feat(site): publish News and unify Explanations navigation - #604

Review A (senior engineering review, round 1) · head
83642ad2c750d4981222e1db8e458523616548c0 · base main at
37e6757ed4c51a1d93f2f999814c2a5efbe2a223

Reviewer: strong tier, requested gpt-6-astra at xhigh · Channel: formal review
prepared for coordinator publication.
Coverage: 34 of 34 changed paths; exclusions: none. Reviewed the complete diff, all
new programs, and relevant surrounding renderer, math, release, link-resolution and
browser-test code.
Tests run: read-only Python 3.14.7 assertions and one directly invoked
regression function passed; two targeted reproductions demonstrated A1 and A2;
git diff --check passed.
No pytest suite or browser was run locally, as required by the coordinator’s
scratch-storage restriction.

Verdict: Address the two Medium findings below.
No High or Blocker finding.
Required CI and dedicated reviews remain prerequisites for merge; this review does not
claim browser validation.

A1 — Medium: Plain-text previews change the meaning of structured mathematics.

Locations:
render_changelog.py:733
and
render_changelog.py:760.

NewsPreviewText retains MathML text nodes but drops the structural elements that carry
roots, fractions and exponents.
render_news() joins those nodes and publishes the result as the collapsed preview.
The schema and sanitizer accept all three examples below.
Replacing one summary in an in-memory copy of the real record, then calling validate()
and render_news(..., limit=1), produced:

These are different mathematical statements.
The five math-bearing summaries in the frozen 22-entry record use simple expressions and
are unaffected; the failure affects valid content the renderer accepts.

Fix: Preserve a formula’s structure in the non-link preview.
Keeping the sanitized inline math subtree while removing links and block wrappers
preserves its existing rendering; a faithful source-TeX fallback for structured math is
also acceptable. Do not concatenate MathML text as a general mathematical serialization.
Add a regression using a root, fraction and exponent through the actual preview render
path.

A2 — Medium: The first “Show less” click does not close a card pinned through its
body.

Location:
news-cards.js:32,
particularly the click condition at line 41 and body pin at line 51.

Hover opens a card with newsTransient=true. Focusing or clicking its body sets
newsPinned=true but leaves the transient flag present.
The next pointer click on the summary enters the transient-pin branch, calls
preventDefault(), and leaves the card open.
A second click is required to close it, despite the visible “Show less” control.

An in-memory Node VM executed the actual file’s captured handlers in this order: pointer
enter, body-link focus, summary focus, summary click.
It reported:

after hover + body-link focus:
  open=true, newsTransient=true, newsPinned=true
after first Show less click:
  prevented=true, open=true, newsPinned=true

This is a reproduction of the JavaScript state transition, not a browser run.
The existing browser test pins through the summary before testing close; its later
body-link focus starts from a persistent keyboard-open state, so neither path covers
this transition.

Fix: Clear the transient flag whenever body interaction pins the card, or make the
click interception conditional on the card not already being pinned.
Add the browser transition hover → body interaction → one summary click → closed, while
preserving ordinary link activation.

Design assessment: Native details/summary is a suitable base for the requested
inline, keyboard, touch and no-script disclosure.
The shared YAML and _entry_lines extraction keep one history and one sanitized prose
path. Reusing the page container’s available width is a smaller and more maintainable
Atlas change than adding another viewport calculation.
No new dependency or broader redesign is needed.
The remaining design costs are the small hover/pin state machine and a preview
conversion that must preserve authored meaning; A1 and A2 identify their uncovered
cases.

Documentation: The README, development guide, URL registry, feature plan and design
system consistently describe News, its homepage preview, legacy About forwarding and
uncapped Atlas width.
The site advances to v0.7.0; independent paper and poster histories remain unchanged.
The paper release-impact explanation explicitly identifies the changed HTML navigation
and provenance links as site-owned, and does not claim byte-identical artifact builds.
No additional documentation finding.

Confirmed benign; do not change:

• GitHub changelog output is byte-identical to both the base renderer’s output and the
  checked-in CHANGELOG.md for the retained record.
  The extracted _entry_lines did not change it.
• The YAML is unchanged from the base: 22 entries, with frozen dates and PR membership.
  News renders every entry in stable newest-day order; the homepage selects exactly two
  individual entries before grouping them by day.
• All five regenerated claim documents equal their base bytes after only replacing
  /blob/93822bfe/ with /blob/37e6757e/. Their mathematical prose, certificates and
  embedded verifiers are unchanged.
• Mixed headings and phrasing inside summary are allowed by the current
  WHATWG summary content model.
  The daily H2 and preview spans are conforming markup.
• The existing math-preparation parser classifies details as sans.
  All 15 formulas parsed from the full News body select the sans profile; no extra News
  class registration is required.
• The narrow preview fix correctly removes duplicate hidden presentation and annotation
  text, including nested hidden subtrees.
  A1 concerns the distinct loss of mathematical structure.
• The Atlas change does not modify view, size, scale, Regularized/Original controls or
  the gray count styling.
  Its new width test checks both surfaces at 390, 1920 and 3200 pixels, with and without
  scripts, and includes a negative control that reinstates the old cap.
  These are source-reviewed tests, pending actual browser execution.
• No policy grants, dependency locks, workflows or frozen history were changed in this
  PR.

Validation evidence:

The coordinator reported passing scoped Ruff, Biome, JavaScript type checks, Python type
checks, Flowmark, release-impact, URL and direct-render checks.
Those reports supplement this review; they are not represented here as reviewer-run
tests or browser evidence.

CI status: Packing and
Pages were pending at
review time, including the frontend job.
Await the required current-head results and actual browser tests after addressing A1 and
A2. The separate temporary strict-checkpoint work and PR #599 are outside this review’s
merge dependencies.

Dedicated coverage: The coordinator will arrange separate security and correctness
reviews for the sanitized markup/link boundary, disclosure states, legacy anchors and
release/publication mapping.
No performance-sensitive algorithm or new large-data path was introduced.

