pandorga 1.2.1

data/scripts/test/test-public-cv-export.rb

@@ -0,0 +1,164 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Public content-store contract: print-only CV copy stays in Git for private
+# PDF builds and must not appear in the R2 JSON export.
+# Spec: docs/content/architecture.md
+
+$stdout.sync = true
+$stderr.sync = true
+
+require "date"
+require "json"
+require "open3"
+require "pathname"
+require "tmpdir"
+require "yaml"
+
+REPO_ROOT = Pathname.new(__dir__).join("..", "..").expand_path
+EXPORT_SCRIPT = REPO_ROOT.join("scripts/content/export-content-json.rb")
+JOBS_DIR = REPO_ROOT.join("content/collections/jobs")
+
+PRIVATE_JOB_FIELDS = %w[body_extended body_single_page].freeze
+PRINT_ONLY_PAGE_FRAGMENTS = %w[
+  pages/cv/summary-extended.json
+  pages/cv/summary-single-page.json
+  pages/cv/ai-practice.json
+].freeze
+
+def fail!(message)
+  warn message
+  exit 1
+end
+
+def check!(condition, message)
+  fail!(message) unless condition
+end
+
+def run_export!(out_dir)
+  stdout, stderr, status = Open3.capture3(
+    { "CONTENT_API_BASE_URL" => "" },
+    "ruby", EXPORT_SCRIPT.to_s, "content", out_dir.to_s,
+    chdir: REPO_ROOT.to_s
+  )
+  fail!("export failed:\n#{stderr}\n#{stdout}") unless status.success?
+
+  stdout
+end
+
+def split_front_matter(text)
+  text = text.sub(/\A\xEF\xBB\xBF/, "")
+  return [{}, text] unless text.start_with?("---\n")
+
+  parts = text.split(/^---\s*$\n?/, 3)
+  return [{}, text] unless parts.length == 3
+
+  data = YAML.safe_load(parts[1], permitted_classes: [Date, Time], aliases: true) || {}
+  [data, parts[2]]
+end
+
+puts "Testing public CV export redaction..."
+
+source_jobs = JOBS_DIR.glob("*.md")
+check!(!source_jobs.empty?, "expected job Markdown under content/collections/jobs")
+
+jobs_with_private = source_jobs.select do |path|
+  front_matter, = split_front_matter(path.read)
+  PRIVATE_JOB_FIELDS.any? { |field| !front_matter[field].to_s.strip.empty? }
+end
+check!(!jobs_with_private.empty?, "expected at least one job with body_extended or body_single_page in Git")
+
+extended_summary = REPO_ROOT.join("content/pages/cv/summary-extended.md")
+single_page_summary = REPO_ROOT.join("content/pages/cv/summary-single-page.md")
+check!(extended_summary.file?, "missing print-only #{extended_summary}")
+check!(single_page_summary.file?, "missing print-only #{single_page_summary}")
+
+def check_export!(out, jobs_with_private)
+  job_json = out.glob("collections/jobs/*.json")
+  check!(!job_json.empty?, "export produced no job JSON")
+
+  job_json.each do |path|
+    payload = JSON.parse(path.read)
+    front_matter = payload["front_matter"] || {}
+    PRIVATE_JOB_FIELDS.each do |field|
+      check!(
+        !front_matter.key?(field),
+        "#{path.basename} public JSON still contains front_matter.#{field}"
+      )
+    end
+
+    source = JOBS_DIR.join("#{path.basename('.json')}.md")
+    next unless source.file?
+
+    source_fm, = split_front_matter(source.read)
+    next if source_fm["body_public"].to_s.strip.empty?
+
+    check!(
+      !front_matter["body_public"].to_s.strip.empty?,
+      "#{path.basename} dropped body_public while redacting print-only fields"
+    )
+  end
+
+  PRINT_ONLY_PAGE_FRAGMENTS.each do |relative|
+    leaked = out.join(relative)
+    check!(!leaked.file?, "print-only fragment exported to public JSON: #{relative}")
+  end
+
+  public_summary = out.join("pages/cv/summary.json")
+  check!(public_summary.file?, "public CV summary fragment missing from export")
+
+  skills_json = out.join("data/skills.json")
+  check!(!skills_json.file?, "skills.json should not be exported publicly (private CV PDF sidebar only)")
+
+  contacts_json = out.join("data/contacts.json")
+  check!(contacts_json.file?, "public contacts JSON missing from export")
+  contacts = JSON.parse(contacts_json.read)
+  check!(contacts.is_a?(Array) && !contacts.empty?, "public contacts JSON should be a non-empty array")
+  contacts.each do |contact|
+    href = contact.is_a?(Hash) ? contact["href"].to_s : ""
+    check!(
+      !href.start_with?("mailto:"),
+      "data/contacts.json still exports a mailto contact (#{href})"
+    )
+  end
+  check!(
+    !contacts_json.read.match?(/mailto:|@gmail\.com/i),
+    "data/contacts.json still contains a public email address"
+  )
+
+  print_header = REPO_ROOT.join("_includes/cv/cv-print-header.html")
+  check!(print_header.file?, "missing private CV print header")
+  check!(
+    print_header.read.include?("mailto:"),
+    "private CV print header must keep mailto for recruiter PDFs"
+  )
+
+  leaked_blob = out.glob("**/*.json").map(&:read).join("\n")
+  jobs_with_private.each do |source|
+    front_matter, = split_front_matter(source.read)
+    PRIVATE_JOB_FIELDS.each do |field|
+      snippet = front_matter[field].to_s.strip.lines.map(&:strip).reject(&:empty?).find { |line| line.length >= 40 }
+      next if snippet.nil?
+
+      check!(
+        !leaked_blob.include?(snippet),
+        "#{source.basename} #{field} still appears in public JSON (#{snippet[0, 80]}…)"
+      )
+    end
+  end
+end
+
+existing = ARGV[0]
+if existing
+  out = Pathname.new(existing).expand_path
+  check!(out.directory?, "export dir missing: #{out}")
+  check_export!(out, jobs_with_private)
+else
+  Dir.mktmpdir("public-cv-export-") do |dir|
+    out = Pathname.new(dir).join("export")
+    run_export!(out)
+    check_export!(out, jobs_with_private)
+  end
+end
+
+puts "Public CV export redaction OK"

