Changelog

Register, not decoration — the article surface says what it means

Owner report: the article theme still read as "AI design slop", with a figure

cut off at the frame. Four defects, each measured in a browser before and after.

The figure-width gate had never fired once. ARTICLE_TRACK_PX in

tools/build-article-diagrams.mjs was 1100 while the real reading column is

--rz-measure: 46rem = 736 px, so the build reported PASS on every figure —

including the two widest, method-assessment at 1068 px in articles 6 and 8,

which hide 31 % of themselves behind a scroll. It also measured the wrong thing:

it computed the type size a wide figure "would" shrink to, but a figure is never

scaled — .rz-figure gives it a scroll track and the min-width pin keeps it 1:1.

Rewritten around the real mechanism: report each figure's overflow ratio and the

fraction off-screen on arrival, fail only past 2× the column. Proven in both

directions — 11 figures now reported, 0 failing; lowering the threshold to 1.4

produces exactly the 3 expected failures.

The padlock contradicted the state it described. #pfasProBtn carried

fa-lock hardcoded in markup, so a signed-in root saw unlocked panels behind a

button still wearing a closed padlock. syncLockAffordance() now drives the icon

and aria-label from isPremium, and is called on arrival in both states —

measured: anon previously had no aria-label at all. Five gate panels also said

"requires Full access access"; the inline amber hex on the login heading now

resolves through --rz-signal-amber.

The chemistry blocks were two registers sharing one class, and neither worked.

white-space: pre-wrap preserves alignment spaces and wraps, so the dot leaders

never held and overflow-x: auto never engaged. Measured on the real 741 px

column: all seven blocks wrapped, 8–16 extra lines each; at 390 px, 15–22. Block 6

rendered 14 source lines as 30, more than half of them continuation debris in the

column where a key belongs. Split by what the content is: three key→value blocks

became real tables (.pfas-chem-table, stacking below 560 px), four worked

calculations became .pfas-chem-calc with white-space: pre and their own

scroller — alignment now holds, and all five scrollers reach their end on a phone

viewport with no page-level horizontal scroll — and the read-out sentences that

were sitting inside the mono blocks moved to .pfas-chem-note in prose type.

Captions were arguing in an instrument voice. Measured across the whole corpus,

not one page: all 13 .rz-figcaption entries run 276–367 characters in IBM Plex

Mono at .78 rem with .02em tracking. Mono with positive tracking is this site's

register for a reading or a unit; three sentences of argument in it is the

typography claiming "machine output" about the author arguing. Every caption was

already written as one short declarative lead plus the argument, so the split is

the author's own: .rz-figcaption-lead keeps mono, .rz-figcaption-note gets

prose type, provenance stays instrument meta in .rz-figcaption-src. No caption

text changed — verified character-for-character against HEAD across all 13.

The split lives in captionMarkup() inside the build tool, not in the pages: this

tool owns everything between <figure> and </figure>, and the same structure

applied by hand was reported out of date by --check and would have been

overwritten by the next build. Article 28's figure is hand-authored and carries no

data-rz-figure, so it keeps its own copy.

The rules the gates were graded against disagreed with each other

Three documents stated three different reading measures and the figure gate was

calibrated to a fourth. --rz-measure: 46rem = 736px is now canonical, recorded

in documentation/design.md; design.md's 1.55 / 70ch was corrected (70ch is

the pre-v1.49.10 value and is the exact defect that release removed — ch is

font-size dependent, so the lead and body paragraphs landed on different left

edges), and RESPONSIVE_STANDARD.md's 760px block is annotated as the legacy

generic cap it is.

Radius ceilings are now per register in tools/audit-vibecode.mjs — editorial

≤10px, instrument ≤3px, unscoped ≤8px — matching design.md §16.2 and

DARK_MODE_STANDARD.md rule 5. The gate had read ≥8px everywhere, so the

project's own compliant editorial value failed its own gate while an instrument

surface could sit at 7px and pass. Measured first: of 86 blocks at radius ≥8px,

2 are editorial-scoped (both exactly 8px, both already exempt by name) and 1 is

instrument-scoped (4px, functional) — nothing sat in the gap, so this closes a

latent contradiction and changes no live finding. Fixtures seed one violation

per register so a later reader cannot take "0 findings" as evidence the register

logic was exercised.

FUNC_SEL now matches the final compound, not the whole selector string.

.ltc-tab-panel > div > .feature-block { border-radius: 10px } was exempt because

the word "tab" appears on an ancestor; 31 decorative blocks were exempted that

way, and any slop nested under a nav, tab, drawer or form disappeared from all

three decorative rules at once. Tightening it surfaced 7 findings; a capsule

exemption (a pill is a shape, not a rounded panel — with a panel disqualified

first, after the first version of that exemption let a seeded

display:block;height:120px;border-radius:28px straight through) removed the 3

false positives, and the remaining 4 are fixed: three cx-calculator.html drawer

callouts carrying the explicitly rejected wash + 3px saturated border in raw

Tailwind hexes, and three square icon tiles at 10–14px radius.

Also in cx-calculator.html: a rule with no selector at all —

{ --accent-purple:…; } straight after a comment — which the browser discarded,

so none of those 7 tokens was ever defined. Zero consumers, so it was dead either

way; removed rather than given a selector. Nothing in the gate suite validates CSS

structurally, which is now an OPEN ledger row.

And the funnel was instrumented to answer why audit-vibecode reports zero:

252,319 CSS blocks scanned, 56,633 pass the decorative vocabulary, **1,869 reach

the radius test**, none over ceiling. The radius backlog really was swept — but

ANTI_VIBECODE_STANDARD.md still printed the pre-sweep baseline (1058 blocks /

169 files), which is what made a working gate read as an unwired one. That section

is marked obsolete in place, with the measurement and the date it was true.

New: standarization/UIUX_AUDIT_LEDGER.md

Living ledger in the proven format of the SEO one: every row carries a status,

CLOSED only with the version and the gate that keeps it closed, a

Read this first section for claims retracted as measurement artifacts, and the

population stated as what was counted — **74 pages declaring

data-rz-register="editorial"**, measured from the filesystem, not 29 articles.

11 CLOSED, 1 PARTIAL, 5 OPEN, 2 WITHDRAWN.

The largest OPEN row is the one worth repeating here: **32 of those 74 pages do

not load css/rz-article-dark.css.** Every rule in that file — the callout

language that replaced the rejected 3–4px slab, the caption registers, the figure

scroll affordance — reaches 43 pages, not 74. Not yet measured in a browser what

those 32 render, and that is deliberate: declaring a register whose stylesheet

never arrives is either a missing link or a register that means nothing there, and

the two have different fixes.

One claim was withdrawn: "at ≤768px the page's overflow-x:hidden clips the

figure instead of scrolling it" is false — .rz-figure has its own

overflow-x:auto and scrolls inside the clipped page (maxScrollReached: 370).

That came from reading the cascade instead of scrolling the element.

Also

• A raw — inside a chart config's JSON source: string printed as literal

text to the reader (that field is rendered as text, not HTML).

• The figure scroll track is now visible: a thin always-shown native scrollbar on

.rz-figure with overscroll-behavior-x: contain. It was invisible before —

76 px of 820 hidden at desktop, 370 px at phone width, with no signal that the

figure continued, which is what "terpotong dari framenya" was.

96 search snippets now finish instead of truncating

Row 2 of the SEO ledger had been open since the audit: **96 published descriptions ran past the

~160-character display cut**, 45 of them with no clause boundary anywhere inside the window. The row

recorded it as not fixable, because the two obvious moves both destroy authored text — trim at a

boundary and you discard the rest, leave it and it truncates mid-phrase.

There was a third move the row did not consider: **rewrite the description so it finishes inside the

cut.** Nothing authored is lost, because the sentence is composed to fit. Measured, most of the

overflow was a redundant lead-in rather than substance — "Calculate X for your data center",

"... on ResistanceZero", "Full engineering methodology for the ..." — so the information survived

compression intact. 96 pages rewritten by hand, longest now 157 characters, each one keeping its

page's own vocabulary and spelling convention.

Added

• tools/test-meta-description-fit.mjs, wired into tools/ship-gate.sh. Per page the sitemap

publishes: M1 a description of at least 50 characters, M2 at most 160, M3 no dangling connector or

trailing function word — the signature of a sentence that was cut rather than written. Proven RED

at exactly 96, the same count the original audit found, which is the evidence it measures the

same defect.

The deferral mechanism, used and then emptied in the same release. Three pages —

article-20.html, article-26.html, rfs-readiness-workbench.html — were open in a parallel

session's working tree (an inline-login-modal sweep), and editing a file another session is

mid-change on means one of us silently reverts the other. They were deferred by name in a PENDING

map, with rule M4: a pending page that already fits is reported as a FAILURE telling you to

delete it from the list, so the exemption can only shrink and cannot quietly become where

descriptions go to dodge the rule. Proven by shortening one in a throwaway worktree and watching M4

fire. That session then pushed its sweep, so these three were rewritten too and **PENDING is empty

again** — the only end state the mechanism accepts.

This release was renumbered from v3.11.10 to v3.11.11: the parallel session published its own

v3.11.10 while this work was still local, so the number was taken. Caught by comparing against

origin/main before pushing rather than after.

Changed

• standarization/Audit result/SEO_AUDIT_LEDGER.md — row 2 moved to CLOSED with the gate that keeps

it closed and the three pending pages named.

• llms.txt / llms-full.txt regenerated: the crawler exports embed page descriptions, so all 93

rewrites appear there too. 18 OG cards rebuilt for the same reason — the cards render the

description, so rewriting one leaves its image stale. The OG freshness gate caught all 18; none of

them belonged to the parallel session's pages, which was checked before rebuilding rather than

assumed. Regenerated with the parallel session's eight open files temporarily

reset to their committed content, so this release carries my text and not their unpushed work.

Fixed — being signed in was what broke the PFAS calculator

Owner report: "Full analysis" stayed locked on article-26.html while signed in as root, "sering

sekali". It was worse than locked. The entire inline calculator script was dying, and only when

a session existed.

checkSession() runs inline during parse. auth.js and rz-engine.min.js load at the end of the

document with defer, so neither exists yet — window.RZEngine is undefined on that first call,

always. With a session present the fallback reached activatePremiumUI(), which called

pfasSetMode('pro') — assigned to window 56 lines further down. A function expression on

window is not hoisted, so that call threw and killed the rest of the script. Measured:

no session    typeof window.pfasSetMode === "function"
root session  typeof window.pfasSetMode === "undefined"

Every later global — pfasSetMode, pfasReset, pfasExportPDF, pfasHideLogin,

pfasHandleLogin — ended up undefined, and every onclick on the page was a no-op. The page

returned 200, the HTML was intact, every static gate was green. **It worked for every visitor and

broke only for the one person who is always logged in.**

Also removed the early return that skipped the localStorage fallback when RZEngine was present but

unhydrated, and widened the rz-auth-change listener: auth.js dispatches a bare Event in one

path, and a handler testing only detail.action === 'login' ignored it.

Fixed — five login modals that could not be opened, and could not be submitted

attemptLogin, closeLoginModal, wcHandleLogin, rfsAttemptLogin — referenced by onclick,

defined nowhere. Reachability was measured before anything was written: all five modals had

shows-it = 0. Nothing in any page ever set their display or added an open class. They were the

tail of the migration to the shared _rzAuth.showModal, which those pages already use.

So they were removed rather than repaired — 15,758 characters across dc-market-tracker,

pue-calculator, tia-942-checklist, article-20 and rfs-readiness-workbench, including **five

dead login forms carrying a type=password input**. A password field with no handler is worse than

dead weight: a password manager will offer to fill it.

Fixed — two more buttons that did nothing

exportTcoCSV on tco-calculator was a bare function declaration trapped in scope while its

neighbours use window.exportPDF = .... toggleCalcTheme on roi-calculator was **never defined

at all**, on a page carrying 93 [data-theme="dark"] rules and fully ready for it — the canonical

implementation from capex-calculator now sits there.

Added — tools/audit-runtime-handlers.mjs, a gate that runs the page

audit-onclick-handlers.py covers the neighbouring bug (a handler trapped in an IIFE) and could see

none of this, for two reasons. It reads source instead of running the page, and — line 10 of its own

usage text — "If no files are given, scans spares-readiness-calculator.html". **It audits one file

out of 179 and prints [OK] No missing exports**, which reads as a site-wide verdict.

The new gate loads every page carrying inline handlers in two auth states and requires every

referenced name to resolve. A handler dead in only one state is ranked above one dead in both,

because that is the defect that passes every test run by someone in the other state.

Proven both directions before being trusted: --strict exits 1 on the pre-fix article-26

(five dead handlers, correctly labelled dead-when-signed-in) and 0 once fixed. Baseline is now

717 handlers across 105 pages.

Two things were rejected rather than reported. A finding named function was the tool's own regex

catching an inline forEach callback. And two page-error rows were contention, not defects — run

solo, rz-ops-p7x3k9m.html passes with 110 handlers. A navigation failure is now retried once with

a longer budget, because a gate that reports contention as a defect teaches people to ignore it.

The gated cockpit now says something true to a reader who cannot enter it

datahallAI.html is in sitemap.xml and declares robots: index, follow, and it ships

<body class="locked"> in its static HTML. Until now body.locked applied

filter:blur(4px); pointer-events:none to the cockpit behind a fixed scrim holding a 32-word

card that said "access required" and offered nothing else. So search traffic — and any rendering

crawler — met a blurred wall, while the indexed text described a cockpit no visitor could read.