Changed-path coverage (34/34):

• Reader documentation: README.md; development.md; docs/project/site-urls.md;
  docs/project/specs/active/plan-2026-10-13-site-changelog.md.
• Claim documents: packing/cases/n11_fractional_certificate/t-018-proof-card.md;
  packing/cases/n11_fractional_certificate/t-018-verifiable-claim-19-5.md;
  packing/cases/n11_fractional_certificate/t-018-verifiable-claim-381-100.md;
  packing/cases/n11_threshold_certificate/t-025-verifiable-claim-191-50.md;
  packing/cases/n11_threshold_certificate/t-026-verifiable-claim-dilation-limit.md.
• Python production and publication code: packing/devtools/check_published_site.py;
  packing/devtools/measure_atlas_views.py; packing/devtools/render_changelog.py;
  packing/devtools/render_overview.py; packing/devtools/site_documents.py;
  packing/src/sqpack/release.py.
• Browser code and measurement probes: packing/devtools/overview/news-cards.js;
  packing/devtools/overview/news-forward.js;
  packing/devtools/probes/measure_atlas_views/layout.js; deleted
  packing/devtools/probes/measure_atlas_views/widen.js.
• Templates, styling and URL data: packing/devtools/templates/about-article.md;
  packing/devtools/templates/news-article.md;
  packing/devtools/templates/overview-article.md;
  packing/devtools/templates/paper-design.md;
  packing/devtools/templates/site-nav.html; packing/devtools/templates/site.css;
  packing/site-urls.yaml.
• Test probe and tests: packing/tests/probes/site_homepage/news.js;
  packing/tests/test_changelog_publication.py;
  packing/tests/test_check_published_site.py; packing/tests/test_overview.py;
  packing/tests/test_site_atlas_views.py; packing/tests/test_site_documents.py;
  packing/tests/test_site_homepage.py; packing/tests/test_site_wide_blocks.py.

Suggestions: None beyond A1 and A2.

Review B (correctness review, round 1) · head
8c465d2090bcc2e5fa9b5762644446e3951c09f3 · base main at
37e6757ed4c51a1d93f2f999814c2a5efbe2a223

Reviewer: strong tier, requested gpt-6-astra at xhigh · Channel: formal review.
Coverage: 46 of 46 changed paths; exclusions: none. Current production code, tests,
probes, templates, workflow and documentation diffs reviewed; generated changelog and
five claim documents additionally checked by exact comparison.
Tests run: eight focused pytest cases passed in 3.08 seconds; both retained News browser
cases passed in real Chromium against the current preview; an additional short-card
resize probe passed; historical-record and generated-output assertions passed; one
schema-valid fixture reproduced B1.

Verdict: Address B1–B3: one Medium S5-rendering defect and two Medium test defects
confirmed by the current-head hosted frontend run.
No Blocker, High or Low findings.
The current 25 News entries and three homepage results render correctly in the exercised
cases. Required hosted checks and the dedicated security review remain separate merge
prerequisites.

B1 — Medium: A valid S5 result kind can abort the homepage render.

Location:
news_highlights.py:24,
passed to news_topics at line 33.

The selection accepts any result with significance 5. _article() maps only
formalization and simplification, then passes every other result kind unchanged to
the six-value News topic vocabulary.
The result schema also permits kinds such as rigidity, audit, correction,
case-exclusion, method-limit and restricted-optimality. news_topics() raises
ValueError for those values.
Because overview_page() calls news_highlights.render() without an alternate path, an
otherwise accepted S5 record can prevent the entire homepage from building.

Reproduction used an in-memory copy of existing rigidity result T-012, changing only its
significance score to 5 and its established date to 2026-10-14. The complete modified
result-register payload passed Draft202012Validator against
packing/frontier/results.schema.yaml (after removing its Soft Schema envelope, as
required by that schema).
The actual selection and rendering then produced:

schema_valid_candidate {"id": "T-012", "kind": "rigidity", "score": 5,
  "selected": ["T-012", "T-154", "T-153"]}
REPRODUCED ValueError unknown News topic

This is a fixture showing an accepted-input boundary, not a claim that T-012 currently
has S5. The current three highlights have supported kinds and are unaffected.

Fix: Define subject mapping separately from result kinds, with coverage for every
accepted kind. Omit a subject tag when none of the six labels accurately describes the
result, or use an explicit justified mapping; preserve the real kind/status chips.
Add a regression showing that an S5 rigidity or other currently unmapped result renders
without changing its claim or evidentiary status.

B2 — Medium: The homepage heading assertion rejects the three new News titles.

Location:
test_site_homepage.py:700.

The PR adds three News h3 headings, while this changed test still requires the global
lower_headings count to equal two.
The current-head hosted frontend job fails at both 1280 and 390 pixels with
assert 3 == 2. The focused News tests pass, but this integration assertion prevents
the required job from passing.

Fix: Make the heading contract distinguish the three News article titles from the
rest of the page, preserving meaningful checks for both.
Update the probe if needed and run both affected width cases.

B3 — Medium: The Atlas negative control asserts before its restored cap is
effective.

Locations:
width-cap.js:9
and
test_site_atlas_views.py:1956.

The negative-control probe writes maxWidth = "140rem" and immediately reads computed
style; the test then measures without waiting for that cap to take effect.
In the hosted atlas.html, scripts-enabled case, the probe reported a 16px root font
but computed max_width: "3120px", so the expected 2240px cap had not become effective.
The test failed with (3120 - 3120) > 500. This is a failure of the control’s setup
precondition; the preceding actual-width assertions passed.
The shared reduced-motion stylesheet supplies a 0.01ms transition, whose one-frame
behavior is already documented at site.css:2449.

Fix: Disable transitions on the measured element for this synthetic control, or wait
for its computed cap and geometry to settle before measuring.
Keep the greater-than-500px negative-control assertion, and rerun both Atlas surfaces
with and without scripts.

B2 and B3 are based on the retained log of
frontend job 116026059173,
which this reviewer inspected after it completed: 3 failed, 419 passed, 6 skipped in
273.44s. They are not new product-layout findings.
The coordinator is tracking their repair under think-i7qh.

Invariants checked

Design assessment: Rendering the complete sanitized article once avoids a separate
representation of mathematical prose.
The shared card renderer is appropriate for history articles and result highlights, and
the explicit disclosure state is small enough to inspect directly.
The remaining boundary needs a complete mapping between the independent result-kind and
topic vocabularies. No new dependency or broader redesign is needed.
No additional performance-sensitive path was identified.

