fix(deps): upgrade Astro and Starlight to close #54

[tizerluo]

Summary

Finish the #54 dependency half after #54A's already merged analytics fix. Pin Astro 7.3.5 and Starlight 0.42.5, add their compatible markdown-remark peer, and regenerate the lockfile. Register Starlight's empty i18n collection for Astro 7 while retaining built-in English text. Regenerate the five-part English baseline from this exact head's built output. The existing analytics asset, script source, delivery destination, and tests remain unchanged.

Approval and scope

Commander #5577 approved D1–D4 and D2 ceilings: non-generated production/config/Progress ≤180, tests ≤200, subtotal ≤380; generated lock ≤2000 and baseline ≤220; all additions ≤2600. Actual PR diff is 17/0/17 + 1835/174 = 2026 additions; 2177 deletions disclosed (README 1, package 2, content config 2, lock 1998, baseline 174). Seven approved paths only. @astrojs/sitemap remains 3.7.3 and parse5 remains 7.3.0. No deploy configuration, user copy, or unrelated feature changed.

Verification

• Clean-resolved install: npm ci RC0, real node_modules; no symlink. npm audit --json: old same-tree dependency audit 9 findings (critical 1/high 4/moderate 1/low 3), candidate 0 across all severities, confirmed independently by FC.
• Old e7aa4fd7 and candidate builds each pass in the same environment. FC independently reran full npm run build RC0, covering prebuild, Astro build, postbuild, G13, rendered SEO/i18n and analytics. No new failure name.
• G13 baseline: node scripts/i18n-check.mjs --write-en-baseline generated from this head's actual dist; FC regenerated it after a fresh build and SHA256 stayed b8838a4033036c5f5fa052656f5cd32a9d4e9e5a655e361a09f5c7e1eb0beb1e. All 35 English pages retain the same URL set. Per-page body/head/rules/stylesheets attribution is materials/studio-debt-54/b-g13-attribution-20261001.md; FC verified its 35 rows and all 140 field statuses against both JSON baselines, unknown causes 0. Astro HTML whitespace compression, generator metadata and CSS hashes explain common differences; Starlight adds a screen-reader Menu control to docs chrome. Gates were not edited or disabled.
• Local Node v22.22.3 satisfies Astro's ≥22.12.0. CI uses actions/setup-node with major 22 in both jobs. setup-node resolves a current cached or distributed 22; the Node release index lists v22.23.3. Fresh exact-head CI run 36902271467 actually resolved v22.23.3, ran npm ci with 0 vulnerabilities, and passed full build; guard and otp-redirect-smoke also passed. No CI file edit was needed.
• #54A invariant: SHA-named same-origin Umami asset remains 4655 bytes / SHA256 1ad1145d19d4558c20f5469ca4a5fc50a1a46f860858c9c91bfcd56fd29a522a. Source and rendered checks pass. FC local Playwright, with /api/send intercepted and fulfilled without production contact: home, docs quickstart and /zh/ 3 pass / 0 fail, asset 200, correct website ID and hostname.
• FC old/new preview at 390 and 1280: home, docs quickstart and pricing return 200 with matching titles, H1 and language. Home/docs have no horizontal overflow; pricing's narrow overflow is present on both old and new output. Screenshots: materials/studio-debt-54/fc-visual/. Author read-only Cursor Task P0/P1/P2/P3=none; full transcript in materials/studio-debt-54/b-completion-20261001.md. FC acceptance: materials/studio-debt-54/fc-qa-b-20261001.md.

Known output changes

• The old caddyfile warning disappears. A new Vite/Astro astro:head-inject warning comes from transformed docs MDX; build and same-origin analytics pass. The initial empty-i18n warning was resolved by the collection registration. The docs→404 lookup warning is present on both heads.
• Starlight docs chrome uses a popover menu and a new sidebar pane; article copy is unchanged. No production deployment is claimed. Commander retains merge/deploy authority.
• ZCode P2 requested old/new <head> resource attribution. FC checked all 35 pages: unchanged script counts, no new remote script or external head endpoint, and only local /_astro bundle filenames changed. Full per-page record materials/studio-debt-54/fc-head-diff-a1be6f9.txt, PR evidence comment. CodeRabbit's Linked Issues inconclusive check is addressed by lock/audit/analytics evidence; its review generated no actionable comments.

