@nextcommerce/campaigns-os 1.46.0 → 1.48.0

package/skills.json

@@ -1,7 +1,7 @@
 {
   "name": "campaigns-os-skills",
   "description": "Skills bundled with Campaigns OS. `skills.sh` installs these into the shared agent skill directories (~/.claude/skills, ~/.codex/skills), so each one is a versioned package: bump the version whenever a package changes. `bundle_revision` identifies the bundle as a whole — `<package version>+skills.<n>`, where the prefix is this package's version and `<n>` counts the skill-text revisions published against it. It advances whenever ANY bundled skill changes, every SKILL.md states it on its first body line, and `campaigns-os tooling status --skills-revision <value>` compares the value an agent read from a skill against the bundle on disk. See docs/skills-revision.md.",
-  "bundle_revision": "1.46.0+skills.1",
+  "bundle_revision": "1.48.0+skills.1",
   "homepage": "https://github.com/NextCommerceCo/campaigns-os",
   "retired_skills": [
     {
@@ -16,7 +16,7 @@
     {
       "id": "next-campaigns-os",
       "name": "Campaigns OS Lifecycle",
-      "version": "1.0.37",
+      "version": "1.0.42",
       "path": "skills/next-campaigns-os/SKILL.md",
       "domain": "campaigns",
       "description": "Coordinate Campaigns OS lifecycle workflows from CampaignSpec, Build Packet, starter-template contracts, stage reports, deploy evidence, and QA proof depth."
@@ -24,7 +24,7 @@
     {
       "id": "next-campaigns-os-setup",
       "name": "Campaigns OS Setup",
-      "version": "2.0.20",
+      "version": "2.0.25",
       "path": "skills/next-campaigns-os-setup/SKILL.md",
       "domain": "campaigns",
       "description": "Bootstrap or prepare a target page-kit campaign repo from a doctor-cleared Campaigns OS Build Packet before full build wiring. Formerly next-campaigns-setup; renamed to release that name to the published NextCommerceCo/skills scaffolder."
@@ -32,7 +32,7 @@
     {
       "id": "next-campaigns-build",
       "name": "Campaign Build",
-      "version": "1.0.22",
+      "version": "1.0.27",
       "path": "skills/next-campaigns-build/SKILL.md",
       "domain": "campaigns",
       "description": "Assemble a NEXT campaign from a doctor-cleared Build Packet, CampaignSpec/API values, prepared HTML/assets, page-kit, and starter-template contracts."
@@ -40,7 +40,7 @@
     {
       "id": "next-campaigns-polish",
       "name": "Campaign Polish",
-      "version": "1.1.21",
+      "version": "1.1.26",
       "path": "skills/next-campaigns-polish/SKILL.md",
       "domain": "campaigns",
       "description": "Run the visual/runtime polish pass after build and before QA for a Campaigns OS campaign."
@@ -48,7 +48,7 @@
     {
       "id": "next-campaigns-qa",
       "name": "Campaign QA",
-      "version": "1.3.21",
+      "version": "1.3.26",
       "path": "skills/next-campaigns-qa/SKILL.md",
       "domain": "campaigns",
       "description": "Run spec-aware QA from a saved Map or local-spec Build Packet and tested campaign URL after build, polish, and deploy/local evidence exist, including Playwright typed-card test-order proof."
@@ -56,7 +56,7 @@
     {
       "id": "campaign-lifecycle-orientation",
       "name": "Campaign Lifecycle Orientation",
-      "version": "1.0.17",
+      "version": "1.0.22",
       "path": "skills/campaign-lifecycle-orientation/SKILL.md",
       "domain": "campaigns",
       "description": "Orient a reader to the Campaigns OS lifecycle artifacts a run has already emitted, without advancing their state: the shared vocabulary, doctor as a gate, the stage record, and the store-theme/Page Kit two-worlds trap."
@@ -64,7 +64,7 @@
     {
       "id": "campaign-run-evidence",
       "name": "Campaign Run Evidence",
-      "version": "1.0.17",
+      "version": "1.0.22",
       "path": "skills/campaign-run-evidence/SKILL.md",
       "domain": "campaigns",
       "description": "Interpret existing doctor, QA verdict and proof-depth evidence without claiming more proof than the artifacts contain, and keep funnel proof apart from merchant launch readiness."
@@ -72,7 +72,7 @@
     {
       "id": "campaign-readback-classification",
       "name": "Campaign Readback Classification",
-      "version": "1.0.17",
+      "version": "1.0.22",
       "path": "skills/campaign-readback-classification/SKILL.md",
       "domain": "campaigns",
       "description": "Classify a selected campaign from the campaigns-os-readback/v2 fields (artifacts, staleness.stale_keys, clean, doctor, divergences, skip_cascades) and write a read-only handoff without turning diagnosis into permission."
@@ -80,7 +80,7 @@
     {
       "id": "contribution-intake",
       "name": "Contribution Intake",
-      "version": "1.0.17",
+      "version": "1.0.22",
       "path": "skills/contribution-intake/SKILL.md",
       "domain": "campaigns",
       "description": "Turn a suggestion about the agent surface into a classified, evidence-checked and redacted proposal, filed on this repository tracker only with attended approval."