Documentation: The plan, design-system document, navigation, URL registry and
maintenance instructions describe the current News cards, three S5 highlights, legacy
About forwarding and full-width Atlas.
No additional documentation finding.
The new subject tags do not change V/C status.
The result register and certificate files are unchanged by this PR.

Earlier review and confirmed benign cases:
Review A and
its dispositions
were read. A1 and A2 are not duplicated: their mechanisms were removed, and the current
math and browser checks above confirm the relevant behavior.
Initially short cards were specifically investigated for resize clipping; Chromium
showed empty inline caps and full body heights after narrowing, so no fix is requested
there. Atlas width changes retain the existing controls and horizontal panning.
The retained local validation record reports both repaired Atlas cases passing; this
reviewer source-reviewed those tests and their restored-cap negative control without
rerunning the large Atlas fixture.

Reviewer-run commands and limits:

• tbd shortcut review-github-pr review-code-correctness, review-code,
  pr-review-workflows, relevant engineering guidelines, and the remote
  stack-membership check were completed.
  stacks?pull_request=604 returned []; the PR targets main.
• Python was /Users/levy/wrk/github/squares/packing/.venv/bin/python3 with the
  reviewed tree and its checked-out kpress dependency on PYTHONPATH, bytecode
  disabled, and TMPDIR, CARGO_TARGET_DIR, UV_CACHE_DIR and pytest retention
  settings directed to the external scratch volume.
• python3 -B -m pytest -q -p no:cacheprovider tests/test_news_highlights.py tests/test_changelog_publication.py::test_news_cards_keep_the_actual_article_and_structured_math_once:
  8 passed in 3.08s. Here python3 denotes the absolute project interpreter above.
• browser-checks.py directly invoked both retained
  test_news_cards_expand_only_on_press_and_legacy_bookmarks_forward parametrizations
  against the coordinator’s current rendered files using the project’s Chromium
  launcher: 1280 passed; 390 passed. It did not rebuild the site or run the full
  browser suite.
• Read-only Python assertions checked the historical fields, generated changelog, five
  claim documents and release impacts.
  The separate schema-valid S5 reproduction produced B1. No source file or scientific
  record was edited.
• Discovery covered formal reviews, inline comments, PR comments and all-state issue
  search. The three numeric search matches (#495, #413, #405), including their paginated
  comments, contained no PR #604 review references.
  Only review letter A was in use before publication.
• The default-branch policy fetch completed and tbd policy show confirmed
  github-editing: granted; standard review requirements apply.
  Local and remote heads still matched the pinned head, and git status --short was
  empty.

CI status: The current-head
frontend job
failed on B2 and B3, with 3 failed, 419 passed and 6 skipped tests.
The retained News interaction cases passed in that hosted run as well as in the
independent local run.
The wider
Packing run 38614518600 and
Pages run 38614518630 were
still incomplete at the last status read.
Mergeability and Pages scope had passed.
The dedicated security pass applies to sanitized markup, links and publication mapping
and is coordinated separately.

Suggestions: None beyond B1–B3.

Review C (security review, round 1) · head
8c465d2090bcc2e5fa9b5762644446e3951c09f3 · base main at
37e6757ed4c51a1d93f2f999814c2a5efbe2a223

Reviewer: strong tier, requested gpt-6-astra at xhigh · Channel: formal review.
Coverage: 44 of 46 changed paths manually reviewed for security; the remaining two,
packing/site-changelog.yaml and generated CHANGELOG.md, received validation and
exact generation comparison rather than another editorial review.
The five generated claim documents were checked for the source-link revision change.
Surrounding YAML, Markdown/MathML, result-prose, URL and publication code was also
inspected. Tests run: 17 targeted retained tests passed in 1.74 seconds; additional
in-memory metadata, YAML and output-injection assertions passed; git diff --check
passed.

Verdict: No new security finding at this head.
Counts: 0 Blocker, 0 High, 0 Medium, 0 Low.
This does not clear the open correctness findings or failing required CI.

Findings and suggestions: None in this pass.
Review B
already owns B1–B3: unsupported result-kind mapping, homepage heading count and the
Atlas test’s transition timing.
The coordinator also owns the newly observed suite-a CSS contract failures.
They are not duplicated here.
Review A’s dispositions
were read; the current code no longer uses its lossy text preview or hover/pin state
machine.

Surface reviewed:

Design assessment: Reusing the existing sanitizer and URL policy keeps one authoring
boundary for the GitHub and News views.
The fragment forwarder resolves a generated destination instead of constructing a URL
from reader input. No additional sanitizer or navigation framework is warranted by this
change.

Documentation: The feature plan explicitly requires escaped metadata and refusal of
raw HTML and unsafe schemes; the reviewed paths implement that contract.
The public News destination and retained About bookmarks are documented consistently.
No security documentation gap found.

False positives / do not fix: Raw HTML construction in news_card receives the
already sanitized body on the changelog path and the escaped existing result-rendering
output on the highlights path.
legacy_news_anchors is called with load() output, so its metadata is validated
before interpolation.
The newly registered scripts do not fetch or interpret arbitrary fragment content.
These are not bypasses in their actual callers.

Reviewer-run evidence: Python was
/Users/levy/wrk/github/squares/packing/.venv/bin/python3 (project Python 3.14), with
the candidate tree’s packing, packing/src, vendor/kpress/src and workbench tools
on PYTHONPATH. Bytecode was disabled.
TMPDIR, UV_CACHE_DIR and a worktree-specific CARGO_TARGET_DIR were explicitly
under /Volumes/spud-ext1/agent-scratch/news604-review-c/; the mounted external volume
was writable with 1.2 GiB available.
Pytest retention was set to failed tests only, count one.