data/scripts/test/test-r2-config-consistency.rb

@@ -0,0 +1,57 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+$stdout.sync = true
+$stderr.sync = true
+
+require "pathname"
+require_relative "../lib/content_storage_config"
+
+REPO_ROOT = ContentStorageConfig.repo_root
+REDIRECTS_FILE = REPO_ROOT.join("_redirects")
+STUDIO_FILE = REPO_ROOT.join("studio/index.html")
+EXPORT_SCRIPT = REPO_ROOT.join("scripts/content/export-content-json.rb")
+
+def fail!(message)
+  raise message
+end
+
+def check!(condition, message)
+  fail!(message) unless condition
+end
+
+base = ContentStorageConfig.base_url
+check!(base && !base.empty?, "_config.yml content_api_base_url must be set")
+
+legacy_host = ContentStorageConfig::LEGACY_GCS_HOST
+[
+  ["_config.yml", ContentStorageConfig.config_path.read],
+  ["_redirects", REDIRECTS_FILE.read],
+  ["studio/index.html", STUDIO_FILE.read],
+  ["scripts/content/export-content-json.rb", EXPORT_SCRIPT.read]
+].each do |label, text|
+  check!(!text.include?(legacy_host),
+         "#{label} still references GCS (#{legacy_host})")
+end
+
+if ContentStorageConfig.placeholder?(base)
+  puts "SKIP: R2 URL alignment checks (content_api_base_url is still placeholder: #{base})"
+  puts "      Fill the URL per docs/ops/cloudflare.md before production cutover."
+  exit 0
+end
+
+redirects = REDIRECTS_FILE.read
+media_line = redirects.lines.find { |line| line.start_with?("/media/*") }
+check!(media_line, "_redirects must define /media/* → R2")
+check!(media_line.include?(base),
+       "/media/* redirect must use content_api_base_url (#{base}); got: #{media_line.strip}")
+
+studio = STUDIO_FILE.read
+# Self-hosted Studio SPA: media is HTTPS or /media/* (redirected via _redirects).
+# Do not require a Decap-era CONTENT_MEDIA_BASE constant in index.html.
+check!(!studio.match?(%r{storage\.googleapis\.com|googleapis\.com/storage}),
+       "studio/index.html must not hardcode a GCS media host")
+check!(!studio.include?(legacy_host),
+       "studio/index.html must not reference legacy GCS host")
+
+puts "R2 config consistency OK (#{base})"

