[schlessera]

Closes #1772

What changed

The closed fictional website demo answers HTML preview HEAD checks from the same HTML fixture set used by its static iframe route. Existing previews stay visible; missing and non-HTML paths return bodyless 404. The phone browser check handles the already-visible file tree after navigation while retaining the exact document, collapsed frontmatter and no-overflow assertions. Generated shares and previews are refreshed against current workspace inputs.

Why this shape

The production reader already verifies iframe availability. Its injected demo transport lacked that route. This fixes the fixture without changing the reader, authentication, static navigation, iframe sandbox, production permissions or deadlines. No package changeset is needed: only independently built website source, proof and generated assets change.

Proof

Current candidate ddeadb30371eaa71acbc89a2c9f0176815d6c34e integrates main 9bebef7bfed47139792ccaf1d22d4ac7f5f093e9, including the delivered #1783 correction and its full PR/main qualification. This is a relevant-base refresh, not an unchanged retry of failed qualification.

Fresh local proof (Bun 1.4.2, locked website Node 22.23.3):

• Frozen dependencies and full workspace website regeneration/check pass: 150 prepared exports, current recipe metadata, HTML/assets/links, publication/share/release-selection guards, all four app smokes, real downloads and preview/status checks, responsive themes, all eight library scenes, handbook accessibility and no external browser requests.
• Fresh mutation removes only the HTML HEAD branch from the demo source and recompiles its browser bundle with the original recipe/version. The unchanged iframe heading assertion fails after 7,000 ms at verifyRichDemo, website/scripts/rich-demo-check.ts:129. Source and bundle are restored byte for byte, and the identical complete browser command passes. No production or checker assertion changes during the mutation.
• Complete root-path website check passes at /, preserving every assertion; the normal /brain-kit/ project build is restored afterwards.
• An isolated tagged-source assembly against published @schlessera/brain@0.43.1, product f691c5b62a0ffcca67bedfee0be6557631d0930d, passes frozen installation, full regeneration/build/typecheck, comprehensive website browser/guard proof and exact publication identity verification. Its website source is integration commit 0ffa21b4f8d824d6d04d4c433156f359214ced55; the later candidate changes only generated exports. All six consumed package versions/integrities are confirmed from npm. The first manual identity call lacked required workflow environment and refused; supplying the explicit source/product/base environment passes without code changes or rerunning browser proof.
• Shared browser review opens departure-brief.html, renders the Departure from Ogygia heading, reports File loaded and retains exact sandbox="allow-scripts".
• Committed bun run check:pr --base origin/main: 852 tests / 5,459 assertions pass in 38.09 s, with lint, leakage, metadata and compilation gates.

Historical evidence remains distinct. Original website run 38416635653 failed the unchanged HTML heading after false 404. Prior PR run 38420173810 failed the separate #1783 maintenance assertion; twelve substantive jobs passed, unit 2 failed and aggregate could not pass. Its checkout 56c9f112e10ee7fbeccc6f5e60cefa55bf6aefc7, parents f2c98da6093c9e1731f061625ba7302f51bf7340 + 063189f8fd4027817a02c57c114c53cfa5fbfabe, tree 8923db534d4fdeacb63525154f6cecf89db9e313 remains an immutable failed receipt. Subsequent automatic website occurrences through 0.43.1 are preserved on #1772; none is relabelled green.

Final ready qualification run 38832015245, attempt 1, passes all fourteen selected jobs including aggregate 116760120874. Every actual job checkout log agrees on 9b34851f6c427eae3d9f7e8172ab751e3b37fa77, parents tested main 9bebef7bfed47139792ccaf1d22d4ac7f5f093e9 + head ddeadb30371eaa71acbc89a2c9f0176815d6c34e, tree fc2866deac46fb2f2f9d2b42c768259b079f7313; immutable API and local Git agree. Strict verification, packaging, all units, both browsers/layouts, captures, runtime and aggregate pass. The draft-event run was superseded before substantive qualification; the completed ready run supplies proof.

Live main advanced independently to 9cf4aa5f37a33d40f53f783ecd0e8344f920f9ec (#2001), adding only one regression case to tests/export-native-rejection-runtime.test.ts. It changes no website, product, lockfile or CI/harness input. Preserve the original tested base/tree rather than relabel that run. A focused combined-source native check using the new main test passes 2 cases / 163 assertions in 1.56 s with Chrome required; the temporary file is restored and checkout is clean. The reviewed combined tree calculated with git merge-tree is 19decbcbdf60f861917feaba00361fe6c17c03b8. Verify the actual squash parent/tree and its independent automatic main run after merge.

Checklist

• Focused committed preflight and complete selected current-head hosted qualification pass, with actual job checkout evidence below.
• Meaningful native browser red/restored proof and original assertions retained.
• Acceptance criteria implemented; fresh qualification remains required.
• Release milestone on issue and PR read back before merge.
• No package changeset: independently built website only.
• No personal data, package/API contract, CSP or production behavior change.
• Generated export provenance matches the current recipe.

Anything left open

Nothing in the scoped fixture correction. #1783 is delivered. Automatic main-push and website workflows will have separate receipts after merge; no manual publication/deployment is included.

[schlessera]

Final verification complete: automatic main-push package run 38834572937, attempt 1 passes all fourteen selected jobs and the proof aggregate. Every actual checkout log identifies exact squash 665bf5e4e7dca4fcaba5e9cf6b341fbef95c9f4c. This independently qualifies the actual combined result, including main's separately assessed native test addition; the PR run keeps its older tested base/tree identity.

Automatic website run 38834573141 passes artifact and deployment. The public build manifest and its SHA-256 match the workflow receipt: website source is the exact squash, dirty: false, released product 0.43.1 at f691c5b62a0ffcca67bedfee0be6557631d0930d, and base /brain-kit/. The nested Quickstart returns 200. The full native website proof includes the original HTML heading, truthful bodyless HEAD statuses, exact sandbox, exports, responsive themes, library scenes, accessibility and offline requests. No manual deployment was invoked.

#1776 is merged, #1772 is closed, and both retain milestone 0.44.0. Source/bundle mutation is restored; the checkout is clean. Claim 1772-qualify-1272759e-20261016 is complete. Historical failed receipts remain source-attributed, and no next issue is taken.