package/src/built-script-syntax.mjs

@@ -17,10 +17,17 @@
 // nothing it would define runs, but whether the page needs it is not known
 // here, so it does not block.
 //
+// Two shapes are not read and only warn (#515). A `<script>` left unclosed at
+// the end of the file never runs: the browser does not prepare a script
+// element whose end tag never arrives. And a script that is a symlink, or
+// sits under a symlinked directory, resolving outside the site root: a static
+// server would follow it, but its bytes are not part of the built output. A
+// symlink that stays inside the site root is read where it points.
+//
 // Not waivable: a script that cannot be parsed cannot be intended to ship.
 // Both doctor entry points drive it, like the other static built-output gates.
 
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { basename, isAbsolute, posix, relative, resolve, sep } from "node:path";
 
 import { parse as parseJs } from "acorn";
@@ -29,6 +36,8 @@ import { parse as parseHtml } from "parse5";
 export const SCRIPT_SYNTAX = "built_output.script_syntax";
 export const SCRIPT_SYNTAX_PARSE_FAILURE = `${SCRIPT_SYNTAX}.parse_failure`;
 export const SCRIPT_SYNTAX_MISSING_SCRIPT = `${SCRIPT_SYNTAX}.missing_script`;
+export const SCRIPT_SYNTAX_UNCLOSED_SCRIPT = `${SCRIPT_SYNTAX}.unclosed_script`;
+export const SCRIPT_SYNTAX_SYMLINK_OUTSIDE_SITE = `${SCRIPT_SYNTAX}.symlink_outside_site`;
 
 // Classic script MIME types the browser executes. Anything else with a type
 // attribute (JSON-LD, text/template, importmap) is a data block, not script.
@@ -200,6 +209,17 @@ export function baseInEffect(bases, scriptNode) {
   return base ? base.href : null;
 }
 
+/**
+ * Whether the file ended inside this parse5 element, before its end tag. The
+ * parser prepares a script at its end tag; at end of file it marks the element
+ * "already started" instead, so the browser never fetches or runs it.
+ *
+ * @param {object} node a parse5 element parsed with `sourceCodeLocationInfo`
+ */
+export function endsUnclosed(node) {
+  return Boolean(node?.sourceCodeLocation) && !node.sourceCodeLocation.endTag;
+}
+
 /**
  * `<script src>` references on a page, in document order, with whether each
  * is a module and the `<base href>` in effect when the browser prepares it
@@ -215,16 +235,21 @@ export function baseInEffect(bases, scriptNode) {
  * load there. A module script ignores `nomodule` and is kept (see scriptKind).
  * Template content and noscript are inert and not walked.
  *
+ * A script element the file ends inside (its end tag never arrives) is never
+ * prepared, so it never runs and is not a reference. It is returned in
+ * `unclosed` instead: its src, or null for an inline script.
+ *
  * @param {string} html
- * @returns {{ base: string | null, refs: Array<{ src: string, module: boolean, base: string | null }> }}
+ * @returns {{ base: string | null, refs: Array<{ src: string, module: boolean, base: string | null }>, unclosed: Array<{ src: string | null }> }}
  */
 export function pageScriptDocument(html) {
   const refs = [];
+  const unclosed = [];
   let document;
   try {
     document = parseHtml(String(html ?? ""), { sourceCodeLocationInfo: true });
   } catch {
-    return { base: null, refs };
+    return { base: null, refs, unclosed };
   }
   const bases = documentBases(document);
   const walk = (node) => {
@@ -233,9 +258,12 @@ export function pageScriptDocument(html) {
     // href / xlink:href, and a MathML "script" is not a script element.
     if (node.tagName === "script" && node.namespaceURI === HTML_NAMESPACE) {
       const kind = scriptKind(attrs);
+      const hasSrc = typeof attrs.src === "string" && attrs.src !== "";
+      if (kind && endsUnclosed(node)) {
+        unclosed.push({ src: hasSrc ? stripUrlSpace(attrs.src) : null });
       // "prepare the script element" skips only an empty src; anything else,
       // even whitespace, is parsed as a URL and fetched.
-      if (kind && typeof attrs.src === "string" && attrs.src !== "") {
+      } else if (kind && hasSrc) {
         refs.push({ src: stripUrlSpace(attrs.src), module: kind === "module", base: baseInEffect(bases, node) });
       }
     }
@@ -243,7 +271,7 @@ export function pageScriptDocument(html) {
     for (const child of node.childNodes || []) walk(child);
   };
   walk(document);
-  return { base: bases[0]?.href ?? null, refs };
+  return { base: bases[0]?.href ?? null, refs, unclosed };
 }
 