data/scripts/test/test-r2-json-sync.rb

@@ -0,0 +1,193 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Checksum skip planner for R2 JSON publish. No live credentials.
+
+$stdout.sync = true
+$stderr.sync = true
+
+require "digest"
+require "fileutils"
+require "json"
+require "open3"
+require "pathname"
+require "tmpdir"
+
+require_relative "../lib/r2_json_sync"
+require_relative "../lib/writing_index_contract"
+
+REPO_ROOT = Pathname.new(__dir__).join("..", "..").expand_path
+EXPORT_SCRIPT = REPO_ROOT.join("scripts/content/export-content-json.rb")
+
+def fail!(message)
+  warn message
+  exit 1
+end
+
+def check!(condition, message)
+  fail!(message) unless condition
+end
+
+def md5(text)
+  Digest::MD5.hexdigest(text)
+end
+
+puts "Testing R2 JSON checksum skip planner..."
+
+check!(!R2JsonSync.skip_upload?(nil, "abc"), "missing etag must upload")
+check!(!R2JsonSync.skip_upload?("", "abc"), "blank etag must upload")
+check!(!R2JsonSync.skip_upload?("abc-2", "abc"), "multipart etag must upload")
+check!(!R2JsonSync.skip_upload?('"abc-2"', "abc"), "quoted multipart etag must upload")
+check!(R2JsonSync.skip_upload?("abc", "abc"), "matching md5 must skip")
+check!(R2JsonSync.skip_upload?("ABC", "abc"), "etag compare is case-insensitive")
+check!(R2JsonSync.skip_upload?('"abc"', "abc"), "quoted etag must still skip")
+check!(!R2JsonSync.skip_upload?("abc", "def"), "hash mismatch must upload")
+check!(
+  !R2JsonSync.skip_upload?("abc", "abc", key: "data/writing_index.json"),
+  "writing_index.json must always upload"
+)
+
+listed = R2JsonSync.contents_to_etags([
+  { "Key" => "collections/articles/a.json", "ETag" => '"aaa"' },
+  { "Key" => "collections/", "ETag" => '"dir"' },
+  { "Key" => "", "ETag" => '"empty"' }
+])
+check!(listed == { "collections/articles/a.json" => "aaa" }, "list contents keep file keys only")
+
+plan = R2JsonSync.plan(
+  [
+    { "key" => "collections/articles/a.json", "md5" => "aaa" },
+    { "key" => "collections/articles/b.json", "md5" => "bbb" },
+    { "key" => "data/writing_index.json", "md5" => "idx" }
+  ],
+  {
+    "collections/articles/a.json" => "aaa",
+    "collections/articles/b.json" => "old-b",
+    "collections/articles/gone.json" => "zzz",
+    "data/writing_index.json" => "idx"
+  }
+)
+check!(plan["upload"] == ["collections/articles/b.json", "data/writing_index.json"],
+       "mismatch + writing_index upload (got #{plan['upload'].inspect})")
+check!(plan["skip"] == ["collections/articles/a.json"], "unchanged A must skip (got #{plan['skip'].inspect})")
+check!(plan["delete"] == ["collections/articles/gone.json"], "extra remote key must delete")
+
+summary = R2JsonSync.summary_line("collections", plan)
+check!(summary.include?("uploaded=2"), "summary uploaded count (#{summary})")
+check!(summary.include?("skipped=1"), "summary skipped count (#{summary})")
+check!(summary.include?("deleted=1"), "summary deleted count (#{summary})")
+
+puts "  planner OK"
+
+puts "Testing export A → sync → change A → incremental export → small upload..."
+
+Dir.mktmpdir("r2-json-sync-") do |dir|
+  root = Pathname.new(dir)
+  content = root.join("content")
+  export = root.join("export")
+  FileUtils.mkdir_p(content.join("collections/articles"))
+
+  write_article = lambda do |stem, title, body|
+    content.join("collections/articles/#{stem}.md").write(<<~MARKDOWN)
+      ---
+      title: #{title}
+      key: #{stem}
+      date: 2026-08-22
+      published: true
+      ---
+      #{body}
+    MARKDOWN
+  end
+
+  write_article.call("article-a", "Article A", "Body A version one.")
+  write_article.call("article-b", "Article B", "Body B stays put.")
+  %w[article-c article-d article-e article-f].each do |stem|
+    write_article.call(stem, stem, "Unchanged body for #{stem}.")
+  end
+
+  run_export = lambda do |changed_paths|
+    env = {
+      "CONTENT_API_BASE_URL" => "",
+      "CONTENT_EXPORT_SKIP_VALIDATE" => "1"
+    }
+    env["CONTENT_EXPORT_CHANGED_PATHS"] = changed_paths.join("\n") unless changed_paths.empty?
+    stdout, stderr, status = Open3.capture3(
+      env,
+      "ruby", EXPORT_SCRIPT.to_s, content.to_s, export.to_s,
+      chdir: REPO_ROOT.to_s
+    )
+    fail!("export failed:\n#{stderr}\n#{stdout}") unless status.success?
+
+    stdout
+  end
+
+  first = run_export.call([])
+  check!(first.include?("changed="), "first export missing write summary")
+
+  a_path = export.join("collections/articles/2026-08-22-article-a.json")
+  b_path = export.join("collections/articles/2026-08-22-article-b.json")
+  check!(a_path.file?, "missing exported A")
+  check!(b_path.file?, "missing exported B")
+
+  remote = {}
+  apply_plan = lambda do |planned|
+    planned["upload"].each do |key|
+      local = export.join(key)
+      body = local.binread
+      remote[key] = { "body" => body, "etag" => md5(body) }
+    end
+    planned["delete"].each { |key| remote.delete(key) }
+  end
+
+  local_files = lambda do
+    export.find.select(&:file?).filter_map do |path|
+      rel = path.relative_path_from(export).to_s
+      next if rel == "manifest.json"
+
+      { "key" => rel, "md5" => md5(path.binread) }
+    end
+  end
+
+  first_plan = R2JsonSync.plan(local_files.call, {})
+  check!(first_plan["skip"].empty?, "empty remote must upload everything")
+  apply_plan.call(first_plan)
+  remote_b_before = remote["collections/articles/2026-08-22-article-b.json"]["body"]
+
+  write_article.call("article-a", "Article A", "Body A version two — only this file changed.")
+  sleep 1
+  second = run_export.call(["content/collections/articles/article-a.md"])
+  check!(second.match?(/unchanged=[1-9]/), "incremental re-export should reuse B (#{second})")
+
+  check!(b_path.binread == remote_b_before,
+         "incremental export must leave B bytes unchanged")
+
+  second_plan = R2JsonSync.plan(
+    local_files.call,
+    remote.transform_values { |item| item["etag"] }
+  )
+  uploaded = second_plan["upload"]
+  skipped = second_plan["skip"]
+  check!(uploaded.length < skipped.length,
+         "second sync should upload fewer than it skips (upload=#{uploaded.length} skip=#{skipped.length} upload=#{uploaded.inspect})")
+  check!(uploaded.include?("collections/articles/2026-08-22-article-a.json"),
+         "changed A must upload")
+  check!(uploaded.include?("data/writing_index.json"),
+         "writing_index must upload after A changes")
+  check!(!uploaded.include?("collections/articles/2026-08-22-article-b.json"),
+         "unchanged B must not upload")
+  check!(skipped.include?("collections/articles/2026-08-22-article-b.json"),
+         "unchanged B must be skipped")
+
+  apply_plan.call(second_plan)
+  check!(remote["collections/articles/2026-08-22-article-b.json"]["body"] == remote_b_before,
+         "remote B body must stay unchanged")
+
+  WritingIndexContract.assert_slugs_match_export!(export)
+  index = JSON.parse(export.join("data/writing_index.json").read)
+  a_entry = index.find { |entry| entry["key"] == "article-a" }
+  check!(!a_entry.nil?, "writing_index must include article-a")
+  check!(export.join("collections/articles/#{a_entry['slug']}.json").file?,
+         "Freshy-like dated slug must match an exported JSON file")
+end
+
+puts "R2 JSON sync skip logic OK"

