git:20260925.8183b60 to git:20260926.3f55475

# Contents

- `src/` contains the static `slopcamera.com` homepage and documentation, inert `/preview` composition, visual system, appearance control, crawler files, favicons, social preview, and machine-readable page bodies.

- `src/negotiate.ts`, `src/negotiate-request.ts`, and `middleware.ts` select HTML or markdown from `Accept` for document routes.

- `scripts/build.ts` renders fingerprinted local assets into `dist/` from an explicit allowlist and bundles the pinned PostHog browser client only for a configured Production build.

- `src/preview.stylex.ts`, `src/preview-renderer.ts`, and `src/preview-foundation.*` own the inert preview's static recipes, sealed HTML producer, and CSS-importing foundation entry. `scripts/build-preview.ts` compiles their public StyleX generation; `scripts/preview-contract.ts` bounds its publication projection.

- `src/site-install.stylex.ts` owns only local install instructions and copy-control presentation, including finite idle/copied/failed classes and an inert offscreen textarea template. `src/copy-command.ts` uses those SSR-produced classes without importing the compiler/runtime or adding inline styles. Marketing section/headings and the appearance menu remain separate legacy boundaries.

- `scripts/site-css.ts` inspects the ordinary foundation AST, including relative URLs in custom properties and image-set strings; the strict publication contract requires each of the fourteen fonts once and each of the two canonical 0.8 textures twice (editorial field and material wall), with one emitted artifact per exact asset hash. This inspection never rewrites emitted bytes. The preview keeps its independent dependency inspector unchanged.

- The preview browser verifier keeps the Bun HTTP server and Direct-owned Chrome lifecycle in its parent. A separately owned Node 24 worker drives Playwright through a bounded request, phase and result protocol; acceptance follows collection of both process groups and the server.

- `scripts/verify-site-shell.ts` and `site-shell-browser-*` require an exact reviewed old-tree manifest and compare ordinary documents in the same pinned native browser. The baseline is an independent input, never inferred from a prior passing claim.

- `verify:marketing` owns a separate current-design native lane: the exact bf1e1a9 two-stylesheet baseline, closed editorial expectations, all 76 native cases, finite property/flow differences, strict 404 and shell comparison, and both foundation/final-CSS restoration controls. It does not certify historical migration parity.

- `src/blog-registry.ts`, `src/blog-admissions.ts`, `src/blog-content.ts`, `src/blog.html`, `src/site-blog.stylex.ts`, and `src/blog/*.md` own the `/blog` collection: a middleware-safe registry, admission records, the build-time article/feed/sitemap producer, the shared sealed template, blog chrome recipes, and authored post bodies.

- `site.test.ts`, `package.json`, and `vercel.json` define the content, identity, accessibility, performance, legacy-host, and deployment contracts.

# Guidelines

- Keep the site static and useful without JavaScript. Browser code may load only fingerprinted local assets. The sole runtime request is the reviewed PostHog pageview boundary below.

- Seal the install/copy state classes and fallback textarea in the same captured ordinary SSR graph. Preserve semantic hooks, hidden-before-JS behavior, exact commands/text, live status/described-by links, native focus, failed-hover gold ink, 34rem physical border change, and the exact 2500ms success reset. Never import a recipe into the theme client. Pure copy-handler and compiler-output ownership tests complement, not replace, all 76 ordinary native cases and additional real copy success/failure/fallback/reset/hover/focus/phone/forced-color evidence before delivery.

- Seal both ordinary documents and all registered docs pages in one SSR graph with the exact UI, design-kit, and footer manifests, one CSS-importing Vite foundation, and one final union. Complete content and asset substitutions before sealing. Publish only the sealed HTML files, foundation and union CSS, fourteen identity-checked local WOFF2 files and the two exact shared-preset SVG textures. Docs pages share `doc.html` as one produced template per page, keep `/docs` routes first-party with markdown mirrors beside them, and carry canonical, alternate, TechArticle, and source-provenance metadata. Do not concatenate package standalone recipe CSS, publish graph JavaScript/evidence, or rewrite sealed HTML/CSS. Preserve the two original shell breakpoints, static navigation and recovery links, native focus, appearance behavior, and strict local-only font/style CSP.

