# Edit Lifecycle & Trust Rails — mvahpets.com truth book at `f669b097f` **Pin verified**: `git rev-parse HEAD` → `f669b097ff26350b4f87160a88d76cc1828faaef`, committed `2026-08-14 08:09:31 -0700`. Repo: `/Users/robertsanchez/lane-worktrees/hands-flagship`. --- ## 1. LIFECYCLE **`edit:preview`** — `package.json:27` → `node --import tsx scripts/edit-cli.ts preview` - Dispatch: `scripts/edit-cli.ts:4197-4219` (`case "preview"`, wrapped in `withGitSpine`, defined `edit-cli.ts:4065`) → `cmdPreview` (`edit-cli.ts:2792-2794`) → `runEditPreviewCommand` (`edit-cli.ts:2436-2496`) → `runEditPreview` (`edit-cli.ts:410-462`). - `runEditPreview` reads `originHost` from `site.config.json` (`readSiteConfig`, `edit-cli.ts:222-232`), calls `produce({genomeDir: repoRoot, outDir: /site, originHost, ...})` (`scripts/produce.ts:622`; `SITE_DIR` const `edit-cli.ts:213`), then `assertGenomeOnlyWrite` — the "[M] gate" (`edit-cli.ts:63,448-459`). - Persists `.edits/preview-verdict.json` (`PREVIEW_VERDICT_PATH`, `edit-cli.ts:2714`; schema `edit-cli.ts:2717-2731`: `schemaVersion 2, verdict GREEN|RED, mode full|incremental, pagesReprojected, pagesDeployed`) via `persistPreviewVerdict` (`edit-cli.ts:2739-2762`), and `.edits/preview-inputs.json` + `.edits/preview-certified-inventory.json` (`scripts/lib/preview-extent.ts:88-89`) via `persistPreviewChainRecords` (`edit-cli.ts:2691-2712`) — the pin the *next* preview may scope against. - **Where is it served?** Nowhere external. `edit-cli.ts:19-21`: *"preview — produce() the genome ... into `./site`, then verify it"*; `edit-cli.ts:22-24`: *"No Cloudflare/GitHub credentials required or assumed — an actual internet-facing deploy is an infra/credentials concern outside a standalone repo's control."* Confirmed: no `http.createServer`/`.listen(`/wrangler-pages call anywhere in `edit-cli.ts` or `produce.ts`. At this pin `site/` and `live/` don't even exist on disk — the only trace of the last real run is the git-tracked `.edits/preview-verdict.json` (see §6). **`edit:promote` + two-lap gate** — `package.json:29` → `edit-cli.ts promote` - `cmdPromote` (`edit-cli.ts:2944-2946`) → `runPromoteCommand` (`edit-cli.ts:2823-2942`): requires explicit `--yes` (`2844-2846`); requires `./site` to exist (`2850-2852`); requires the persisted verdict GREEN and non-stale (else refuses, unless `--force-red-preview ""` while RED-but-fresh, journaled to `.edits/promote-overrides.jsonl` at `2886-2902`); snapshots the worktree first (`2883`, comment `2876-2882` explains a measured defect where whole-tree staging once destroyed a bystander file, "owner-draft-note.txt swept by fe1cb0a, destroyed by the revert"); `rm live/; cp site/ live/` (`2904-2905`); `writePublishedCommit`+`writeRollbackAnchor` (`2906-2907`); commits `publish: ` (`2910-2919`). - **`scripts/two-lap-gate.ts` is a separate CI merge gate, not called by `edit:promote`.** Purpose, verbatim (`two-lap-gate.ts:2-7`): *"this gate certifies FACTS and prevents ACCIDENT... It does not defend against a deliberate edit to its own mechanism. Any such edit is machinery, so it pays the full battery."* - `classify()` (`two-lap-gate.ts:211-228`) diffs base→head and returns `"genome-data"` only if every changed path is a **guarded** genome-data path class in `ci/path-classes.json` with no mode changes — else `"machinery"` (fail-closed default). - **Lap 1 "content"**: only checks whose `guards` array is non-empty run (`two-lap-gate.ts:575,905-906`) — the fast lane for pure content edits. - **Lap 2 "machinery"**: every registered check (`two-lap-gate.ts:907-909`) plus a parallel `door-red-proofs` sharded job (workflow `two-lap-gate.ts:662-683`). - Aggregate `gate` job (`two-lap-gate.ts:685-719`): genome-data ⇒ `content=success, machinery=skipped, red-proofs=skipped`; machinery ⇒ all three `success`. - Wired via 8 npm scripts: `ci:door-red-proof-shards`, `ci:machinery-manifest[:mint]`, `ci:guard-coverage`, `ci:receipt-well-formedness`, `ci:two-lap[:red-proofs]`, `ci:gate-workflow[:render]` (`package.json:48-54,58-59`). **`edit:rollback`** — `package.json:30` → `cmdRollback` (`edit-cli.ts:2986-2988`) → `runRollbackCommand` (`edit-cli.ts:2948-2984`): refuses `NO_ROLLBACK_ANCHOR` if never published twice (`2950-2961`); else `rollbackBookChange(...)