Closes #54

Summary by CodeRabbit

• Updates

  • The site now uses Astro 7.3.5 and Starlight 0.42.5, along with an updated Markdown integration.
  • English remains the site’s available interface language; no translated interface content was added.

• Documentation

  • The README now reflects the updated Astro and Starlight versions.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openagentemail/website/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 2ce4b3e4-e401-4cdd-aaec-17ead95d2653

📥 Commits

Reviewing files that changed from the base of the PR and between e7aa4fd and a1be6f9.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (6)

• Progress.md
• README.md
• i18n-en-baseline.json
• package.json
• src/content.config.ts
• src/content/i18n/en.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The project pins Astro 7.3.5, Starlight 0.42.5, and the Markdown remark integration 7.3.1. It registers an empty English i18n collection and updates the English baseline hashes and project documentation.

Changes

Site dependency and content update

Layer / File(s)	Summary
Pin dependencies and register i18n package.json, src/content.config.ts, src/content/i18n/en.json, README.md	The dependency declarations pin Astro 7.3.5, Starlight 0.42.5, and @astrojs/markdown-remark 7.3.1. The content configuration registers an i18n collection backed by an empty English JSON file. The README identifies the updated Astro and Starlight versions.
Update English baseline and progress record i18n-en-baseline.json, Progress.md	The baseline hashes are updated for existing page content, document heads, rules, and stylesheet assets. The progress entry records dependency versions, the i18n collection, and the baseline update process.

Priority: ⬆️ High

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to a1be6

The framework upgrade refreshes the generated English baseline, and CI is wired to compare it with built output. No concrete user-facing regression or merge-blocking issue is established; normal CI confirmation remains appropriate.

Architecture Summary

Architecture risk: 🔵 Low · up to a1be6

The change affects 5 systems.

Changed systems: src, i18n-en-baseline.json, package.json, Progress.md, README.md

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — src (service) was modified; 2 changed files map to changed impact.
• observed — i18n-en-baseline.json (service) was modified; 1 changed file maps to changed impact.
• observed — package.json (service) was modified; 1 changed file maps to changed impact.
• observed — Progress.md (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in Progress.md: Adds the #54B progress entry documenting dependency pins, the peer dependency, i18n registration, build issues and baseline update process; it also records unchanged sitemap and parse5 versions and that no commit, push, or PR was made.
• observed — Modified behavior in README.md: The README’s stack description changes from Astro 5 and unversioned Starlight to Astro 7.3.5 and Starlight 0.42.5.
• observed — Modified behavior in i18n-en-baseline.json: Updated the 404 and AgentMail entries’ content, head, rules, and stylesheet hashes.
• observed — Modified behavior in i18n-en-baseline.json: Updated page metadata hashes and stylesheet hashes across the compare, contact, documentation, homepage, MCP, pricing, and policy entries. Page paths and entry structure are unchanged.

🚥 Pre-merge checks | ✅ 4 | ❓ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The PR implements the visible dependency objectives in #54: Astro 7.3.5, Starlight 0.42.5, the compatible @astrojs/markdown-remark dependency, Astro 7 i18n registration, baseline regeneration, and r…	Provide reviewable evidence for package-lock.json, the before/after audit JSON severity counts and residual disposition, and the analytics integrity control or documented boundary with its regression assertion. Confirm that the dependency…

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The reported changes remain connected to #54. Progress.md and README.md document the dependency upgrade. src/content.config.ts and src/content/i18n/en.json provide Astro 7/Starlight compatibil…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: upgrading Astro and Starlight dependencies to address issue #54.

