Dated entry per WORK_CYCLE step 6: what shipped, what the reviews found before
any code was written, what each guard now refuses, and what is left.
The short version of the second half: the secret scanner had never once run its
private-key pattern, React was discarding the prerendered DOM on every page, the
production sitemap carried no dates at all, every page preloaded the wrong image,
eleven pages shipped a run-on description, an odd link could blank a page, and
every Docker build context carried the operator's live credentials. All fixed,
each proven by breaking it first.
Next action and blockers are in the entry: the Google and Bing submissions need
account access this session did not have, and Levi's four vendor screenshots need
him.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
8cc9b4342f