- The homepage opts into the shared editorial preset on main and the independent Lantern material on its HTML host. Only its hero is a material wall; the existing proof frame stays opaque, and open questions use the matched warm plane and ink. Preserve compiled shell geometry, 404 and inert preview presentation. The literal shell recipe reads the shared chrome paint, blur and seam tokens with exact prior fallbacks; only the homepage carries the chrome hook. The homepage outlined navigation action has one local `--gold-ink: var(--ink)` bridge scoped to `.topbar nav[aria-label="Primary"] > .site-action`; its text and currentColor borders follow the header foreground rather than filled-accent contrast ink. Native idle, hover and focus paint must be positive in every existing theme and forced-color profile; all unlisted shell paint and dimensions remain exact. `vendor/marketing-preset/` is a finite immutable source snapshot with CSS, Instrument Serif, texture SVGs, licensing and a canonical checker; no package/compiler upgrade is implied. The ordinary builder admits every snapshot byte, captures its font and texture output hashes before sealing, and publishes the four attribution files separately from the compiler graph. Refresh the complete snapshot from one reviewed design-kit source commit; never patch its files locally.

- `vendor/lantern-material/` is the five-file, asset-free canonical snapshot from design-kit `0e089bc18f9a0409f0e74b1fb7192f468956e386` (immutable v0.8.0). The ordinary builder verifies and fingerprints all five files, captures the CSS through its existing foundation, and publishes only the exact license as a separate attribution. Do not patch vendor bytes or import material into the independent preview graph. Peer changes require a reviewed compatible compiler profile and fresh native evidence. This material extension needs a reviewed finite current-design native contract before delivery; the existing 76-case editorial/historical contracts remain authoritative for their declared inputs and must not be relabeled as Lantern evidence.

- Keep the required design-kit foundation inside `base.hraness-foundation`, finite UA compatibility in the later base layer, and retained product rules in `components.slopcamera-legacy` before the compiler-owned union. UA reversions must not override the appearance trigger's cursor or touch action. The temporary unlayered `site-ask-ai-compatibility.css` must scope every selector to `.slopcamera-ask-ai`; `site-footer-compatibility.css` retains only the footer social link's inherited color. These preserve original presentation while the public static components lack descendant recipe overrides. Do not count either boundary as migrated or broaden it to mask other cascade regressions. Ordinary native evidence must compare those shared surfaces as well as the shell.

- The supported preview compiler profile is Bun 1.3.14 with Vite 8.2.1, production only, no React plugin, source maps, watch mode, or client renderer. The Vite foundation entry is TypeScript importing CSS, never a CSS-only bundler input. Capture its single empty JavaScript entry as private graph evidence, then publish only the sealed HTML, final StyleX union, captured foundation CSS, and all thirteen identity-checked installed WOFF2 files. Never publish graph JavaScript, source, receipts, manifests, or source maps. Keep fonts local and the preview's existing `style-src 'self'` and `font-src 'self'` CSP unchanged.

- The preview's final CSS URL is addressed by the complete captured source, lockfile, toolchain, and package-input fingerprint because the public generation API binds its URL before compilation. The finalized completion record separately binds the emitted CSS bytes. Preserve private generation evidence on success and failure; do not copy it into `dist/` or rewrite sealed HTML/CSS to rename assets.

- Use the framework-neutral `@hraness/design-kit` appearance menu as the final action in every ordinary HTML header. Keep exactly one Light, Dark, and System icon-menu control per page, default to System, and never place it inside navigation or a footer.

- Keep `apps/web` independently installable from its Vercel Root Directory: pin every dependency exactly in this package and commit its local `bun.lock`. Verify an isolated `bun install --frozen-lockfile --ignore-scripts`; do not depend on the parent workspace catalog or lockfile.

- Describe the released SDK, local host, and native companion as one Slopcamera system. Where a page covers cost, accounts, or generation, also describe the hosted image generation that `api.slopcamera.com` bills through prepaid Hraness Credits. Do not add an account, billing, authentication, or generation service to the website itself.

- Keep generation credentials in local SDK or CLI processes. The browser must never accept, store, forward, or render an AI Gateway credential.

- Preserve the four public output families: images, diagrams, animated loops, and video. Treat audio and captions as composable project inputs rather than another project model.

