AGENTS.md@apps/web git:20260916.dc5ae8dA

Immutable. This exact content never changes and is served at /api/v1/blob/2e3d232d2191e132.

# Contents

- `src/` contains the static `slopcamera.com` homepage and documentation, inert `/preview` composition, visual system, appearance control, crawler files, favicons, social preview, and machine-readable page bodies.
- `src/negotiate.ts`, `src/negotiate-request.ts`, and `middleware.ts` select HTML or markdown from `Accept` for document routes.
- `scripts/build.ts` renders fingerprinted local assets into `dist/` from an explicit allowlist and bundles the pinned PostHog browser client only for a configured Production build.
- `src/preview.stylex.ts`, `src/preview-renderer.ts`, and `src/preview-foundation.*` own the inert preview's static recipes, sealed HTML producer, and CSS-importing foundation entry. `scripts/build-preview.ts` compiles their public StyleX generation; `scripts/preview-contract.ts` bounds its publication projection.
- `src/site-shell.stylex.ts` owns ordinary skip-link, header/navigation, and 404 presentation. `src/site-renderer.ts` produces both complete ordinary documents plus every registered docs page inside the generation in `scripts/build-site.ts`; `scripts/site-contract.ts` admits their closed public artifact projection. `src/docs-registry.ts`, `src/docs.ts`, `src/docs-markdown.ts`, `src/doc.html`, `src/site-docs.stylex.ts`, and `src/docs/**/*.md` own the bounded documentation pipeline: a StyleX-free registry, placeholder-emitting body renderer, shared sealed template, documentation recipes, and authored markdown sources. Only the sealed renderer resolves `DOCS_*` class placeholders; no build entrypoint or middleware may import a StyleX recipe. `src/site-foundation.css` keeps shared foundations and the remaining raw marketing/appearance compatibility below the final union.
- `src/site-install.stylex.ts` owns only local install instructions and copy-control presentation, including finite idle/copied/failed classes and an inert offscreen textarea template. `src/copy-command.ts` uses those SSR-produced classes without importing the compiler/runtime or adding inline styles. Marketing section/headings and the appearance menu remain separate legacy boundaries.
- `scripts/site-css.ts` inspects the ordinary foundation AST, including relative URLs in custom properties and image-set strings; the strict publication contract requires each of the fourteen fonts once and each of the two canonical 0.8 textures twice (editorial field and material wall), with one emitted artifact per exact asset hash. This inspection never rewrites emitted bytes. The preview keeps its independent dependency inspector unchanged.
- The preview browser verifier keeps the Bun HTTP server and Direct-owned Chrome lifecycle in its parent. A separately owned Node 24 worker drives Playwright through a bounded request, phase and result protocol; acceptance follows collection of both process groups and the server.
- `scripts/verify-site-shell.ts` and `site-shell-browser-*` require an exact reviewed old-tree manifest and compare ordinary documents in the same pinned native browser. The baseline is an independent input, never inferred from a prior passing claim.
- `verify:marketing` owns a separate current-design native lane: the exact bf1e1a9 two-stylesheet baseline, closed editorial expectations, all 76 native cases, finite property/flow differences, strict 404 and shell comparison, and both foundation/final-CSS restoration controls. It does not certify historical migration parity.
- `site.test.ts`, `package.json`, and `vercel.json` define the content, identity, accessibility, performance, legacy-host, and deployment contracts.

# Guidelines

- Keep the site static and useful without JavaScript. Browser code may load only fingerprinted local assets. The sole runtime request is the reviewed PostHog pageview boundary below.
- Author `/preview`, the ordinary skip-link/header/navigation/404 shell, and local install/copy presentation in product-owned literal StyleX recipes. Use the released `@hraness/ui/stylex-build` generation, Vite and Bun adapters, produced-template seal, and finalizer. Keep the ordinary homepage marketing, Ask-AI overrides, and framework-neutral appearance menu explicitly separate and unmigrated; a captured compatibility stylesheet is not a converted component.