` with a `reproduce` callback that re-runs `runEditPreview` and, if `live/` is affected, re-copies site→live (`2966-2977`); FAILs if any reversal verdict is `DRIFTED`/`CANNOT-VERIFY` (`2979-2982`). File's own history note: the old promote/rollback hand-rolled a `.migration/rollback//` snapshot of `live/` only and silently missed facts/anchors — measured: *"the plain-value-edit class touched 9 paths and the undo brought back 3"* (`edit-cli.ts:2798-2806`) — replaced by `git revert`-based `rollbackBookChange()` reverting every tracked path in one commit (`2807-2809`). **`edit:request`** (the "door") — `package.json:22` → `scripts/remote-edit-request.ts`. Usage: `--instruction "" [--filing-id][--grounding][--requester][--result]` (`remote-edit-request.ts:384-388`). Four outcomes, header verbatim (`remote-edit-request.ts:6-11`): `edited | ask | needs-human | (exit 78) every non-"edited" outcome stops before any mutation`. Calls the primitive layer directly (`runFactEditCommand`, `runBind`, `runInsert`, `runConfirmWorldConsequenceCommand`, `runEditPreviewCommand`), and **calls `runEditPreviewCommand` itself** at 4 sites (`remote-edit-request.ts:619,851,911,1341`) — a landed wish already carries a fresh `site/` + verdict inside the *same* attributed commit. **End-to-end, filed edit → visible preview:** 1. `npm run edit:request -- --instruction "..."` (or direct `edit:fact`, `package.json:11`) — the instruction is either hand-typed prose ("grammar") or a fenced JSON `resolved-decision/v1` object ("cockpit"), distinguished by a `{`-prefix check (`scripts/lib/remote-edit-request.ts:1629`). 2. `computeEditDecision` (`edit-cli.ts:895-999`) classifies world-consequence **first** (`classifyWorldConsequence`, §3), then routes court via `jurisdiction-router.ts`. 3. If autonomous: `writeFactValueIn` mutates `facts/.yaml`; `appendEditLogRecord` appends one row to `.edits/edit-log.jsonl` (`edit-log.ts:99-121`). 4. `withGitSpine`/`beginBookOperation`+`sealBookOperation` wraps the whole wish in **one** attributed commit carrying `Genome-Claim`/`Genome-Why` trailers. 5. The door calls `runEditPreviewCommand` before reporting `edited`; a preview failure aborts and restores the pre-wish snapshot (`finish()`, `remote-edit-request.ts:174-175`: `if (result.outcome !== "edited" && bookSnapshot) restoreBook(...)`). 6. `npm run edit:promote -- --yes` is a **separate**, deliberate step copying `site/`→`live/` — never automatic, and never network/CF-facing from this repo. 7. Idempotency: every accepted filing is keyed by `resolvedDecisionIdempotencyKey(filing.decision)` (`remote-edit-request.ts:429`); a resubmission replays `.edits/resolved-decision-outcomes/.json` (`remote-edit-request.ts:433`) instead of re-executing. --- ## 2. UNDO **`scripts/edit-undo.ts`** own header (`1-22`) — **can reverse**: exactly the fact ids the original change touched ("never a string sweep", `10-11`), filed **through the door** (`remote-edit-request.ts`) "so every guard, receipt, anchor recompute, and ledger row applies exactly as for any other edit" (`4-8`) — plain existing-fact value restorations only, all-or-nothing per value-move group (`15,210-232`). **States explicitly it cannot yet reverse** (body, not just header): - **Deletion**: `"taking back a removal means putting the content back, which isn't built yet"` (`edit-undo.ts:136-140`). - **Creation**: `"this handle-based undo restores existing fact values, so use the change's recorded reverse wish to remove the created fact"` (or, for a scoped split, "take it back with the reverse wish, which removes the