 /**
@@ -317,6 +345,15 @@ function isRemote(src) {
   return /^[a-z][a-z0-9+.-]*:/i.test(src) || src.startsWith("//");
 }
 
+// The real path of a file, or null when it cannot be resolved.
+function realPathOf(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return null;
+  }
+}
+
 function relFrom(root, path) {
   const rel = relative(root, path);
   return rel && !rel.startsWith("..") ? rel.split(sep).join("/") : path;
@@ -334,13 +371,23 @@ function relFrom(root, path) {
  * emits `/js/...`), never outside either. A base or src on another origin is
  * remote and not read.
  *
+ * Missing scripts are keyed by the URL the browser resolves, so two spellings
+ * of one URL (`check&#9;out.js`, `checkout.js`) are one entry, under the first
+ * spelling met. A path whose real path leaves the site root (a symlinked file
+ * or directory pointing elsewhere) is not read and is listed in
+ * `outside_site` by the link's own path. A page that ends inside a script
+ * element is listed in `unclosed`.
+ *
  * @param {{ site_root: string, campaign_dir: string, pages: Array<{ page_id: string, built_path: string }> }} scope
  * @param {string} targetRepo
  */
 export function collectBuiltScriptSyntaxInputs(scope, targetRepo) {
   const scripts = new Map();
   const unresolved = new Map();
+  const outsideSite = new Map();
+  const unclosed = [];
   const pages = Array.isArray(scope?.pages) ? scope.pages : [];
+  const siteRootReal = scope?.site_root ? realPathOf(scope.site_root) : null;
   for (const page of pages) {
     let html;
     try {
@@ -348,9 +395,12 @@ export function collectBuiltScriptSyntaxInputs(scope, targetRepo) {
     } catch {
       continue;
     }
-    const { refs } = pageScriptDocument(html);
+    const document = pageScriptDocument(html);
+    // One entry per page: the file ends inside at most one script, and the
+    // warning is about the page's truncated output.
+    if (document.unclosed.length) unclosed.push({ src: document.unclosed[0].src, pages: [page.page_id] });
     const pageUrl = pageUrlFor(scope.site_root, page.built_path);
-    for (const ref of refs) {
+    for (const ref of document.refs) {
       if (isRemote(ref.src)) continue;
       const { remote, pathname } = resolveScriptUrl(ref.src, ref.base, pageUrl);
       if (remote) continue;
@@ -366,9 +416,21 @@ export function collectBuiltScriptSyntaxInputs(scope, targetRepo) {
         isFile = false;
       }
       if (!isFile) {
-        const entry = unresolved.get(ref.src) || { src: ref.src, pages: [] };
+        const urlKey = pathname ?? `\u0000${ref.src}`;
+        const entry = unresolved.get(urlKey) || { src: ref.src, pages: [] };
         if (!entry.pages.includes(page.page_id)) entry.pages.push(page.page_id);
-        unresolved.set(ref.src, entry);
+        unresolved.set(urlKey, entry);
+        continue;
+      }
+      // Read where a static server would serve it, but only while the real
+      // path stays inside the site root. When either real path is unknown the
+      // check is undecidable, and the script is read as before.
+      const real = realPathOf(path);
+      if (siteRootReal && real && real !== siteRootReal && !real.startsWith(`${siteRootReal}${sep}`)) {
+        const file = relFrom(targetRepo, resolve(path));
+        const entry = outsideSite.get(file) || { file, src: ref.src, pages: [] };
+        if (!entry.pages.includes(page.page_id)) entry.pages.push(page.page_id);
+        outsideSite.set(file, entry);
         continue;
       }
       const key = `${resolve(path)}\u0000${ref.module ? "module" : "script"}`;
@@ -386,7 +448,13 @@ export function collectBuiltScriptSyntaxInputs(scope, targetRepo) {
       if (!entry.pages.includes(page.page_id)) entry.pages.push(page.page_id);
     }
   }
-  return { pages_scanned: pages.length, scripts: [...scripts.values()], unresolved: [...unresolved.values()] };
+  return {
+    pages_scanned: pages.length,
+    scripts: [...scripts.values()],
+    unresolved: [...unresolved.values()],
+    outside_site: [...outsideSite.values()],
+    unclosed,
+  };
 }
 