Full details: Linked Issues check

Explanation

The PR implements the visible dependency objectives in #54: Astro 7.3.5, Starlight 0.42.5, the compatible @astrojs/markdown-remark dependency, Astro 7 i18n registration, baseline regeneration, and reported build, audit, and focused test results. The linked issue also requires reviewable before/after npm audit --json counts, disposition of residual findings, preserved analytics loading, and a regression assertion for the selected analytics integrity control or documented boundary. package-lock.json is excluded from review, so lockfile churn and the dependency resolution cannot be verified. The summary does not establish the analytics integrity control, its regression assertion, or the reported audit JSON evidence. The reference to the prior analytics work does not independently prove that implementation at this reviewed head.

Resolution

Provide reviewable evidence for package-lock.json, the before/after audit JSON severity counts and residual disposition, and the analytics integrity control or documented boundary with its regression assertion. Confirm that the dependency and analytics changes are independently auditable as required by #54.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[tizerluo]

Muse Review Gate：✅ pass

建议级（非阻断）：本闸入闸面并计 P 级，但不单独阻断合并；强＝字符串/渲染/夹具/运行时一致性，弱＝跨文件协议/安全契约/跨仓推理 ⇒ 弱面类卡上 pass ≠ 无人反对。

项	值
head	a1be6f9ab5c4
严重度分布	P0 × 0 · P1 × 0 · P2 × 0 · P3 × 0
结论	patch is correct（置信 0.85）——升级改动自洽：package.json 与 lock 同步钉版，content.config.ts 按 Starlight 0.42 注册 i18n 集合并以空 en.json 取默认文案，基线哈希随 Astro 7 渲染变化整体重写符合预期，未发现新引入的明确缺陷。

完整审查报告（opencode headless · plan 只读 · 官方 rubric）

未发现该 PR 新引入的问题。

---

_{Muse Review Gate（opencode opencode/muse-spark-1.3-contributor-free · Zen 免费档 · in 52656/out 1485 tok，71s）· 同一 head 不重复审 · 建议级（非阻断）· 观察指标累计中：出现假阳性即复评；连续 30 张无独有真发现则降级或改用途}

[tizerluo]

Codex Local Review：✅ pass

项	值
head	a1be6f9ab5c4
严重度分布	P0 × 0 · P1 × 0 · P2 × 0 · P3 × 0
结论	patch is correct（置信 0.78）——未发现该 PR 新引入的明确缺陷。依赖版本与 CI 的 Node 22 配置相容，英文基线仍覆盖原有的 35 个页面。

完整审查报告（本地 codex CLI · 只读沙箱 · 官方 rubric）

未发现该 PR 新引入的问题。

---

_{Codex Local Review Gate（自托管 3+ 加固：严判 verdict · 同轮重试 · 现场诊断；模型线见 ~/.codex-dev/config.toml；in 702161/out 4778 tok，132s）· 同一 head 不重复审 · 云端 connector 延迟时的快速闸}

[tizerluo]

ZCode Review Gate：✅ pass

项	值
head（mimosa 扫描基线）	a1be6f9ab5c4
严重度分布	P0 × 0 · P1 × 0 · P2 × 1 · P3 × 2
结论	未发现阻断问题，可以合并

完整审查报告（zcode_pr_review：git diff + mimosa 深扫 + ZCode 只读复核）

审查完成。以下为审查报告。

---

PR 安全审查报告

PR 内容概述: 本次改动是一次工具链大版本升级 —— Astro ^5.13.0 → 7.3.5、Starlight ^0.37.7 → 0.42.5(跨两个大版本,rollup→rolldown、编译器换 Rust binding),新增直接依赖 @astrojs/markdown-remark@7.3.1;为 Starlight 0.42 注册空 i18n 集合(src/content.config.ts + 新文件 src/content/i18n/en.json 内容为 {});i18n-en-baseline.json 全量重写为新工具链产物的哈希;README/Progress.md 文档同步。无业务逻辑、无页面源码改动。