scoped child") (`142-151`). - **No current anchor found**: `"no stored location carries this value today"` (`157-159`). - **Interference**: if a touched fact moved again since ⇒ `compare-and-ask`, zero writes (`13-15,172-178`). **`ci:edit-undo`** (`package.json:41`) → `scripts/edit-undo.fixture.ts` — bench-pinned to real incident commit `8bde80ca9` (2026-08-11 AlieTestAccount vaccine-section session, file header `1-3,29`). Six proofs: A (attribution survives 600 injected noise commits, `118-151`), B (exact-atom restore, same-string neighbor untouched, **`assert.ok(bElapsedMs < 60_000, ...)` — single-fact undo must finish in <60s, `line 186`, the only wall-clock number in this file**), C (idempotent no-op, `222-227`), D (interference refuses with zero writes, `268-277`), E (undo→redo→undo = 3 fresh door commits, `200-220`), F (real six-fact logo wish lands wholly or refuses wholly, never partial, `229-266`). **`ci:roundtrip`** (`package.json:56`) → `scripts/roundtrip.fixture.ts` clones the whole repo into a scratch tempdir (`6,13-19`) and runs `edit-cli.ts roundtrip` there — never touches the pinned tree. Byte-identity proof, `cmdRoundtrip` (`edit-cli.ts:3593-3702`): 1. baseline `preview`+`promote --yes`; `preEditHash = hashTree(LIVE_DIR)` (`3608-3613`). 2. apply a synthetic nonce edit to one real anchored fact (`3617-3628`). 3. `preview`; assert a witness sidecar cites that `factId` — proves the edit landed at a real anchored span (`3630-3636`, `editWitnessCitesFact` `3706-3726`). 4. `promote --yes`; `assertPromotedBytes` proves `live/`==`site/` and carries the nonce; explicitly FAILs if promoted bytes equal the pre-edit baseline ("vacuous promote", `3638-3649`). 5. `rollback`; `assertRollbackRestored(LIVE_DIR, preEditHash)` proves **byte-identical** restoration (`3652-3661`). 6. `finally`: unconditionally reverts the fact, re-previews (`3663-3675`). 7. A second leg repeats the *same* proof for **mint → preview → promote → unmint** ("undo does not get a weaker proof than a word change", `3682-3692`). - Fail-closed: no anchored fact to test ⇒ hard FAIL, never skip — "an unexercised promote/rollback is the defect" (`3596-3602`). --- ## 3. CONSENT/WORLD-CONSEQUENCE `scripts/il-edit/world-consequence-registry.ts` registers exactly three classes — `booking-vendor`, `payment`, `domain` (`1,9-13`) — detected by factId pattern, factType name, or value regex (calendly/acuityscheduling/vetstoria for booking; stripe/paypal/squareup for payment; a bare-domain regex for domain, `28-57`), under an explicit ruling: *"WIRING STOPS, MARKETING SHIPS — a vendor link EMBEDDED in the practice's workflow... is world-consequence; a plain marketing link TO a vendor... must ship autonomously"* (`18-26`). `computeEditDecision` checks this class **first**, ahead of court/eligibility routing, and forces `disposition: "needs-human-confirm"` unconditionally on any non-"none" class (`edit-cli.ts:943-952`). Such an edit is staged — `.edits/pending/..json` (`edit-cli.ts:1123-1133`) — until `edit:confirm-world-consequence` (`package.json:31`) runs; `cmdConfirmWorldConsequence` (`edit-cli.ts:2180-2350`) re-verifies the live fact still equals the staged `before` (else `CONFIRM_STALE`, `2256-2280`), applies, deletes the pending file, and logs `guard_outcome:"human-confirmed-applied"` (`2333-2345`). `edit:confirm-join` (`package.json:14`) confirms a different staged class — merging duplicate text occurrences vs. keeping separate (`runConfirmJoinCommand`, `scripts/il-edit/ops/join.ts:520+`), re-checking an occurrence-set fingerprint for drift first (`join.ts:527-529`). `edit-access.ts` is a coarser, separate gate: `checkEditAccess` reads an optional `.edits/access-policy.json` allow-list and **defaults to allow-all** when no policy exists (`edit-access.ts:38-80`, esp. `52-58,76-80`) — access control is opt-in, not default-deny. A cryptographic layer covers "acts" specifically: `assertWorldConsequenceActIdentity` (`scripts/lib/remote-edit-request.ts:530-540`) throws unless the act shown to the human canonicalizes byte-identical to the act executed; a CSPRNG-minted `door-consent/v1` nonce (`remote-edit-request.ts:2489-2519`) writes `.edits/consent-records/.pending.json` at issue, renamed to `.used.json` at redemption (`2449-2453,2523-2527`) — the on-disk sample `02d90f3d-0d23-443b-be98-f0a9029eb7d9.used.json` carries keys `act, consequenceClass, contract, issuedAt, nonce, requester, shown, usedAt, wishId`. --- ## 4. RECEIPTS/CERTIFICATE **`outcome-record.ts`** (`scripts/il-edit/outcome-record.ts`): *"EXACTLY ONE RECORD PER INVOCATION, at the process boundary"* (`line 1`), ledger at `.edits/outcomes.jsonl` (`OUTCOMES_LEDGER_PATH, line 37`), schema `{ts, verb, exit, outcome: success|inform|ask|refuse|error, code?, message?, duration_ms}` (`25-35`). Two rules make it real: a caught throw still writes (`withOutcomeRecord` try/catch, `60-89`), and a record with no usable `duration_ms` **throws** — "a record without a clock is RED" (`14-18,40-47`). Wired only into `mint-page`/`unmint-page` (`edit-cli.ts:4266-4303`). **At this pin, `.edits/outcomes.jsonl` does not exist** (confirmed absent, untracked). **`edit-log.ts`**: append-only `.edits/edit-log.jsonl`; every row stamped with provenance read off the HEAD commit's own claim trailers (`provenanceContext`, `65-96`) — unattributable HEAD yields `actor_id:"UNATTRIBUTED"` (`82-90`). Full type `edit-log.ts:14-44`. **Real last row on disk carries keys** (no values needed): `access_decision, actor_id, actor_kind, after_hash, ask, before_hash, commit_sha, court, disposition, dry_run_vs_shipped, edit_actor_id, fact_natures, fact_type, guard_outcome, site, ts, world_consequence, world_consequence_class`. **`.edits/` layout, observed at this pin:** - `change-extent.jsonl` (2,145,995 B), `edit-log.jsonl` (2,512,114 B), `machine-health.json` (222 B), `preview-certified-inventory.json` (721,624 B), `preview-inputs.json` (10,279,096 B), `preview-verdict.json` (525 B) - `consent-records/` — 116 entries, e.g. `02d90f3d-0d23-443b-be98-f0a9029eb7d9.used.json` (keys above) - `refs/` — only `rollback-anchor` present (last touched by commit `bc0509971e3`, 2026-08-08); `refs/published` is absent from HEAD at this pin (`git show HEAD:.edits/refs/published` → not found), consistent with the legacy-git-ref fallback path (`book-git-spine.ts:280-288`), not obviously a defect. - `resolved-decision-outcomes/` — 24 entries, one file per idempotency key, e.g. `1c04fe7c1da7c0298b6bb372da9907dbc752edb184ba39808b13bf9360fbb1ca.json` → keys `outcome, factId, coverage{factsTouched, otherFactsWithSameValue, mentionsTouched, mentionsTotal, embeddedInOtherFacts}, note, summary, wishId, receipt{contract, requester, reader, said, gathered, acknowledged, reading}`. - No `outcomes.jsonl`, `invocation-timings.jsonl`, `.il-edit/`, or `pending/` present at this pin. **`ci:door-run`** (`package.json:43`) → `scripts/door-run.fixture.ts`: scratch-clones the repo, drives the real door through apply / refusal / a `facts`-reply (exit 78, zero byte effect, no commit) / a full undo restoring the exact prior fact/anchor set byte-identically, then asserts a commit receipt and clean tree. Its own final PASS line states what green certifies, verbatim: **"real door battery checked exits, contract receipts, facts/ and anchors/ byte effects, undo, crash output, and live-tree isolation."