aliasfoxkde · Nov 12, 2026 · Nov 11, 2026 · Nov 11, 2026 · Nov 12, 2026 · Nov 12, 2026
diff --git a/docs/PROGRESS.md b/docs/PROGRESS.md
@@ -13,13 +13,17 @@
 
 - **Release:** `v0.2.5` is the latest tag; `main` carries the
   shell-lineage train (#107) and the post-train dependency work
-  (#117) beyond it. The live Pages deployment was reconciled on
-  2026-11-11 (#104): its JavaScript, wasm and `appinfo` match the
-  released v0.2.5 web bytes; `host.html`/`index.html` differ only by
-  Cloudflare's injected analytics beacon. Decision recorded in #104:
-  the release bytes are the source of truth; republishing from the
-  release artifact is the pending next step (T18 row in
-  [`TASKS.md`](TASKS.md)).
+  (#117) beyond it. The live Pages deployment was measured on
+  2026-11-11: its trunk asset name and wasm digest match neither the
+  published v0.2.5 release asset nor a rebuild of the v0.2.5 tag, so
+  the live build corresponds to no identifiable release and its source
+  revision is unknown. The earlier reconciliation (#104) inferred a
+  match from equal file sizes and an identical `appinfo.json`; the
+  digest measurement falsifies it. The served `index.html` differs
+  only by the substituted asset names and Cloudflare's injected
+  analytics beacon — that difference is explained. Republishing from a
+  named commit, with its digests recorded, is the pending next step
+  (T18 row in [`TASKS.md`](TASKS.md)).
 - **Build evidence:** the earlier optimized `dist/web/` distribution,
   built 2026-11-04 16:45 local time, had a 21,274,323-byte wasm
   (below the 21,500,000-byte ceiling). It was built from `56ee1bf`,
@@ -77,8 +81,8 @@
 | Earlier optimized `dist/web/` | 2026-11-04 16:45 local; 21,274,323-byte wasm; manifest verified | Build from `56ee1bf`, whose Git tree matches `5fac7a2`; deployment comparison and earlier bridge smoke |
 | T22 optimized rebuild in `dist/web/` | 2026-11-04; 21,271,259-byte wasm | `5fac7a2` plus dock and inspector changes; six browser captures and interaction checks in [T22](tasks/T22-screenshot-ui.md#receipts--2026-11-04) |
 | Raw `web/dist/` | 2026-11-04 18:21 local; 95,583,065-byte wasm | Development output; not the optimized distribution |
-| Browser smoke | Earlier optimized artifact: bridge smoke in session history; T22 rebuild: six captures and interaction checks in T22 | Local end-to-end proof for each recorded artifact; the live deployment was reconciled against the release bytes on 2026-11-11 (#104) |
-| Live Pages | Reconciled 2026-11-11 (#104) | JS/wasm/appinfo match the released v0.2.5 web bytes; `host.html`/`index.html` differ only by Cloudflare's injected beacon; release bytes are the source of truth |
+| Browser smoke | Earlier optimized artifact: bridge smoke in session history; T22 rebuild: six captures and interaction checks in T22 | Local end-to-end proof for each recorded artifact; the live deployment was measured against the release bytes on 2026-11-11 — it is neither the release asset nor a rebuild of the tag |
+| Live Pages | Measured 2026-11-11 by digest | The live bundle's trunk asset name (`2274ac8c2925b61d`) and wasm digest (`f4f0a3f0…`) match neither the published v0.2.5 release asset nor a rebuild of the v0.2.5 tag; the live build corresponds to no identifiable release and its source revision is unknown. `index.html` differs only by the substituted asset names and Cloudflare's injected beacon |
 