From the candidate packing/ directory:

/Users/levy/wrk/github/squares/packing/.venv/bin/python3 -B -m pytest -q -p no:cacheprovider \
  tests/test_changelog.py::test_markdown_rejects_html_and_unsafe_links_preserves_code \
  tests/test_changelog.py::test_math_generated_markup_and_urls_are_rejected_through_full_news \
  tests/test_changelog.py::test_normal_math_and_safe_math_links_survive_full_news \
  tests/test_changelog.py::test_reference_labels_are_local_to_each_summary_and_details \
  tests/test_changelog.py::test_structured_links_reject_decoded_markup_and_unsafe_authorities \
  tests/test_changelog.py::test_structured_link_markdown_delimiters_cannot_create_html_links \
  tests/test_changelog.py::test_real_structured_links_preserve_exact_canonical_destinations \
  tests/test_changelog.py::test_entry_anchors_cannot_borrow_an_existing_about_heading \
  tests/test_site_scripts.py

Result: 17 passed in 1.74s. The additional read-only Python assertions checked five
malformed metadata cases, three YAML rejection cases, title/label/link injection through
render_news, successful validation of the retained record and exact CHANGELOG.md
generation. No full site build or browser suite was repeated; browser interaction
evidence is in Review B, and the scripts were inspected directly here.

Discovery covered formal reviews, inline comments, PR comments and all-state issue
search. Only A and B occupied review letters.
The three issue-search matches (#495, #413, #405) were unrelated numeric matches; their
paginated comments contained no #604 review references.
stacks?pull_request=604 returned [], and the PR targets main.

The coordinator completed the required default-branch policy fetch to
37e6757ed4c51a1d93f2f999814c2a5efbe2a223; an independent tbd policy show confirmed
github-editing: granted and standard review requirements.
GitHub confirmed same-repository author jlevy, association OWNER. Local and remote
heads still matched the pinned head, and git status --porcelain was empty.
No source, Git or bead state was changed by this reviewer.

CI status:
Pages run 38614518630
completed successfully.
Packing run 38614518600
failed in frontend, suite-a and the aggregate packing-required check; those failures
remain for the coordinator to repair.
Other required checks and mergeability were read from gh pr checks. Security review
completion is not a merge-ready verdict.

Review D — follow-up, round 2

Reviewer: strong tier, requested gpt-6-astra at xhigh. Reviewed head:
d08551e0aba9cc92eb4d17389bb8c7a4bd1cdf81. PR base:
37e6757ed4c51a1d93f2f999814c2a5efbe2a223. Coverage: 27 of 27 changed paths in the
follow-up delta from 8c465d2090bcc2e5fa9b5762644446e3951c09f3 to the reviewed head,
plus relevant callers and shared navigation, title, CSS and header-test code.
This covers the B fixes, newly requested News presentation, Explanations navigation and
project branding, and their tests and documentation.
The earlier A, B and C reviews cover the preceding PR changes.

Verdict: No outstanding findings in this follow-up delta.
D1, a Medium test regression found during the precommit review, is fixed in the reviewed
head. Finding totals for this round: 0 Blocker, 0 High, 1 Medium (fixed), 0 Low.
Final-head hosted CI is still running; this review does not establish merge readiness.

D1 — Medium, fixed: Header layout test retained the replaced navigation and tab
counts.

The precommit version of
packing/tests/test_site_wide_blocks.py::test_the_name_stands_on_the_links_baseline
required eight navigation links and two section tabs.
The new shared navigation emits seven links and three tabs, so the test would fail
before finishing its layout assertions.

The reviewed head checks the exact seven navigation labels and the exact Papers, Film
and Workbench tab labels, preserving baseline, wrapping and spacing assertions.
It also adds papers.html to the existing section-page fixture and adjusts the negative
control’s owner to account for that new page.
Tracker: think-0fph. Source inspection and the retained seven-case targeted rerun
confirm the repair, including desktop/mobile tab placement and negative controls.

Behavior and fixes confirmed:

• B1: TOPIC_BY_KIND maps the five supported subjects explicitly and omits a topic for
  other accepted result kinds.
  Actual kind, status, claim and credit retain their existing rendering paths.
  Tests cover all accepted kinds and a real rigidity result promoted into S5. The latter
  now correctly derives its expected status from the promoted candidate.
• B2: the homepage probe separates News headings from other lower headings.
  Assertions require the three selected IDs, nonempty titles and no unexpected lower
  headings.
• B3: the synthetic width-cap negative control disables its transition before measuring
  the applied cap. Its measured element and greater-than-500-pixel negative assertion
  remain intact.
• News: both surfaces render date, normal foreground H3, smaller topic chips, then
  article content. The chips use 85% of the note-size scale.
  Probes compare rendered titles with an ordinary H3 and check the actual order and chip
  size on both surfaces.
• Explanations: the single main-navigation item leads to existing papers.html. Shared
  Papers, Film and Workbench links preserve their existing URLs; centralized aliases
  select Explanations for existing paper and film callers.
  The workbench uses the correct relative root.
  The papers landing selects Papers beneath its Explanations heading.
• Branding: the homepage browser and sharing titles use exactly “The Squares Project”
  through the shared title generator.
• CI contracts: icon-mask validation admits the exact News fade selector and gradient
  while retaining the remaining icon checks.
  The rung reader handles grouped status selectors while retaining all five statuses,
  both themes, gamut and contrast checks.
• Documentation matches the navigation names and News order.
  No scientific record, component version, dependency, policy or permission change
  occurs in this delta.

The final source matches the frozen reviewed overlay: only whitespace formatting changed
in the design and plan Markdown files, and the two acknowledged test repairs match the
subsequently inspected versions.
The local tree was clean at the reviewed head, and the same-repository PR belongs to
jlevy.

Validation evidence: This reviewer ran no tests or builds, as required by the
read-only brief. Review used git diff, git show, rg, source reads, final-head and
clean-tree checks, policy inspection, GitHub review/disposition reads, and comparison of
the retained precommit delta with the committed result.
The reviewer inspected the coordinator’s retained validation report and JUnit evidence:

• Seven final targeted cases passed in 38.77 seconds: the corrected S5 fixture,
  shared-header baseline/type, desktop/mobile section tabs and negative controls.
• Six browser cases passed in 87.75 seconds: desktop/mobile homepage and News checks,
  plus Atlas width with and without scripts.
• Four paper-navigation cases and 125 publication-audit cases passed.
• The broader affected contract run reported 440 passes and one new fixture expectation
  failure; the exact failed case was corrected and passed in the seven-case rerun.
• Ruff, Biome, the strict probe TypeScript check and BasedPyright passed; release-impact
  validation reported no errors.
  Normal commit hooks passed.