data/scripts/test/test-registry-home.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# Refs: PLT-AC-3 — homepage bands derive from the registry.
+require "pathname"
+require "yaml"
+
+ROOT = Pathname.new(__dir__).join("../..").expand_path
+$LOAD_PATH.unshift(ROOT.join("lib").to_s)
+require "pandorga/registry"
+
+config = YAML.safe_load(ROOT.join("examples/full/_config.yml").read, aliases: true)
+pages = PandorgaRegistry.pages(config)
+bands = PandorgaRegistry.home_bands(pages)
+
+kinds = bands.map { |b| b["kind"] }
+unless kinds == %w[portfolio articles blog index]
+  warn "FAIL test-registry-home: unexpected band kinds #{kinds.inspect}"
+  exit 1
+end
+
+index = bands.find { |b| b["kind"] == "index" }
+panel_keys = index["pages"].map { |p| p["key"] }
+unless panel_keys == %w[resources network bibliography]
+  warn "FAIL test-registry-home: index panels #{panel_keys.inspect}"
+  exit 1
+end
+
+layout = PandorgaRegistry.layout_for({ "template" => "portfolio" })
+unless layout == "projects"
+  warn "FAIL test-registry-home: portfolio layout expected projects, got #{layout}"
+  exit 1
+end
+
+puts "PASS test-registry-home"