 <!-- /coderabbit-ai-generated:v1 -->
 

diff --git a/docs/TASKS.md b/docs/TASKS.md
@@ -46,7 +46,7 @@
 | P0 | Phase 22: CS6 shell fidelity and screenshot audit | In progress | [T22](tasks/T22-screenshot-ui.md) — screenshot acceptance is complete; 22.1 panel inventory and 22.2 tool strip landed on `main` with the shell-lineage train (#107); 22.5 chrome remains partial, and 22.4 still has evidence-gated bitmap transform/fill-stroke work. [Phase 22](NEXT.md#phase-22--cs6-shell-fidelity-p0-the-looks-and-acts-like-fireworks-phase) |
 | P1 | Phase 20: daily-driver editing features | **In progress — 20.1–20.3, 20.5–20.7 on main; 20.4 in PR** | In-canvas text editing landed 2026-11-06 ([T20](tasks/T20-text-editing.md)); multi-document tabs (20.5), history rewind (20.6), and slice/hotspot behavior editing with HTML preview (20.7) landed 2026-11-11 in #107; the Optimize panel (20.2, [T7](tasks/T7-optimize-panel.md)) and the animation timeline (20.3, [T8](tasks/T8-animation-timeline.md)) landed 2026-11-11 in #118. Mask stack (20.4) is in open PR #113. Do not count open PR work as shipped until merged and validated. [details](NEXT.md#phase-20--daily-driver-features-p1) |
 | P1 | Phase 21: modern differentiators | **Done — all items landed 2026-11-11** | Autosave/crash recovery, HiDPI, command palette v2 (fuzzy scoring, recents, Save Steps As Command), preferences, accesskit accessibility and in-app scripting (`.jsf`/`.fwsteps`) all landed with the shell-lineage train (#107, PR #15); [details](NEXT.md#phase-21--modern-differentiators) |
-| P1 | Reconcile live web deployment | **Reconciled — republish pending** | #104 (`docs/web-deployment-reconciliation`) reconciled the live site against v0.2.5: the JS, wasm and `appinfo` match; `host.html`/`index.html` fail the site's own manifest because Cloudflare injects an analytics beacon after it is written. Decision recorded there: the release bytes are the source of truth. Next: republish from the release artifact. See [T18](tasks/T18-release.md). |
+| P1 | Reconcile live web deployment | **Measured — the live site is not the v0.2.5 release bytes** | Measured 2026-11-11 by digest: the live bundle's trunk asset name (`2274ac8c2925b61d`) and wasm digest (`f4f0a3f0…`) match neither the published v0.2.5 release asset (`f9dbe2f14305b2d9` / `a8a4fa4f…`) nor a rebuild of the v0.2.5 tag (`103c62d3366aef17` / `5934702f…`), so the live build corresponds to no identifiable release and its source revision is unknown. The earlier reconciliation (#104) inferred a match from equal file *sizes* and an identical `appinfo.json`; the digest measurement falsifies it. The served `index.html` difference is explained (substituted asset names plus the Cloudflare analytics beacon). **What would close it:** deploy a bundle whose asset name and wasm digest are recorded here, from a named commit — a production publish, gated for explicit maintainer approval. See [T18](tasks/T18-release.md). |
 | P2 | Next-release asset breadth and platform verification | Open | [T23](tasks/T23-release-assets.md); recipes exist, but non-Linux artifacts need real platform build/launch receipts. |
 | P2 | Coverage and test quality ratchet | Open | Replace the old aspirational 99% label with measured per-crate targets and snapshots; [NEXT.md](NEXT.md). |
 | P2 | Aegis gate: content-keyed baseline, so a doc edit no longer fails the gate | **Done — landed on `main`** | [decisions/0074-aegis-content-keyed-baseline.md](decisions/0074-aegis-content-keyed-baseline.md). The baseline keys on content (pattern, file, digest) rather than on line, and every rule class stays armed. |

diff --git a/docs/tasks/T18-release.md b/docs/tasks/T18-release.md
@@ -1,6 +1,56 @@
 # T18 — Verify v0.2.5 release and web deployment
 