The source and validation evidence support the B1–B3 dispositions in
the coordinator’s response.
No further finding or suggestion arose.
No new security or performance-sensitive boundary appears in this delta; the sanitizer
and fragment-handling paths covered by
security review C
are unchanged.

Review E (senior follow-up, round 3) · head
296c65c90fd5f25c0a674abb92e798e02bb721ee · base main at
2319afaa581355a6e35a27f51698aa1c64d487f4.

Reviewer: tbd-strong, configured for gpt-6-astra at xhigh. A separate backend
model identifier is not exposed to this runtime.
Reviews E and F are distinct checklist passes by this same independent reviewer, not two
independent reviewers.
Channel: formal review; coordinator publishes.

Coverage: All 63 paths changed since the previously reviewed implementation at
fe2f20ee65c7d93e6fb3aa13d48bc02031d5aafe, with focused surrounding source.
The complete PR changes 87 paths against main; the other 24 paths are unchanged by this
follow-up and remain covered by preceding reviews A–D. The reviewed sets comprise the
31-path News significance/topic increment, the 35-path tutorial integration, and the
12-path final chooser increment, with overlapping paths counted once.
Their union covers every current follow-up path.
The five generated claim documents were verified by complete substitution comparison,
not treated as new mathematical manuscripts.
The final plan, release-scope and tooltip corrections were read at their immutable
commits and confirmed in the pinned, clean worktree.

Tests run: Own-tree Python 3.14.7 with -B and bytecode disabled; eight retained
source controls, six additional title-escaping probes, release-impact inspection against
main, release/data AST comparisons, policy-file comparison, source-identity checks and
git diff --check passed.
Earlier scoped checks and the tutorial preservation audit are recorded in the linked
review evidence below.
Producer browser evidence was inspected, not rerun by this reviewer: four retained
chooser/bookmark cases and two corrected tooltip cases passed at desktop and mobile
widths.

Verdict: approve the reviewed changes.
No open findings. The two Low interaction findings are resolved and documented as F1
and F2 in the dedicated correctness pass.
Current-head hosted CI, the complete push gate and the merge checkpoint remain the
coordinator’s responsibility; this review does not attest that they passed.

Design Assessment

News significance is an explicit editorial score with a plain rationale, independent of
verification or confirmation rungs.
The importer requires that decision for a new article rather than borrowing the score of
a cited result. Historical validation reads the historical record and its historical
schema together, preserving the existing frozen date and PR-membership rules while
adding the required rating to current entries.
All 25 ratings were reviewed against the rubric.

The topic registry is shared by Results, homepage highlights and the News archive.
It preserves all 12 registered result kinds and adds the three News-only subjects.
Formalization, Simplification and the other precise kinds are not relabelled Optimality.
Sentence-case labels and color roles remain consistent; result kind keys and assurance
qualifiers are unchanged.
Homepage highlights keep their registered claims, credits, dates, V/C rungs and explicit
V0 qualification.

The final controls reuse the existing small chooser component rather than maintaining a
second set of button styles.
Single-select tabs retain their existing tab semantics and keyboard handling;
multiple-selection groups use native buttons with aria-pressed. All and Reset remain
ordinary actions. Visually hidden legends retain accessible group names.
The count uses the Results control row and aligns to the cards’ right edge.
The retained browser contract compares both chooser states under normal, hover and
keyboard focus in both themes, and rejects an injected page-specific font override.

News cards share a title/date/metadata header on both surfaces.
Topics occupy the left side; one fixed-width significance meter sits on the right.
Its shared tooltip contains both the rung definition and the article’s rationale.
Disclosure remains a press action, with ordinary body-link focus revealing the article;
tooltip focus now leaves it collapsed.
The original articles and ordinary links remain available without JavaScript.

The title renderer uses the existing escaped mathematical-headline boundary.
Plain HTML and code remain escaped, and the Markdown-link recognizer only admits HTTP(S)
addresses. The retained title regression and six probes covering script/image markup,
JavaScript/data links, attribute quotes and code spans produced no executable element,
event-handler attribute or unsafe-scheme link.
This is a targeted boundary check, not a new independent audit of the math library.

Tutorial and Editorial Integration

The short basic tutorial and advanced companion retain their separately reviewed
manuscripts and the corrected field-degree qualification, contact legend and
preservation receipt.
The wrapper integration registers both pages, links, math inventories, publication
checks, URL history and browser surfaces.
The advanced page receives the former long tutorial’s measured size budget; the basic
page keeps the ordinary reader-page budget.
The exact root filename exception does not permit a duplicate advanced tutorial under
packing/.

Legacy tutorial sections remain visible relocation links into the advanced text.
Explanations orders Tutorial, Papers, PDFs and Visuals, with the basic tutorial first
and its advanced companion beside it.
The Film/Workbench links remain available, and the inline film does not autoplay.
A direct in-memory Explanations render confirmed this section order and both tutorial
links without constructing the whole site.

The 37 final News copy edits were checked against the structured old/new map.
Applying precisely those title, summary and detail replacements reproduces the current
record; all remaining metadata is identical.
The prose retains the n=17 V0/C1 limitation, sampled rather than exhaustive checks,
unestablished independent continuous-cover claims, finite-feasibility versus optimality
boundary, and the historical adoption/supersession distinctions.

Release and Policy Boundaries

The integrated site has one minor successor, v0.6.2 to v0.7.0. The unpublished v0.8.0
intermediate entry is absent.
All five non-site publication histories and DATA_REVISION are AST-identical to main.
AGENTS.md is byte-identical, including its policy block.
No scientific registry, witness or mathematical checker changes in this follow-up.

The fresh no-public-change decision names the four paper components, their 12 outputs
and the exact 20 affected source paths.
The twentieth path is the shared chooser stylesheet; its stated effect on print-hidden
navigation is consistent with the code.
The standalone paper manuscripts, figures and paper-owned typography are unchanged.
The five generated claim documents change only repository source-link provenance.
check_release_impact.inspect(base=2319afaa...) reports no errors.
No PDF rebuild or PDF byte-identity claim is made.

Documentation and Evidence

The final design template and active plan describe the actual title-first header,
topics/meter row, shared compact controls, accessible hidden group names, right-aligned
count and split tutorials.
The plan correction at f44b3893403f2f31a459729dfe21342edf636d8d and release-scope
correction at ddd8d9bfee095d0339922c3090438cbad1010fa4 are included in this approval.
No further documentation correction was identified.