- Seal the install/copy state classes and fallback textarea in the same captured ordinary SSR graph. Preserve semantic hooks, hidden-before-JS behavior, exact commands/text, live status/described-by links, native focus, failed-hover gold ink, 34rem physical border change, and the exact 2500ms success reset. Never import a recipe into the theme client. Pure copy-handler and compiler-output ownership tests complement, not replace, all 76 ordinary native cases and additional real copy success/failure/fallback/reset/hover/focus/phone/forced-color evidence before delivery.
- Seal both ordinary documents and all registered docs pages in one SSR graph with the exact UI, design-kit, and footer manifests, one CSS-importing Vite foundation, and one final union. Complete content and asset substitutions before sealing. Publish only the sealed HTML files, foundation and union CSS, fourteen identity-checked local WOFF2 files and the two exact shared-preset SVG textures. Docs pages share `doc.html` as one produced template per page, keep `/docs` routes first-party with markdown mirrors beside them, and carry canonical, alternate, TechArticle, and source-provenance metadata. Do not concatenate package standalone recipe CSS, publish graph JavaScript/evidence, or rewrite sealed HTML/CSS. Preserve the two original shell breakpoints, static navigation and recovery links, native focus, appearance behavior, and strict local-only font/style CSP.
- The homepage opts into the shared editorial preset on main and the independent Lantern material on its HTML host. Only its hero is a material wall; the existing proof frame stays opaque, and open questions use the matched warm plane and ink. Preserve compiled shell geometry, 404 and inert preview presentation. The literal shell recipe reads the shared chrome paint, blur and seam tokens with exact prior fallbacks; only the homepage carries the chrome hook. The homepage outlined navigation action has one local `--gold-ink: var(--ink)` bridge scoped to `.topbar nav[aria-label="Primary"] > .site-action`; its text and currentColor borders follow the header foreground rather than filled-accent contrast ink. Native idle, hover and focus paint must be positive in every existing theme and forced-color profile; all unlisted shell paint and dimensions remain exact. `vendor/marketing-preset/` is a finite immutable source snapshot with CSS, Instrument Serif, texture SVGs, licensing and a canonical checker; no package/compiler upgrade is implied. The ordinary builder admits every snapshot byte, captures its font and texture output hashes before sealing, and publishes the four attribution files separately from the compiler graph. Refresh the complete snapshot from one reviewed design-kit source commit; never patch its files locally.
- `vendor/lantern-material/` is the five-file, asset-free canonical snapshot from design-kit `0e089bc18f9a0409f0e74b1fb7192f468956e386` (immutable v0.8.0). The ordinary builder verifies and fingerprints all five files, captures the CSS through its existing foundation, and publishes only the exact license as a separate attribution. Do not patch vendor bytes or import material into the independent preview graph. Peer changes require a reviewed compatible compiler profile and fresh native evidence. This material extension needs a reviewed finite current-design native contract before delivery; the existing 76-case editorial/historical contracts remain authoritative for their declared inputs and must not be relabeled as Lantern evidence.
- Keep the required design-kit foundation inside `base.hraness-foundation`, finite UA compatibility in the later base layer, and retained product rules in `components.slopcamera-legacy` before the compiler-owned union. UA reversions must not override the appearance trigger's cursor or touch action. The temporary unlayered `site-ask-ai-compatibility.css` must scope every selector to `.slopcamera-ask-ai`; `site-footer-compatibility.css` retains only the footer social link's inherited color. These preserve original presentation while the public static components lack descendant recipe overrides. Do not count either boundary as migrated or broaden it to mask other cascade regressions. Ordinary native evidence must compare those shared surfaces as well as the shell.
- The supported preview compiler profile is Bun 1.3.14 with Vite 8.2.1, production only, no React plugin, source maps, watch mode, or client renderer. The Vite foundation entry is TypeScript importing CSS, never a CSS-only bundler input. Capture its single empty JavaScript entry as private graph evidence, then publish only the sealed HTML, final StyleX union, captured foundation CSS, and all thirteen identity-checked installed WOFF2 files. Never publish graph JavaScript, source, receipts, manifests, or source maps. Keep fonts local and the preview's existing `style-src 'self'` and `font-src 'self'` CSP unchanged.