- Use the canonical Slopcamera mark PNG derivatives for the public site. Bind their bytes and dimensions to `scripts/public-identity.ts`; the mark SVG is published at `src/marks/slopcamera.svg` and the marketing illustration at `src/icons/slopcamera.svg`. Preserve the historical camera-with-flash emoji (📸) derivative and the desktop camera-frame and lens artwork as provenance, never relabel either as newly generated.

- Reviewed public workflow derivatives belong only in `media/`, declared by `media/examples.json`. `src/example-registry.ts` owns the closed metadata, provenance, per-file and collection limits; `scripts/example-assets.ts` verifies exact bytes before copying declared files to `/assets/examples/`. Keep editable authoring inputs under `examples/showcase/` and native masters, caches, private paths and raw runtime/provider receipts under ignored `artifacts/`. A render receipt alone is not creative acceptance. Keep native video controls and local poster/source URLs in server-rendered HTML; docs playback is manual, and short homepage previews honor reduced motion, data saving, visibility and user pause.

- Keep every page semantic, keyboard-operable, readable at 200% zoom, and free of remote fonts and client frameworks. Analytics may emit one anonymous cookieless `$pageview` from `https://slopcamera.com/` to `https://us.i.posthog.com`, tagged with `site_id=slopcamera` and `analytics_schema_version=1`. Keep persons, persistence, autocapture, replay, flags, surveys, heatmaps, pageleave, web vitals, referrer, URL, query, hash, page text, content, and custom events disabled. Do not initialize analytics on built-in Preview deployments, alternate hosts, or `404.html`.

- Organize `/docs` by user intent: guided learning, goal-oriented how-to, factual reference, and conceptual explanation. Do not mix those modes into one undifferentiated command catalog.

- Render the canonical `@hraness/site-footer` markup and styles on every ordinary HTML page. The shared footer owns the “Built by Hraness” organization attribution; do not add a separate maker section or attribute the product to a person on any public page or markdown mirror. Keep product links and disclosures outside the footer. The noindex `/preview` composition is the sole exception: keep it free of scripts, analytics, actions, authentication, user data, and crawler discovery.

- The `/blog` collection is the site's only editorial collection; `src/blog-admissions.ts` holds one design-kit `ArticleAdmission` record per post, validated by `assertArticleAdmissions` in `src/blog.test.ts`. Posts render at build time from `src/blog/<slug>.md` through `src/blog-content.ts`, which maps design-kit article markup to closed `BLOG_*`/`DOCS_*` class tokens resolved only by the sealed renderer from `src/site-blog.stylex.ts` and the docs recipes; never link a separate stylesheet or import design-kit into the sealed graph. Every post shows the Hraness byline and provenance note. A `quarantined` post keeps its page and mirror but ships `noindex` (meta, `vercel.json` header and middleware) and stays out of the blog index, sitemap, Atom feed, `llms.txt` and `sitemap.md`; update the `vercel.json` noindex header whenever a post's lifecycle changes. Before adding a route, score the proposed page from 0–2 on reader utility, original evidence, factual confidence, Slopcamera fit, voice integrity, and maintenance. Publish only at 9/12 or higher with no zero; revise or consolidate at 6–8; reject at 5 or lower. Record the reader job, three nearest existing URLs and merge rationale, evidence owner, refresh trigger, and a 28–56 day reassessment date in the same change.

- A reading must add first-party evidence or a genuinely Slopcamera-specific conclusion beyond summarizing another Hraness note. Do not invent first-person experience, pad a page to satisfy length or heading quotas, manufacture an “X, not Y” frame, or create a sibling-link web to make a thin collection appear substantial.

- Keep editorial discovery selective. Do not generate art before the page clears editorial admission, add generic “Ask AI about this” chrome to editorial pages, or treat keyword coverage, article count, image count, internal-link volume, or word count as evidence of value.

- If a reading is admitted, publish crawlable HTML with a matching markdown mirror and keep visible figures, captions, responsive image delivery, social metadata, schema, feeds, and sitemaps synchronized through the `editorial-image-seo` skill. Retain reviewed image provenance without exposing internal paths publicly.

- Publish `/llms.txt` as `text/plain` with an H1, summary, and a when-to-use section. Publish `/sitemap.md` and `/index.md` as markdown. Honor `Accept: text/markdown` on the homepage with `Content-Type: text/markdown; charset=utf-8` and `Vary: Accept`. Return `406` when the request rejects every produced type. Keep unknown routes as real `404` or `410` responses, and give markdown 404s recovery links to the home page, `llms.txt`, and sitemaps.

