FM-SCRUB-SCHEMA-URL + FM-CAL-DASHBOARD-LINK: scrub operator hostname; surface Sync Calendar from dashboard + scene controls

[keyxmakerx]

Bundles two related dispatches that landed in the same session on the same feature branch.

---

Dispatch 1 — FM-SCRUB-SCHEMA-URL (security)

Operator's production hostname appears in chronicle-package.json:2 (the $schema advisory field). That file ships with every module install — every consumer sees the URL. Operator policy: no instance-specific hostnames in shipped artifacts.

Fix (1 commit, 2 files):

File	Change
chronicle-package.json	Drop the $schema field entirely (Option A from the dispatch). The schema is server-enforced in Chronicle's descriptor.go::loadDescriptor; the field's only value was IDE hint-on-edit, which the operator doesn't need.
tools/test-no-instance-hostname.mjs (new)	CI grep guard. Walks every tracked source file with a typical extension (.mjs/.json/.md/.hbs/.css/.yml/etc.), fails loud if any forbidden hostname fragment appears. The test file itself is in a self-reference allowlist so its own literal mentions don't recurse-fail.

---

Dispatch 2 — FM-CAL-DASHBOARD-LINK (operator-visible)

Surface SyncCalendarApplication from two new affordances so the operator doesn't have to dig through Game Settings → Module Settings to find it. Closes the "Sync Calendar discoverability" BACKLOG entry surfaced during the #25 debug session.

Affordances:

1. Dashboard Calendar tab → "Open Sync Calendar" button. A primary-action launch row above the date-sync status panel. Wired via the standard data-action="open-sync-calendar" ApplicationV2 pattern; handler calls the singleton openSyncCalendar() helper from sync-calendar.mjs (GM-only by contract).
2. Scene-controls toolbar → sync-calendar tool. A second tool inside the existing chronicle-sync group (calendar-days icon). Registered in both v12 array and v13 object shapes. Inherits the GM-only guard at the top of the getSceneControlButtons hook.

Files (5 commits, 6 files):

File	Change
scripts/module.mjs	Import openSyncCalendar; extend the existing scene-controls hook to register the sync-calendar tool in both v12+v13 shapes.
scripts/sync-dashboard.mjs	Import openSyncCalendar; wire 'open-sync-calendar' action handler; add #onOpenSyncCalendarAction private static method.
templates/sync-dashboard.hbs	Add .calendar-tab-actions launch row at top of the Calendar tab body, before the existing {{#if calendar.available}} block.
lang/en.json	Add CHRONICLE.Dashboard.Calendar.OpenSyncCalendar + OpenSyncCalendarHint, and a new CHRONICLE.SceneControl.SyncCalendar namespace.
styles/chronicle-sync.css	.calendar-tab-actions / .primary-action / .action-hint — sized so the operator's first glance lands on the button.
tools/test-sync-calendar-discoverability.mjs (new)	11 static-source regression pins covering both affordances + the GM gate + all 3 i18n keys.

---

Acceptance

• ✅ grep -rn "bnuuy" --include="*.json" --include="*.mjs" --include="*.md" --include="*.hbs" --include="*.css" --include="*.yml" . returns nothing.
• ✅ chronicle-package.json parses as valid JSON; descriptor still passes loadDescriptor (only advisory $schema removed).
• ✅ SyncCalendarApplication is now reachable from two new GM-only entry points without opening Module Settings.
• ✅ All tests pass: 250 / 250 (234 prior + 4 new from FM-SCRUB-SCHEMA-URL + 11 new from FM-CAL-DASHBOARD-LINK + 1 prior).

Tests

node --test tools/test-*.mjs
# tests 250
# pass 250 / fail 0

Out of scope

• ❌ Rework of chronicle-package.json's structure (only the offending line dropped).
• ❌ Chronicle-side hostname scrub — parallel C-SCRUB-INSTANCE-URLS dispatch handles the Chronicle-source references.
• ❌ Restyling the dashboard's Calendar tab beyond the new launch row.
• ❌ Player-side exposure of the Sync Calendar (GM-only by contract is preserved).

Commits

33cb6ca FM-CAL-DASHBOARD-LINK: style the calendar-tab-actions launch row
158d8f0 FM-CAL-DASHBOARD-LINK: wire open-sync-calendar action handler in dashboard
62eb77f FM-CAL-DASHBOARD-LINK: add Open Sync Calendar button to dashboard template
d057ef0 FM-CAL-DASHBOARD-LINK: add i18n keys for dashboard button + scene-control title
2bc2c90 FM-CAL-DASHBOARD-LINK: i18n + dashboard template + discoverability tests
1f4ec7a FM-CAL-DASHBOARD-LINK: surface Sync Calendar from dashboard + scene controls
7e62a15 FM-SCRUB-SCHEMA-URL: drop operator hostname from chronicle-package.json + add grep guard

---

Generated by Claude Code