Row 10 of the SEO ledger recorded that as an owner decision with three options; the owner delegated

it ("Yg terbaik walau ultraeffort"), and this is option (c): **keep the page discoverable, give the

public reader real engineering, and gate only the interactive cockpit.**

What a public visitor now gets. An in-flow brief — the cockpit is hidden, not teased — with 270+

words on what the model is and how the thermal and electrical chains are derived, links to the public

manual and PRD, and eight headline figures:

The figures cannot drift from the model. They are rendered from window.RZ_DCAI_PARAMETERS — the

same registry twin the basis drawer reads — under the same basis ids the dashboard cells carry.

Nothing is typed and nothing is re-derived, and each cell keeps its data-basis-param, so **a public

reader can click any figure and get the full basis record**: derivation, evidence class and source.

It fails closed twice over. With the registry absent every figure is an em dash rather than a

plausible guess (P8). And because the brief reads the registry twin rather than the engine, it could

have painted while the cockpit itself was showing em dashes — so it now also honours the page's

authority contract: figures render only when data-datahall-authority is current, and a

MutationObserver repaints when the engine validates (P9). A public reader is never shown a number the

page itself refuses to stand behind.

Two things the gates caught, both real:

• The brief first sat ABOVE the header, pushing the site's own navigation below the fold — the

telemetry e2e gate reported prd/datahallai.html as no longer topmost. The brief now follows the

header.

• The prose said "the live cockpit". On a page whose every number is simulated, the authority gate

forbids live phrasing, and it was right to: the word claims real telemetry. Reworded to

"interactive cockpit".

Also fixed while in here. The gate card violated the site's own design standard — 14px radius, a

filled green pill, centred text, a drop shadow — and is rebuilt on the 4px radius, 1px hairline,

mono-label, tabular-numeral system with 44px controls. And the page's three descriptions advertised

telemetry an anonymous visitor cannot use; they now describe the model, and the meta description is

146 characters, written to finish inside the ~160 SERP cut rather than truncate mid-clause, which

is the defect ledger row 2 exists for.

Added

• tools/test-dcai-public-brief.mjs (P1–P9), wired into tools/ship-gate.sh: locked shows the brief

and hides the cockpit with nothing blurred; the brief is substantive; every figure equals its

registry value; a figure click opens a populated basis record; 390px carries no overflow, 44px

figures and 24px controls; unlocking restores the cockpit; and both fail-closed paths hold. Proven

RED against v3.11.8 in a detached worktree — 8 findings, naming the defect directly: *"the

cockpit is blurred (blur(4px))", "the brief carries only 32 words — a placeholder"*.

Changed

• data/dcai-parameters.json + js/dcai-parameters.js regenerated through the builder (never by

hand): the brief's hooks moved R8 to 241/283 ids rendered, 42 declared internal, STRICT.

• standarization/Audit result/SEO_AUDIT_LEDGER.md — row 10 CLOSED with the option taken and the

gate that keeps it closed.

Six tickers were repainting panels nobody could see

v3.11.7 stopped building hidden panels. This stops repainting them. Measured on the dash tab

over a 20 s window, with a MutationObserver on every panel that is not the active one:

After: 0. Every panel-local ticker now tests .pn.on first.

What deliberately keeps running. #fireImpairmentBanner sits outside .mn and the sidebar

counters sit outside every panel: §A6 requires a FIRE WATCH to be visible on whatever tab the reader

is on. upd() writes the page-wide #sUA/#sUB sidebar values alongside hall-local cells. Both

functions were SPLIT rather than guarded wholesale — guarding either one would have frozen live

data that belongs on every tab.

The fire inventory stays eager, and that is a decision, not an oversight: the sidebar counters

are derived from it, so deferring it would show em dashes on the dashboard — a visible regression

traded for ~410 ms.

electrical-live.js got an additive shouldRender predicate. With no predicate its behaviour is

byte-for-byte what it was, which is what its fake-DOM gate exercises; the page supplies the .pn.on

test for #p-elec.

Two defects this exposed that it did not cause

An SLD cell carried three undeclared numerals for months. #eDH<n>Live has two writers with

different formats: the builder draws seven numerals including a `(derived; cooling X + UPS/dist Y +

aux Z kW) breakdown, while electrical-live.js` overwrote the cell with three (IT / Facility / PUE)

within 4 s of load. The hook declared four ids, so the three breakdown numerals were never traced —

and the coverage gate never saw them, because by the time it measured, the ticker had replaced the

text. Guarding the ticker stopped the overwrite and the gate reported drawn=7,648 registry=67,382.

Fixed by declaring what the drawing actually prints: pb_cooling, pb_upsDist and pb_aux all

resolve through DH_BASIS to real registry ids.

A modified module would have shipped invisibly. electrical-live.js is loaded under a version

pin (?v=3.7.0), and tools/normalize-cache-tokens.mjs deliberately leaves pinned assets alone. So

nothing would have made a returning browser fetch the new module: it would have kept the cached copy,

kept repainting the hidden panel, and every gate would have passed. All three electrical module pins

move to ?v=3.8.0 and ASSET_VERSION in tools/test-datahall-ai-electrical-visual-map.mjs moves

with them, with the reason recorded at the constant.

Added

• tools/test-dcai-deferred-panels.mjs gains D6 and D7. D6: nothing mutates inside a hidden

panel. D7: once a panel IS active its subtree keeps mutating — a visibility guard that never

releases would be a worse bug than the waste it removed, and D7 is what caught updateDashKPI.

Proven RED against v3.11.7 in a detached worktree: 8 findings, exit 1.

• rzPanelOn(id) and rzElemOn(el) in the page. The element form exists because #pplCount is

present in two panels, so naming one would have been a guess.

Also in this release

• standarization/Audit result/SEO_AUDIT_LEDGER.md — row 8 re-traced live after v3.11.7 and v3.11.8:

FunctionCall 1,864 → 428 ms (−77%), ParseHTML 2,237 → 1,064, UpdateLayoutTree 777 → 306,

Layout 1,292 → 793, EvaluateScript 2,163 → 1,431, Paint 260 → 161. It stays OPEN because the page

is still outside the good band, not because a fix is being skipped.

• New row 10, and it is an owner decision, not a defect being fixed. datahallAI.html ships

<body class="locked"> in its static HTML — body.locked blurs .wrap/.mn and kills pointer

events behind #rootGate — while robots says index, follow and the URL sits in sitemap.xml.

An anonymous visitor, including a rendering crawler, meets a blurred wall. Of the 5 root-gated

pages on the site the other 4 are noindex, nofollow and sitemap-absent, so this is the exception

to the site's own convention. Three options are recorded in the row; nothing is changed pending

the decision, because the indexability of the flagship cockpit is a product call.

• A finding raised and withdrawn in the same pass: two root-level gated labs appeared to be

listed in the sitemap. They are not — the sitemap lists manual/ pages that share their

basenames. Matching a filename without its directory is the same blindness that produced the

row A cache-token defect.

Not claimed

Idle long-task time read 1,263 / 1,885 / 2,144 ms across runs including the unguarded baseline.

With five samples on this machine that is noise, and no claim is made from it. The mutation count is

deterministic, which is why it is the number in the gate.

A panel the visitor never opens is now never built

v3.11.6 deferred four of the nine hidden panels on datahallAI.html, then painted them all on an

idle slice after load so print, find-in-page and the gates would still see a complete document.

This release defers the other four — the cooling P&ID, rack architecture, network fabric and BMS

diagrams, 126 KB of builder bodies between them — and removes the idle drain entirely.

Measured against the tree shipped an hour earlier: with the drain, a visitor who never left the

dashboard still had 1,011,614 characters of markup built for them — hc 313,776,

elecDH1C 190,029, coolC 179,082, bldgC 107,802, netC 75,424, rackC 71,396, bmsC 69,544,

overCards 4,561. None of it is built now until a tab is opened.

Same harness, same concurrent server, 390px at 4x CPU throttling, median of five runs each:

The drain only moved the work a few hundred ms later, where it still blocked the main thread.

Removing it is the only variant that removes work rather than relocating it.

Correction to the v3.11.6 record. That entry said pure lazy paint was "tested and REJECTED —

TBT 11,442 / 2,218 ms … unstable and no better". That was wrong, and the reason matters: the

rejection rested on a single outlier run. An outlier of that shape has since appeared in every

variant on this machine, including the shipped one (one v3.11.6 run measured 39,967 ms), so it was

never evidence about pure lazy. Five runs and a median reverse the conclusion.

Correction to the row 8 plan. v3.11.6 scoped the next fix as extracting the inline scripts to

external files, blocked behind a shared page-source helper for the 37 tools that read

datahallAI.html as source text. A devtools.timeline trace retires that plan: **v8.compile is

208 ms** of the load, against ParseHTML 2,237 ms, EvaluateScript 2,163 ms (with FunctionCall

1,864 ms inside it) and Layout + UpdateLayoutTree 2,069 ms. The cost is running the builders

and laying out their DOM, not compiling them, so extraction would have risked blinding 37 gates to

chase 208 ms. Not doing it.

Nothing depended on the drain, checked rather than assumed: the page's own @media print block

is empty, display:none content is already invisible to find-in-page, and every gate reaches a

panel through activateTab, which clicks the real button.

Changed

• datahallAI.html — RZDefer loses its load listener and idle drain; add/ensure/pending

remain. The four remaining builders defer through named self-registering IIFEs: the function names

itself, and on its first eager run it registers with RZDefer and returns, so the queue can call

it again later. That needs only an opening edit — a first attempt that rewrote both ends with a

hand-written brace matcher left a stray call behind and threw RZDefer.add(...) is not a function,

caught by the gate and reverted rather than patched.

• tools/test-dcai-deferred-panels.mjs — widened to all eight containers and its D2 inverted:

v3.11.6 asserted the drain filled every panel, this asserts every panel is STILL empty seconds

later with no click. Proven RED against v3.11.6 in a detached worktree (16 findings, exit 1).

The cockpit painted nine panels nobody was looking at

datahallAI.html opens on the dash tab. The other nine panels sit behind .pn{display:none}

until the visitor clicks their tab — and the page built every one of them before first paint.

Measured at the load event, four containers alone already held 635,446 characters of generated

markup: hc 313,776 (the hall mimic), elecDH1C 209,307 (one of four per-hall single-line

diagrams), bldgC 107,802 and overCards 4,561.

Profiled on a 390px viewport at 4x CPU throttling, renderOverview, renderHall and the four

drawDH sheets owned ~0.4 s of self time on the critical path, and each one re-triggered the

rz-svg-legible MutationObserver pass (256 ms of self time on its own).

Changed. A small RZDefer queue in the page script. A panel now paints on the first activation

of its tab — synchronously, before the panel is shown, so it can never flash empty — or on an idle

slice after load, whichever comes first, one panel per task so the queue cannot rebuild the long

task it was added to break up. The idle drain means print, find-in-page and every gate that waits

for load+settle still see the whole document. ensure() is idempotent, so a panel never paints twice.

Measured effect, stated honestly. The work is moved off the critical path, not removed: total

CPU is unchanged. The deterministic result is that 635 KB of pre-paint DOM construction is gone,

which is what the new gate holds.

Controlled A/B, added after the first numbers in this entry proved untrustworthy — same harness,

same concurrent local server, the two trees measured back to back at 390px with 4x CPU throttling,

median of two runs:

A correction to this entry's first draft. It claimed long tasks fell 30 → 23. That came from a

single-threaded python -m http.server harness whose own serialization dominated the numbers, and

it is withdrawn. The long-task COUNT rises slightly (24 → 28) — that is the chunked drain working as

designed, splitting one long task into several shorter ones. What falls is the longest task and the

total blocking time.

Also tested and rejected: removing the idle drain entirely. Pure lazy paint (panels built only

when their tab is opened) measured TBT 11,442 / 2,218 ms across two runs with a 6,867 ms outlier

task — unstable and no better, so the chunked drain stays.

> Withdrawn in v3.11.7. That rejection rested on a single outlier run. An outlier of the same

> shape has since appeared in EVERY variant on this machine, including this one (a v3.11.6 run

> measured 39,967 ms), so it was never evidence about pure lazy. Five runs and a median reverse the

> conclusion, and v3.11.7 removes the drain.

This does not close SEO ledger row 8. Live after this ship the page still measures LCP ~6.4 s

and TBT ~5.0 s on that profile — live runs carry network variance and whatever else this machine is

doing, so they are not a controlled comparison with the pre-ship live reading and no claim is made

from them; what they do establish is that the page is still far outside the "good" band. The

dominant term is (program) at 2,981 ms — parse and

compile of 1,236 KB of inline JS (88% of the document; 558 KB of it template-literal SVG

strings). Fixing that means extracting the inline scripts to external files, and **37 tools read

datahallAI.html as source text** — they would go green-but-blind the moment the code moved. That

extraction needs one shared page-source helper first, and is scoped in the ledger rather than

started here.

Added

• tools/test-dcai-deferred-panels.mjs — asserts the structural invariant, not a millisecond

budget (a timing threshold on this box is a flake generator): every deferred container is empty at

the load event, the idle drain fills all of them with no click, activation alone paints a panel

with the idle drain suppressed, and a panel paints exactly once. Proven RED against the pre-change

tree in a detached worktree — 10 failures — and green after. Wired into tools/ship-gate.sh.