- Do not add a public API, OAuth, GraphQL, MCP, account, or commerce surface to the website.

- Preserve permanent production redirects for every reviewed predecessor host without redirecting canonical Slopcamera hosts. Do not create a durable Preview hostname as a compatibility target.

- Count complete UTF-8 artifacts: expanded authored homepage below 39,500 bytes (raised from 39,000 in 41ba2b6 for the Atet rename line), sealed built homepage below 65,000, combined foundation and final union CSS below 316,000, theme bundle below 27,500. These finite example-gallery budgets were independently reviewed against exact ba231ba output: 61,150-byte HTML, 312,759-byte CSS and 23,233-byte theme bundle. The five-example draft measured 62,650, 314,949 and 26,513 bytes; the remaining HTML headroom admits only the bounded sixth example. The attributable additions were 2,190 CSS bytes and 3,280 theme-bundle bytes; ordinary union CSS was byte-identical. Complete content-slot expansion measured authored HTML at 35,913 bytes in the baseline and 37,413 in the five-example candidate. The 39,000-byte ceiling admits the measured 1,500-byte change and a bounded sixth figure without discounting any media markup. Retain exact-ceiling and UTF-8 overflow tests. Preserve the separate 36,000-byte product CSS, 3,000-byte theme source, 4,000-byte copy source and 180,000-byte analytics limits, all media limits, and every native/source gate. Earlier 61,260/313,500/24,000 ceilings remain historical evidence; they are not exclusions from the current complete-artifact count.

- Run `bun run check` in this directory after a site change.

- `bun run verify:shell --baseline-directory <absolute baseline apps/web> --baseline-manifest <absolute reviewed JSON>` is the historical behavior-preserving ordinary-shell migration proof, run under exclusive browser admission when delivering or revisiting that migration. Preserve its fixed old revision/tree, independent source/config/artifact manifest, complete paired cases and strict equivalence assertions. It has no intentional-design mode: do not substitute current source for the historical baseline, relabel an old receipt, or claim that changed marketing copy, page height or layout is equivalent.

- Intentional changes to unmigrated marketing require this directory's complete `bun run check`, the applicable source gate in `CONTRIBUTING.md`, and separate current-design native browser acceptance against independently reviewed copy/layout expectations. Record the intended differences before verification; preserve the compiled shell unless it is explicitly in scope. Retain every declared responsive, light/dark, forced-color, coarse-pointer and RTL case, native focus transfer and visible target ownership, appearance keyboard/system behavior, local CSP/network restrictions, stylesheet-disable negative controls with exact restoration, fixed deadlines and positive browser/worker/server collection. Verify unchanged shell contracts without treating an intentionally changed page height as equal. Neither a preview-only result nor historical migration parity substitutes for this current-design evidence. Reflow-equivalent viewport evidence is not genuine browser-zoom evidence.

- `bun test ./scripts/preview-contract.test.ts ./scripts/site-contract.test.ts ./scripts/site-template.test.ts` is a pure, process-free edit loop. `typecheck:preview` checks both static compiler boundaries independently of the root SDK configuration. `site.test.ts` performs real compilation and `verify:preview` runs native Chromium; the integration owner runs those through the required host/repository admission, including an isolated frozen install and the applicable ordinary-page acceptance above. Changes to the retained `styles.css` also change preview's captured input fingerprint and require fresh preview evidence.

- Delivering or revisiting the historical ed48ebb3 install/copy migration requires `bun run verify:install-shell` and `bun run verify:copy`, each with the two explicit baseline arguments above and exclusive browser admission. Both select only `install-family-ed48ebb3-v1`: independent checkout/source revision `ed48ebb3bb3aceb30fe369586467d2efbfa42455`, tree `b3a2708ae6fc0a09dbf7d3eb694b2eebecdc1342`, and a reviewed schema-two manifest binding every source/config and built artifact. This baseline preserves PR #88's intentional design before the install migration; never substitute migration HEAD or relabel historical evidence. It has exactly two stylesheets, while the historical profile still requires one. `verify:install-shell` retains the complete original 76-case/720-second strict comparison, with no intentional-design exemption.