- The preview's final CSS URL is addressed by the complete captured source, lockfile, toolchain, and package-input fingerprint because the public generation API binds its URL before compilation. The finalized completion record separately binds the emitted CSS bytes. Preserve private generation evidence on success and failure; do not copy it into `dist/` or rewrite sealed HTML/CSS to rename assets.
- Use the framework-neutral `@hraness/design-kit` appearance menu as the final action in every ordinary HTML header. Keep exactly one Light, Dark, and System icon-menu control per page, default to System, and never place it inside navigation or a footer.
- Keep `apps/web` independently installable from its Vercel Root Directory: pin every dependency exactly in this package and commit its local `bun.lock`. Verify an isolated `bun install --frozen-lockfile --ignore-scripts`; do not depend on the parent workspace catalog or lockfile.
- Describe the released SDK, local host, and desktop capture shell as one Slopcamera system. Do not introduce a hosted account, billing, authentication, or generation service.
- Keep generation credentials in local SDK or CLI processes. The browser must never accept, store, forward, or render an AI Gateway credential.
- Preserve the four public output families: images, diagrams, animated loops, and video. Treat audio and captions as composable project inputs rather than another project model.
- Use the reviewed camera-with-flash emoji (📸) PNG derivatives for the public site. Bind their bytes and dimensions to `scripts/public-identity.ts`; keep the identity catalog SVG private. Preserve the desktop camera-frame and lens artwork and its historical provenance independently, never relabel it as newly generated.
- Keep every page semantic, keyboard-operable, readable at 200% zoom, and free of remote fonts and client frameworks. Analytics may emit one anonymous cookieless `$pageview` from `https://slopcamera.com/` to `https://us.i.posthog.com`, tagged with `site_id=slopcamera` and `analytics_schema_version=1`. Keep persons, persistence, autocapture, replay, flags, surveys, heatmaps, pageleave, web vitals, referrer, URL, query, hash, page text, content, and custom events disabled. Do not initialize analytics on built-in Preview deployments, alternate hosts, or `404.html`.
- Organize `/docs` by user intent: guided learning, goal-oriented how-to, factual reference, and conceptual explanation. Do not mix those modes into one undifferentiated command catalog.
- Render the canonical `@hraness/site-footer` markup and styles on every ordinary HTML page. Keep product links and disclosures outside the footer. The noindex `/preview` composition is the sole exception: keep it free of scripts, analytics, actions, authentication, user data, and crawler discovery.
- The reading collection is intentionally empty. Before adding a route, score the proposed page from 0–2 on reader utility, original evidence, factual confidence, Slopcamera fit, voice integrity, and maintenance. Publish only at 9/12 or higher with no zero; revise or consolidate at 6–8; reject at 5 or lower. Record the reader job, three nearest existing URLs and merge rationale, evidence owner, refresh trigger, and a 28–56 day reassessment date in the same change.
- A reading must add first-party evidence or a genuinely Slopcamera-specific conclusion beyond summarizing another Hraness note. Do not invent first-person experience, pad a page to satisfy length or heading quotas, manufacture an “X, not Y” frame, or create a sibling-link web to make a thin collection appear substantial.
- Keep editorial discovery selective. Do not generate art before the page clears editorial admission, add generic “Ask AI about this” chrome to editorial pages, or treat keyword coverage, article count, image count, internal-link volume, or word count as evidence of value.
- If a reading is admitted, publish crawlable HTML with a matching markdown mirror and keep visible figures, captions, responsive image delivery, social metadata, schema, feeds, and sitemaps synchronized through the `editorial-image-seo` skill. Retain reviewed image provenance without exposing internal paths publicly.
- Publish `/llms.txt` as `text/plain` with an H1, summary, and a when-to-use section. Publish `/sitemap.md` and `/index.md` as markdown. Honor `Accept: text/markdown` on the homepage with `Content-Type: text/markdown; charset=utf-8` and `Vary: Accept`. Return `406` when the request rejects every produced type. Keep unknown routes as real `404` or `410` responses, and give markdown 404s recovery links to the home page, `llms.txt`, and sitemaps.
- Do not add a public API, OAuth, GraphQL, MCP, account, or commerce surface to the website.