Changed

• datahallAI.html — RZDefer queue; renderOverview/renderOverviewCards, renderHall and the

four drawDH calls moved into it; the tab click handler paints a panel before showing it.

• standarization/Audit result/SEO_AUDIT_LEDGER.md — row 8 re-measured: 381 KB over the wire

(gzipped), not the 1,375 KB raw figure it quoted, with the composition, the live CWV numbers and

the 37-gate blast radius recorded.

• tools/lib/cockpit-tabs.mjs — the tab-readiness wait is READINESS_MS (30 s, RZ_TAB_READY_MS

to override) instead of a hard 10 s. Found while verifying this ship, and NOT caused by it:

test-conv-geometry and test-datahall-ai-inspector-runtime were failing intermittently at that

timeout, and both fail identically on the pre-change tree, while walking all 21 datahallAI entries

through the same function readies every one. A cold navigation on this machine can exceed 45 s

while the file serves in 3 ms, so 10 s was asserting the machine's speed, not the page. This is a

readiness wait, not a speed budget: a tab that never readies still fails, and that was proven by

forcing RZ_TAB_READY_MS=1 and confirming the timeouts return — a threshold is only loosened here

after the failure is shown false, per feedback_gate_exists_but_unwired.

• standarization/AGENT_HARNESS_STANDARD.md — Last updated moved to the release date, which gate

86 requires of every release.

Every text field on the site zoomed the page on iOS

A full mobile audit of all 176 published pages at 390px, checking five defect classes. The

worst finding by far: 1,471 form controls across 154 pages sized between 10px and 15.2px.

iOS Safari zooms the viewport whenever a focused text-entry control is under 16px, and it does not

zoom back. The reader is left in a magnified page to pinch out of — on every field. On a site whose

main offering is interactive calculators, that is most of the value of the site misbehaving on the

device most readers arrive with. spares-readiness-calculator.html alone had 277.

Fixed

• A 16px floor at the phone breakpoint, scoped to controls that actually zoom: text-like input,

select, textarea. A checkbox, radio, range or colour swatch has no text to size and is left

alone — and the gate uses the same scope, so the fix and the check cannot disagree.

• Delivered two ways because the site is not uniform: 123 pages take it from styles.css; the

other 31 are self-contained and carry the rule inline, since a shared-stylesheet fix would

have silently missed them.

• The floor needs !important. A page's own .form-group input (0,1,1) outranks a bare input

(0,0,1), and the first cut left 377 controls on 54 pages still zooming for exactly that

reason. This is an accessibility floor at one breakpoint, not a style preference.

Verified 1,471 → 0, with no horizontal overflow introduced on any page — checked

specifically on the 277-field page, where growing every control was most likely to break the

layout.

Added

• tools/test-mobile-forms.mjs, wired into ship-gate.sh. **Proven RED against shipped v3.11.2:

1,081 controls across 152 pages. 0 after.**

What the audit cleared, and one thing it taught

Zero pages overflow horizontally at 390px. The three "off-screen content" findings in the first

pass were a news ticker that scrolls by design — exempting marquees and transform-animated

ancestors took that class from 40 findings to 0 before any of it was reported. Calibrating the

probe against a handful of rendered pages first is what kept a scrolling headline out of a defect

list.

Still open, measured and deliberately not swept

• 1,042 tap targets under 24px across 152 pages, nearly all navigation and footer links at

17–22px. WCAG 2.5.8 (AA) asks for 24×24. v3.11.2 fixed the .nav-right family; the rest is the

site's standard link styling and changing it site-wide is a design decision, not a bug fix.

• 41 text runs under 10px, mostly footnotes and source lines at 9.6–9.9px. A legitimate

typographic tier, on the small side.

Fixed — one site, two GWPs for the same fluid, and one page citing the wrong report

Carrying v3.11.4's IPCC AR6 work across the rest of the site turned up two provenance defects.

Shipped in this release as 550ae083; the changelog line was owed because CHANGELOG.md was held

by a parallel session at the time.

carbon-footprint.html stated "Refrigerant GWP values from IPCC AR6" while using R-410A = 2088,

which is the AR4 value. On AR6 components that blend is about 2256 (HFC-32 at 771, HFC-125 at

3740, Table 7.SM.7).

The numbers were not the problem. This site is deliberately and consistently AR4 for refrigerants,

because that is the basis EU F-gas regulation uses, and rz-engine.js documents it as

"GWP100 IPCC AR4 (consistent with sitewide published values)". manual/carbon.html and

capex-calculator.html both say AR4 and both use AR4 numbers. Only this page's methodology line

claimed otherwise, so the claim was corrected rather than the values — newer is not automatically

more correct when a regulation mandates the older basis. The line now names the numbers and states

what AR6 would give instead.

That is the same defect class as the FC-72 row in v3.11.3: a figure attributed to a source that does

not state it.

Second, data/refrigerants.csv and rz-engine.js both still carried Novec7000 at GWP 530 after

v3.11.4 had corrected the article's own dataset to 576. One site, two different GWPs for the same

compound — and 530 is neither an AR4 nor an AR6 value. Both are now 576 from IPCC AR6 WGI

Table 7.SM.7, where the fluid is listed as HFE-347mcc3 (CH₃OCF₂CF₂CF₃) with a 5.1-year lifetime. AR6

rather than the AR4 basis used for the rows above it, because this fluid is not an F-gas refrigerant

and that convention is a regulatory one which does not apply to it — stated in the row's own source

cell so the mixed basis is visible rather than silent.

Worth naming: correcting a number in the dataset that prompted the search is not correcting it.

The substance has to be grepped for across the whole repository, engine constants included.

Engine chain run per CLAUDE.md: rz-engine.min.js reproducibly re-minified, engine-catalog.json

regenerated, and the rz-engine.min.js cache token rotated on the 59 pages that load it.

test-rz-engine 763/763, value-bindings 85/85, reference-parity 155/155.

The climate arithmetic was built on the wrong Novec, again

v3.11.1 found Novec 7100's vapour pressure sitting on the Novec 7000 row. The same

transposition was sitting in the GWP column, and it had been there longer.

article-26 computed every CO₂e figure at GWP100 = 320, labelled

[vendor — representative]. That is 3M's number for Novec 7100. The article's narrative fluid

is Novec 7000, and the chart's own source string said so while carrying the other fluid's

constant: "3M Novec 7000, 100 L charge; GWP100 320 low-end, 3M TDS".

The 6,000-row worked-model dataset disclosed the choice honestly — `"320 used as low-end

illustrative"` — but its own cell in the same row stated the range as 370–575, which 320 sits

below. A conservative figure is defensible. A conservative figure borrowed from a different fluid

and printed below the range you yourself quote is not.

Replaced with the primary reference, not a vendor range

IPCC AR6 WGI Table 7.SM.7 tabulates these compounds directly:

AR6 also lists HFE-7100's isomers separately, n- at 544 and i- at 437, which brackets the 460

mixture value and confirms the row matched is the right one rather than a same-formula coincidence.

Novec 649 is absent from the table, consistent with its five-day lifetime; its GWP of ~1 rests

on the lifetime rather than on a tabulated figure, and the dataset now says that instead of

implying a citation. Opteon 2P50, R-1234yf and R-1233zd(E) already agreed with AR6 and now carry

their AR6 designation so the next check is trivial.

What moved

The worked example goes from 61 to 111 t CO₂e/yr for a single tank at field loss — the same

192 kg of fluid, correctly weighted. The chart's CO₂e series scales by 1.8×. The live calculator's

two-phase-pfas constant goes 320 → 576. And the fluid-choice swing between a Novec-class HFE and

a Galden-class PFPE is ~17×, not the ~30× the understated figure produced.

Every mass figure is unchanged. Only the weighting was wrong, and it was wrong in the direction of

making the problem look smaller.

The dataset gate now covers every dataset, not the one that broke

v3.11.2 added audit-fluid-properties.py after four rows of one CSV turned out to mis-parse. That

scope was wrong, and the reason is in the defect itself: unquoted commas are a property of

hand-edited delimited text, not of chemistry. The four broken rows happened to be chemical names.

The next one will not be.

Renamed to tools/audit-published-datasets.py and widened to **41,469 rows across all 51

published CSVs**, each parsed the way a consumer will parse it. All currently pass — the audit was

run across every file before the gate was written, so this is a verified floor rather than a hope.

Added — relations that hold by definition, so they need no standard in hand

data/fire/clean-agent-properties.csv is a fire-safety table, and two of its columns constrain

each other regardless of which code is being followed: a design concentration cannot sit below the

concentration that extinguishes, and a no-observed-adverse-effect level cannot exceed the

lowest-observed one. Eight such relations across five agents, all holding.

Blank cells are skipped, not read as zero. CO2 carries no NOAEL because it is lethal at design

concentration and its own source cell says so; coercing that blank to 0 would manufacture a passing

comparison out of missing data.

Deliberately not gated: the 1.2× class-A safety factor and the occupied-space design ≤ NOAEL

rule. Both are NFPA 2001 provisions with exceptions, and asserting a compliance rule from memory is

the same mistake the whole gate exists because of.

Proven against four seeded defects before being trusted

Structure, on a file unrelated to the original bug (spares-oems.csv, an injected comma). NOAEL and

LOAEL swapped. A design concentration pushed below its extinguishing concentration. And the original

transposed vapour pressure, at ×0.37. All four exit 1 under --strict; clean exits 0.

Twenty-eight pages had navigation links too small to tap

Found while verifying v3.11.1 on the live site rather than locally. The protocol explainers show no

hamburger at phone width, which is a valid design — their navigation is two always-visible links.

Measured, those links render 17px tall at 390px, on 28 pages: all 25 network/** explainers

plus all-in-one-dashboard, network-compare and network-visualization-hub.

WCAG 2.2 SC 2.5.8 (Target Size, Minimum, AA) asks for 24×24 CSS px. Its "inline" exception covers

targets inside a sentence; a navigation bar is not a sentence, and on those pages those links

are the only way out.

The cause is that .nav-right renders its links as bare inline anchors, so the target box is the

TEXT box. The fix is a floor, not a redesign: min-height: 24px with inline-flex grows the box

without moving the text, in the shared stylesheet all 28 already load. The 44 other .nav-right

pages whose targets already clear 24px are unaffected, because a floor beneath them changes

nothing.

Added

• tools/test-tap-targets.mjs, wired into ship-gate.sh. Every page with a .nav-right bar, at

390px, must render each visible link at least 24px tall. **Proven RED against shipped v3.11.1:

28 pages. 0 after.**

Why the hamburger gate could not see this

test-mobile-nav.mjs enumerates pages that have both a navbar AND a menu container, then asserts

one working toggle. These pages have no toggle and no menu container — they were never in its

population, and they were right not to be. A gate that asserts "the hamburger works" cannot notice

a page that correctly has no hamburger and fails for a different reason. That is an argument for

checking the rendered page against a different question, not for widening the first gate.

The downloadable dataset was corrupt for every parser, and nobody could see it

v3.11.1 fixed a vapour pressure in article-26 that belonged to a different fluid. Auditing the

rest of the table it came from turned up a second defect of a different kind, in the same file.

data/article-26/fluid-properties.csv is offered to readers as a download, so a stranger loads it

into pandas and trusts the result. Four of its eleven rows mis-parsed, because chemical names

like cis-1,1,1,4,4,4-hexafluoro-2-butene and 2,3,3,3-tetrafluoropropene carry unquoted commas.

Those rows silently shifted columns: R-1234yf reported C3H2F4 where its boiling point belongs,

and R-1233zd(E) reported a CAS number as a vapour pressure. Opened in a text editor the file looks

perfect. One of the four was introduced by the v3.11.1 fix itself — writing

3M TDS (GWP, vapor pressure) into the source cell added a comma and split the Novec 7000 row.

All eleven rows are quoted properly now and parse to fifteen columns.

Added — tools/audit-fluid-properties.py, a gate the eye cannot be

Two defects in one week, neither visible by reading the file, is a gate's job description.

Structure: every row must parse to the header's column count. A row that does not is broken for

every consumer, full stop.

Physics: boiling point and vapour pressure at 25 °C are not independent. Trouton's rule gives

the enthalpy of vaporisation from the boiling point alone (ΔS_vap ≈ 88 J/(mol·K)), and

Clausius-Clapeyron turns that into a predicted p_sat(25 °C). **Needing only the boiling point is

what makes it an independent check on the pressure cell** — exactly what the Novec 7000 defect

lacked.

Run against the repaired table, all seven pure compounds agree: Novec 7000 ×0.88, Novec 7100 ×0.96,

Novec 649 ×0.93, Opteon 2P50 ×1.20, FC-72 ×0.89, R-1234yf ×0.87, R-1233zd(E) ×0.92. Run against the

unfixed table it fails both original bugs — the transposed pressure at ×0.37, and the unquoted

comma by column count — and exits 1 under --strict. A gate that has never been shown to fail is

not a gate.

Mixtures are exempt by name, with the reason written down, never by pattern. Galden HT55/HT70

are polydisperse PFPE cuts whose "55" and "70" are nominal mid-cuts rather than normal boiling

points; FC-40 is a blend; mineral oil gives ">300" and "negligible", neither of which is a number.

The split turns out to be exact — every pure compound passes and every failure is a mixture — and

that pattern is the evidence the method works, which a blanket "skip anything that looks like a

mixture" would have hidden.