Local evidence retained beside this report includes the earlier
News review, the
tutorial preservation review, the
37-field copy-edit map, and the
dedicated correctness confirmation.
The producer’s retained browser results are
the four chooser/bookmark cases and
the two tooltip cases.
Both tooltip-tested source files are byte-identical between producer commit
d11ec4b5e5b27def44c728739e865b602a231ac6 and this final combined head.

No source, Git, GitHub or bead mutations were performed by this review.
Only the authorized durable review evidence was written.

Review F (dedicated correctness, round 3) · head
296c65c90fd5f25c0a674abb92e798e02bb721ee · base main at
2319afaa581355a6e35a27f51698aa1c64d487f4.

Reviewer: tbd-strong, configured for gpt-6-astra at xhigh. A separate backend
model identifier is not exposed to this runtime.
This is the same reviewer as E, applying a dedicated correctness checklist; it is not a
second independent reviewer.
Channel: formal review; coordinator publishes.

Coverage: The 63-path follow-up since fe2f20ee65c7d93e6fb3aa13d48bc02031d5aafe,
within the PR’s 87 changed paths.
The other 24 paths are unchanged since preceding reviews A–D and are excluded from this
new pass. Particular attention went to rating/schema/history boundaries, shared topic
identity, filter/disclosure state, tutorial preservation and link registration,
escaping, release identity and retained failure controls.

Tests run: Own-tree Python 3.14.7 -B direct controls and in-memory comparisons,
plus source inspection of the browser regressions and their retained passing JUnit
results.
No new browser run, complete pytest suite, site build, PDF export or hosted gate
was run by this reviewer.

Verdict: approve. F1 and F2 are resolved at the reviewed head.
No open findings or additional suggestions. Hosted CI and the complete push/merge
gates remain pending; this is a source and bounded behavioral confirmation.

F1 — Low, Resolved: Encoded Bookmarks Left the Revealed Card Collapsed

Original location: packing/devtools/overview/news-cards.js:100 at
f8395bc2f2d0235764d3e2065143d217b6bacd27. This was provisional C1 in the earlier News
review.

The filters decoded a percent-encoded fragment, but the disclosure script used its
encoded spelling in getElementById. A long S3 card addressed by #%6Eews-encoded-test
consequently became visible under the S4/S5 defaults while retaining
aria-expanded=false. The plain spelling expanded correctly.
Both original complete scripts were exercised in a Node VM to reproduce the distinction
while retaining the unrelated reader=kept parameter.

Fix confirmed: decodeURIComponent now runs once inside a guarded resolver;
malformed escapes return harmlessly.
The browser regression enters the encoded low-score bookmark directly from the hidden
initial state, so a previous plain-hash visit cannot mask a failure.
It requires widened facets, full expansion, unchanged encoded URL spelling and preserved
unrelated parameters.
A malformed UTF-8 escape must leave defaults intact without a page error.
Ordinary bookmarks, Back/Forward and no-JavaScript behavior remain covered.

Fixed in 2df6f9278949e62274cef4c17f9a51a06e5c4a85, integrated as
17ead6a3902615a9fa8fc2abbcd22766e08ae4fa, and retained at this final head.
The four-case desktop/mobile chooser and bookmark JUnit record contains no failure,
error or skip. This reviewer inspected that evidence and the source, rather than
rerunning its browser fixture.

F2 — Low, Resolved: Tooltip Focus Expanded the Article

Original location: packing/devtools/overview/news-cards.js:74 at
17ead6a3902615a9fa8fc2abbcd22766e08ae4fa. This was provisional C2 during the final
interaction review.

The body unconditionally expanded its card on focusin. The shared tooltip script makes
the significance meter focusable and displays its explanation on focus.
Its click and keydown propagation guards run too late to prevent the earlier bubbling
focus event from expanding the article.
Thus keyboard focus or a focus-producing tap could reveal a long article when the reader
only requested the significance explanation.
This finding was established from the complete disclosure and tooltip event paths.

Fix confirmed: The body focus handler now ignores a target within
[data-site-tooltip], retaining the existing expansion behavior for ordinary links.
The guard is confined to enhanced tooltip triggers.
The retained desktop/mobile regression requests the tooltip by hover, focus and
click/tap, verifies its exact rung definition and article rationale, and requires
unchanged card/body heights with aria-expanded=false. It then retains the original
ordinary-link-focus expansion assertion.
The no-JavaScript and legacy-bookmark checks remain intact.

Fixed in d11ec4b5e5b27def44c728739e865b602a231ac6, integrated as this final
296c65c90fd5f25c0a674abb92e798e02bb721ee commit.
Both changed files are byte-identical between the producer-tested and final commits.
The two retained desktop/mobile JUnit cases passed without skips; no timing-floor
compliance is inferred from their aggregate durations.

Correctness Checklist

• Record truth: All 25 explicit ratings follow the stated rubric; neither scores nor
  topic labels confer a V/C rung.
  The schema refuses missing, Boolean, fractional or out-of-range scores and invalid
  rationales. Importing a cited S5 result does not silently score its enclosing article
  S5.
• Historical truth: Historical validation uses the record and schema from the same
  immutable revision. Frozen-entry removal, date and membership protections remain.
  The 37 copy edits change only the declared prose fields; delivery, publication,
  omission, rating and frozen metadata remain exact.
• Filter state: OR within each facet and AND across facets, explicit empty
  selections, defaults, All, Reset, unrelated query parameters, Back/Forward and
  bookmark widening remain consistent.
  Native buttons retain accurate pressed states; the groups do not pretend to be
  single-select tablists.
• Shared presentation: All 12 result kinds plus the three News subjects retain one
  topic vocabulary. The five-segment meter fills the selected number of segments.
  Both surfaces expose one significance meter per card.
  The count and chooser checks compare real computed styles and include a page-specific
  override negative control.
• Escaping: The retained title test and six additional HTML/URL/code-boundary probes
  passed. Existing structured-reference rejection tests still refuse decoded markup,
  unsafe authorities and Markdown-delimiter attacks.
  The plain mathematical headline path does not admit JavaScript/data links or raw HTML.
• Tutorial preservation: The manuscript review’s three corrections remain intact.
  The wrapper changes preserve old section landings, register both pages and apply the
  long-page budget to the advanced document.
  The Explanations order and no-autoplay behavior were confirmed by a direct in-memory
  render. No new mathematical or independent-confirmation claim was introduced by the
  wrappers or copy edits.
• Release boundaries: Exactly one site minor successor, v0.7.0 after v0.6.2,
  remains. The five non-site histories and data pin are unchanged.
  The exact 20-path/12-output paper exemption passes the release-impact checker.
  AGENTS.md is unchanged.