 function gateBase(subject) {
@@ -405,11 +473,16 @@ function gateBase(subject) {
  *
  * @param {{ subject?: object, pages_scanned?: number,
  *   scripts?: Array<{ file: string, module?: boolean, content: string, pages?: string[] }>,
- *   unresolved?: Array<{ src: string, pages: string[] }> }} input
+ *   unresolved?: Array<{ src: string, pages: string[] }>,
+ *   outside_site?: Array<{ file: string, src: string, pages: string[] }>,
+ *   unclosed?: Array<{ src: string | null, pages: string[] }> }} input
  */
-export function evaluateBuiltScriptSyntax({ subject, pages_scanned: pagesScanned = 0, scripts = [], unresolved = [] } = {}) {
+export function evaluateBuiltScriptSyntax({ subject, pages_scanned: pagesScanned = 0, scripts = [], unresolved = [], outside_site: outsideSite = [], unclosed = [] } = {}) {
   const list = Array.isArray(scripts) ? scripts : [];
   const missing = Array.isArray(unresolved) ? unresolved : [];
+  const outside = Array.isArray(outsideSite) ? outsideSite : [];
+  const open = Array.isArray(unclosed) ? unclosed : [];
+  const onPages = (pages) => (pages.length ? ` on ${pages.join(", ")}` : "");
   // A local script the page loads that is not in the built output: a 404 at
   // runtime. A warning, not a blocker (#502).
   const warned = missing.map((entry) => {
@@ -418,11 +491,39 @@ export function evaluateBuiltScriptSyntax({ subject, pages_scanned: pagesScanned
       code: SCRIPT_SYNTAX_MISSING_SCRIPT,
       src: entry.src,
       pages,
-      message: `${entry.src} is loaded by a local <script src>${pages.length ? ` on ${pages.join(", ")}` : ""} but is not in the built output. The browser gets a 404 for it and nothing it would define runs. Add the file to the build, or remove the reference if the page does not need it.`,
+      message: `${entry.src} is loaded by a local <script src>${onPages(pages)} but is not in the built output. The browser gets a 404 for it and nothing it would define runs. Add the file to the build, or remove the reference if the page does not need it.`,
     };
   });
-  const missingNote = warned.length ? ` ${warned.length} referenced local script(s) are not in the built output.` : "";
-  const common = { scripts_unresolved: missing, warned, pages_scanned: pagesScanned };
+  // A script symlink whose target is outside the site root (#515): not read,
+  // and named by the link, never by where it points.
+  for (const entry of outside) {
+    const pages = Array.isArray(entry.pages) ? entry.pages : [];
+    warned.push({
+      code: SCRIPT_SYNTAX_SYMLINK_OUTSIDE_SITE,
+      file: entry.file,
+      src: entry.src,
+      pages,
+      message: `${entry.file} is loaded by a local <script src>${onPages(pages)} but is a symlink whose target is outside the site root, so its syntax was not checked. A static server may still serve it. Copy the script into the build output instead of linking to it.`,
+    });
+  }
+  // A page that ends inside a script element (#515): the browser never runs
+  // that script, so it is not parsed. The page output is probably truncated.
+  for (const entry of open) {
+    const pages = Array.isArray(entry.pages) ? entry.pages : [];
+    warned.push({
+      code: SCRIPT_SYNTAX_UNCLOSED_SCRIPT,
+      src: entry.src ?? null,
+      pages,
+      message: `${entry.src ? `The <script src="${entry.src}">` : "An inline <script>"}${onPages(pages)} is never closed: the page ends before its </script>. The browser does not run a script element whose end tag never arrives, so it was not parsed. Check the page for truncated output and rebuild.`,
+    });
+  }
+  const notes = [
+    missing.length ? ` ${missing.length} referenced local script(s) are not in the built output.` : "",
+    outside.length ? ` ${outside.length} script symlink(s) resolve outside the site root and were not read.` : "",
+    open.length ? ` ${open.length} page(s) end inside an unclosed <script>.` : "",
+  ];
+  const missingNote = notes.join("");
+  const common = { scripts_unresolved: missing, scripts_outside_site: outside, warned, pages_scanned: pagesScanned };
   if (list.length === 0) {
     return {
       ...gateBase(subject),