- The separate, closed 180-second copy protocol contains eight paired 544/545px × light/dark × forced-colors cases; it never replaces or extends either 76-case matrix. Fresh contexts override only clipboard/legacy-copy ports and observe the real 2500ms timer, native textarea selection, keyboard/pointer actions, all ten idle/copied/failed/fallback/reset states, and exact authored descendant paint. No OS clipboard is read or written. Final receipts retain the finite real port/timer observations, complete paired names, stylesheet/focus negative controls and original owned browser/server collection. Shell DOM normalization may remove only counted install compiler transports and restore the exact four de-indented starts; every outside-install byte, meaningful text/attribute and classless descendant count stays protected.

- Set `NODE_EXECUTABLE_PATH` to the explicit Node 24 executable for preview browser verification. CI pins Node 24.18.1. Keep Playwright in the genuine Node worker, preserve the ten-second attachment deadline, and never accept a worker result before input revalidation, cancellation settlement, stream closure and positive owned-process absence.

- Use the Chromium revision selected by this app's pinned `playwright-core` for native preview evidence. After the frozen, scripts-disabled install, reproduce the site job's shell block in `.github/workflows/ci.yml` from the repository root, using the explicit Node 24 executable and a fresh task-owned temporary directory for `PLAYWRIGHT_BROWSERS_PATH` in place of CI's `RUNNER_TEMP`. The block resolves the CLI from the app's exported package manifest and declared binary, runs `install --no-shell chromium`, then resolves and checks `SLOPCAMERA_CHROME_PATH` through that same package's `chromium.executablePath()`. Keep the browser path exported for both operations. Route the installation and unchanged `bun run check:web` through the required local admission. Retain the browser revision, executable identity and verifier evidence; do not substitute an ambient browser or treat browser selection as proof of a prior failure's cause.

- Run `bun run verify:marketing --baseline-directory <absolute bf1e1a9 apps/web> --baseline-manifest <absolute reviewed schema-three JSON>` for the shared editorial homepage. Independently review `scripts/site-marketing-browser-contract.ts` before execution. Require clean candidate and exact clean baseline Git identities, immutable source/artifact manifests and the final canonical preset. Retain all 76 cases and the 720-second deadline; the receipt reports reflow equivalence, never native browser zoom. The compiled shell, copy commands and all unlisted properties stay exact; only declared main typography/field/measure/spacing, resulting sibling Y translation and the exact homepage header action ink repair with restored forced-color contrast differ.

- `bun run verify:refinement --baseline-directory <absolute clean 0ba8ba1 apps/web> --baseline-manifest <absolute reviewed schema-four JSON>` selects only `marketing-refinement-v1`. `bun run verify:refinement-copy` with the same explicit arguments selects only `refinement-copy-v1`. These are separate current-design acceptance identities; historical `verify:shell`, `verify:install-shell`, `verify:copy`, `verify:marketing`, manifests and receipts retain their original contracts and names.

- The refinement baseline must be the clean independent checkout `0ba8ba1a44cbee73d6af3dee09c714f0470d886b`, tree `e04baeee52e3f3fc92c9dadc8ae4d5a36f2c2a31`. Its schema-four manifest binds exact source/config and built artifact bytes and records the independently reviewed integrated equivalent `634443cef38ba2aea4b239f8fc829d195521a539`; the candidate must also be clean. Admit only immutable material `0e089bc18f9a0409f0e74b1fb7192f468956e386`. Independently review `scripts/site-refinement-browser-contract.ts`, `scripts/site-refinement-fixtures.ts`, and the small shared-parent selection changes before native execution.

- Refinement retains the exact 76-case/720-second ordinary matrix and separate eight-case/180-second copy matrix. Literal fixtures admit only six authored islands: release boundary copy, illustrative terminal, archive-and-matching-skill install, four full-width interface rows, the skill FAQ answer, and closing release copy. Every outside body byte and compiled shell class remains exact. Code has exact source text and single-line range evidence, class-only themed syntax, bounded containers and restored native keyboard scrolling; source instructions use a keyboard-tested disclosure. Positive 0.8 paint formulas admit only named material/section properties; main marketing actions require the canonical 8px radius and unchanged native target minimums. The install frame requires the immutable 0.8 frame radius of 14px, compared with the historical 10px; all other existing projection rules remain unchanged. The unchanged hero grid is checked on both sides: one column below 62rem, two 0.9/1.1 columns at or above it, exact centered copy/frame positions and facts flow. The copy container and its five direct children retain exact paired styles, dimensions and relative positions, with only literal boundary text and its natural line-count height admitted. Copy height may change only by that same boundary-height delta. The exact first, visually hidden hero name must retain its absolute 1px, clipped recipe with the retained paragraph reset’s zero margins and four computed `auto` insets from CSS Typed OM. Only that owner may project CSSOM used inset strings; its copy-relative rectangle and every other style remain paired, and visible-child insets stay exact. Only the title and summary share their positively measured copy-column Y offset; all other dimensions, relative text spacing and styles stay exact. Resulting ancestor heights and section/sibling flow translations are explicit, while unchanged geometry, focus, appearance, 404, forced colors, coarse-pointer/RTL, local network/CSP and all other measured properties remain strict.