Wired into the ship-audit list in CLAUDE.md, because a gate that exists and is not wired is a gate

that does not exist.

The drawer opened and the page showed straight through it

v3.10.21 put the hamburger back on all 138 navbar pages. Opening it on

datacenter-solutions.html still printed the hero headline over the menu — a screenshot of the

live site shows "Plan, Cost, and Commission Your Data Center" legible across the open drawer.

The drawer's background was not the problem: it computed rgba(15,23,42,0.97) and its gutter

pixels sampled (23, 30, 49). **A z-index on the drawer cannot fix this, because the drawer lives

inside .navbar and can only ever paint as high as the navbar's own stacking context.** Lifting

the NAVBAR while the drawer is open is what makes the page disappear behind it. The background is

fully opaque now for the same reason — 3% of a bright gradient headline is still legible.

Found by screenshot, fixed by screenshot. elementsFromPoint reported the drawer ABOVE the H1, and

that reading was useless: the pixels disagreed.

Added — N5, the check a link count cannot make

tools/test-mobile-nav.mjs counted tappable links and passed a drawer the page printed through.

N5 samples six points down the drawer's own area and requires each to land on the drawer rather

than on the page beneath. It skips root-gated pages, where a full-screen gate overlay covers the

drawer legitimately and N5 has nothing to say.

The gate was flaky, and the flake was the same one dark-coverage had

Three consecutive runs of the UNCHANGED gate returned 4, then 3, then 1 finding — a shifting set,

which is the signature. It reported drawers as closed while simultaneously counting 22, 19 and 17

visible links inside them; measured alone, every one of those reported opacity: 1.

A drawer fades and slides in, and getComputedStyle during that returns the interpolated value.

Under the CPU load of a 138-page sweep the animation clock runs behind and the gate reads a

half-opened drawer. tools/audit-dark-coverage.mjs hit the identical flake reading body colour

mid-theme-flip. Same remedy: **suppress transitions before measuring, and assert the settled state

— which is exactly what the animation was delaying.** Three consecutive clean runs after.

Fixed — the gate crashed on its own viewport switch

Flipping isMobile on a live page makes Puppeteer reload it, and doing that once per page killed

the run with a protocol error. Mobile and desktop are now two passes with the viewport set once in

each; the number of navigations is identical. A page that fails to render is now reported as a

finding instead of being skipped by a bare catch.

Fixed — article-26 quoted another fluid's vapour pressure

article-26 gave Novec 7000's vapour pressure as 270 hPa at 25 °C. The 3M datasheet gives

65 kPa — 650 hPa. 270 hPa at 25 °C is Novec 7100's figure, and the article's own

data/article-26/fluid-properties.csv carried the proof one row apart: the 7100 row reads

~27 kPa. One row's value had been written onto another's.

Verified three independent ways before anything was touched: the datasheet (65 kPa), a vendor spec

quoted as 9.5 psi at room temperature (65.5 kPa), and Clausius-Clapeyron anchored on the 34 °C

boiling point and the 142 kJ/kg heat of vaporisation — which uses neither of the other two and

lands at 72.4 kPa. The article's own water comparison of 32 hPa is correct, so the units were

consistent and the gap was real.

The correction makes the argument stronger, not weaker. The number was being used to show that

opening a two-phase system releases significant vapour, and the true figure is 2.4× larger. Liquid

equivalent per m³ of headspace goes from 1.56 L to 3.75 L.

A first count found nine occurrences. A sweep for the DERIVED claims found four more, because the

error travelled without its own number attached: "eight times that of water" carried it in prose,

and one passage credited the 8.4× to industry documentation when it came from the article's own

division of 270 by 32. That ratio is now stated as a vapour-pressure ratio of about 20×, not an

evaporation-rate ratio — a pressure quotient is not a rate, and since this molecule is ~11× heavier

than water, calling it one understates the mass anyway.

The calculator's 0.008 coefficient is deliberately unchanged, and settling that did not need

the original author. Its comment claimed a basis of "vapor pressure 270 hPa, open surface ~2m², avg

open time 4hr", but the implemented term scales with fluid volume while a surface-evaporation

model does not scale with volume at all — so one cannot be derived from the other, and numerically

the surface model over-predicts it by an order of magnitude at any tank size. 0.008 is an assumed

per-event fraction, about three headspace exchanges plus film and drag-out. The comment now says

so. Output is byte-identical. **Compare the shape of two models before asking which number came

from which.**

Scope beyond the article: glossary.html, the downloadable dataset, and **seven unpublished social

drafts** that would have spread it to LinkedIn, Medium, Quora, Mastodon, TikTok and Facebook.

Generated artefacts rebuilt from source and the explain-db token rotated on the 108 pages that load

it.

Eleven figures, fourteen reasons

Explanatory figures for the article corpus, built rather than hand-drawn, and a written

verdict for every article that did not get one.

The corpus survey corrected an assumption first: counting <svg> per article returns 19–52

and looks like a corpus rich in diagrams, but almost all of it is interface — share buttons,

nav chevrons, icon glyphs. Counting only SVGs larger than 200 units gives thirteen real

figures across twenty-nine articles, and eight articles carrying no visual at all.

Added

• tools/build-article-diagrams.mjs — figures rendered at BUILD time, so they survive

the PDF export, the Markdown extraction into llms-full.txt, a reader with JavaScript

off, and the first paint. The author places an empty

<figure data-rz-figure="id"></figure> where the figure belongs; the tool fills it and

never inserts a placeholder itself, because where a figure belongs in an argument is an

editorial decision. Every definition records a because naming what it adds that the

prose cannot.

• Eleven figures, each earning its place by showing a shape a table could not:

article‑4 and 6/8 (what the calculator actually does — the output is a distribution

and the ranking is derived, not authored), 10 (the cooling loop §8.1 assumes but never

draws), 12 (the tariff gap, as a distance rather than a subtraction), 17 (Jevons as the

reinforcing loop it is, not three independent rows), 18 (two tables never connected — the

density trajectory crossed the air ceiling, so the heat path changed shape), 19 (the

corridor is one system, not a choice between two sites), 21 (the causal chain that makes a

20‑year PPA legible as a replacement for one link), 22 (drawn at the real 24:1 trace

ratio — the retimers exist only to pay for the distance), 26 (the escape routes bypass the

meter), 27 (two of three levers never reach the pool).

• standarization/ARTICLE_FIGURE_AUDIT.md — every article, and the reason for each

verdict including the fourteen against building. Article 25 nearly received a static

duplicate of the 6 GW gap its own living diagram already animates; article 1 was excluded

by reading its code, which scores dimensions and runs no Monte Carlo at all.

Changed

• The diagram engine gained the guards listed in DIAGRAM_ENGINE_STANDARD §3e. Colour may

never be the only channel (WCAG 1.4.1) — which caught hot and cold streams separated by

hue, and three node classes using ISA alarm hues as categories. A legend may not name

two things with an identical swatch, which found three such pairs already shipped. Ports,

node height, unknown options and the node budget all now report instead of failing quietly.

• Figure size bounds travel with each figure, from its own viewBox. One blanket

min-width:640px had produced two opposite failures: wide figures shrank until their type

fell under the 8.5 px floor, narrow ones stretched until they shouted.

Fixed

• tools/test-asset-cache-tokens.mjs --fix <asset> repairs the tokens it reports, for the

assets named explicitly. The manual sweep was forgotten twice in one session; a control

that has to be remembered is only a rule again.

v3.10.20 fixed "two hamburgers" by shipping "no hamburger"

Owner, on the same page, after that release: "Malah nggak ada navbar. Tolol. Audit fix yg bener."

He was right. Wiring the page's own button, the code replaced its <i class="fas fa-bars"> with

three bare <span>s — and those are styled by .rz-nav-burger span in styles.min.css, which

these pages do not load. The button rendered 0px wide. An existing icon is already a hamburger;

the span-morph is cosmetic and must never destroy content that is doing the job.

Then the sweep he asked for found far more than the seven pages v3.10.20 touched

Every page the sitemap publishes that has a navbar and a menu — 138 of them, not a sample:

The 24 had been broken all along, for a reason worth writing down. findNavbar() used a single

querySelector with a comma list, and that returns the first match in **document order, not

selector priority**. On article pages nav.toc-sidebar sits above nav.navbar in the markup, so

the last fallback in the list — body > nav:first-of-type — claimed the table-of-contents sidebar.

That sidebar is display:none on a phone, so the burger was injected into a hidden element and no

reader ever saw a menu button.

Fixed, all in js/rz-mobile-nav.js

• Never destroy an existing button's content. Spans are added only when the button is empty.
• Selectors are asked in priority order, and a candidate must have a rendered box — a hidden

shell is not the navbar a reader uses.

• The fallback styles the burger too, and all four menu shapes (.nav-menu, .nav-links,

.cx-nav-links, .rfs-nav-links). The inject branch set burger styles inline; the wire branch

had nothing, which is how a 4px tap target opened a working menu.

• Drawer links are forced visible. rfs-readiness-workbench hid two of its three links at

mobile width, from a time when there was no drawer to put them in. Inside an open drawer there is

room, and hiding them there serves nobody.

The gate now covers every navbar page, because a sample told me about the sample

tools/test-mobile-nav.mjs sampled seven "navbar shapes" and passed while 25 pages were broken. It

now walks all 138. Proven RED against shipped v3.10.20: 28 findings on 28 pages — 26 with the

wrong number of visible toggles, 2 opening a menu with nothing tappable. 0 after.

I had to correct my own test twice, and both corrections are the same lesson

• Height is not "open". A correctly CLOSED slide-in drawer measures 774px tall, parked at

left:-601px. Judging by height called two working pages broken.

• A centre hit-test is not "visible". It fails on a root-gated page because the gate overlay

sits above the menu, and on another because the centre landed on a nested input.

It now counts what a reader actually needs: links they can see and tap. Same lesson as v3.10.18 —

measure the thing the metric is a proxy for, not the metric.

Two hamburgers, neither working

Owner, on datacenter-solutions.html at phone width: *"Hamburger button utk menu ada 2 dan nggak

working saat di klik. Ini critical."* Two buttons in one header, and neither did anything. Seven

pages: datacenter-solutions.html and the six pln-java-grid* pages.

js/rz-mobile-nav.js states in its own header that it exists to prevent exactly this — it detects

an existing toggle and wires it up "instead of double-injecting". **Three compounding faults, and

none of them is visible by reading the file.**

• The detector's selector list did not include .mobile-nav-toggle, which is how those seven

pages mark their button up. The query missed, the code fell through to the INJECT branch, and

the reader got a second hamburger beside the first.

• Those pages do not load styles.min.css, so none of its 45 body.rz-nav-open rules reach

them. The surviving burger set the class correctly and nothing listened.

• They DO ship their own drawer — .navbar.menu-open .nav-links, designed in their own

palette, var(--pjg-bg) and all — but 89 pages carry a mobile block with

.nav-menu, .nav-links { display: none !important }, and importance beats specificity. A

finished design sat behind a rule it could never win against, with nothing setting its class.

Fixed

• .mobile-nav-toggle and #mobileNavToggle added to the detector. One hamburger, not two.
• menu-open is now toggled on the navbar alongside body.rz-nav-open, so a page whose own drawer

rule CAN win gets to use it.

• A minimal drawer is injected only where no body.rz-nav-open rule exists. The coverage test

deliberately does not count .menu-open: it is not !important, so it cannot beat the mobile

hide, and counting it suppressed the fallback on exactly the seven pages that needed one.

The CSS trap that cost the most time

The first fallback used position: fixed; top: 56px; bottom: 0 and rendered 48px tall. No rule

set a height and max-height was none. The cause: **.navbar carries `backdrop-filter:

blur(20px)`, and a filtered ancestor becomes the containing block for its fixed descendants** — so

the drawer resolved against a 64px bar instead of the screen. The navbar is itself position: fixed

on these pages, so the fallback now hangs off it with top: 100%, which is both correct and simpler

than fighting the containing block.

Added

• tools/test-mobile-nav.mjs, wired into ship-gate.sh. At 390px on seven navbar shapes it

asserts exactly one VISIBLE toggle, that clicking it opens a menu of real size, that clicking

again closes it, and that no toggle is visible at 1280px. Proven RED against the shipped code,

where it reports precisely the owner's two symptoms: found 2 toggles, and menu 0x0px.

Reading the source would not have caught any of this. Only a rendered page at a phone width,

clicked, answers the question the owner asked — which is why the gate drives a real browser.

Verified not to regress the 82 pages that already worked

index.html, articles.html, glossary.html and tools.html each still show one toggle, open to

a full drawer and close again.

The token followed the clock, and the clock moved

v3.10.13 made every ?v= token content-derived, <yyyymmdd>-<first 8 of sha256>. The digest half

is stable and is the half the gate compares. **The date half was minted from date.today() by a

sweep script retyped by hand at each ship**, and that is a defect with two faces:

• Midnight churn. Re-running the sweep the day after a release rewrites every token on every

page — 253 pages, for assets whose bytes never changed. Measured this morning: index.html

carries seven tokens, all dated 20260920, every digest current. A clock-derived sweep would

have restamped all of them 20260921 for nothing.

• A split token, introduced while fixing the first. Regenerating ONE page with today's date

leaves it as the only page carrying a different token for a shared asset — precisely the "one

asset served under several tokens" defect tools/test-asset-cache-tokens.mjs exists to catch.