At the final head, eight retained tests were invoked directly: mathematical title
escaping; shared Markdown/site rendering; semantic negative boundaries; unsafe prose
links/HTML; decoded structured-link markup/authority refusal; structured delimiter
refusal; canonical structured destinations; and the shared News topic vocabulary.
All passed under Python 3.14.7 with module paths asserted inside the reviewed worktree.
Release-impact inspection, complete non-site history/data AST comparisons, clean-tree
checks and git diff --check also passed.

Design Assessment and Documentation

The changes keep editorial importance separate from scientific assurance, reuse the
existing presentation components and give each interactive control its actual semantic
role. The two targeted fixes preserve the broader disclosure/filter state machine.
No alternative architecture or additional abstraction is needed for these corrections.
The current plan and design template describe the final interface; no outstanding
wording correction was identified.

See Review E for the full coverage map, source integration and
release assessment, and the original News review for the
pre-fix reproduction and earlier validation record.
Only authorized durable review evidence was written; no source, Git, GitHub or bead
mutation was performed.

Review G (senior/correctness follow-up, round 4) · head
ffca9c1937e258f89cd4b377fbc2cbebb3bfadaa · base main at
2319afaa581355a6e35a27f51698aa1c64d487f4.

Reviewer: tbd-strong, configured for gpt-6-astra at xhigh; no separate backend
model identifier is exposed.
Channel: formal review; coordinator publishes.

Coverage: All eight files changed since the E/F-reviewed head
296c65c90fd5f25c0a674abb92e798e02bb721ee: README, overview_sections.py, the design
template, the homepage state probe, and the changelog, overview, result-overview and
result-column tests.
The earlier feature review is not repeated.
The final source was pinned and clean.

Tests run: Own-tree Python 3.14.7 -B checks passed: 12 old/new significance-mark
comparisons, all V/C rung captures, all 17 registered ladder cells, three retained
tests, README layout/links, release-impact inspection, changed Python parsing and
policy/release identity checks.
git diff --check passed.
The producer’s retained browser and targeted pytest receipts were inspected; no complete
suite, browser build, PDF export or hosted gate was rerun by this reviewer.

Verdict: approve. No findings or outstanding documentation corrections. Fresh hosted
CI and full-gate results are not attested by this review.

Design and Correctness

The only production change removes an unused class from the significance label’s inner
span. Repository searches found no CSS or JavaScript consumer of that class.
The span, visible S value, aria-hidden, outer accessible label, tooltip data and five
segments remain. Twelve old/new outputs, covering S0–S5 with empty and escaped meanings,
differ only by the 32-byte class="site-significance-label" attribute.
The updated parsers retain group 1 as the rung label and produce identical results for
all registered V/C chips and all 17 displayed ladder cells.

The coordinator’s complete n=17 comparison reports 19 removed attributes: 500,230 to
499,622 bytes, exactly the old HTML with that attribute removed.
The 500,000-byte page budget is unchanged.
This review independently verified the producer transformation, not the complete case
render measurement.

The escaping fixture still includes a script element and requires escaped delimiters
with no raw <script> output.
Replacing its executable body with inert text preserves that boundary while satisfying
the repository’s no-JavaScript-in-Python rule.
README now names and accurately distinguishes both tutorials, including the advanced
file in its layout tree.

The result-column contract now describes the requested fixed-width five-segment meter.
It pins the S column to 102.5 ± 0.5 pixels and the complete table floor to 1124.5 ± 0.5,
rather than retaining the old numeric-mark limits.
Both tables must still fit their 1200-pixel track without scrolling at a 1280-pixel
viewport. Narrow-view panning is bounded at 181/437 pixels and must equal the actual
table width minus its frame width.
Long case lists require nine lines at 1440 and ten at 1280; the existing column floors,
measures, unbroken values/ranges, chip widths, formula checks and phone constraints
remain. These are specific geometry updates for the changed design, not a relaxation of
validation timing ceilings or a removal of content guards.

The retained browser receipt measures a 1124.8-pixel complete table locally, within the
contract around the hosted 1124.5-pixel value, with 180.8/436.8 pixels of panning.
It reports no overflow or wrapped chips on either surface at any tested width.
The homepage probe now selects the actual nested header and reads its closest article’s
entry ID; it still distinguishes those headlines from other lower-level headings.
The complete result-column module plus both homepage order cases passed: 78 tests, no
skips. The observed homepage IDs remain T-154, T-153 and T-060 at both widths.

The remaining overview assertions follow the existing shared vocabulary and structure:
the restricted-optimality label comes from the canonical topic registry, and the Part
III card is identified within the Papers section instead of by a shifted global ordinal.
The T-060 claim, mathematics and V3/C3 assertions remain.
Tutorial and Papers are separate frames for the median-size check.
The sole declared exception is the prominent Tutorial section: exactly its two expected
links must use large reading cards.
Every other section retains its median-text rule.

Documentation and Validation Limits

The design template documents that narrow Tutorial exception and replaces the stale
Papers-page description with the actual Explanations sections, reading order,
independent paper editions, reader-document tutorials and paused Film/Workbench
presentation. No additional behavior is introduced by those wording corrections.

The earlier meter-suite receipt records 22 passes and one stale-import failure; it has
not been relabelled a clean run.
The corrected topic-label test passed in a fresh process, as recorded in
the confirmation log.
The 78-case browser evidence and concrete dimensions are retained in
the result-column repair log.
These local receipts do not establish hosted timing compliance or a complete
current-head gate pass.

Release-impact inspection against main passes.
AGENTS.md and release.py are byte-identical to the E/F-reviewed head; there is no
policy, version, data-pin or scientific-record change in this repair.
No source, Git, GitHub or bead mutations were performed by the reviewer; only this
requested durable evidence was written.

