T5.5 - CR-006: section toggles, and X4 resolved rather than deferred

X4 first, because the brief asks for it explicitly.

IMPLEMENTATION.md sequences CR-006 after B7 on the grounds that the toggles must
suppress sections inside the creator, which is an iframe child until T7.1. The
wave file puts it in wave 5 anyway, and its last done-when is written to
accommodate exactly that: "toggle state propagates into the creator, OR the PR
documents exactly where it does not and why".

It propagates. Both ways, by two separate paths, because they fail differently:

  ON THE CREATOR'S OWN BOOT the flags ride on the SOP, which the creator already
  reads - ProjectData.pullProject hydrates it from the server. Nothing crosses
  the frame boundary at all, so this path is unaffected by B7 either way. It
  covers a reload, a fresh tab, the standalone creator page, and a colleague
  opening the project on another machine.

  WHILE THE FRAME IS OPEN the wizard hands the change straight across
  (pushSectionsToCreator -> cw.applySopSections), the same shape T5.3 used for
  the dashboard filter. Without it, flipping a toggle would appear to do nothing
  until a reload.

T7.1 removes the second path, not the first. That is the whole of the X4
exposure and it is one function, commented as such. Building CR-006 after B7
would not have made the SOP-borne path any different; it would only have saved
writing the hand-off.

What it does

  Ten sections, one shared list (html/wp-sections.js) read by the wizard, the
  creator's form and the creator's rendered document. Three surfaces meant three
  chances to drift, which is how "Assets is off, except in the export" happens.

  Off means NOT RENDERED - form, detail view and PDF export. It never means
  deleted. renderPackage() was rebuilt from one long string into a list of
  (section, html) blocks so a suppressed section leaves no empty heading and the
  survivors renumber 1.0, 2.0, 3.0 instead of leaving a hole. The print window
  reuses that same HTML, so the export needed no separate change.

  Absent means ON. A SOP saved before today mentions no sections, and reading
  that as "all off" would blank every project in the estate the moment this
  shipped. WPSections.normalize is the one place that decision lives.

  html/wp-sections.js               new - the shared list, defaults, normalize
  html/work-package-suite.html      step 12, a 12th rail button
  html/work-package-suite-app.js    the toggles, state.sections, the hand-off
  html/work-package-suite-styles.css the toggle rows
  html/wp-creation-index.html       stable ids on the five unnamed cards
  html/wp-creation-app.js           WP_SECTION_NODES, applySopSections,
                                    renderPackage rebuilt as blocks
  tests/sections_check.py           new - 53 checks

Done when
  [x] all 10 sections are toggleable - each one driven off and back on
  [x] a section toggled off is absent from the form, the detail view and the
      PDF export - checked by content marker, not by heading, so "the section
      is gone" and "the section was empty" cannot be confused
  [x] toggling off then on restores prior data with no loss - and the sharper
      version: a package EDITED while Assets is off still carries its assets
      through collectPackage(), which is what Save uses
  [x] new SOPs default to all sections on
  [x] toggle state propagates into the creator - both paths, separately

Two things worth arguing with

  General Information is toggleable, because CR-006 enumerates it. Turning it
  off leaves nothing to identify a package by. The row says so in its own note
  rather than being quietly excluded from the list.

  Location has no card of its own - it is a field inside General Information's
  grid, and its toggle governs that one row. CR-004 gives it structured
  building/floor/sector fields in wave 6, at which point one line of
  WP_SECTION_NODES changes. Written down because "the toggle does nothing" and
  "the toggle governs one row" look identical from outside.

  Approvals & Sign-offs is NOT toggleable and is not one of the ten. A package
  nobody signed is not a shorter package.

Verified one at a time
  sections_check  53/53  new
  stepper_check   70/70  (STEP_COUNT 11 -> 12)
  locations_check 58/58  (its "step 11 is last" check now asserts the thing that
                          is actually invariant - the wizard's navigation follows)
  browser_check   71/71
  a11y            22/22
  url_state       23/23
  autosave        34/34
  aggregates      16/16
  pipeline        43/43
  launcher        58/58
  f_items         F1-F5 FIXED, F6 REPRODUCES (T7.2)

No colour literal added: still 0 across all page sheets and inline blocks. Each
toggle says its state three ways - the checkbox, the words "In use" / "Not used",
and the rule down its left edge (C1).