The first face was found and fixed in tools/build-changelog-html.py (ed5eb0f1): the ship gate

failed on a generated artifact nobody had touched, and the obvious remedy was the trap above.

Added

• tools/normalize-cache-tokens.mjs, wired into ship-gate.sh. **The token follows the SITE, not

the clock:** it adopts the date the rest of the site already carries for this exact digest, and

mints today's date only when the digest shows the asset genuinely changed. A content change still

busts the cache, because the digest changes; a rebuild of an unchanged file does nothing.

Both halves proven by injection: with the tree clean it reports nothing to normalise; after a

real edit to styles-index.css it mints ?v=20260921-0409f1bd for the one changed asset and

leaves the other six alone.

It uses the local date, not UTC. build-changelog-html.py mints with Python's date.today(),

which is local; this box is UTC+7, so the first cut of this tool minted 20260920 at 00:30 local

— two dates for one digest, which is the split it exists to prevent.

Why a tool and not a snippet

This rule lived in an ad-hoc Python block pasted at each ship, which is exactly how the clock got

into the token: a rule that lives in the author's head is applied when the author remembers it.

test-asset-cache-tokens.mjs checks the digest; this writes it. Version pins are left alone — a tag

carrying a data-*-authority attribute declares a CONTRACT version, and hashing those blanks the

cockpit fail-closed.

Also in this release

• Dark-coverage measures the settled colour (17b031ca). The body carries

transition: background-color 0.3s, so a theme flip ANIMATES, and getComputedStyle during the

transition returns the interpolated value — pure white under CPU contention. That is the

body-lum=255 light-block=has-share-buttons false positive that has cost three investigations,

shifts to a different page set every run, and names pages that render correctly in isolation.

Independently confirmed here before the fix landed: the four pages the v3.10.18 battery and a

solo re-run flagged — article-2, article-25, article-7, FF-2 — all measure

rgb(14, 15, 18), luminance 15, when probed directly. Transitions are now suppressed before

the flip, so the reading no longer depends on how busy the machine is.

Fixed while shipping this

• Two type tiers in the diagram engine were below the legibility floor. article-10's new

loop figure rendered ten labels at 8px — "DOES THE WORK", "RAISE SETPOINTS", "RAISE CYCLES",

"DELIBERATE" and six more — and the legibility gate caught it on the release battery, having

reached main in bbd8ce4e.

My first fix was wrong and a second gate caught it. I edited the font-size attributes in

article-10.html directly; the article-diagrams gate immediately reported the page out of date

against its generator. The figure is GENERATED, and hand-editing generated output is the exact

mistake this repository's freshness gates exist to prevent — committed by the person who spent

the previous release writing them.

The real cause is js/rz-diagram.js: eyebrow and arrow-label are the smallest type the

engine emits and were size: 8, so **every figure carrying an eyebrow or an arrow label failed

the floor the moment it shipped.** Raised to 9 in the engine and all four figures rebuilt with

their own tool. The type ramp (from documentation/design.md) and the 8.5px legibility floor are

both this repository's standards and they disagreed; the floor wins, because it is the one

measured against a rendered page. 9 is already sublabel's size, so the ramp keeps three

distinct steps below datum. Engine gates: 113/113 assertions, 0 collisions after the reflow.

• AGENT_HARNESS_STANDARD.md's Last updated: now matches the release date. The harness gate

asserts that parity and failed because this release crossed midnight — the same clock that put

this entry in the changelog.

Four of my own audit findings were measurement artifacts

Working the SEO ledger down, four rows did not survive being re-measured. They are recorded because

the mistakes are the same class the site's gates exist to prevent — a count taken without asking

what it counts:

A count is not a finding. Each needed a question about what the number means.

Added

• tools/test-page-metadata.mjs, wired into ship-gate.sh — the gate the ledger carried as OPEN-7

because v3.10.17 brought metadata to 100% with ad-hoc scripts and left nothing holding it there.

It requires eleven signals of every page sitemap.xml publishes, parses every JSON-LD block

rather than counting them, checks each advertised og:image is on disk, and requires a

publication date on every article-type node. Proven RED against the pre-v3.10.17 tree: **193

missing signals across 34 pages**.

Fixed

• Every published page now has exactly one <h1>. Five cockpits had none — chiller-plant,

datahall, ict, water-system, EPMS_Telemetry — because their identity sits in instrument

chrome. Each page's single .title/.brand element was promoted to <h1>, keeping its class and

therefore its styling. Their mobile hero rules (h1 { font-size: 1.6rem !important }) are written

for article headings and would have jumped an instrument header to 1.6rem on a phone, so those

rules are now scoped h1:not(.brand). a11y audit clean after, both themes.

• 111 article-type nodes carry datePublished; 76 pages had none. The date is the commit that

ADDED the page — when it was published here, which git records exactly. That is a different claim

from sitemap <lastmod>, which tools/build-sitemap.py:53 refuses because a commit does not

prove a CONTENT update. First appearance is not an update; it is a publication. Spot-checked

against known history: manual/pue.html 2026-07-20 matches the manuals programme,

network/industrial-ot/modbus-tcp.html 2026-05-24 matches its own asset token.

dateModified is deliberately absent — nothing in this repository can prove one.

Score

78 → 88 / 100, with the same caveat as before: these are static source measurements, not

Lighthouse runs and not Search Console data. Core Web Vitals are inferred from page weight, never

measured, and an SEO score is a proxy for discoverability, never a ranking prediction.

Also measured and found clean, so no row was opened

0 pages carry more than one <title> in <head> (the apparent duplicates are PDF-export templates

inside JS strings, well past </head>), and 0 titles are duplicated across pages.

The two title rows, judged rather than left hanging

geopolitics-1.html is one character over the display cut and article-28.html's colon-led

hook — "The Compression Horizon:", 24 characters — survives it intact. Shortening either would cost

the question the article is about, so this is closed as judged, not left implying pending work.

Still open, and each says why

96 descriptions truncate mid-clause, and re-measuring says it cannot be swept: **70 are a single

list with no sentence boundary inside the window** — there is nothing to trim to — and the other

26 could end at a boundary only by discarding the text after it. Both paths delete authored content

to fix a cosmetic SERP issue, so it stays open. Plus datahallAI.html at 1,375 KB against a 55 KB

median, and the commercial artefacts in a public repository where deleting the files would not

remove them from git history. Ledger: standarization/Audit result/SEO_AUDIT_LEDGER.md.

A gate that walks one directory reports a clean site by not looking at it

Two findings from the SEO audit, and they are the same bug twice: a tool that enumerates pages with

readdir(ROOT) or glob("*.html") sees the repository root and nothing else. Half this site's

public surface lives in network/, manual/, id/ and prd/.

A — 79 of 90 sub-directory pages were serving a shared asset under a stale or legacy token.

tools/test-asset-cache-tokens.mjs has been green on every ship while never opening those

directories:

auth.js on 43 pages is the same class as the stale auth.min.js that once made the HOMEPAGE run

old code.

The gate now enumerates git ls-files '*.html' and **keys every asset by its path from the

repository root**, because a sub-directory page writes ../../styles.min.css for the file a root

page calls styles.min.css — treating those as two assets would have split every pin and every

token check down the middle even after the walk was fixed. 266 pages scanned, up from 179;

118 pages retokened; version pins still exempt, since hashing those blanks the cockpits fail-closed.

B — the 25 network/** protocol explainers had no social or structured metadata at all.

Modbus TCP and RTU, BACnet/IP and MS/TP, OPC UA, DNP3, PROFINET, EtherCAT, EtherNet/IP, TLS, mTLS,

OAuth/JWT, WireGuard, SNMP, syslog, IPMI/Redfish, gRPC, GraphQL, REST, MCP tool-call, DHCP/DNS,

IPv4 vs IPv6, subnetting/CIDR, the TCP handshake and the OSI model — no og:*, no twitter:card,

no JSON-LD. For an answer engine those are the most citable pages on the site and they were the

least marked up. tools/build-og-images.py had the identical root-only glob, which is why.

Each page now carries the full Open Graph block, a Twitter summary card, and TechArticle JSON-LD

built from its own <h1>, description and canonical — authored values, nothing invented. Their

cards already existed on disk as assets/og/network-*.webp; no page had ever pointed at one.

The slug is network-<stem>, not the bare stem: 27 stems collide across this sitemap

(datahall, ict, fire-system, pue, cdu-mini-bms…), so a bare stem is not a safe card name

for a page that lives in a sub-directory.

Metadata coverage, measured over the 176 sitemap pages

The last nine were prd/ and manual/ pages that had an og:image and no Twitter card.

A recommendation I withdrew after reading the code

The audit's first recommendation was to add <lastmod> to the sitemap — 180 priority and 180

changefreq values ship today, both of which Google ignores, and zero lastmod, which it uses.

tools/build-sitemap.py:53 omits it deliberately: *"Omit dates: Git commits and checkout

mtimes do not prove significant updates."* That is a considered position, not an oversight, and I

had recommended overriding it without reading it. A checkout mtime or a cache-token commit is not a

content update, and Google discards a lastmod it finds unreliable. If it is ever wanted, the only

honest source is the page's own authored dateModified, omitted where the page makes no claim.

Also in this ship — the security zone ladder is checked

tools/test-dcai-security-zones.mjs (written alongside the WAN gate in v3.10.15, wired here).

The Security Network view is page-authored like the WAN sheet, so its one structural claim — the

IEC 62443 ladder — is checked rather than asserted: one conduit per adjacent pair (8 zones,

7 conduits), SL-T never decreasing inward (1 → 2 → 2 → 2 → 3 → 3 → 3 → 4), life safety innermost at

the highest level, its conduit monitor-only with no write, and no zone claiming a verified SL-A.

How far it is proven. S1, S2, S4 and S5 were each triggered on their own by injecting the

matching fault. S3 could not be violated independently — every way of moving life safety off the

inner end also trips S1 or S2 first. It is kept because it states the ladder's endpoint explicitly,

but it is a redundant guard, not an independent check, and the gate's own header says so.

Still open, and not mechanical

94 titles outside 30–60 characters and 96 descriptions outside 70–160; 137 of 176 pages carry no

datePublished/dateModified; 41 pages with more than one <h1> and 4 with none; 7 orphan pages

with no internal inbound link. Every one of those needs authored judgement, not a sweep.

The site stops asking for money and for e-mail addresses

Owner, on a "Stay Updated / Subscribe" box at the foot of an article: *"Jangan ada tulisan

subscribe atau apapun. Ini bukti klw saya mengkomersilkan ini. Delete atau ganti aja. Audit total

pastikan tidak ada."* The site is an engineering portfolio and a teaching model; a newsletter

capture and a PRO tier read as a business, and that reading is the defect.

The audit found far more than the one box he was looking at. Measured across the public pages:

The tier was never a paywall

dc-market-tracker.html grants access on rz-auth-change at login and from an

rz_premium_session key. There is no payment check anywhere in any page. The words were the

only commercial thing about it — so the words changed and the gating did not: "Upgrade to PRO"

became "Sign in for the full analysis", "Premium Access" became "Full access", "Unlock PRO" became

"Sign in", PRO badges became FULL. Class names and JS identifiers were deliberately left alone;

renaming live identifiers to satisfy a text rule is how a sweep breaks a page.

Removed

• All 22 capture forms and their wrappers, subscribeNewsletter() from script.js, the 20 dead

.newsletter-* CSS rules from styles.css / styles-index.css, and the orphaned

<!-- Newsletter Script --> comments. styles.min.css, styles-index.min.css and

script.min.js rebuilt.

• The two privacy-policy rows describing newsletter collection. A privacy policy may not describe

collection that no longer happens.

Fixed — a thumbnail of the owner's own face

articles.html drew article-15's card from assets/og/index.webp, borrowed as a placeholder since

v2.16.0. v3.9.0 repainted index.webp into the portrait identity card, so the borrowed placeholder

silently became the owner's photograph on an article about a service catalog. Repointed to

assets/article-15-cover.webp, which existed all along, with its real 800×1433 dimensions declared

instead of the inherited 1200×630.

Added

• tools/test-no-commercial-surface.mjs, wired into ship-gate.sh. **91 findings on 41 pages

before the sweep, 0 after** — and 114 once the structural rule was repaired (see below).

Two gate mistakes, both caught by testing the gate instead of trusting it

• The first rules banned WORDS — premium, pricing, unlock, upgrade — and reported **254

findings on 71 pages, every one false**: "OpenAI pricing" in an article about the AI market,

"CAPEX premium" in a Tier comparison, "resilience upgrade to Cloudflare's Multi-Colo", and

"Log in to unlock", which is the correct access wording this very sweep introduced. A $N/month

rule was written and deleted for the same reason — its 27 findings were all electricity bills

("$17/month increase already; $70/month projected by 2028"). The rules now match the ask: a

tier CTA's exact phrasing, or a form that collects an address. No word is banned on its own.

• The structural rule did not fire at all. It read a 600-character window around each

type="email" input and excused it if the word "account" appeared — and every page carries an

Account link in its navigation, so it excused everything. Proven by injecting a bare mailing-list

form, which it failed to catch. Scoped to the form's own opening tag, it now reports all 23.

Honest boundary

Two things were found and deliberately NOT removed, because they are the owner's to decide, not a

typo to fix:

• rz-ops-p7x3k9m.html — a root-gated, noindex, sitemap-absent admin console with Revenue

Analytics, Mayar Payments, Tier Manager and a Newsletter Subscribers panel. No reader can reach

it; it is excluded by name in the gate so the exclusion is on the record.

