb752`; report recorded in SPEC v0.40, D-201 to D-207) |
 
 ## Constraints the orchestrator must keep in mind
 
@@ -54,5 +54,5 @@ Plans in the same wave can run in parallel (they own disjoint paths, SPEC §14.7
 - **M6** landed `7730a31` (D-063 to D-066): charts on `Canvas`, Expressive fallbacks against material3 1.4.0, formatting tables in code, one golden per sheet × theme × language (+200 %), which M7a to M7f follow. Its M8 contract requests are in SPEC §11.3.
 - **M12** (D-054): done; the importer test `category_table_matches_the_spec` is green again since M12b (`6eaccec`). M12d (D-059) landed `557af7e` (D-060 to D-062); M7a to M7f run on top of both.
 - **Phone:** M2b (one `installDebug`), M5 (only if instrumented tests), M8 and M10 use the phone; only one at a time, named in the notes. M8's on-phone test was run by the orchestrator with the owner on 2026-10-18; M12e did not use the phone; its APK needs a schema-3 server (SPEC §14.8), and the dev server already runs it.
-- **K0 to K3** (D-176, SPEC §11.3): K0 ran with the owner on the Mac only and is done; its answers are in SPEC v0.36 (D-177 to D-180), so K1 to K3 can start. Fill `{{SPEC_VERSION}}` with v0.38 for K1 (done: landed `671c00d`, recorded in v0.38 with D-181 to D-188), v0.39 for K2 and v0.40 for K3, and `{{NEXT_DECISION}}` from D-191 to D-210 in disjoint ranges for K2 and K3. K1 owns the contract (migration 0004, OpenAPI E-36 to E-44, examples, `match_card_purchase.json`) and lands first; K2 and K3 may start on the spec and fakes and rebase before their gates. Give K1, K2 and K3 disjoint decision ranges. No agent ever prints, logs or commits a real card purchase; the owner's BankID steps are relayed in chat.
+- **K0 to K3** (D-176, SPEC §11.3): K0 ran with the owner on the Mac only and is done; its answers are in SPEC v0.36 (D-177 to D-180), so K1 to K3 can start. Fill `{{SPEC_VERSION}}` with v0.38 for K1 (done: landed `671c00d`, recorded in v0.38 with D-181 to D-188), v0.39 for K2 (done: landed `a8f91ee`, recorded in v0.39 with D-191 to D-200) and v0.40 for K3 (done: landed `faeb752`, recorded in v0.40 with D-201 to D-207), and `{{NEXT_DECISION}}` from D-191 to D-210 in disjoint ranges for K2 and K3 (D-208 to D-210 unused; next free D-212, v0.41). K1 owns the contract (migration 0004, OpenAPI E-36 to E-44, examples, `match_card_purchase.json`) and lands first; K2 and K3 may start on the spec and fakes and rebase before their gates. Give K1, K2 and K3 disjoint decision ranges. No agent ever prints, logs or commits a real card purchase; the owner's BankID steps are relayed in chat.
 - **Outside the repository:** M2c-dev (D-022, done), M2c-pi needs none: it writes the `infra/pi/` compose project and the owner runs it on the Pi (D-100, revises D-023; D-125); M8 (dev server on the Mac), M10 and M11 (production) need the owner's allowance in the notes.