汇总

级别	数量	说明
P0(阻断)	0	—
P1(应修)	0	—
P2(建议)	1	基线全量重写吸收了工具链引入的全部产物变化,本 PR 自身缺少对 head 变化的留痕核验
P3(提示)	2	① 无 engines 字段但新工具链硬性要求 node ≥22.12;② 双大版本一步升级的回归面

mimosa findings 核实: 共 0 条(扫描深度 deep,依赖 462 包已完成)→ 【确认漏洞】0 /【误报】0 /【存疑】0。按附件提示,我代替扫描器对改动文件做了人工抽查(见下文“抽查记录”),未发现 mimosa 漏报的可利用问题。

结论: 可以合并。 本 PR 未引入任何可识别的安全漏洞；所有改动均为构建期工具链与测试基线,站点是纯静态输出(output: 'static',无框架岛、无运行时用户输入处理面)。

---

一、新引入问题详述

P2-1 基线重写使 en-baseline 闸门对本 PR 的产物变化“一次性失明”

• 位置: i18n-en-baseline.json(全量重写,~26 个页面 × 4 类哈希)
• 判定依据: scripts/i18n-check.mjs 的 en-baseline 检查(5 要素: body 逐字节、归一化 head、内联 CSS 规则、外部样式表数量与内容哈希)是本仓库防止“英文页被悄悄改动”的核心漂移闸门。本 PR 因 Astro 7 压缩空白、Starlight 0.42 改菜单/侧栏标记而整包重写基线,这意味着升级本身引入的任何 head 变化(例如新版 Starlight/Astro 注入的新脚本、新第三方请求端点、新 link 资源)都会被新基线“合法化”,未来闸门再也检不出来。唯一的防线是提交者在 Progress.md 中声称的做法(“用同环境 Astro 5 产物逐页对过可见文本后,才写入基线”)——但可见文本对比不覆盖 head 里的脚本与网络端点,且该过程无留痕、不可复核。缓解因素:normalizeHead() 只剥离 <style> 和 stylesheet <link>、保留 script 标签,headNormSha256 升级后仍持续钉住 head 中的脚本;tests/analytics-integrity.test.mjs 独立钉死 Umami tracker(同源 /vendor/umami-1ad1145d….js、data-host-url 指向 stats.openagent.email、禁止远程 script.js),postbuild 链路本次未动,升级后这些闸门照常生效。
• 修复建议: 在 PR 描述或评审记录中附一次新旧 dist 的 <head> 逐标签 diff(重点: <script src>、<link rel=preload>、任何指向非 openagent.email 域名的 URL),确认 0.42/7.3.5 未注入新的第三方端点。属流程补强,不阻断合并。

P3-1 新工具链要求 node ≥22.12,但仓库未声明 engines

• 位置: package.json(无 engines 字段、无 .nvmrc);lockfile 中 @astrojs/mdx@8.0.2、@astrojs/compiler-rs@0.5.1 声明 node >=22.12.0,@rolldown/binding-* 声明 ^20.19.0 || >=22.12.0
• 判定依据: CI(.github/workflows/ci.yml)固定 node-version: "22",setup-node 会装最新 22.x(≥22.12),CI 不受影响;但本地开发者若还在 node 20(Astro 5 时代可用)会得到不直观的运行时报错。CI 注释已明说“补 engines 是另一次改动”,属已知的存量惯例,非安全问题。
• 修复建议: 后续 PR 补 "engines": { "node": ">=22.12.0" } 或 .nvmrc。

P3-2 一步跨两个大版本,回归面较大

• 位置: package.json / package-lock.json
• 判定依据: Astro 5→7(中间跳过 6)、Starlight 0.37→0.42,连带 shiki 3→4、i18next 23→26、prism/markdown 管线更换(@astrojs/markdown-satteri 新家族)、打包器换 rolldown 原生 binding。虽然全部是构建期依赖(静态站无运行时框架),但渲染管线的任何 XSS 转义行为差异(如 markdown→HTML 转义、smartypants)都会直接影响产物安全性。缓解: 本仓库的闸门体系在这类站点里属于极强(postbuild 8 个 rendered gate + prebuild 11 个源 gate + CI 强制 + 每周定时),且基线已重写为当前产物,后续漂移会被钉住。
• 修复建议: 无需动作;若后续出问题,回滚面就是这两个锁死的精确版本(锁版本本身是好的)。