• Data/Freemium Scheme/ — 56 tracked files including a Mayar payment webhook and Pro-Mode plans.

Not in the sitemap, Disallowed in robots.txt, but tracked in a public repository. Deleting

the files would not remove them from git history, so deletion alone would not achieve what it

looks like it achieves.

Archived audit reports under standarization/Audit result/ were swept by mistake and reverted:

they are records of past state, not site copy.

A declared number is honest; it is not checked

The Corporate & DC Internet view (§A7) is the one sheet on datahallAI.html the engine does not

feed, and it says so on every figure: the dataset-refresh rate, the diurnal peak factor, the

replication / distribution / ops terms, the committed transit and the installed port count are

DESIGN SELECTIONS, not engine quantities. That declaration is what ACCURACY_VALIDATION asks for,

the coverage walker counts those figures as accounted, and the row reads CLEAN.

None of which makes the arithmetic true. **A page-authored study is exactly where a number drifts

unseen** — change the dataset rate in the card and the headline keeps the old peak, and no gate on

this site would notice, precisely because every figure is already declared.

Added

• tools/test-dcai-wan-study.mjs, wired into ship-gate.sh. It re-derives the study from its own

stated inputs and checks that every printed figure follows:

| | identity | measured |

|---|---|---|

| W1 | sustained = dataset × 8 ÷ 604,800 s | 10 PB/week → 132.3 Gb/s |

| W2 | peak = sustained × factor + replication + distribution + ops | 132.3 × 3 + 120 + 40 + 19 = 575.9 |

| W3 | headline tile = the Demand Model card's peak | 576 = 576 |

| W4 | committed = carriers × per-carrier commitment | 2 × 400 = 800 |

| W5 | one carrier lost = committed ÷ carriers | 800 ÷ 2 = 400 |

| W6 | the adverse finding is drawn in the adverse token | 400 < 576, tile is amber |

| W7 | installed ≥ committed | 4.8 Tb/s ≥ 800 Gb/s |

It asserts the ARITHMETIC and never the choice of inputs — changing a design selection is not a

failure; publishing a figure that does not follow from it is.

Every identity proven RED, one at a time

A gate that has only ever passed is decoration. Each of the seven was injected with its own fault

and reported its own finding: dataset rate raised without the sustained figure, peak factor raised

without the peak, headline drifted from the card, committed drifted from the carrier count,

one-carrier figure wrong, the adverse tile repainted in an identity colour, installed dropped below

committed. The page was restored byte-identical after every injection.

W6 is the one worth naming: **an adverse finding rendered in an identity colour is a finding nobody

reads.** The surviving commitment after a carrier loss (400 Gb/s) is below the modelled peak

(576 Gb/s), and the gate now requires that comparison and the amber token to agree in both

directions — if the design ever stops being adverse, the amber must go too.

Changed

• The §A7 ledger entry is corrected. Owner comment (4) — "Network: modal per block, split into

rack-fabric / corporate-internet / security sub-tabs, firewall + cyber architecture" — is

shipped: netSvg, wanSvg and secSvg exist as three scoped sub-tabs, all three coverage

rows read CLEAN, and each block opens its own detail modal. The plan file still listed it as

outstanding.

Honest boundary

wanSvg carries 0 engine hooks and is a MONITOR row in the basis-hooks gate. That is correct, not

a gap: the engine publishes no WAN quantity, so there is nothing to hook. This gate is what stands

in for hooking — the figures answer to each other instead of to the engine.

A check nothing runs is a comment

v3.10.12 closed the pixel half of the colour ban by asserting that every OG card is a current

rendering of its generator, and wrote the general rule into the standard: *when a generated

artefact cannot be inspected for the property you care about, assert that it is a current

rendering of the thing you CAN inspect.*

That rule is not about colour. Applied to the site's text artefacts, it immediately found one that

had drifted four months in plain sight:

standarization/Indexing gconsole/top-urls-request-indexing.txt

generated 2026-05-14 · 102 URLs · the sitemap publishes 180

still naming "GB200 NVL72 Live Operations", a title retired in v2.0.0

**78 public pages had never been on the list a person works down when requesting indexing in

Search Console.** Nothing reported it: --check existed on three of these builders and was wired

into no gate at all, and two more builders had no check mode to wire.

Added

• tools/test-generator-freshness.py, wired into ship-gate.sh beside the OG-card and min-twin

freshness gates. Runs each builder's check mode over sitemap.xml, llms.txt, llms-full.txt,

search-sections.json, rz-explain-db.js + search-terms.json, and the indexing list.

• --check on tools/build-indexing-list.py, tools/build-search-sections.py and

tools/build-explain-db.py, which had none.

Fixed

• The indexing list regenerated: 102 → 180 URLs, retired titles gone.
• build-indexing-list.py now unescapes the <title> it reads. A title is HTML; this file is

plain text a person pastes into Search Console, and it had been shipping

"Live Capacity &amp; Growth Dashboard".

The design note that decides whether such a gate survives

The indexing list carries a generation DATE in its header, so a byte compare would report drift

every single day and be switched off within a week. Its check compares the URL rows and their

titles — the thing that must not drift — and ignores the header. **A check that cries wolf is a

check that gets disabled.**

Honest boundary

tools/build-profile-photos.py is NOT covered: it needs OpenCV for the face-centred crop and

cv2 is not installed on this machine, so a freshness check for the portrait ladder would fail on

a missing dependency rather than on staleness. Named in the gate rather than silently skipped.

The rows read zero

datahallAI.html now gates on geometry, like every other page in the survey.

PASS Conventional geometry: no label collisions, no clipped elements,
     no degenerate labels, no phone overflow

Twenty-one drawings, four viewports, both themes. The page entered that gate in v1.135.0 carrying

2,678 findings — 812 collisions, 1,780 sub-floor labels, 86 clipped — because before that

release no render gate had ever opened eight of its ten tabs. Failing the build on day one would

have got the whole gate muted, which is exactly how the page went unmeasured for so long, so its

findings were reported rather than enforced, on one condition written into the gate itself:

> flip to strict once its rows read zero, and do not widen the tolerance to get there.

Both halves hold. The tolerances are unchanged from the day the page arrived — 1.5 px overlap,

1.0 px clip, 8.5 px legibility floor. The sweep was paid, not the threshold.

Changed

• MONITOR_PAGES is empty. The comment left in its place says what it costs to get a page back

out of that set, because a page added to it is a page that stops being enforced.

Fixed

• The last pair, on the floor plan — and it took three trades to stop nudging and read the

band. The chiller status caption was moved off the AHU room in v3.10.11, onto the glyph note in

v3.10.12, and onto the CW riser caption after that. Dumping every label's coordinate in that

column showed five elements sharing it, and showed that the corridor strip assumed to be in

the way is only 72 px wide at the far left — it never reaches this column. With the band actually

mapped, both captions fit between 450.4 and 470 with real clearance: the status line at grid

36.3, the glyph note at 36.9.

• The isometric's last pair was not a placement failure. DH-4 — 440 racks kept meeting BD

however the search moved it, because the caption was authored at f.z+FH+6.5 — inside the band

the equipment tags project into, where every nearby slot is contested. FH+10 puts it above that

plane. Placement catches what an author misses; it cannot excuse where the author starts.

Verified

A collision was injected (the status caption returned to grid 35.8) and the gate reported it with

the drawing named and no "REPORTED, not gating" note — the findings now count as blocking,

and the exit expression is blocking.length === 0 ? 0 : 1.

The hue gate could not see the pixels, so it asserts freshness instead

v3.10.8 taught the colour ban to read the Python generators that print the pages, and named the

half it still could not reach: source scanning cannot see pixels. Fixing a violet literal in

tools/build-og-images.py does not repaint a card already written — three cards had to be

rebuilt by hand, and nothing but memory would have caught a fourth.

The obvious gate was tried and it does not work. Scanning the rendered cards for the banned

hue band was written, measured, and abandoned:

WebP at quality 80 smears a flat 4px rule into roughly 750 distinct near-colours, so neither the

total nor the longest same-colour run tells an accent apart from a photograph that happens to hold

violet-ish tones. Any threshold there either misses the accent or condemns the photo.

Added

• tools/test-og-card-freshness.py, wired into ship-gate.sh beside audit-min-twins.mjs, whose

rule it borrows: a derived artefact that no longer matches its source is stale. Every card is

re-rendered in memory through build_og_image(), re-encoded at the quality the builder would

use, and compared per-pixel across 8 worker processes (about two minutes).

Fixed

• Six stale cards, found by the gate on its first runs and invisible until then. datahallAI

and FF-3 at 2.07 and 2.22 of 255; then FF-1, FF-2, cx-calculator and future-forward at

1.55–1.89 once the tolerance was tightened. All six were hero-panel cards rendered before a later

change to the panel, all six rebuilt.

The numbers behind the tolerance

On a clean tree 135 of 139 cards measure exactly 0.000, and rendering the same target twice also

measures 0.000 — the render is deterministic and the encoder reproducible, so the 1.0-of-255

tolerance is insurance against a future Pillow or libwebp change, not absorption of run-to-run

noise. It was first written at 2.0; at 2.0 four of the six stale cards would have passed. The RED

proof is the card the gate exists for: the pre-v3.10.8 violet pue-calculator.webp measures 33.6.

Standard

standarization/ANTI_VIBECODE_STANDARD.md clause 4 is closed, with the general rule it produced:

**when a generated artefact cannot be inspected for the property you care about, assert that it is

a current rendering of the thing you CAN inspect.**

Nine pairs, nine reasons

Every remaining overlapping label pair outside the isometric, fixed at its cause. None of these is

a crowded drawing; each is a coordinate that was right when it was typed.

Fixed — cooling P&ID

• The chiller grid's value column met its own labels. Values are end-anchored at px+55, and

the widest label in that grid — Air duty (fac), fourteen characters at 3.5 — runs to px+29.4

while 142,037 kW at 4.5 starts at px+28. px+60 clears the longest label by 3.6 units and

still leaves 5 before the next column.

• Four labels shared fifteen units on the CDW return line. They now own separate rows:

CDW Return 197–201, the flow figure 203.75–207, CLOSED LOOP 209–213.5, DN300 CS 216.75–220.

• A pressure tap sat inside a label it was not part of. The P sensor at x=584 was within the

span of HTW Return 45.0 °C, which is centred on 585 and runs 564–605. Moved along the same run

to 545, where it still reads as a tap on that line.

• A BACnet bullet rode above its own circle. Drawn at y=22 while its circle is centred on 24,

so it sat outside the glyph it belongs to and clipped the ISA-5.1 legend subtitle overhead.

Centred in its circle it is both correct and clear.

• 3.8 bar moved clear of the BFV tag above it.

Fixed — elsewhere

• Electrical overview: the genset bank captions end at y=193 and → LV 400V via ATS began at

194.25. Both ATS lines drop four units.

• Floor plan: a chiller-bank caption sat at 37.9 grid units — inside the AHU room, which

starts at 37.5 — so it landed on that room's own name. Raised to 36.6.

• Fire mimic: symNozzle() draws its own NZ caption at cy+20, so nozzles at cy=322 put

NZ at y=342 and the block's READY caption sits at 343 — the middle nozzle's label was

directly underneath it. The glyph row moves up six units; everything stays inside the block's

310–348 box and READY keeps the baseline its two sibling blocks also use.

The mask moved, the text did not

The building isometric goes 4 overlapping label pairs → 1. One of the three fixes below was a

bug I shipped two releases ago, and it is the reason the other two looked like they were not

working.

Fixed

• A displaced caption moved its mask and left its text behind. isoResolvePlacement() applied

only dy when re-rendering a placed label. That was correct while placement was vertical-only;

escalation to the full ladder and the outward axis (both v3.10.9) made horizontal moves

possible, and from then on the opaque mask moved while the words stayed where they were

authored. CW PUMP STATION's mask ended up 36 px right of its own label. The search

reported every one of these as placed, because by its own reckoning the box it moved was

clear — so the diagnosis kept pointing at the search when the defect was in the rendering.

A displaced box now moves everything it draws, or it has moved nothing.

• Equipment tags are semi-rigid, not immovable. A tag names one box, so it cannot wander —

but "cannot wander" had been written as "cannot move", and two tags then sat on each other:

MV SWGR-B and SM6 20kV both landed on the 80,000L tank tag, visible only once the floor

caption stopped covering them. A tag now gets a 12-unit budget against the tags already

placed; beyond that it stays put and the drawing has a real layout problem, which is the honest

outcome.

Changed

• Placement pads every hit test by 2 units. A text box computed from a width budget is an

approximation of what a font engine draws. Treating the estimate as exact declares a near-miss

clear, and the browser then measures a two-unit overlap the search never saw.

Added

• I1e, I1f and a displacement assertion — 99/99. I1f is the regression test for the

dx bug: reverting to dy-only puts the text 70 units from the centre of its own mask.

• A diagnostic hook, window.ISO_DIAG, publishing {flex, rigid, moved, unplaced}. The

isometric's placement runs inside a closure, so a gate finding GROUND FLOOR x SM6 20kV could

not distinguish "the caption was moved and still collides", "it was left where it was authored"

and "it was never in the pass at all" — three different defects that look identical from

outside. Current reading: 41 flex, 20 rigid, 26 moved, 0 unplaced.