- The refinement copy observer has its own closed 18-element inventory and exact two-line release command; the historical 22-element source-install inventory remains unchanged. It reuses the real ten-state clipboard/fallback/2500ms timer observer, native selected textarea, physical 544/545px border change, focus and stylesheet negative/restoration controls, with independent native theme/system-color probes and container checks. Both scopes use the existing owned Bun parent/Node worker/Chrome protocol and require cancellation settlement, immutable input revalidation, stream EOF, positive browser/worker absence and both loopback servers collected before acceptance. Use pinned repository Playwright 1.62.0 Chromium, isolated frozen install and exclusive browser admission as above; do not substitute ambient Chrome or claim native browser zoom.

- Optional footer support uses a separate `optional-support-v1` acceptance identity against clean source `425066a62a62bf76e3a5e8562c4199e4ec108b9e`, tree `7c953911e82f256fe981794902b7234960f8a4af`, with a schema-five source/artifact manifest. Run `verify:support` and `verify:support-copy` with the same explicit baseline arguments under exclusive browser admission. Preserve all 76 ordinary cases and eight copy cases, unchanged 720/180-second bounds and original process custody. Only the exact independently hash-bound old/new canonical footer DOM island may differ; pair every outside-footer body byte, computed style, geometry, keyboard/appearance/hover behavior, and project only the measured footer height into body height. The new support target must have the exact clean public URL, visible unobstructed nonoverlapping geometry, native keyboard focus and hover, no form or hidden account client. Preserve both stylesheet negative/restoration controls, strict current copy semantics, local CSP/network rules and all historical acceptance profiles.

- The shared footer bar is `position: fixed` over its own in-flow footprint, and Chromium's sequential focus never scrolls a target that already sits inside the layout viewport, so a target in the band under the bar stays covered. `styles.css` therefore sets `html { scroll-padding-block-end }` to the installed footer's exact bar height for fine and coarse pointers, and `site.test.ts` binds that rule to the installed package's tokens; update both together on a footer repin. Under `optional-support-v1` the shared Tab loop records each covered fragment with its bounded hit owner instead of failing immediately: the current page must record none, and the immutable baseline must record exactly the reviewed inventory in `scripts/site-support-browser-contract.ts` (the four Ask-AI links and the two 404 recovery links under the fixed bar in the four 720×450 reflow-equivalent cases), each owned by `.hraness-site-footer__inner`; the receipt carries them as `baselineObstructions`. Historical profiles keep their immediate ownership assertion.

- Workflow examples use `bun run verify:examples --baseline-directory <absolute clean c56e007 apps/web> --baseline-manifest <absolute reviewed schema-six JSON>`, selecting only `workflow-examples-v1` against revision `c56e007e915cfd4a13242b8543c3c054fe682126`, tree `241362dc401eb5f665cc7cffa934903405fa3868`. This independent baseline includes the verified 3.3.3 release instructions, the mainline parametric fixes, the published docs favicon and the hosted-API mainline commits, with its immutable v3.3.3 installation copy retained in the reviewed baseline island; retain the prior 4cdfb0b, 437a530, d203c22 and 0e3f8df baseline evidence without relabeling any of them. Independently review the exact literal islands before native execution; the candidate and baseline must be clean. Preserve all 76 ordinary cases, eight copy cases, 40 docs cases and nine real player cases, the bounded parent/Node/Chromium protocol, local network/CSP controls, negative/restoration checks and positive collection. Every body byte outside the eight admitted islands remains paired; height changes project only the eight literal islands’ measured growth, with install growth additionally bound to the natural note/grid proof below. Only the exact reviewed secondary hero CTA literal may change intrinsic width: native single-text-node ranges plus unchanged padding and borders must explain both button widths, and their preserved gap and copy content width must explain the containing row width. Keep the same wrap mode, button and row heights, and logical start edge; project only the proven secondary and row widths and their derived RTL X offsets. All other CTA semantics, styles and geometry remain paired; historical refinement rules stay unchanged. User-initiated media, native keyboard traversal, reduced motion, Save-Data, visibility, denied playback and failure behavior need real browser observations. Historical profiles and oracles keep their declared inputs and contracts.

