- runBundleTelemetryGate: PRODUCTION web/dist ONLY (dist-harness forbidden,
BA5); analytics/beacon token set (sendBeacon explicit form); positive
host allowlist with the host inventory printed, never assumed (A4);
deep-link crypto (D-11) and storage tokens JS-assets-only; a missing
build is notRun, never a silent pass
- runKvExpiryProbe: npx wrangler kv key list (current syntax, deprecated
colon form forbidden), namespace id read from bot/wrangler.jsonc at
runtime; parses name/expiration/metadata + list_complete/cursor and
follows the cursor; unexpected families REPORTED (A5); oldest/newest
expiry reported; raw key names never printed (category-only evidence)
- runAssetHeaderProbe: curl -sSI cache-control/cf-cache-status reported
VERBATIM (probabilistic — printed, never interpreted)
- documented adjudications: MapLibre static-text hosts, W3C namespace
identifiers, bare-array = CLI's internally-paginated complete set