package/src/cli.mjs

@@ -296,15 +296,18 @@ Usage:
   campaigns-os start (--spec <json> | --map-id <id>) --source <html-dir> --target <page-kit-dir> --template-family <family>
                      [--brief <yaml|json>] [--proxy-base <url>] [--cached-spec] [--theme-policy <inspect_only|auto|off>]
                      [--wrapper-policy <strip_document_wrappers|preserve_document_wrappers|not_required|unknown>] [--design-manifest <path>]
-                     [--allow-uncertified-template "<reason>"] [--order-path-depth <off|common|full>] [--no-run-session] [--force]   # --force overwrites an assembly report that carries stage evidence (destructive; prints the cleared stage keys) and regenerates a stale Design Source Package an earlier intake synthesized and nobody changed
+                     [--allow-uncertified-template "<reason>"] [--order-path-depth <off|common|full>]
+                     [--deploy-target <target>] [--preview-url <url>] [--production-url <url>] [--no-run-session] [--force]   # --force overwrites an assembly report that carries stage evidence (destructive; prints the cleared stage keys) and regenerates a stale Design Source Package an earlier intake synthesized and nobody changed
   campaigns-os prepare-build (--spec <json> | --map-id <id>) --source <html-dir> --target <page-kit-dir> --template-family <family>
                              [--brief <yaml|json>] [--proxy-base <url>] [--cached-spec] [--theme-policy <inspect_only|auto|off>]
                              [--wrapper-policy <strip_document_wrappers|preserve_document_wrappers|not_required|unknown>] [--design-manifest <path>]
-                             [--allow-uncertified-template "<reason>"] [--order-path-depth <off|common|full>] [--no-run-session] [--force]
+                             [--allow-uncertified-template "<reason>"] [--order-path-depth <off|common|full>]
+                             [--deploy-target <target>] [--preview-url <url>] [--production-url <url>] [--no-run-session] [--force]
   campaigns-os build (--spec <json> | --map-id <id>) --source <html-dir> --target <page-kit-dir> --template-family <family>
                      [--brief <yaml|json>] [--proxy-base <url>] [--cached-spec] [--theme-policy <inspect_only|auto|off>]
                      [--wrapper-policy <strip_document_wrappers|preserve_document_wrappers|not_required|unknown>] [--design-manifest <path>]
-                     [--allow-uncertified-template "<reason>"] [--order-path-depth <off|common|full>] [--no-run-session] [--force]   # intake alias for prepare-build + doctor
+                     [--allow-uncertified-template "<reason>"] [--order-path-depth <off|common|full>]
+                     [--deploy-target <target>] [--preview-url <url>] [--production-url <url>] [--no-run-session] [--force]   # intake alias for prepare-build + doctor
   campaigns-os doctor --packet <campaign-runtime.build.json> [--context <json>] [--report <json>] [--strip-paths] [--write] [--no-write] [--doctor-out <path>] [--proxy-base <url>] [--no-live-refs] [--json]   # inspection by default; --doctor-out requires --write; --no-write wins. When the packet's built _site/<route>/ exists and a public Campaigns API key resolves (packet, its local CampaignSpec, or the declared campaign-key env var), doctor makes one read-only GET of {proxy-base}/api/campaign under X-Campaign-Key to check each built page's shipping and package refs against the live campaign; --proxy-base overrides the canonical proxy (https, or a loopback host over http). --no-live-refs skips the read and records not_run with reason disabled. No key, no built page, or a failed read records derived.live_campaign_refs as not_run with its reason. Only doctor and qa run make this read; other commands that run doctor record not_read
   campaigns-os doctor --built <page-kit-target-repo> --family <family> [--slug <slug>] [--base-url <url>] [--emit-packet [path]] [--json]   # L7: doctor a built _site/ with no Build Packet
   campaigns-os bundle check --packet <campaign-runtime.build.json> [--require-qa] [--json]   # validate the canonical migration/readback JSON bundle; never substitutes markdown

package/src/content-residue.mjs

@@ -1,23 +1,22 @@
 // Rendered-output content-residue scan + proof-attestation gate.
 //
 // Scans BUILT campaign output (_site HTML), not frontmatter: layout- or
-// script-rendered proof/urgency chrome only exists after the build, which is
-// why frontmatter-level checks missed the hardcoded rating/countdown chrome.
+// script-rendered chrome only exists after the build, which is why
+// frontmatter-level checks missed the hardcoded starter countdown chrome.
 //
-// Pattern provenance: the generic anti-pattern classes distilled from the
-// 2026-07 winning-campaign content audit (invented counts, fabricated
-// verified-buyer chrome, fictional bylines, borrowed authority, science
-// theater, scarcity theater, fake comparisons, unlinked press marquees).
-// Only GENERIC patterns and the public starter-template demo strings live
-// here; merchant-specific residue fingerprints are deliberately not carried
-// in this public package.
+// What it looks for is template residue, never the merchant's own copy: the
+// public starter-template demo strings, bracket-style demo stubs, and the
+// literal needs-merchant-input marker. Proof and urgency content the merchant
+// supplies (reviews, ratings, "Verified Purchase" labels, stock counters,
+// countdowns) is the merchant's responsibility and is not scanned. No
+// merchant-specific fingerprints are carried in this public package.
 //
-// Posture (fail closed, two tiers):
-// - hard: the literal needs-merchant-input marker, and urgency chrome
-//   rendered without verified offer urgency — blockers (collect-inputs).
-// - review: anti-pattern hits and demo/placeholder residue — warnings that
-//   feed the review/attestation queue; a hit means "remove or demand
-//   brief/source evidence", never "make it more plausible".
+// Posture (two tiers):
+// - hard: the literal needs-merchant-input marker, and starter countdown
+//   chrome on a brief-backed build whose brief does not verify the offer
+//   urgency — blockers (collect-inputs).
+// - review: demo/placeholder residue — warnings; a hit means an unreplaced
+//   demo slot or a stale template.
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
 
@@ -55,63 +54,6 @@ export const DEMO_RESIDUE_TERMS = Object.freeze([
   "Sell-Out Risk: High",
 ]);
 