- Public-release datum and install-copy updates from the already shipped workflow-examples design use the separate `bun run verify:release-copy --baseline-directory <absolute clean 6ebdc34 apps/web> --baseline-manifest <reviewed schema-seven JSON>`. This selects only `release-copy-v1`, profile `before-release-copy-6ebdc34-v1`, revision `6ebdc349924dfffb5a158034d3d30ae1be946ae6`, tree `34daa7703c8601f85234bffa82e069d5e6a0037a`; independently build the clean baseline and require a clean candidate. Schema seven binds the full media and referenced example-source closure on both sides, plus the workspace root package/lock and paper-theme CSS. Preserve the historical schema-six/c56 `verify:examples` identity, its eight literal islands, the prior a742 schema-seven baseline and all prior receipts without relabeling or retrospective qualification. Independently review the release-copy profile, comparator, parent selection, policy, source-delta admission and baseline manifest before native execution.

- Release-copy admission requires every product source, media file, vendor input, build/runtime script, package dependency and lockfile to pair with 6ebdc34; only the validated public release datum may differ. The parent admits a closed explicit inventory of reviewed verifier/config/test changes and only the new command/test package entries. Compare every body byte outside one exact install island, including the wordmark and all seven other historical islands, and retain strict hero/CTA text, widths, typography, paint, styles and measured geometry. Only the existing positively hash-bound two-texture test-server origin projection is allowed. Docs observation remains a behavioral/shell claim; release placeholders can change docs copy, so it is not a whole-doc-body equivalence claim. The release-copy edit-video inventory is the exact eight figures/videos already authored in 6eb: color-warm, color-cool, color-mono, premiere-wall, then the four existing directed ratios in their original order. Require that exact count and order in every edit-video case, including JavaScript-disabled cases; preserve all manual-player, geometry, navigation and network checks. The historical workflow-examples inventory remains the original seven without premiere-wall.

- Only release-copy player cases, excluding intentional failed-media, may account for browser-selected media transfer cancellation. Bind each Request object once to an owned main-frame media GET at the exact declared local path, SHA-256 and independently verified file length; validate each canonical range or non-Range request and its exact 206 or 200 status, video type, content range and length. Observe one terminal event before calling the original `response.finished()` once for a finished request, and require null completion. Only pre-seal, pre-close `net::ERR_ABORTED` after a valid response may remain provisional; never invoke that unresolved response-finished promise for an aborted request. At seal enumerate every request for each cancelled asset, including distinct attempts with repeated ranges, and account for every cancellation exactly once. Do not require fixed offsets, request count, a completed successor or a full transfer. Require the exact original final owned connected HTMLVideoElement sample, nonempty matching `currentSrc`, no media error, readiness 2–4 and finite time greater than 0.04, recorded after every same-asset terminal and successful response completion. This proves decoded readiness and accumulated playback at that observation, not advancement after cancellation, persistent earlier node identity or complete-video decoding. Emit strictly parsed ordered cancellation inventories with globally unique request/event identities; wire validation checks described history, while the live ledger owns completeness against actual traffic. Retain the global 64-request and 512-event bounds, sample and protocol limits, and reject unfinished responses, other failures, duplicate or late events and cleanup-induced cancellation. Preserve the original request/error handling for docs, historical profiles, nonmedia and intentional failed-media; excluded cancellation inventories remain empty. Keep every existing page action, player assertion, network-settlement deadline and close/collection check.