- Preserve permanent production redirects for every reviewed predecessor host without redirecting canonical Slopcamera hosts. Do not create a durable Preview hostname as a compatibility target.
- Keep the reviewed marketing-refinement-v1 resource ceilings strict: authored homepage content must remain below 36,000 UTF-8 bytes, and the complete sealed ordinary union plus captured foundation must remain below 310,500 bytes before compression. These replace the earlier 32,000 / 256,000 ceilings for the authorized highlighted terminal, archive plus matching Skill installer, source disclosure, four interface examples, and immutable design-kit 0.8 material adoption; the 304,000 CSS interim ceiling was raised for the shared-footer v0.9.x geo-gated consent styles, the 308,000 ceiling was raised again for the shared-footer v0.11.x subscribe-disclosure and account-navigation styles, and the 310,000 ceiling was raised to 310,500 for the shared-footer v0.12.x optional-support styles plus the host `scroll-padding-block-end` rule that keeps keyboard focus above the fixed footer bar (the optional-support candidate measures 310,206 combined CSS bytes). The reviewed candidate measures 35,299 authored bytes and 308,662 combined CSS bytes; the previous compiled baseline measured 252,840 combined CSS bytes. Count highlighted markup and both complete CSS artifacts, including repeated layered material rules. Discount only the existing finite compiler-slot spelling from authored content; do not rewrite sealed assets or vendor snapshots to meet a budget. The complete built homepage must remain below 58,604 UTF-8 bytes: the optional-support footer adds exactly 604 bytes to the independently built current baseline (57,613 → 58,217), preserving the existing 387-byte headroom. Historically, its admitted baseline was 55,043 bytes and the refinement is 57,023 bytes. The six highlighted code blocks add 2,105 bytes (147 text bytes and 1,958 markup bytes), while all other document bytes shrink by 125. Count the entire sealed HTML without exclusions. Preserve exact-boundary and UTF-8 overflow tests, the separate 36,000-byte product CSS, 3,000-byte theme source, 4,000-byte copy source, 24,000-byte theme bundle and 180,000-byte analytics limits, and every native/source gate.
- Run `bun run check` in this directory after a site change.
- `bun run verify:shell --baseline-directory <absolute baseline apps/web> --baseline-manifest <absolute reviewed JSON>` is the historical behavior-preserving ordinary-shell migration proof, run under exclusive browser admission when delivering or revisiting that migration. Preserve its fixed old revision/tree, independent source/config/artifact manifest, complete paired cases and strict equivalence assertions. It has no intentional-design mode: do not substitute current source for the historical baseline, relabel an old receipt, or claim that changed marketing copy, page height or layout is equivalent.
- Intentional changes to unmigrated marketing require this directory's complete `bun run check`, the applicable source gate in `CONTRIBUTING.md`, and separate current-design native browser acceptance against independently reviewed copy/layout expectations. Record the intended differences before verification; preserve the compiled shell unless it is explicitly in scope. Retain every declared responsive, light/dark, forced-color, coarse-pointer and RTL case, native focus transfer and visible target ownership, appearance keyboard/system behavior, local CSP/network restrictions, stylesheet-disable negative controls with exact restoration, fixed deadlines and positive browser/worker/server collection. Verify unchanged shell contracts without treating an intentionally changed page height as equal. Neither a preview-only result nor historical migration parity substitutes for this current-design evidence. Reflow-equivalent viewport evidence is not genuine browser-zoom evidence.
- `bun test ./scripts/preview-contract.test.ts ./scripts/site-contract.test.ts ./scripts/site-template.test.ts` is a pure, process-free edit loop. `typecheck:preview` checks both static compiler boundaries independently of the root SDK configuration. `site.test.ts` performs real compilation and `verify:preview` runs native Chromium; the integration owner runs those through the required host/repository admission, including an isolated frozen install and the applicable ordinary-page acceptance above. Changes to the retained `styles.css` also change preview's captured input fingerprint and require fresh preview evidence.