data/scripts/test/test-runtime-js-syntax.rb

@@ -0,0 +1,64 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# The content runtime is assembled from a dozen Liquid partials into one
+# inline <script>. A syntax error in any partial takes down every listing and
+# detail view at once, and no Ruby gate would notice: the build succeeds and
+# the page ships broken. Parse the assembled script the way a browser would.
+
+require "pathname"
+require "open3"
+require "tmpdir"
+
+REPO_ROOT = Pathname.new(__dir__).join("..", "..").expand_path
+SITE_ROOT = REPO_ROOT.join("_site")
+
+# One page per distinct runtime assembly. They all include the same partials
+# today, but a layout could include a subset tomorrow.
+CANDIDATES = [
+  "pages/articles/index.html",
+  "pages/blog/index.html",
+  "pages/projects/index.html",
+  "index.html"
+].freeze
+
+RUNTIME_PATTERN = /window\.ContentRuntime = \(function \(\) \{.*?\n  \}\)\(\);/m
+
+def fail!(message)
+  warn message
+  exit 1
+end
+
+puts "Testing content runtime JS syntax..."
+
+unless SITE_ROOT.directory?
+  puts "  skipped: no _site build to inspect"
+  exit 0
+end
+
+checked = 0
+
+Dir.mktmpdir do |tmp|
+  CANDIDATES.each do |relative|
+    page = SITE_ROOT.join(relative)
+    next unless page.file?
+
+    match = page.read.match(RUNTIME_PATTERN)
+    next if match.nil?
+
+    script = Pathname.new(tmp).join("#{relative.tr('/', '-')}.js")
+    script.write(match[0])
+
+    _out, err, status = Open3.capture3("node", "--check", script.to_s)
+    unless status.success?
+      fail!("#{relative}: content runtime is not valid JavaScript\n#{err}")
+    end
+
+    checked += 1
+    puts "  #{relative}: OK (#{match[0].bytesize} bytes)"
+  end
+end
+
+fail!("no page contained a ContentRuntime block — did the runtime stop inlining?") if checked.zero?
+
+puts "All content runtime JS syntax tests passed (#{checked} page(s))."