-**Status:** the `v0.2.5` release is complete. On 2026-11-04, the served Pages manifest's JS/wasm/index hashes differed from local `dist/web`; the deployed source revision remains unknown.
+**Status:** the `v0.2.5` release is complete. The live deployment is
+**not** the v0.2.5 release artifact and is **not** reproducible from
+the v0.2.5 tag — measured 2026-11-11, receipt below. The deployed
+source revision remains unknown.
+
+## Deployment receipt — 2026-11-11
+
+Three distinct web bundles were compared by digest. The trunk asset
+name carries a source-tree hash, so a differing name is a differing
+source; the wasm digest is the build's byte identity.
+
+| Bundle | trunk asset name | wasm bytes | wasm sha256 |
+|---|---|---|---|
+| **live** — `https://firecraft-web.pages.dev` | `2274ac8c2925b61d` | 21 231 377 | `f4f0a3f06fa3f5057485715c5c039fda50de9a6a0e72a451a62bf56366dbdb11` |
+| **v0.2.5 release asset** — `firecraft-web-0.2.5.zip` | `f9dbe2f14305b2d9` | 21 238 451 | `a8a4fa4f28aa81a9e5fa6bb2a24eec1fe8a38b7ae4759333e12cc8c38b201865` |
+| **v0.2.5 tag rebuild** — `xtask dist --web` at tag `v0.2.5` | `103c62d3366aef17` | 21 229 720 | `5934702ff141ea4cc7b0557abebaf95b78219adbc9ed2dc64607740a4a3e9e7b` |
+
+Consequences, each measured rather than inferred:
+
+- **The live bundle is not the v0.2.5 release asset.** Different asset
+  name, different wasm digest, different byte count. The JS text
+  differs only in wasm-bindgen closure `shim_idx` values and the
+  internal wasm-bindgen symbol hashes — a toolchain difference, not
+  proof of a source difference; the asset *name* is the source
+  identity, and it differs.
+- **The live bundle is not reproducible from the v0.2.5 tag** with
+  the current CI toolchain either (the tag rebuild carries a third
+  asset name). The published v0.2.5 asset was therefore built from a
+  tree that is neither the tag nor the live deployment.
+- **The live HTML difference is explained.** The served `index.html`
+  is the build's own `index.html` with the asset names and their
+  `integrity` digests substituted, plus the Cloudflare Pages
+  analytics beacon injected by the CDN. That accounts for the whole
+  2 195 → 2 409 byte difference; there is no unexplained drift.
+- **`appinfo.json` matches** the release asset byte for byte
+  (`7d039c36f28e9b1f67f5ee45fd7bdfd705873e716cc13b09d093be19ea0a3ffa`),
+  so the live app reports version `0.2.5` — but every commit since the
+  v0.2.5 stamp also reports `0.2.5`, so the version stamp alone
+  identifies nothing.
+
+The earlier reconciliation recorded on this ticket — that the live
+site's JavaScript and wasm "match the v0.2.5 release bytes" — is
+**falsified**: the digests differ, and the match was inferred from
+equal file *sizes* and an identical `appinfo.json`, not from
+digests. The live site corresponds to no identifiable release, which
+is what blocker B-6 in the task board says.
+
+**What would close it:** deploy a bundle whose asset name and wasm
+digest are recorded here, from a named commit, and re-measure the
+live host against that record. That is a production publish and stays
+gated for explicit maintainer approval.
 
 **Objective:** verify the already tagged v0.2.5 release and confirm which
 web build is live on Cloudflare Pages.

diff --git a/docs/wiki/Project-Status.md b/docs/wiki/Project-Status.md
@@ -23,7 +23,7 @@ FireCraft is a functional Rust graphics editor with a shared document engine and
 
 ## Deployment and release
 
-The 2026-11-11 deployment reconciliation (#104) found that the live site's JavaScript, Wasm and WebOS app metadata match the v0.2.5 release bytes. Cloudflare injects an analytics beacon into the served HTML, which accounts for the remaining HTML-manifest difference. Republish from the canonical release artifact is pending.
+The live deployment is **not** the v0.2.5 release artifact and is **not** reproducible from the v0.2.5 tag — measured 2026-11-11 by digest. The live bundle's trunk asset name (`2274ac8c2925b61d`) and wasm digest (`f4f0a3f0…`) match neither the published v0.2.5 release asset (`f9dbe2f14305b2d9` / `a8a4fa4f…`) nor a rebuild of the v0.2.5 tag (`103c62d3366aef17` / `5934702f…`), so the live build corresponds to no identifiable release and its source revision is unknown. The served `index.html` differs from the build's own only by the substituted asset names and the Cloudflare analytics beacon — that difference is explained. Do not infer the live build from the source version alone: every commit since the v0.2.5 stamp reports version `0.2.5`. The measurement is in [T18](../tasks/T18-release.md#deployment-receipt--2026-11-11).
 
 The current release program keeps standalone FireCraft and embeddable developer artifacts as complementary targets. A packaging recipe or cross-compile is not a verified release.