- Only the validated release-copy worker may select guarded native Tab seeking in the shared ordinary observer. Preserve every real Tab, target inventory, wrap proof and complete font/paint settlement for every named stop, including skip and duplicate targets. Before omitting settlement for an unnamed document-level target, the passive window-capture guard must bind focusin event targets to exact DOM nodes and named keys, validate each trusted Tab dispatch and atomically drain its bounded queue. Any multiple gains, late gain, invalid owner, overflow, changed node/key or incomplete epoch fails; retain the listener across observations until final atomic validation and removal, and clean it up on failure. After an awaited real native Tab without a document keydown, only the exact same connected same-document unnamed HTMLVideoElement may remain unobserved: require controls in the prior checkpoint, the prepared epoch start and the atomic read, no captured gain or latched error, and unchanged node/key. That quiet-video exception never admits an exit, changed owner, named target, audio element or uncontrolled video. A separate provisional exit may bind exactly one trusted composed focusin from the exact prior controlled video to a connected same-document HTMLAnchorElement, with relatedTarget equal to the source video. Require the following trusted composed unmodified Tab keyup to target that exact active anchor; revalidate the source video node/key/controls and captured anchor node/key at gain, keyup and read. Any additional or late gain, source/anchor change, unexpected keydown, or missing, repeated or invalid keyup fails irrecoverably. Named anchor exits retain full settlement before observation; no general opaque-exit fallback is permitted. This is not an internal native-media-control identity claim. Admit only the explicit shared observer and release-only helper paths as verifier changes; historical profiles keep their original unconditional settlement order, and all existing deadlines, cases, negative controls and process custody remain unchanged.

- In the release-copy scope, independently admit the baseline's complete agent-first v3.3.6 note and two-line command and the current literal bound to the validated public datum. Check each side's real clipboard and fallback evidence and all eighteen copy owners in all ten states. Project only one complete note in `#install`, `.install-note` and `.hraness-marketing-install__heading-group`, and one complete command in `#install`, `.hraness-marketing-install__commands`, `[data-copy-command]` and `[data-copy-command-value]`: six distinct text owners. Check exact install DOM in ordinary and copy states; a detached clone may restore only positively checked live button/status state, with complete nonstate attributes and raw snapshot binding. Group bounded nonempty text-node rectangles into nonoverlapping native line bands. Derive note height from line count and unchanged line height, heading content from title/gap/note, column command Y from that heading, and row height from the validated heading/command maximum. Preserve widths, font metrics, paint, padding, borders, gaps, display, alignment, title and command dimensions. Project only those proven note/heading/install used heights and command-relative Y, plus the resulting install-derived following-section/document translation; all other section heights stay exact. Reuse the existing `{scrollY,fixed}` metadata without inventing sticky ownership. Native zero-client-rect descendants retain zero geometry with observed scrollY; real clipped status boxes retain exact command-relative geometry/styles. Keep exact focused, readonly, selected, offscreen fallback evidence. Preserve all 133 cases in order (76 ordinary, eight copy, forty docs, nine player), 1,200,000ms parent and existing per-case/startup/attachment deadlines, 262,144-byte worker and 128KiB protocol bounds, local network/CSP, negative/restoration controls, immutable input revalidation, cancellation/EOF and positive browser/worker/server collection. Historical migration, refinement, support and workflow-example profiles retain their original contracts and run when delivering or revisiting those changes.

- The workflow-examples docs matrix includes four JavaScript-disabled phone/desktop light/dark cases. Phone navigation is a native closed disclosure with a visible current-page context and keyboard Enter/Space toggling; its closed links and the breakpoint-hidden sidebar leave the native Tab order. Desktop retains its visible sidebar. The two projections share one link source, unique landmark labels and no duplicate IDs. Require an article title before the fold on direct visits.

- Release-copy ordinary cases retain passive navigation failure diagnostics in the canonical worker. Observe only the current original pair, return the exact original promises with unchanged arguments, and issue no additional browser calls. Keep at most two contexts, 512 request identities, 128 events and four pending-request snapshots; copy cached request timing values when observed. Retire successful pairs. After the existing failure cleanup, publish at most one 128 KiB diagnostic sidecar; overflow must be explicit with byte count, digest and record counts. A diagnostic error never replaces the original failure. The parent binds a collected sidecar to the request token, baseline and original failing case; missing or invalid evidence stays explicit. Its separate 256-event HTTP tail is recent server history, not a per-pair trace or proof of socket delivery. Preserve the phase protocol, all 133 cases, original actions and assertions, deadlines, worker byte cap and positive collection; historical profiles do not enable the recorder.