-// Generic anti-pattern classes (review tier). Each id is stable so the
-// attestation/review UX can key on it.
-export const CONTENT_ANTI_PATTERNS = Object.freeze([
-  {
-    id: "invented_counts",
-    antiPattern: 1,
-    rule: "Counts/ratings/percent-recommend claims require a real, brief-sourced basis.",
-    // Count branch requires a proof-scaled number (comma groups, 4+ digits, or
-    // a trailing +) so ordinary commerce quantities ("Choose 3 pairs and
-    // save") never enter the review queue; "pairs"/"sold" dropped as nouns
-    // for the same reason. Small invented counts are a knowingly accepted gap.
-    regex: /\b(?:\d{1,3}(?:,\d{3})+|\d{4,}|\d+\+)\s+(?:reviews?|ratings?|customers?|users?|famil(?:y|ies)|wearers?|people)\b|\b(?:4\.[5-9]|5\.0)\s*(?:\/\s*5|stars?)|\b(?:9[0-9]|100)%\b[^<]{0,60}\b(?:recommend|reported|said|would)\b/i,
-  },
-  {
-    id: "verified_buyer_chrome",
-    antiPattern: 2,
-    rule: "'Verified' labels must resolve to a real approved review source.",
-    regex: /Verified\s+(?:Buyer|Customer|Purchase)|What\s+(?:Our\s+)?Customers\s+(?:Think|Say)|Real\s+(?:People|Customers)[^<]{0,20}Real\s+(?:Results|Relief)|5[- ]Star\s+Review/i,
-  },
-  {
-    id: "byline_persona",
-    antiPattern: 3,
-    rule: "Advertorial identities must be real, brief-supplied, and authorized.",
-    regex: /Mom\s+of\s+Two|Consumer\s+Report|Review\s+Team|Wellness\s+Educator|Licensed\s+(?:Physiotherapist|Professional)/i,
-  },
-  {
-    id: "borrowed_authority",
-    antiPattern: 4,
-    rule: "Expert/clinician/institution references require name, credential, permission, and source.",
-    regex: /\bDr\.\s+[A-Z]|\bM\.?D\.?\b|doctor[- ]recommended|clinically\s+(?:recognized|recommended)|expert\s+(?:says|recommends)/i,
-  },
-  {
-    id: "press_marquee",
-    antiPattern: 8,
-    rule: "Press mentions require a brief-supplied working URL for the exact merchant and product.",
-    regex: /As\s+Seen\s+(?:On|In)|Featured\s+(?:On|In)/i,
-  },
-  {
-    id: "science_theater",
-    antiPattern: 9,
-    rule: "Study/clinical/certification claims require citation metadata and approved wording.",
-    regex: /peer[- ]reviewed|science[- ]backed|backed\s+by\s+science|stud(?:y|ies)\s+(?:show|prove|confirm)|researchers\s+found|clinically\s+(?:proven|shown|tested)|NASA[- ]developed/i,
-  },
-  {
-    id: "scarcity_theater",
-    antiPattern: 10,
-    rule: "Urgency renders only from a real, approved promotion window or live inventory source.",
-    regex: /ENDS\s+AT\s+MIDNIGHT|Offer\s+Expires|Deal\s+Ending|Only\s+\d+\s+(?:Units\s+)?Left|Stock\s+(?:Levels?\s+)?Low|\d+%\s+Sold|Sell[- ]?Out\s+Risk|supplies\s+are\s+limited/i,
-  },
-  {
-    id: "fake_comparison",
-    antiPattern: 11,
-    rule: "Tested-N/showdown framing requires a brief-supplied comparison matrix and test record.",
-    regex: /(?:we\s+)?tested\s+\d+\s+(?:contenders|products|devices|gloves|combinations|brands)|only\s+one\s+(?:survived|worked|stood)|Competitor\s+[12]\b/i,
-  },
-]);
-
 const ENTITIES = new Map([
   ["&amp;", "&"], ["&lt;", "<"], ["&gt;", ">"], ["&quot;", '"'],
   ["&#39;", "'"], ["&apos;", "'"], ["&nbsp;", " "], ["&#8217;", "’"], ["&#8212;", "—"],
@@ -168,13 +110,12 @@ function excerptAt(html, index, span = 80) {
 }
 
 // Pure scan of one rendered HTML document. Returns { hard: [], review: [] };
-// each finding: { id, tier, rule?, excerpt }. Hard checks run on the markup
-// view (attributes count, comments/scripts do not); review checks run on the
-// visible-text view for precision, except exact-string demo terms and bracket
-// stubs which run on markup so attribute residue is still caught.
+// each finding: { id, tier, rule?, excerpt }. The hard checks and the demo
+// terms run on the markup view (attributes count, comments and script/style
+// bodies do not), so attribute residue is still caught; bracket stubs run on
+// the same view with tags stripped, so CSS attribute selectors never match.
 export function scanRenderedHtml(html, { urgencyVerified = false } = {}) {
   const markup = markupView(typeof html === "string" ? html : "");
-  const text = visibleText(typeof html === "string" ? html : "");
   const hard = [];
   const review = [];
 