** "Live-tree isolation" is separately enforced: the outer `runGate()` hashes the *pinned* repo's `git status` before/after the whole battery and throws if it moved. **`gate:readonly`** (`package.json:34` → `walk-scratch.ts --gate-step -- `) is generic, not door-run-specific: `runReadOnlyGateStep` hashes every HEAD-tracked byte (`subjectTreeHash`, excluding a declared machine-records allowlist) before/after running a child command and throws `GateSubjectMutationRefusal` on any delta (`scripts/lib/walk-scratch.ts:210-289`, CLI entry `245-263`). Green ⇒ that step touched **zero tracked bytes**. **`book:health`** (`package.json:25`) → `runBookHealthCommand` (`edit-cli.ts:464-555`): requires zero `resources.lock.json` errors (`verifyResourcesLock`) AND zero `validateGenomeTree` findings for `HEALTHY`; exact green text: *"book:health: HEALTHY — all N promised resources are present and unchanged; every recorded fact is anchored or exempt."* (`504-508`). DAMAGED still permits staging edits — only preview/publish are blocked (`472-473,491-492,541-542`). --- ## 5. REMOTE DOOR Not Slack, not a poller, not a watcher — confirmed by a repo-wide `grep -rniE "\bslack\b"` (only two unrelated whitespace-trimming comments, `scripts/guard/change-safety-guard.ts:1066,1131`) and zero `.listen(`/`http.createServer`/file-watch code. Arrival is a **synchronous CLI invocation**: `npm run edit:request -- --instruction "" [--filing-id][--grounding][--requester][--result]` (`remote-edit-request.ts:384-388`) — whatever outer agent/workflow calls the door passes the teammate's ask as an argv string, either hand-typed prose or a fenced JSON `resolved-decision/v1` object (`{`-prefix check, `scripts/lib/remote-edit-request.ts:1629`). Idempotent replay via `resolvedDecisionIdempotencyKey` + `.edits/resolved-decision-outcomes/.json` (`remote-edit-request.ts:429,433`). `scripts/il-edit/edit-op-lock.ts`: exclusive file-based op locks with liveness. `acquireEditOpLock` (`211-275`) does an atomic `open(path,"wx")`; on `EEXIST` inspects the existing `{pid, acquiredAt}` payload (mtime-only for "legacy" locks) and reclaims if the holder pid is dead or the lock's age ≥ `STALE_LOCK_AGE_MS = 10 * 60 * 1000` (**10 minutes**, `line 23`, reclaim logic `167-184`); reclaims are journaled to `.il-edit/lock-reclaim.jsonl` (`73-81,244-262`). Two concrete lock files today: `.insert.lock` for `edit:insert-text` (`scripts/il-edit/ops/insert-text.ts:918-919`) and `.mint.lock` for `edit:mint-page` (`scripts/il-edit/ops/mint-page.ts:1020`) — this is not a whole-door mutex; ordinary `edit:fact`/`edit:request` rely on the git-commit collision rail instead. --- ## 6. LATENCY `scripts/lib/edit-invocation-timing.ts`: `installEditInvocationTimingRecorder(bookDir, args)` (`122-160`) is called once per process at the top of both `edit-cli.ts` (`edit-cli.ts:4188`) and `remote-edit-request.ts` (`remote-edit-request.ts:373`). Registers a `process.on("exit", ...)` handler that appends one row to `.edits/invocation-timings.jsonl` (`EDIT_INVOCATION_TIMING_PATH, line 4`) on **any** exit path except `SIGKILL` — the schema says so itself: `blindSpot: "A hard kill such as SIGKILL leaves no row because process exit handlers cannot run."` (`line 150`). Row: `command, flags, exitStatus, staged, wrote, commitProduced, moments{processSpawn,doorEntry,doorExit}, durationsMs{processSpawnToDoor, door, total}` (+ optional per-operation `transactions`). **No budget/threshold is asserted here — pure instrumentation.** At this pin `.edits/invocation-timings.jsonl` **does not exist** (confirmed absent, untracked). `scripts/arm-speed.fixture.ts` / `scripts/car-speed.fixture.ts`, despite the name, are **not wall-clock budget suites** — they're correctness proofs for the machinery that keeps edits fast: arm-speed cases (`218-225`) are `anchor-index` (cache reuse count, `97-116`), `guard-batch` (N edits share ONE completeness computation, `118-138`), `branch-order` (fail fast before real work, `140-156`), `adoption-output`, `spine-batch-record` (N mutations, one append, `178-216`). car-speed's `testInvocationTimings` (`206-255`) is the regression test *for* the timing recorder above, and explicitly asserts positional argument **values** never leak into the row (`rows.includes("Alfa")===false`, `246-247`). **The only genuine numeric wall-clock budgets found:** - `edit-undo.fixture.ts:186` (ci:edit-undo): `assert.ok(bElapsedMs < 60_000, ...)