.json [--bucket ...]
```
### Script requirements
```typescript
// Pattern (adapt per repo)
import './load-local-env.js';
import { createClient } from '@supabase/supabase-js';
import { marked } from 'marked'; // or remark/unified — pin version, verify docs
import { createHash } from 'crypto';
import { writeFileSync, mkdirSync } from 'fs';
const dryRun = !process.argv.includes('--apply');
const backupPath = getArg('--backup');
// 1. SELECT only rows matching audit bucket (same SQL as Phase 1)
// 2. For each row: transform deterministically; NEVER call LLM
// 3. Validate: sha256 before/after, length ratio, format re-check
// 4. If validation fails → skip row, log to remediation-skipped.json
// 5. dry-run → write diff files; apply → UPDATE + sync word_count/reading_time
```
### Transform selection
| Source → Target | Tool | Caution |
|-----------------|------|---------|
| MD → HTML | `marked` / `remark` + `rehype-sanitize` | Configure allowed tags to match reader |
| MDX → HTML | MDX compile OR strip JSX if MDX not supported | MDX ≠ MD; needs separate pipeline |
| HTML → HTML (hybrid) | Parse DOM (`node-html-parser`, `cheerio`); convert text nodes only | Never regex whole document |
| HTML → MD | Only if target is MD (rare) | Lossy; document why |
| Plain → HTML | Wrap in ``, escape entities | Minimal |
| Strip comments | DOM or targeted regex on known patterns | Low risk |
**Never run MD converter on already-HTML bodies** unless you've extracted markdown islands first.
### Validation gates (per row)
Skip and flag if any fail:
- [ ] `sha256(before)` recorded in backup
- [ ] Plain-text word count within ±15% (or policy threshold)
- [ ] `len(after) >= 0.85 * len(before)` for MD→HTML (HTML adds tags)
- [ ] Re-classification passes target bucket
- [ ] No `