- Install/copy delivery requires `bun run verify:install-shell` and `bun run verify:copy`, each with the two explicit baseline arguments above and exclusive browser admission. Both select only `install-family-ed48ebb3-v1`: independent checkout/source revision `ed48ebb3bb3aceb30fe369586467d2efbfa42455`, tree `b3a2708ae6fc0a09dbf7d3eb694b2eebecdc1342`, and a reviewed schema-two manifest binding every source/config and built artifact. This baseline preserves PR #88's intentional design before the install migration; never substitute migration HEAD or relabel historical evidence. It has exactly two stylesheets, while the historical profile still requires one. `verify:install-shell` retains the complete original 76-case/720-second strict comparison, with no intentional-design exemption.
- The separate, closed 180-second copy protocol contains eight paired 544/545px × light/dark × forced-colors cases; it never replaces or extends either 76-case matrix. Fresh contexts override only clipboard/legacy-copy ports and observe the real 2500ms timer, native textarea selection, keyboard/pointer actions, all ten idle/copied/failed/fallback/reset states, and exact authored descendant paint. No OS clipboard is read or written. Final receipts retain the finite real port/timer observations, complete paired names, stylesheet/focus negative controls and original owned browser/server collection. Shell DOM normalization may remove only counted install compiler transports and restore the exact four de-indented starts; every outside-install byte, meaningful text/attribute and classless descendant count stays protected.
- Set `NODE_EXECUTABLE_PATH` to the explicit Node 24 executable for preview browser verification. CI pins Node 24.18.1. Keep Playwright in the genuine Node worker, preserve the ten-second attachment deadline, and never accept a worker result before input revalidation, cancellation settlement, stream closure and positive owned-process absence.
- Use the Chromium revision selected by this app's pinned `playwright-core` for native preview evidence. After the frozen, scripts-disabled install, reproduce the site job's shell block in `.github/workflows/ci.yml` from the repository root, using the explicit Node 24 executable and a fresh task-owned temporary directory for `PLAYWRIGHT_BROWSERS_PATH` in place of CI's `RUNNER_TEMP`. The block resolves the CLI from the app's exported package manifest and declared binary, runs `install --no-shell chromium`, then resolves and checks `SLOPCAMERA_CHROME_PATH` through that same package's `chromium.executablePath()`. Keep the browser path exported for both operations. Route the installation and unchanged `bun run check:web` through the required local admission. Retain the browser revision, executable identity and verifier evidence; do not substitute an ambient browser or treat browser selection as proof of a prior failure's cause.

- Run `bun run verify:marketing --baseline-directory <absolute bf1e1a9 apps/web> --baseline-manifest <absolute reviewed schema-three JSON>` for the shared editorial homepage. Independently review `scripts/site-marketing-browser-contract.ts` before execution. Require clean candidate and exact clean baseline Git identities, immutable source/artifact manifests and the final canonical preset. Retain all 76 cases and the 720-second deadline; the receipt reports reflow equivalence, never native browser zoom. The compiled shell, copy commands and all unlisted properties stay exact; only declared main typography/field/measure/spacing, resulting sibling Y translation and the exact homepage header action ink repair with restored forced-color contrast differ.

- `bun run verify:refinement --baseline-directory <absolute clean 0ba8ba1 apps/web> --baseline-manifest <absolute reviewed schema-four JSON>` selects only `marketing-refinement-v1`. `bun run verify:refinement-copy` with the same explicit arguments selects only `refinement-copy-v1`. These are separate current-design acceptance identities; historical `verify:shell`, `verify:install-shell`, `verify:copy`, `verify:marketing`, manifests and receipts retain their original contracts and names.
- The refinement baseline must be the clean independent checkout `0ba8ba1a44cbee73d6af3dee09c714f0470d886b`, tree `e04baeee52e3f3fc92c9dadc8ae4d5a36f2c2a31`. Its schema-four manifest binds exact source/config and built artifact bytes and records the independently reviewed integrated equivalent `634443cef38ba2aea4b239f8fc829d195521a539`; the candidate must also be clean. Admit only immutable material `0e089bc18f9a0409f0e74b1fb7192f468956e386`. Independently review `scripts/site-refinement-browser-contract.ts`, `scripts/site-refinement-fixtures.ts`, and the small shared-parent selection changes before native execution.