已核实为良性的改动点(不构成问题)

• src/content/i18n/en.json({})+ src/content.config.ts 注册空 i18n 集合: Starlight 的 i18n 集合是构建期 UI 文案覆盖字典,空对象 = 零覆盖、全部回落内置英文;文件是仓库自身内容而非运行时用户输入,不存在注入面。注册目的(避免 Astro 7 把“集合不存在”当 404 内容错误)与注释一致。
• privacy/、terms/ 两个重定向桩页: 手写静态 meta refresh 跳站内固定路径(src/pages/privacy.astro:13),非开放重定向;基线中两页 rulesSha256 升级前后都是空串哈希 e3b0c442…,证明仅空白压缩导致 body/head 哈希变化,语义未变。
• 基线结构一致性: 逐页核对了 diff——每页 stylesheets 数量升级前后一一对应(docs 类 3→3 或 2→2,营销页 1→1,compare 2→2),无页面增删,无异常条目。
• lockfile 供应链姿态: 458 个 resolved 条目全部来自 https://registry.npmjs.org/,458 个 integrity 一一对应无缺失,无 git/http tarball 来源;新增的 @astrojs/compiler-binding-*、@rolldown/binding-*、@bruits/satteri-* 原生二进制包全部带 sha512 完整性哈希,npm ci 会强制校验。三个顶层依赖全部精确锁版(无 ^),配合 CI 用 npm ci 而非 npm install,可复现性好。
• @astrojs/markdown-remark 放在 dependencies: 与 astro/starlight 同列,符合本仓库“构建链放 dependencies”的既有惯例,且版本满足 starlight 0.42.5 / mdx 8.0.2 的可选 peer(^7.3.0),无 peer 冲突;@astrojs/sitemap@3.7.3 在 lockfile 中无 astro peer 限制,与 astro 7 共存无冲突。

二、mimosa findings 核实

扫描返回 0 findings、0 业务逻辑假设、依赖扫描已完成(462 包),结构化 findings 清单为空。逐条判定结果: 确认漏洞 0 / 误报 0 / 存疑 0(无可判定条目)。

作为替代性抽查,我对本次改动文件及相关链路做了人工复核,均未发现问题:

1. src/content.config.ts — 仅新增集合注册,无数据流变化(见上)。
2. src/content/i18n/en.json — 空字面量,无攻击面(见上)。
3. astro.config.mjs — 本 PR 未改动;head 注入的 Umami 脚本仍是上一 PR 钉死的同源副本(SHA256 命名文件名 + data-host-url 指向自有域),并由 tests/analytics-integrity.test.mjs 的 rendered 检查持续把关(校验字节数 4655、哈希、禁止远程 script.js)。
4. scripts/i18n-check.mjs 中唯一处理外部输入路径的 extractStylesheetHavs() 已有路径穿越断言(filePath.startsWith(distPrefix)),本次未修改;normalizeHead 的正则只用于哈希归一化,不受本 PR 影响。
5. CI 工作流权限最小化(contents: read、persist-credentials: false、20 分钟超时),本 PR 未触碰。

三、合并结论

可以合并。 无 P0/P1 问题;P2-1 是流程补强建议(附一次新旧 head diff 即可闭环),不构成阻断;其余为提示级。基线重写与本 PR 的依赖升级互为配套,闸门结构(headNorm 钉 script、analytics 完整性测试、路径穿越断言)升级后全部保留且继续生效。

---

VERDICT: P0=0 P1=0 P2=1 P3=2 MERGE=yes

---

_{由 zcode-review-gate 自动审查 · 写工具物理禁用 · 同一 head 不重复审}

[tizerluo]

#54B ZCode P2-1 closure — exact head a1be6f9

FC compared the <head> resource tags of all 35 English pages between the clean e7aa4fd7 Astro 5 build and this exact-head Astro 7 build, each produced after real npm ci in the same environment. Full per-page old/new script lists and attributes: materials/studio-debt-54/fc-head-diff-a1be6f9.txt.