@@ -205,19 +146,6 @@ export function scanRenderedHtml(html, { urgencyVerified = false } = {}) {
     }
   }
 
-  for (const pattern of CONTENT_ANTI_PATTERNS) {
-    if (pattern.id === "scarcity_theater" && urgencyVerified) continue;
-    const match = pattern.regex.exec(text);
-    if (match) {
-      review.push({
-        id: pattern.id,
-        tier: "review",
-        antiPattern: pattern.antiPattern,
-        rule: pattern.rule,
-        excerpt: excerptAt(text, match.index),
-      });
-    }
-  }
   return { hard, review };
 }
 

package/src/diagnostic.mjs

@@ -20,7 +20,8 @@ const REASONS = new Set([
   "built_output.upsell_selector_scope", "built_output.sdk_markup.swap_with_add_to_cart",
   "built_output.sdk_markup.checkout_not_form", "built_output.sdk_markup.wrong_field_name",
   "built_output.sdk_markup.missing_selector_id_match", "built_output.script_syntax.parse_failure",
-  "built_output.script_syntax.missing_script", "source_html.producer_provenance",
+  "built_output.script_syntax.missing_script", "built_output.script_syntax.unclosed_script",
+  "built_output.script_syntax.symlink_outside_site", "source_html.producer_provenance",
   "source_html.producer_provenance.source_type", "source_html.producer_provenance.screenshot_fallback_used",
   "source_html.producer_provenance.semantic_section_count", "source_html.producer_provenance.material_fingerprint",
   "source_html.producer_provenance.section_exports", "source_html.producer_provenance.waiver_inert",

package/src/doctor/checks.mjs

@@ -363,7 +363,7 @@ const SPEC_DOCTOR_CHECKS = createDoctorCheckRegistry([
   {
     id: PAGE_KIT_SDK_VERSION_SCOPE,
     phase: "target",
-    run: ({ spec, errors, warnings, ready, derived, buildState }) => validateTargetSdkVersion(spec, errors, warnings, ready, derived, buildState),
+    run: ({ spec, packet, errors, warnings, ready, derived, buildState }) => validateTargetSdkVersion(spec, errors, warnings, ready, derived, buildState, packet),
   },
   {
     id: PAGE_KIT_STORE_PROFILE_SCOPE,
@@ -1159,17 +1159,22 @@ function validateLocalProof(packet, report, errors, warnings, ready) {
   addIssue(errors, LOCAL_PROOF_PARITY_SCOPE, `Production parity FAILED${difference ? ` — first non-gated difference: ${singleLineField(String(difference.kind))} at ${singleLineField(String(difference.route))}${difference.line ? ` line ${difference.line}` : ""}: ${singleLineField(String(difference.detail || ""))}` : `: ${singleLineField(String(parity.summary || ""))}`}. Rebuild in development, re-prove, and run ${parityCommand} again. ${LOCAL_PROOF_NEVER_EDIT_RULE}`, difference ? { first_difference: difference } : undefined);
 }
 
-function validateTargetSdkVersion(spec, errors, warnings, ready, derived, buildState) {
+function validateTargetSdkVersion(spec, errors, warnings, ready, derived, buildState, packet = null) {
   const report = buildState?.report || null;
   const required = stageIsTerminal(report?.stages?.setup?.status)
     || stageIsTerminal(report?.stages?.assembly?.status)
     || derived.scaffold_required !== true;
+  const family = packet?.assembly?.template_family;
+  const verified = isNonEmptyString(family) && isCertifiedTemplateFamily(family)
+    ? assessTemplateFreshness({ family, catalog: resolveCommerceCatalog(), sdkSupportPolicy: defaultSdkSupportPolicy() }).verified_sdk_version
+    : null;
   const gate = evaluatePageKitSdkVersion({
     spec,
     specStatus: buildState?.specStatus || "ok",
     targetLoad: buildState?.pageKitCampaignConfig,
     waivers: report?.waivers,
     required,
+    familyVerification: verified ? { family, sdk_version: verified } : null,
   });
   derived.checkpoint_gates.push(gate);
 