data/scripts/test/test-slim-writing-index.rb

@@ -0,0 +1,126 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Gate: xcite resolution must use the slim writing_index, not bulk loadCollection
+# of articles/posts/products/projects. Spec: GitHub issue #364.
+
+require "json"
+require "open3"
+require "pathname"
+require "tmpdir"
+
+require_relative "../lib/writing_index_contract"
+
+REPO_ROOT = Pathname.new(__dir__).join("..", "..").expand_path
+EXPORT_SCRIPT = REPO_ROOT.join("scripts/content/export-content-json.rb")
+XCITE_INCLUDE = REPO_ROOT.join("_includes/content-runtime/30-includes-xcite.html")
+FRAGMENTS_INCLUDE = REPO_ROOT.join("_includes/content-runtime/60-fragments.html")
+LISTING_INCLUDE = REPO_ROOT.join("_includes/content-runtime/40-listing.html")
+BLOG_LAYOUT = REPO_ROOT.join("_layouts/blog.html")
+ARTICLES_LAYOUT = REPO_ROOT.join("_layouts/articles.html")
+
+def fail!(message)
+  warn message
+  exit 1
+end
+
+def check!(condition, message)
+  fail!(message) unless condition
+end
+
+puts "Testing slim writing index / xcite fetch contract..."
+
+xcite_src = XCITE_INCLUDE.read
+check!(xcite_src.include?("data/writing_index.json"),
+       "ensureXciteIndex must load data/writing_index.json")
+check!(!xcite_src.match?(/loadCollection\(\s*['"]collections\/(articles|posts)/),
+       "ensureXciteIndex must not call loadCollection for articles/posts")
+check!(!xcite_src.match?(/loadCollection\(\s*['"]collections\/(products|projects)/),
+       "ensureXciteIndex must not call loadCollection for products/projects")
+
+fragments_src = FRAGMENTS_INCLUDE.read
+check!(fragments_src.include?("jsonCache"),
+       "loadJson must memoize in-memory")
+check!(fragments_src.include?("function loadWritingIndex"),
+       "runtime must expose loadWritingIndex for listing shells")
+check!(fragments_src.include?("excerpt: entry.excerpt"),
+       "writingIndexAsListingItem must pass excerpt through to listing cards")
+
+listing_src = LISTING_INCLUDE.read
+check!(listing_src.include?("function listingPreview"),
+       "runtime must expose listingPreview so cards can fall back to excerpts")
+
+[BLOG_LAYOUT, ARTICLES_LAYOUT].each do |layout|
+  check!(layout.read.include?("listingPreview"),
+         "#{layout.relative_path_from(REPO_ROOT)} cards must use listingPreview")
+end
+
+Dir.mktmpdir("writing-index-") do |tmp|
+  out_dir = Pathname.new(tmp)
+  stdout, stderr, status = Open3.capture3(
+    { "CONTENT_API_BASE_URL" => "" },
+    "ruby", EXPORT_SCRIPT.to_s, "content", out_dir.to_s,
+    chdir: REPO_ROOT.to_s
+  )
+  fail!("export-content-json.rb failed:\n#{stderr}\n#{stdout}") unless status.success?
+
+  index_path = out_dir.join("data/writing_index.json")
+  check!(index_path.file?, "export must write data/writing_index.json")
+
+  entries = JSON.parse(index_path.read)
+  check!(entries.is_a?(Array) && !entries.empty?, "writing_index must be a non-empty array")
+
+  required = %w[key slug title url type collection date xcites category description excerpt thumbnail aliases]
+  sample = entries.first
+  required.each do |field|
+    check!(sample.key?(field), "writing_index entries must include #{field}")
+  end
+
+  types = entries.map { |e| e["collection"] || e["type"] }.uniq
+  %w[articles posts products projects].each do |collection|
+    check!(types.include?(collection),
+           "writing_index must cover #{collection} (got #{types.inspect})")
+  end
+
+  posts = entries.select { |entry| (entry["collection"] || entry["type"]) == "posts" }
+  check!(!posts.empty?, "writing_index must include posts")
+  post_without_description = posts.find { |entry| entry["description"].to_s.strip.empty? }
+  check!(!post_without_description.nil?, "expected at least one post with an empty editorial description")
+  excerpt = post_without_description["excerpt"].to_s.strip
+  check!(!excerpt.empty?, "posts without description must still export a body excerpt")
+  check!(excerpt.length <= 220, "excerpt must stay within the listing preview limit")
+
+  article = entries.find { |entry| (entry["collection"] || entry["type"]) == "articles" && !entry["description"].to_s.strip.empty? }
+  check!(!article.nil?, "expected an article with an editorial description")
+  check!(!article["excerpt"].to_s.strip.empty?, "articles must still export a body excerpt alongside description")
+
+  WritingIndexContract.assert_slugs_match_export!(out_dir, entries)
+  freshy = entries.find { |entry| entry["key"] == "freshy-cooling-map" }
+  if freshy
+    check!(out_dir.join("collections/articles/#{freshy['slug']}.json").file?,
+           "Freshy writing_index slug must match collections/articles/#{freshy['slug']}.json")
+  end
+
+  expected_aliases = {
+    "ai-agents-sdd" => "ai-agents-sdd",
+    "vibe-coding" => "2026-03-24-where-to-do-vibe-coding",
+    "wsl" => "20260224-wsl",
+    "stitch-and-claude" => "stitch-and-claude"
+  }
+  expected_aliases.each do |key, alias_slug|
+    entry = entries.find { |item| item["key"] == key }
+    check!(!entry.nil?, "writing_index must include #{key}")
+    aliases = Array(entry["aliases"])
+    check!(aliases.include?(alias_slug),
+           "#{key} writing_index aliases must include #{alias_slug} (got #{aliases.inspect})")
+  end
+end
+
+check!(FRAGMENTS_INCLUDE.read.include?("function resolveWritingAlias"),
+       "runtime must resolve old slugs from writing_index aliases")
+check!(ARTICLES_LAYOUT.read.include?("resolveWritingAlias"),
+       "articles shell must resolve writing_index aliases before loading JSON")
+check!(ARTICLES_LAYOUT.read.include?("adoptCanonicalDetailUrl"),
+       "articles shell must replaceState to the canonical URL when an alias matches")
+
+puts "All slim writing index / xcite fetch checks passed."