- Refinement retains the exact 76-case/720-second ordinary matrix and separate eight-case/180-second copy matrix. Literal fixtures admit only six authored islands: release boundary copy, illustrative terminal, archive-and-matching-skill install, four full-width interface rows, the skill FAQ answer, and closing release copy. Every outside body byte and compiled shell class remains exact. Code has exact source text and single-line range evidence, class-only themed syntax, bounded containers and restored native keyboard scrolling; source instructions use a keyboard-tested disclosure. Positive 0.8 paint formulas admit only named material/section properties; main marketing actions require the canonical 8px radius and unchanged native target minimums. The install frame requires the immutable 0.8 frame radius of 14px, compared with the historical 10px; all other existing projection rules remain unchanged. The unchanged hero grid is checked on both sides: one column below 62rem, two 0.9/1.1 columns at or above it, exact centered copy/frame positions and facts flow. The copy container and its five direct children retain exact paired styles, dimensions and relative positions, with only literal boundary text and its natural line-count height admitted. Copy height may change only by that same boundary-height delta. The exact first, visually hidden hero name must retain its absolute 1px, clipped recipe with the retained paragraph reset’s zero margins and four computed `auto` insets from CSS Typed OM. Only that owner may project CSSOM used inset strings; its copy-relative rectangle and every other style remain paired, and visible-child insets stay exact. Only the title and summary share their positively measured copy-column Y offset; all other dimensions, relative text spacing and styles stay exact. Resulting ancestor heights and section/sibling flow translations are explicit, while unchanged geometry, focus, appearance, 404, forced colors, coarse-pointer/RTL, local network/CSP and all other measured properties remain strict.
- The refinement copy observer has its own closed 18-element inventory and exact two-line release command; the historical 22-element source-install inventory remains unchanged. It reuses the real ten-state clipboard/fallback/2500ms timer observer, native selected textarea, physical 544/545px border change, focus and stylesheet negative/restoration controls, with independent native theme/system-color probes and container checks. Both scopes use the existing owned Bun parent/Node worker/Chrome protocol and require cancellation settlement, immutable input revalidation, stream EOF, positive browser/worker absence and both loopback servers collected before acceptance. Use pinned repository Playwright 1.62.0 Chromium, isolated frozen install and exclusive browser admission as above; do not substitute ambient Chrome or claim native browser zoom.

- Optional footer support uses a separate `optional-support-v1` acceptance identity against clean source `425066a62a62bf76e3a5e8562c4199e4ec108b9e`, tree `7c953911e82f256fe981794902b7234960f8a4af`, with a schema-five source/artifact manifest. Run `verify:support` and `verify:support-copy` with the same explicit baseline arguments under exclusive browser admission. Preserve all 76 ordinary cases and eight copy cases, unchanged 720/180-second bounds and original process custody. Only the exact independently hash-bound old/new canonical footer DOM island may differ; pair every outside-footer body byte, computed style, geometry, keyboard/appearance/hover behavior, and project only the measured footer height into body height. The new support target must have the exact clean public URL, visible unobstructed nonoverlapping geometry, native keyboard focus and hover, no form or hidden account client. Preserve both stylesheet negative/restoration controls, strict current copy semantics, local CSP/network rules and all historical acceptance profiles.
- The shared footer bar is `position: fixed` over its own in-flow footprint, and Chromium's sequential focus never scrolls a target that already sits inside the layout viewport, so a target in the band under the bar stays covered. `styles.css` therefore sets `html { scroll-padding-block-end }` to the installed footer's exact bar height for fine and coarse pointers, and `site.test.ts` binds that rule to the installed package's tokens; update both together on a footer repin. Under `optional-support-v1` the shared Tab loop records each covered fragment with its bounded hit owner instead of failing immediately: the current page must record none, and the immutable baseline must record exactly the reviewed inventory in `scripts/site-support-browser-contract.ts` (the four Ask-AI links and the two 404 recovery links under the fixed bar in the four 720×450 reflow-equivalent cases), each owned by `.hraness-site-footer__inner`; the receipt carries them as `baselineObstructions`. Historical profiles keep their immediate ownership assertion.