` — single-fact undo **<60s**. - `scripts/structure-mint.walk.ts:428` (a manual "walk", not wired to any `ci:*` script): `writeMs + produceMs < 60000`, logged as `"(the under-a-minute bar: ${...MET/MISSED})"` for mint+re-produce. - Runaway-guard timeouts (not "speed budgets"): `scripts/lib/edit-sweep.ts:443-444` and `scripts/lib/edit-transaction.ts:754-755` both default `wallMs` to **300,000 ms (5 min)**, overridable via `EDIT_SWEEP_WALL_MS`/`EDIT_TRANSACTION_WALL_MS`. **Recorded timing data on disk:** none (`invocation-timings.jsonl`/`outcomes.jsonl` absent). The one real artifact is the git-tracked `.edits/preview-verdict.json` (525 B) — verbatim: `schemaVersion 2, verdict "GREEN", generatedAt "2026-08-12T21:06:55.836Z", mode "incremental", pagesReprojected 0, pagesDeployed 178`, `basis: "0 fact(s) changed since the last passing preview; every other produce input is byte-identical except 0 authorized current-record anchor shard(s). Reach from their anchors: 0 page(s), 0 stylesheet(s)"` — no duration field. `.edits/machine-health.json` (222 B): `{schemaVersion:1, producerDigest:"f0807a3a...", nodeMajor:26, verdicts:{selftest:{passedAt:"2026-08-14T05:18:45.864Z"}}}` — also no duration. The strongest real latency number anywhere is qualitative: `scripts/lib/preview-extent.ts:5-7`, verbatim: *"`edit:preview` re-projects every page of the book... for a one-fact edit whose reach is recorded, exactly, in that fact's own anchor rows. On the real 744-page south-town book that is a multi-minute wait between typing a phone number and seeing it (s131 cold-walk)."* This repo's genome holds **187** pages (`pages/*.html`), and its last certified preview deployed **178** pages, 0 reprojected. --- ## 7. SERVING Nothing here is a running server — "serving" means locally materializing static output. `scripts/produce.ts` is the sole producer (`produce(opts): ProduceResult`, `622-733`); given `genomeDir`=repo root and `outDir`=`./site`, it reads each page's raw principal HTML byte-verbatim (`project-genome.ts`'s `projectPage`, `57-61`) and injects each edited fact's value by **substring splice at the fact's recorded byte-offset anchors** — i.e. **"reprint" is a per-page byte-splice against frozen principal HTML, never a template re-render**. For every touched HTML/CSS byte it writes a `.witness.json` sidecar (beside, not inside, the served tree) recording exact byte ranges per fact/carrier, letting the gate verify "per-span leaf" + "complement equality" (everything untouched is byte-identical to genesis) **without re-running the splice** (`produce.ts:22-38`). `opts.incremental` (`706-720`, `{slugs, cssAnchorFiles}`) is what makes `edit:preview` scoped: computed by `scripts/lib/preview-extent.ts`'s `boundPreviewExtent`, fail-closed and narrow — bounded only when every *other* produce input (`pages/`, resources, `manifest.json`, `serving/` config, and even the compiler's own vendored code + Node major, `PRODUCER_INPUT_ROOTS` `75-83`) is byte-identical to the last GREEN snapshot; any of those moving forces a full re-render (`preview-extent.ts:11-30`, root list `47-72`). `serving/` itself (this pin: only `_redirects`, 1,389 B) is a genome **input**, not produce output — the redirect source of truth (`scripts/lib/redirect-record.ts:2,248`: *"One redirect truth: factory observations recorded in serving/_redirects"*) — and any change under it is a `NON_FACT_INPUT_ROOTS` member that forces a full preview (`preview-extent.ts:66-69`). Finishing work (sitemap.xml, `resources.lock` verify, `_deploy-manifest.json`, deploy-skips, `produce.ts:19,1549`) runs once per call regardless of scope. At this pin neither `site/` nor `live/` exists on disk, so the <60s budget's real cost here is unmeasured; the only concrete scale numbers on record are the 187 genome pages vs. the last certified preview's 178 deployed / 0 reprojected pages (§6).