Honest residue

DH-4 — 440 racks × BD still overlaps by roughly 3 × 5 units. One pair of twelve. The

drawing is dense enough that the remedy for the last one is the one

DATAHALL_AI_STANDARD.md already prescribes — fewer labels in the SVG — not a wider search.

Parked at the origin

Three clipped elements on datahallAI.html, and neither cause was findable by reading the source.

Both fell out of a probe that names the offending element instead of its tag.

Fixed

• #coolSvg — two flow dots parked at the SVG origin. pDots() gives each dot a positive

animateMotion begin so the dots spread around the cycle. But animateMotion translates an

element from its own position, and these circles carry no cx/cy — so until its delay elapsed,

every delayed dot sat at (0,0) with its 1.5-unit radius hanging outside the frame. A negative

begin starts the animation already in progress: identical spread, no parked frame.

• #hSvg — a frame one unit too tall. The pipe-rack frame was 72 units from y=619 in a

690-tall viewBox, so its bottom edge sat at 691. Its deepest content is at 681, so 68 encloses

everything with six units to spare. The drawing was never the problem; the box around it was.

• Three isometric floor captions never entered the placement pass, because they were two raw

<text> elements rather than an isoLabel — which is why GROUND FLOOR kept landing on

SM6 20kV and MV SWGR-B, and the FLOOR 2 subtitle on the water tank. The caption is now one

deferred block of two lines that moves as one.

Changed

• Placement escalates rather than giving up. A zone caption prefers to move along one axis —

that is what keeps it reading as the name of the thing beneath it. In a dense corner (the FWS

pump station has three pumps, a header and a tank in one band) every candidate on that axis can

be occupied. It now falls back to the full ladder: a caption nudged diagonally still names its

room; a caption sitting on an equipment tag names nothing.

• placeBox() gains a horizontal axis, outward-first. The floor caption is parked beside the

building, so its open canvas is further out — and sliding it vertically would walk it into the

floor above.

Added

• tools/probe-clipped-elements.mjs — the gate reports that a <circle> is clipped and by

how much, which is right for a gate and useless for a fix when the drawing holds hundreds of

circles. This prints the element's attributes, the edge it crosses and its basis hook. Two traps

are written into it: activate a tab and measure that tab before moving on, or the first one

is still hidden at zero width; and use getBoundingClientRect, not getBBox — getBBox

excludes stroke and ignores the transform animateMotion applies, so it reported zero while

the gate reported three.

• Q5, I2b, I2c in the engine suite — 93/93.

The gate failed its own author, and it was right to be fixed rather than worked around

test-diagram-engine-adoption.mjs rejected this release for a comment. The sentence *"every

isoLabel() call today is inside renderOverview()"* was counted as a call, so explaining the rule

tripped the rule.

That is the same defect the purple gate fixed one release earlier, and it has the same remedy:

strip comments before counting, rather than reword the comment. A gate that flags its own rule

being explained teaches people to stop writing the explanation. Block, line and HTML comments are

now stripped; a primitive named inside a string still counts, because this gate cannot tell a

template that emits a call from prose, and counting it is the safe direction for a ratchet.

Baseline re-recorded at 3,111 (from 3,114 — the three it had been miscounting). Verified by

injection: a real <rect x=… y=…> added to ict.html fails; the identical markup inside an HTML

comment does not.

A weak test, caught twice

Q5's first scenario put a blocker exactly as wide as the label, needing dx ≥ 60 from a ladder

that reaches 48 — the failure was the test's, not the search's. It now asserts both halves: a

narrow blocker is cleared, and one wider than the ladder reaches is correctly reported

unplaceable rather than quietly left overlapping.

The generator is where the banned colour was hiding

tools/test-purple-family.mjs reads the hue of every literal in *.html, *.css and *.js, so a

regression cannot rename its way past it. It still could not see a violet that was never written in

one of those files — it was written by a Python generator that prints the page.

Four generators were still emitting the AI-default violet family into pages a sweep had already

cleaned by hand:

• tools/build-changelog-html.py — the MAJOR filter chip painted rgba(139,92,246) / #a78bfa

while its own TIER_COLOR table says amber, a commit-link code chip in the same violet, and a

navigation copy still carrying #4f46e5 on TCO Calculator and #7c3aed on Future Forward.

index.html and articles.html have carried #64748b on both links since the nav sweep; the

generator did not. changelog.html is in the gate's SKIP_FILE list because it is generated —

so the live page kept the violet and nothing could report it.

• tools/generate-city-pages.py — the same two stale nav links plus two disclaimer rules.
• Apps/second brain/rebuild-codebase-graph.py — a root-gate login button and a nav link at

#8b5cf6, where the shipped page beside it reads #0e7490. A regenerate would have undone that

sweep silently.

• tools/build-og-images.py — three social cards keyed to #8b5cf6.

Changed

• The purple gate scans *.py, and strips Python line comments the way it already stripped //

ones: a # opening a comment is followed by whitespace, a # opening a colour literal by a hex

digit inside quotes. Without that, the gate would flag its own ban being explained in a comment.

• MAJOR changelog chip amber (rgba(217,119,6,·) / #f59e0b), matching the tier colour it labels;

commit-link chip neutral slate; both stale nav links #64748b.

• City-page nav and disclaimer links to #64748b / #06b6d4; Second Brain generator to #0e7490.
• OG accents: PUE Calculator #14b8a6, ICT #0d9488, Global PUE Benchmarks #f59e0b; those three

cards rebuilt. A pixel scan of all 127 cards for the banned hue band returns zero.

Standard

standarization/ANTI_VIBECODE_STANDARD.md — "A colour gate must read the GENERATOR, not only what a

browser loads". Four clauses: generators are in scope whatever their extension; comment stripping is

per-language; a page swept by hand has its generator swept in the same commit, or the sweep has a

half-life of one rebuild; and source scanning cannot see pixels.

Honest boundary

The pixel scan was run by hand, not wired as a gate. A colour ban that reads source can never see a

rendered image; that remains an open hole for any artwork a generator paints, and the standard says

so rather than leaving it to be rediscovered.

A registry is not a coverage list

A correction. v3.10.3 and v3.10.4 both stated that the geometry survey does not reach the Track B

cockpits, reasoning from the fact that TAB_SETS names only datahallAI.html.

That reasoning was wrong. TAB_SETS is the tab-activation registry — it records which drawing

sits behind which tab, so a gate can open it. Coverage is a different list:

test-conv-geometry.mjs keeps its own DIAGRAMS array, and it has covered chiller-plant,

fire-system, water-system, fuel-system, ict and EPMS_Telemetry all along.

So those pages are measured, and they measure clean. The census bears that out: every defect it

found sits on #bldgSvg, #coolSvg, one floor plan, the data hall, the electrical overview and the

fire mimic. The claimed 462 unmeasured coordinates across nine files were measured, and were fine.

Fixed

• The false claim is corrected at all three places it was published: the SCOPE docstring and the

COCKPITS comment in tools/test-diagram-engine-adoption.mjs, and §6 of

standarization/DIAGRAM_ENGINE_STANDARD.md.

Unchanged

• The adoption ratchet still names every cockpit itself, for a narrower and true reason: it

holds surfaces the survey's list does not name — all-in-one-dashboard.html,

rz-cockpit-mockup.html, js/ltc-system-modelling-lab.js — and a drawing that is

collision-free today says nothing about the next hand-typed coordinate added to it. The baseline

of 3,114 across fourteen files stands.

The caption yields, the tag does not

The building isometric carries twelve collisions, and all twelve are the same shape: a floating

zone caption landing on an equipment tag — GENERATOR ROOM × BD, GROUND FLOOR ×

SM6 20kV, CW PUMP STATION × P2, TX-A ROOM × DH-2, and eight more.

Nothing here is crowded. An isometric projects a three-unit-tall equipment box up-screen into

exactly the band a floating caption occupies, and both were placed by hand, so neither knew the

other existed.

> The approved plan for this drawing assumed 111 collisions and proposed a re-layout. It

> carries 12. Earlier sweeps paid the rest down, the plan's premise is stale, and a re-layout

> is no longer the right remedy — placement is.

Changed

• isoLabel() places by search instead of by offset. Which label yields is not arbitrary: an

equipment tag names one box and points at the wrong thing if it moves, so tags are rigid;

a zone caption names a region and reads correctly a few units away, so captions are flexible.

• Flexible captions are deferred. A caption is often emitted before the tag it must avoid, so

it emits a token and isoResolvePlacement() substitutes real markup once every rigid box is

registered. Displacement is vertical only — a caption slid sideways stops sitting over the room

it names.

• Mask width now comes from RZDiagramMetrics rather than length × 0.62. These labels are

JetBrains Mono, so the 0.60 em budget is exact, not an estimate.

Added

• RZDiagramLayout.placeBox() — placement near a desired point, for a caption with no

connector to hang from. A ladder, not a spiral: straight up first, because on an exploded

isometric the space above a room is the reliably empty direction. Returns placed:false when

nothing is within reach rather than overlapping silently.

• Q1–Q4 and I0–I3 in tools/test-rz-diagram-engine.mjs — 84/84. The I set runs the

page's own placement code, extracted from datahallAI.html, and covers the two failures that

would render as damage rather than as an error: a token surviving into the DOM, and a page that

has not loaded the engine.

A weak assertion, caught

The first version of I1c checked that the two mask y values differed. Two boxes two units

apart differ and still sit on top of each other — and the assertion duly passed while the captions

were being drawn rigid, which is the exact bug it exists to catch. It now asserts the masks do not

overlap. Both mutations are caught.

Which way is short

v3.10.2 taught the geometry survey to dedupe a defect across the four viewports and two themes

it appears in, because a pair that collides in all eight is one thing to fix. The dedup key was

the pair without its overlap numbers — and the numbers went with them.

That reading is the whole diagnosis. A 27.0x2.0px overlap is a horizontal problem, and no

amount of moving the label down will clear it; two attempts earlier this week were spent taking

the vertical lever on exactly that shape before the geometry was read. 2.0x27.0px is the same

pair and the opposite remedy.

Fixed

• The per-drawing listing keeps one representative overlap per defect, preferring the

desktop row, instead of printing the pair with its measurements stripped. Deduped counts are

unchanged; the reading is back.

Say the deduped number

Housekeeping, but two of these were wrong in a way that would have been quoted.

Fixed

• DIAGRAM_ENGINE_STANDARD.md carried three stale facts — 63 assertions (now 68),

"15 diagrams" on datahallAI.html (TAB_SETS registers 21), and the raw 218 geometry

findings. That last one is inflated by roughly a factor of eight: v3.10.2 taught the survey to

name the drawing and deduplicate across 4 viewports × 2 themes, because a pair that collides in

all eight combinations is one thing to fix. The standard now records what each surface

actually contains — 2,652 hand-authored coordinates on datahallAI.html, 462 across the Track B

cockpits — and states plainly that the survey does not reach those cockpits at all.

• llms-full.txt was stale. Regenerated: 2.88 MB. sitemap.xml, llms.txt and

search-sections.json were checked the same way and were already current.

Added

• The standard's §5 now lists the adoption ratchet alongside the engine test, with the

--baseline re-record step, so a migration does not leave the gate stuck on an old count.

A ratchet, not an ultimatum

The instruction when the engine shipped was plain: when you make a block diagram, use this engine.

This is how that survives contact with a codebase that already contains **3,114 hand-typed

coordinates** across fourteen cockpit files.

A gate that failed on any hand-typed coordinate would fail on day one and stay failed, and a gate

that is always red teaches people to ignore it. So tools/test-diagram-engine-adoption.mjs forbids

only the count from rising. That is enforceable today, and it makes the migration monotonic:

every release either leaves a drawing alone or moves it toward the engine.

Added

• tools/test-diagram-engine-adoption.mjs — counts two proxies per file: calls to the page's

own coordinate-taking draw helpers (tx, tx2, lv, bx2, eq, rm, symGen, …) and SVG

elements positioned by a numeric literal in source. A new cockpit file with any hand-authored

geometry fails outright — a new diagram has no excuse, the engine exists. Wired into

ship-gate.sh; baseline committed as tools/diagram-adoption-baseline.json.

Fixed

• The ratchet does not inherit the geometry survey's blind spot. TAB_SETS lists

datahallAI.html and nothing else, so test-conv-geometry measures that page's twenty-one

drawings and none of the Track B instrument pages — which are not clean: fire-system.html

carries 137 raw coordinate literals, water-system.html 121, fuel-system.html 97. The cockpit

list is named in full in the gate and unioned with TAB_SETS, so those pages are held even

though nothing measures them yet. Extending the survey to reach them is separate work.

Verified

• Both failure paths were injected and observed: one added coordinate on ict.html (11 → 12) and

an unseen cockpit file each fail with the file named.

The width is knowable now

v3.10.0 shipped a diagram engine and said, honestly, that it was not yet wired into any cockpit

page. One piece of it reaches every cockpit immediately, and this ships that piece.

js/rz-svg-basis.js draws the provenance mark that sits just past the end of a label. To find

that end it measured the label as String(text).length * size * 0.6, and the constant beside it

admitted what that was:

var MARK_GAP = 2.4;  // gap between the text end and the mark centre (approx; text width unknown at build time)

Changed

• approxWidth() asks RZDiagramMetrics when the engine is on the page. A flat per-character

estimate puts the mark about 10 units inside a tracked eyebrow (PIPE RACK at 0.18em budgets

32.4 and draws 42.1), 7 inside a CJK label (主控室 budgets 10.8, draws 18.0), and 10 units

adrift of a narrow one (iiiiii budgets 21.6, draws 11.5).