Review H (senior/correctness integration follow-up, round 5) · head
6f8dafa3d21003361b5eb2c75297724b589b119f · base main at
77fa15c7e8dfe8adf62e446198792a23b43864d9.

Reviewer: tbd-strong, configured for gpt-6-astra at xhigh; no separate backend
model identifier is exposed.
The same reviewer performed both passes.
Channel: formal review; coordinator publishes.

Coverage: All 11 overlapping paths between the previously reviewed PR604 head
ffca9c1937e258f89cd4b377fbc2cbebb3bfadaa and incoming main605, including all nine
conflict resolutions and the automatic development/math-markup merges.
Also checked incoming AGENTS and credit-policy preservation, every nonoverlapping
object/deletion against its respective parent, and the final two-file H1 correction.
The complete PR has 83 changed paths against the new main; earlier feature and browser
implementation review is not repeated.
Main605’s 98-path research/intake change is upstream work, not a newly reviewed
mathematical contribution of PR604.

Verdict: approve. H1 is resolved; no open findings. This confirms the bounded
integration and correction.
Fresh CI at the final head remains required and is not attested by this review.

H1: Intake Recommendations Must Not Imply Completed Adoption

Low, resolved (think-gp10). At integration commit
1ba5cc893ad9146dcc7781ecf12ac7c1d3a8a2ce, the new News summary said a claim “enters
the 14 October register” when its side is smaller.
The retained intake ledger compares reported sides; it explicitly does not verify
certificates. That wording could be read as a completed frontier adoption, although this
integration changes no frontier record.

The final commit says the ledger “recommends recording it only when its side is
decisively smaller.”
I verified the correction in both the authoritative YAML and regenerated CHANGELOG. The
summary is the sole structured-record change after the merge; all scores, topics, dates,
source references, delivery evidence and historical records are unchanged.
The current schema, historical validation and generated Markdown signature pass at the
final head.

Release and Generated-Document Integration

Main’s v0.6.3 history and its v0.6.2→v0.6.3 patch decision are preserved.
Exactly one pending v0.7.0 history entry and one minor-impact decision precede them, now
with v0.6.3 as the predecessor.
Removing those new first entries produces main’s complete history and impact sequences
exactly. README retains the reviewed v0.7.0 wording and both tutorial entries.

All five non-site component histories, DATA_REVISION and the retained publication pin
match main. The five generated claim documents are byte-identical to main, with
PUBLICATION_REVISION=e4d46b8d. That pin resolves to
e4d46b8d592cf96505ebb59558bd441eeda8a04e, an ancestor of the reviewed base.
Independent comparison showed that both parents’ claim documents differ only by the
source-link revision; no theorem, verifier, certificate or explanatory content is lost
by retaining main’s copies.
This pin identifies retained claim-document source and does not require a new paper or
poster edition for the UI change.

The incoming historical no-public-change decision describing main605’s 54-file explainer
comparison is retained verbatim.
It remains evidence about that earlier cut; this review does not claim another
byte-identical PDF rebuild.

The fresh PR604 no-public-change decision now names exactly the 15 changed producer
inputs affecting the four papers.
It drops the five claim documents because those are identical to the new baseline.
I ran the actual release-impact inspection against 77fa15c7…: no errors, all four
papers exempt, and the union of their candidate paths exactly equals the fresh
declaration. The site changes have their separate v0.7.0 cut.
The reason distinguishes reader-document and site chrome changes from unchanged paper
manuscripts, figures and paper-owned styles; it makes no new PDF-equality claim.

News and Policy Preservation

All 25 previously reviewed News entry objects survive verbatim, preserving the copy
edits, significance rationales and topic choices.
The new intake entry adds S3 with Engineering and Verification topics.
That is consistent with the focused public-audit anchor; incidental citations to
mathematical reviews do not confer their significance or verification ratings on this
announcement. Its 306 claims, 163 counts and 28 reports agree with the retained intake
source.

The delivery map is exactly the union of the two parents.
The added #601 record retains its real title, merge time, main base and merge commit.
No publication receipt or result adoption is invented.
The final record has 26 entries, 51 deliveries/coverage PRs, 38 represented PRs, 13
unchanged omissions and all 22 branch-frozen entries.
Those 22 include all 20 frozen entries on incoming main.
The existing historical identity check passes against the new main’s own schema.

AGENTS.md equals main exactly, including the merge-commit and issue-label guidance;
the effective policy-grant block is unchanged.
The incoming name-based credit rule in epistemics.md is preserved.
Development keeps both new policy sections and the branch’s News maintenance
instructions. The math-markup merge adds exactly main’s four literal GitHub-label
exceptions while retaining the tutorial additions.

Every path changed only by PR604 retains its exact reviewed object or deletion from
ffca; every path changed only by main605 retains its exact incoming object or deletion.
The overlapping paths were inspected separately.
Browser implementation files and probes are unchanged from ffca.
No frontier or retained atlas-data path differs from the new main.

Actual Validation and Limits

Read-only checks used the existing external Python 3.14.7 with -B, disabled bytecode,
explicit own-tree imports and task scratch/cache variables.
No build, temporary checkout, new environment, browser run, mathematical replay or
complete pytest suite ran in this review.

The reviewer independently checked immutable Git object/deletion preservation,
release-assignment AST identity, claim-document byte identity, pin ancestry, News
structured-record unions, schema and historical validation, generated CHANGELOG
signature, exact release-impact scope, and the two-file H1 delta.
Scoped git diff --check passed.
Initial helper assumptions about deleted paths and differing frozen-entry counts were
corrected before the successful comparisons; those were inspection-script errors, not
source findings.

I parsed the retained 66-contract JUnit: 66 cases,
zero failures, errors or skips.
The producer log reports 12.72 seconds.
Those executions and the reported normal hooks were performed by the coordinator, not
rerun by this reviewer.
The coordinator reports that ffca’s retry passed all 424 site browser cases and
Workbench checks.
Byte preservation supports the implementation-continuity conclusion; it
does not turn that previous-head run into a passing current-head cohort with the new
News data and upstream intake changes.

The final source was clean and pinned.
No source, Git, GitHub or bead mutation was performed by this reviewer; only this
durable review artifact was written.