Question for the PR, per CLAUDE.md: the toggles are SOP-wide, so a project
cannot use Kitting on install packages and not on BIM ones. BL-000b already
records the field-level version of this question; the per-WP-type version is the
same shape and is not recorded anywhere yet.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/reference/file-map.md

@@ -21,14 +21,6 @@ roughly 11,900 lines" — the line count is right, the other two are not. See D1
 | `html/login.html` | login | 163 | `theme-light.css` | `login.js` | neither |
 | `html/index.html` | launcher | 703 | `theme-light.css`, `wp-chrome.css` | `auth-guard`, `wp-format`, `feedback-config`, `project-data`, `help`, *(inline 418–700)*, `wp-chrome` | neither |
 | `html/work-package-suite.html` | SOP wizard | 437 | `theme-light.css`, `wp-chrome.css`, `work-package-suite-styles.css` | `auth-guard`, `wp-format`, `feedback-config`, `project-data`, `help`, `work-package-suite-app`, `wp-chrome` | **hosts** |
-
-> **The SOP wizard has 11 steps, not 10, since `T5.4`.** `CR-005`'s location list was
-> **appended** as step 11 rather than inserted beside Project, where it belongs by
-> subject: renumbering 2–10 would touch every `sop-step-N` id, every `collectStepData`
-> case, every gate key and the analytics history, for an ordering change. The count
-> lives in one place — `LAST_STEP` in `work-package-suite-app.js` — and reordering is
-> cheap once nothing depends on the numbers. `tests/stepper_check.py` names it
-> `STEP_COUNT` for the same reason.
 | `html/wp-creation-index.html` | creator | 401 | `theme-light.css`, `wp-creation-styles.css` | `auth-guard`, `wp-format`, `feedback-config`, `project-data`, `help`, `wp-creation-app` | **child** |
 | `html/admin.html` | admin | 219 | `theme-light.css`, `wp-chrome.css`, `console.css`, `wp-sidenav.css` | `auth-guard`, `wp-format`, `console-util`, `admin`, `wp-chrome`, `wp-sidenav` | neither |
 | `html/users.html` | directory/users | 106 | `theme-light.css`, `wp-chrome.css`, `console.css`, `wp-sidenav.css` | `auth-guard`, `wp-format`, `console-util`, `users`, `wp-chrome`, `wp-sidenav` | neither |
@@ -38,6 +30,18 @@ No script anywhere in `html/` uses `defer`, `async`, or `type="module"`. Every o
 render-blocking classic script. `auth-guard.js` and `wp-format.js` load in `<head>`; the rest
 load at the end of `<body>`.
 
+Wave 5 added two `<head>` scripts, both shared: `wp-sections.js` (the `CR-006` section list,
+read by the wizard *and* the creator, so the two cannot disagree about what "Assets is off"
+means) joins `wp-url.js` and `wp-autosave.js`.
+
+> **The SOP wizard has 12 steps, not 10, since wave 5.** `T5.4` appended Locations (11) and
+> `T5.5` appended Sections (12). Both were **appended** rather than inserted where they
+> belong by subject: renumbering 2–10 would touch every `sop-step-N` id, every
+> `collectStepData` case, every gate key and the analytics history, for an ordering change.
+> The count lives in one place — `LAST_STEP` in `work-package-suite-app.js` — and reordering
+> is cheap once nothing depends on the numbers. `tests/stepper_check.py` names it
+> `STEP_COUNT` for the same reason.
+
 ### The iframe boundary (matters for `B7` / `T7.1`)
 
 `work-package-suite.html:383` declares `<iframe id="wp-frame">` with **no `src`**.
@@ -235,6 +239,7 @@ python tests/stepper_check.py       # A4/S9 — ten real buttons, keyboard opera
 python tests/launcher_check.py      # B3  — can a brand-new account get started?   58 checks
 python tests/pipeline_check.py      # B4 surface — server counts, shareable links  43 checks
 python tests/locations_check.py     # CR-005 — codes not labels, nothing deleted   58 checks
+python tests/sections_check.py      # CR-006 — off means hidden, never deleted    53 checks
 ```
 
 `pipeline_check.py` reads the dashboard's state out of the **iframe's DOM**, not its