@@ -2041,7 +2046,6 @@ function collectBuiltPageIdentityInputs(scope, targetRepo) {
     }
     return {
       page_id: page.page_id,
-      page_type: page.page_type,
       route: page.route,
       file: relFromDir(targetRepo, page.built_path),
       content,
@@ -3200,7 +3204,7 @@ function validateSourceCoverage(packet, packetPath, spec, errors, warnings, read
             addIssue(
               warnings,
               "source_html.pages.source_hash",
-              `Source page "${page.page_id}" hash mismatch — file at ${page.path} has changed since the manifest was written (manifest sha256=${expectedHash.slice(0, 12)}…, on-disk sha256=${actualHash.slice(0, 12)}…). Re-run the producer to refresh the manifest, or accept the local edits.`,
+              `Source page "${page.page_id}" hash mismatch — file at ${page.path} has changed since intake recorded it in the Build Packet (recorded sha256=${expectedHash.slice(0, 12)}…, on-disk sha256=${actualHash.slice(0, 12)}…). This warning does not block. Re-running start or prepare-build with --force records the current file and clears recorded stage evidence; editing the source-html manifest alone does not change the hash the packet holds.`,
             );
           }
         }
@@ -4019,11 +4023,11 @@ function collectPlaceholderTextResidueMatches(root, terms) {
 }
 
 // Rendered-output content-residue scan (assembly-surfaces prototype): scans
-// BUILT pages for the needs-merchant-input marker and urgency chrome rendered
-// without verified offer urgency (blockers), plus demo/placeholder residue and
-// generic content anti-pattern hits (warnings feeding the review/attestation
-// queue). Scans _site output, not frontmatter — layout/script-rendered chrome
-// only exists after the build.
+// BUILT pages for the needs-merchant-input marker and, on a brief-backed
+// build, starter countdown chrome the brief does not verify (blockers), plus
+// template demo/placeholder residue (warnings). The merchant's own proof and
+// urgency copy is not scanned. Scans _site output, not frontmatter —
+// layout/script-rendered chrome only exists after the build.
 export function validateBuiltContentResidue(packet, errors, warnings, ready, derived, buildState = {}) {
   if (!isStageComplete(buildState.report, "assembly")) return;
   // Scan the RENDERED _site output, not the campaign source dir: the Liquid
@@ -4036,7 +4040,7 @@ export function validateBuiltContentResidue(packet, errors, warnings, ready, der
   const urgencyVerified = briefUrgencyVerified(brief?.payload);
   const findings = scanBuiltOutputContentResidue(siteRoot, { urgencyVerified });
   if (!findings.length) {
-    ready.push("Built output carries no needs-input markers, unverified urgency chrome, or content-residue hits");
+    ready.push("Built output carries no needs-input markers, unverified urgency chrome, or template demo residue");
     return;
   }
   // One issue per finding id, carrying the FULL file inventory: the id keeps
@@ -4069,9 +4073,8 @@ export function validateBuiltContentResidue(packet, errors, warnings, ready, der
       );
     } else if (id === "unverified_urgency_countdown") {
       // The scanner emits this only when the brief does not verify urgency
-      // (urgencyVerified=false). Severity keys on the path: with a readable
-      // brief payload (AI-assembled) it blocks; a designed-source campaign
-      // with no brief payload may carry an intentional countdown — warning.
+      // (urgencyVerified=false). Only a readable brief payload (AI-assembled)
+      // makes it a finding.
       if (briefReadable) {
         addIssue(
           errors,
@@ -4079,30 +4082,18 @@ export function validateBuiltContentResidue(packet, errors, warnings, ready, der
           `Built output renders countdown chrome without verified offer urgency (${where}). Set offer.urgency.verified in ${BRIEF_PAYLOAD_REL_PATH} from a real promotion window, or blank the urgency slots.`,
         );
       } else if (brief?.error) {
-        // Unreadable brief payload: the run is already blocked by
-        // proof_attestation.unreadable with the right remediation (repair the
-        // brief). Urgency is re-evaluated on the next doctor run once the
-        // brief parses — "confirm the urgency is real" copy here would point
-        // the operator at the wrong fix.
-      } else {
-        addIssue(
-          warnings,
-          "content_residue.urgency_unattested",
-          `Built output renders countdown chrome and no brief payload attests the promotion window (${where}). Confirm the urgency is real (a genuine offer window or live inventory) before launch.`,
-        );
+        // Deliberately nothing: an unreadable brief payload already blocks
+        // through proof_attestation.unreadable (validateProofAttestation),
+        // and urgency is re-evaluated once the brief parses.
       }
+      // No brief payload at all: the countdown is the merchant's content and
+      // is not ours to question.
     } else if (id === "demo_residue_term" || id === "bracket_placeholder_stub") {
       addIssue(
         warnings,
         "content_residue.demo_residue",
         `Built output carries template demo/placeholder residue (${where}; e.g. "${finding.excerpt}"). Fill or blank the slot — demo values must never ship.`,
       );
-    } else {
-      addIssue(
-        warnings,
-        "content_residue.anti_pattern",
-        `Built output matches content anti-pattern "${id}" (${where}; e.g. "${finding.excerpt}"). ${finding.rule || "Remove it or route it through brief-sourced proof."} This is a review warning and nothing downstream blocks on it: the claim is the operator's and the client's responsibility — remove or evidence it, never make it more plausible.`,
-      );
     }
   }
 }