• Script counts match on all 35 pages. The 34 changed pages differ only in local /_astro/ bundle filenames; the remaining redirect stub is unchanged. No new remote or nonlocal script source appears.
• Preload links, external URL attributes in <head>, and inline-script SHA values have zero changes. The same-origin SHA-named Umami path, data-host-url, and website ID remain unchanged.
• The focused source/rendered analytics gates pass. FC independently ran intercepted local Playwright pageviews on home, docs quickstart, and /zh/: 3/0, local asset 200, correct destination/ID, no production contact. G13 remains enabled, its 35-page baseline was regenerated from this head's actual dist, and FC reproduced the identical baseline SHA.

Disposition: ZCode P2 was a request for review evidence rather than a code defect; this comment supplies the requested head-resource evidence without changing the reviewed head. P3-1 (local engines declaration) is disclosed in the PR's Node section; CI's actual Node/build remains a required fresh gate. P3-2 (major upgrade breadth) is covered by the exact pins, full build, 35-page attribution, old/new browser comparison, and revertable one-commit change.

[tizerluo]

#54B CodeRabbit linked-issue check — evidence for head a1be6f9

CodeRabbit's review completed on this head with no actionable comments and minimal merge risk. Its Linked Issues check is inconclusive because package-lock.json is filtered out of CodeRabbit's review and it could not verify the #54 audit/analytics evidence from the summary. FC disposition, independently checked:

1. Lock resolution: the committed lock has 458 resolved package entries, all 458 from https://registry.npmjs.org/, all 458 carrying sha512 integrity; no git or other tarball source. Clean npm ci succeeded for the worker and the fresh GitHub build. @astrojs/sitemap and parse5 pins did not change.
2. Audit before/after: before migration: critical 1, high 4, moderate 1, low 3 = 9 (astro, sharp, js-yaml, nanoid, svgo, devalue, @astrojs/starlight, @astrojs/mdx, esbuild). After migration: 0 in every severity, no residual findings. Worker JSON records: materials/studio-debt-54/b-head-audit-before-20261001.json and b-head-audit-after-20261001.json; FC independently ran npm audit --json RC0 with empty vulnerabilities.
3. Analytics integrity control and regression assertion: #54A's already merged source/rendered tests check asset byte length, SHA, same-origin source, data-host-url, and reject remote script.js. Local Playwright assertions intercept https://stats.openagent.email/api/send without production contact and verify same-origin asset 200, destination, website ID and hostname. FC reran those three pageviews, 3 pass / 0 fail, on this head. Source/rendered checks also pass in fresh GitHub CI.

This closes the evidence gap without changing the reviewed head. #54A delivered analytics integrity; #54B completes the dependency half. GitHub closingIssuesReferences has only #54 and the PR has no other Development connection event.

[tizerluo]

website #54B PR #97 — FC final review

Commander internal mail #5598 approved a one-head Codex Cloud exception, accepted the ZCode P2 and CodeRabbit Linked Issues evidence, and ordered final review. FC rechecked the exact head at 2026-10-01 18:25Z. Request snd_2f0e950d895f718c1f3ca595 is resolved.

PR #97. Base e7aa4fd7d05080fd51e8e9336afa0b0a3ffb5fe7; exact head a1be6f9ab5c42fbf0f51d1317a0e4a5633955d13. Open, non-draft, mergeable. Remote main e7aa4fd7 and origin/main is an ancestor of head; local branch clean and git diff --check origin/main..HEAD RC0. GitHub closingIssuesReferences = [#54] only; PR CONNECTED_EVENT = 0; issue #54 is OPEN and will close on merge.

