[DevCop95]

Two things the session found by doing rather than reading.

test(site): the shipped site.js now runs in CI

docs/site.js is the file GitHub Pages serves, and nothing could see it. The
moment it was executed instead of read, it turned out the URL check was a
startsWith on the raw string, so

.../releases/download/v9/../../../evil   ->   https://github.com/DevCop95/evil

survived it. That was already fixed in #9 — but without a test, the next edit
could undo it and nothing would notice. A wrong API field name or a renamed
element id in index.html fails the same way: empty download table, no error
anywhere.

docs/site.test.js runs the real file against a minimal DOM stub. No
dependencies, no network — fixtures are trimmed copies of a real release
response, so the gate cannot go red because GitHub was slow.

Scenario	What it proves
A	the real 7-asset shape fills every column, SHA-256 matches checksums.txt, em dash where it should not
B	javascript:, foreign host and ../ traversal all dropped; a raw HTML asset name lands in textContent, not markup
C/D	nothing usable / a 403 both fall back to the pinned list and name the real reason
E	checksums.txt unreachable: table still renders, hashless
F	the hand-written fallback table in index.html still matches the published hashes and byte counts

The element ids are read from index.html, so renaming one there fails
here instead of silently emptying the page. A static check fails if any code
path starts building markup from strings.

Verified under node 20 (what the job pins) and node 24: 24 assertions, all
passing. New required check: site js test.

docs(security): the two boundaries #6 asked to be written down

#6 was never a bug — it was two boundaries the code states and the docs did
not. Both now live in SECURITY.md under Documented limits:

1. The token is a lock on the door, not on the room. GET / hands it to
   the page and cannot tell a browser from any other local process with
   loopback access. Both deployment cases spelled out: on a single-user
   workstation it adds no exposure beyond what a same-user process already has;
   on a shared or RDP host, an unprivileged process that reads it can drive an
   elevated --enable-collect server. The fix (named pipe, SID ACL) and the
   rejected options are named.
2. POST /v1/sys/opt changes the machine with no flag. Documented rather
   than gated, because gating it would change behaviour the threat model
   already declares trusted.

docs/security.html stops calling #6 an open design question and points at the
new section; #6 stays as the record of the discussion.