Scope and D2

Approval commander #5577. Seven paths: package.json, package-lock.json, src/content.config.ts, src/content/i18n/en.json, i18n-en-baseline.json, README.md, Progress.md. Non-generated production/config/Progress +17≤180; tests +0≤200; subtotal +17≤380. Generated lock +1835≤2000; generated baseline +174≤220; total +2026≤2600. Deletions −2177; git diff --check RC0. No changes outside approved scope.

Independent D3

Worker old candidate audit 9 (critical1/high4/moderate1/low3) → candidate zero. FC npm audit --json RC0/zero. Lock 458 resolved entries all registry.npmjs.org with sha512. CI npm ci found zero vulnerabilities. Local Node v22.22.3; exact-head GitHub CI resolved v22.23.3≥22.12.0. Same-environment old and new full builds RC0; FC independent npm run build RC0. G13 35 pages same URL set, 140 per-field statuses match actual JSON, unknown cause0. FC regeneration from exact-head dist left baseline SHA b8838a4033036c5f5fa052656f5cd32a9d4e9e5a655e361a09f5c7e1eb0beb1e unchanged. Old/new 35-page <head> resource comparison: 34 pages only local /_astro bundle filename changes, same script counts, no new remote script, preload, external head URL, or inline-script SHA; record fc-head-diff-a1be6f9.txt.

#54A same-origin analytics asset SHA unchanged, 4655 bytes. Source/rendered tests pass; FC independently ran three local Playwright pageviews with production /api/send intercepted, 3 pass/0 fail. FC desktop/narrow old/new preview: home/docs/pricing titles, H1, lang match, no new horizontal overflow; pricing narrow overflow inherited. Worker author Task P0/P1/P2/P3 none, absolute transcript in b-completion-20261001.md. Independent QA fc-qa-b-20261001.md.

Exact-head gates

• GitHub check-runs: build SUCCESS (17:50:19Z), guard SUCCESS (17:49:55Z), otp-redirect-smoke SUCCESS (17:50:21Z), all head_sha=a1be6f9. Run 36902271467 logs actual Node v22.23.3, npm ci 0 vulnerabilities.
• Codex Local P0/P1/P2/P3=0/0/0/0, pass confidence0.78, comment 17:52:43Z. Muse advisory P0–P3=0, confidence0.85, comment17:51:26Z.
• ZCode P0/P1/P2/P3=0/0/1/2, MERGE=yes, comment17:53:40Z. P2 asks old/new head-resource audit; FC posted exact 35-page evidence #issuecomment-5937379302, no code change. P3 Node engines convention and two-major migration breadth disclosed in PR/QA.
• CodeRabbit commit status success / Review completed, 18:00:54Z; comment final_review_risk_coverage kind=reviewed, source/covered SHA a1be6f9; no actionable, risk minimal. Its Linked Issues pre-merge check inconclusive because lock is filtered and audit/analytics proof not inferred; FC posted lock/audit/analytics evidence #issuecomment-5937437746. Formal reviews0, inline comments0, unresolved review threads0.
• Codex Cloud connector usage limit at 17:49:46Z: no current-head verdict. Commander #5598 authorizes the 18th soft-gate absence exception only for exact head a1be6f9, with no inheritance. Commander also accepts ZCode P2 evidence and CodeRabbit Linked Issues disposition. The exception is not a Cloud pass.

Known behavior and disposition

Starlight docs chrome gains screen-reader Menu, popover/sidebar markup; article text unchanged. Astro HTML compression alters whitespace/hashes. Old caddyfile warning disappears; new framework astro:head-inject warning has no failed gate; docs→404 warning old and new. No production deploy. No FC merge.

FC recommendation: MERGE=yes for exact head a1be6f9ab5c42fbf0f51d1317a0e4a5633955d13, Closes #54. Commander retains merge authority. Per #5598, website main push triggers webhook deployment after 1–2 minutes; after commander merge, FC must run an online acceptance sample of the 35 pages, intercepted analytics delivery, and audit posture, then report. No FC merge/deploy was performed for this report.