• datahallAI.html loads rz-diagram-metrics.js synchronously, before rz-svg-basis.js.

rz-svg-basis looks the engine up at call time rather than capturing it at load time, so a

defer or a later tag would leave every mark on the old approximation — which looks identical

to working.

• The fallback is the old estimate. A page that has not adopted the engine keeps exactly the

behaviour it had. This is an improvement where the engine is present, never a new dependency.

Fixed

• test-conv-geometry.mjs now names the drawing, not just the page. A page carries up to

eighteen diagrams, and a finding attributed only to the page cannot be assigned to any of them:

three collisions fixed on the cooling P&ID moved the printed sample by nothing visible, because

it was already full of the isometric's. Findings are also deduplicated across viewport and theme

— a pair that collides in all eight combinations is one thing to fix, not eight, which is how

one page read as a 218-item backlog.

Added

• B1–B3 in tools/test-rz-diagram-engine.mjs: the CJK label is measured rather than counted,

the engine-less fallback still draws and still hooks its parameter, and the lookup is asserted to

live inside the function rather than at module scope. 68/68.

• DIAGRAM_ENGINE_STANDARD.md §3b documents the hand-off and the three rules that hold it.

240 framework swatches the v3.6.0 sweep could not reach

A full render audit of the representative page set turned up the owner's oldest complaint again, on

a page he had already named. article-27.html — the page he had open when he said *"masih banyak

ai design slop lihat itu kotak highlight biru, orange dll"* — still carried nine of the banned

default tints. So did 45 other pages.

The v3.6.0 sweep cleared `#dcfce7 #dbeafe #f0fdf4 #ecfdf5 #fff7ed #fef3c7 #86efac #6ee7b7 #fdba74

#fcd34d` from fifty files, but only where they lived in a stylesheet rule that sweep looked at.

240 survived: in page-level <style> blocks, inside gradient stops, and in two modules that author

their CSS as a JavaScript string.

Changed

• Every banned swatch used as a FILL is now a low-alpha tint of the page's own semantic token —

green stays green, amber stays amber, red stays red — so a severity ramp keeps its meaning and

only the framework default disappears. An alpha tint also repairs these pills in dark mode,

where a fixed light hex was a bright box on a dark ground; that is the half v3.6.0's editorial

fix could never reach, because it activates only under [data-theme="dark"].

• A text colour is deliberately left alone. Light green ink on a dark ground is legitimate and

the contrast work depends on it; the banned thing is the filled tint box.

Added

• tools/sweep-framework-swatches.py — the mapping, written down and repeatable.
• audit-vibecode.mjs gains framework-swatch-fill, reading background/border

declarations in source. The render audit only sees these once a browser paints them, which is why

they survived two sweeps; this one sees them in the file. STRICT, and green.

Also

• account.html pointed its favicon at assets/favicon.ico, which does not exist — repointed at

assets/favicon-32.png, the file the rest of the site uses. A scan for broken local references

found exactly one other, and it is deliberate: the spares hero image is an optional slot whose

onerror removes its own band.

A note on the first cut

The sweep's first pass rebuilt every background/border declaration it matched, whitespace and

all, which rewrote 52 lines of js/rz-inspector.js to change one colour. A diff that large hides

the edit inside it. It now leaves a declaration that carries no banned swatch byte-identical.

Measured, not guessed — a diagram engine for the cockpit drawings

The block diagrams on this site are built by concatenating SVG strings with coordinates

typed by hand. That works exactly once. The moment a panel gains a row, a title gains a

word, or an engine value goes from 54 to 108, the coordinate is wrong — and nothing says

so. Three separate collisions shipped in v3.9.9 were all that one defect.

The cause is not carelessness. The drawing code cannot ask how wide a label is. This

release gives it a way to ask.

Added

• js/rz-diagram-metrics.js — a per-character width budget. A wide or full-width

character costs 1em, every other character costs its face's Latin advance (0.58em IBM Plex

Sans, 0.60em JetBrains Mono), and combining marks cost nothing. Tracking is counted per

character, which is why an 0.18em eyebrow overruns a box sized from its untracked twin.

overlap() reports per axis and names the cheaper separation, because a boolean is what

made two attempts nudge a label down when the overlap was 27px horizontal and 2px vertical.

• js/rz-diagram-layout.js — placement by search and orthogonal routing. A label takes

the first candidate position that collides with nothing: preferred slot at 8px clearance,

then the 6px floor, then slid along the connector in 8-unit steps. **If every candidate is

blocked the engine reports placed:false and draws nothing** — a silent overlap is the

defect being removed. Connectors are orthogonal only, elbows are quarter-arcs at r=8

shrinking to 6 on a short leg, and a route around an intervening box is preferred to a

route through it; when no route clears, the stroke comes back transit and dashed.

• js/rz-diagram.js — the surface pages draw through. Nodes size themselves from their

own content; an explicit width too small for its text warns rather than overrunning.

fit() shrinks the frame to what was drawn. Labels are painted last, so a label can never

be clipped by a node painted after it — the failure is removed by construction rather than

detected afterwards. No literal hex leaves the engine: colours resolve to the page's own

custom properties, so one edit to a cockpit's :root re-skins every diagram on it in both

themes.

• tools/test-rz-diagram-engine.mjs — 63 geometry assertions, now a ship gate. Disabling

the placement search, the router's obstacle test, or the attach-point formula each turns

three assertions red.

• tools/demo-rz-diagram.mjs — draws the liquid cooling chain through the engine and

exits non-zero on any collision. Also a ship gate. 30 boxes measured, 0 collisions.

• standarization/DIAGRAM_ENGINE_STANDARD.md — what the engine guarantees and what an

author is still responsible for.

Changed

• The project adopts the diagram-design skill's §6 connector rules as its diagram

standard, under a resistancezero skin selected by a .diagram-design marker. Two of that

skill's shipped anti-patterns are deliberately overridden and the reasons are written

down: the dark ground with instrument cyan is an ISA-18.2 alarm palette rather than a

glow, and JetBrains Mono is this site's data face for its slashed zero. Names still go in

IBM Plex Sans and mono is still technical-only.

• Contrast for the diagram skin is measured against each face's own paper, never inverted.

Signal amber #FFAA00 reads 1.82:1 on paper and fails outright, so the light face carries

#8A5A00 at 5.7:1. No role sits below 4.5:1.

Not yet migrated

The engine is built, gated and proven on one real diagram. datahallAI.html and the Track B

cockpits still draw with hand-typed coordinates. Migration is per diagram, each with its own

geometry re-measurement.

Two blocks pinned to the same corner, and two panels drawn on their own lines

Three collisions on the cooling P&ID, and none of them was a crowded drawing. Each was a

layout that had stopped being true and had nothing to say so.

Fixed

• The ISA-5.1 tag legend and the PUE badge were both pinned to the top-right corner of a

960-wide viewBox and overlapped by 50 units — the legend spanning 866–950, the badge

900–955. Neither block measured the other. The four header blocks now lay out in sequence:

ASHRAE 640–720, free-cooling pill 726–804, legend 810–894, PUE badge 900–955.

• The CDU parameter panel was painted on top of the HTW return line. 140 × 98 ending at

y=223, over a line at y=205 and its temperature badge. Four of its twelve rows — Per CDU,

Flow/CDU, Active, Approach — are per-unit specification rather than loop topology, so they

moved to a new CDU Unit Data card and the panel now ends at 190. The panel is

annotation; the line is topology, so the panel gives way.

• The TCS parameter panel had the same defect, 105 × 65 ending at y=225 over the TCS

return line. Four rows moved to a new TCS Loop — rack side card; the panel ends at 192.

• The CDU header bar carried a title wider than itself. The bar is 148 units;

CDU ARRAY — 55 × CoolIT CHx1000 needs about 170, and the 54/55 count chip was already

anchored to its right edge. The title keeps the identity and the model name moved down to

the rating line, which had room. This is the panel header the v3.9.7 dot/title/count sweep

missed.

Every bo(...) that left the drawing landed in a card row: the parameter registry holds at

R8 241/283 STRICT, unchanged.

Follows standarization/DATAHALL_AI_STANDARD.md — *"Spec tables live in the HTML cards below

the drawing, not in the SVG."*

Every public page shares as itself

The share card work continued past the homepage. Measured against sitemap.xml — the site's own

definition of what is public — 15 public pages had a broken card: ten advertised the generic

profile photo or another page's card, one pointed at a file that was never generated, and nine

carried no og:image:alt and no twitter:image at all. Shared to LinkedIn or WhatsApp, ten of the

CDU and fire toolkits all previewed as the same picture.

Fixed

• 11 pages got their own card, one got the file it had been advertising for months

(ai-engineering-maintenance), and 8 more had their tag set completed. Public-page failures in

tools/audit-og-images.py: 15 → 0. The remaining 60 failures are pages the sitemap does not

publish — the root-gated incident dossier and internal tools — and they are correctly left alone.

• The generic card layout. It was a title hanging in the top third over an empty lower half,

with the description sliced mid-word ("a deep all-aspects comp"). Now: a mono family label in

the family's own accent (LIQUID COOLING TOOLKIT / FIRE SAFETY TOOLKIT / CALCULATOR / INCIDENT CASE

FILE …) derived from the slug, the block centred in the card, and text that ends on a word.

Three semantic accent slots — fault red, instrument cyan, brand amber — not one hue per page.

• js/rz-version.js was left on a stale token on 175 pages by the release before this one.

Swept, which is what tools/test-asset-cache-tokens.mjs is for.

Added to the builder, so this cannot silently rot again

• --discover: every public page that advertises no card — or advertises one that is not on disk,

or points at somebody else's — is derived from its own <title> and description. TARGETS was a

hand-kept list, which is why 15 pages fell out of it.

• The completeness pass: --update-html now walks every public page that owns a card and fills

whatever is missing from the tag set. It used to return early the moment og:image was already

correct, which is precisely why nine pages kept an incomplete one.

• Stale entries in HTML_FILES (five pages that no longer exist) are reported instead of crashing

the run half-way through patching.

Dot left, title centre, count right

The cooling P&ID goes 16 → 12 collisions per view. Two causes, both of them a layout the panel

was fighting rather than a crowded drawing.

Fixed

• **Four panel headers put the status dot AND its count on the left, then centred the panel title

in the same band** — so each count ran into the title it belongs to. The count moves to the

panel's right edge, anchored end. Dot left, title centre, count right.

• The COP derivation left the drawing. `COP 5.5 DERIVED from the lift 17.0 → 46.0 °C — not a

nameplate. The liquid path bypasses this plant at the design day.` was drawn at 3.2 units across

the full width of the plant and crossed the EVAP and COND labels of the machine it describes.

The drawing keeps COP 5.5 — derived, not a nameplate; the sentence is now a Chiller Basis

card with its own declared basis, beside the two cooling cards that already existed.

What the harness caught

tools/ship-gate.sh failed 1 of 80 on the first run after this change, and the failure was mine:

the new card printed 19 °C CHW → 43 °C CDW with no registry hook — *"value matches a registry

value — hook it"*. Moving prose into a card is only half the move; **the numbers that travel with

it still need their provenance**. Hooked to chwSupplyC + cdwReturnC; coverage is clean again at

633 hooked numerals, 0 untraced.

A second run then reported elecDH1Svg clicking through to the wrong basis record while DH-02/03/04

— identical drawings, identical counts — passed. Run solo, twice, the gate is **PASS with all four

CLICK-OK**. That is the flake this repo already has on record: a browser gate driven while another

session drives Chrome in the same checkout. Reproduced solo before touching anything, per that note.

Fifteen framework swatches the sweep could not reach

A full render audit of the homepage (tools/audit-site-render.mjs, 390 / 1440 px × both themes)

returned four classes of finding. One of them was real, and it was the owner's oldest complaint

wearing a different hat.

Fixed

• .bexp-dot — fifteen inline framework swatches on the career cards. Each skill bullet carried

an inline hex straight off the default Tailwind ramp — `#6ee7b7 #34d399 #10b981 #60a5fa #93c5fd

#3b82f6 #f59e0b #fbbf24 #fcd34d #f97316 #fb923c #fdba74` — one hue per skill. That is the rainbow

§A9 bans and the default-palette tell §A15 bans, and it is the same thing the owner already

objected to on article-27 (*"masih banyak ai design slop lihat itu kotak highlight biru, orange

dll"*). The v3.6.0 sweep that cleared those swatches from fifty files could not reach these: they

were inline attributes, not stylesheet rules. Each card already declares --bexp-accent for

its own glow, so the dot now reads that token — the per-card grouping survives, the rainbow does

not. Render audit: 9 framework-swatch findings → 0.

• .oe-desc was 0.8rem — 12.8 px, the smallest body copy on the page, in a <p> inside an

<article>. Raised to the 0.9375 rem tier the case-study summaries already use, so the two card

families doing the same job now look the same (§D13 Similarity). prose-font-size findings 22 → 14.

The share card

The owner, on the card the site hands to LinkedIn and WhatsApp: *"og website resistancezero.com

kurang bagus terlalu biasa. Dan fotonya belum diupdate utk OG nya."*

The photo on the deployed card was current — v3.9.0 rebuilt it — but the platforms had cached

the old scrape, and a scraper caches by URL. So the card is now published under a dated filename

(assets/og/index-20260920.webp) and og:image / twitter:image point at it: that is the only

thing that makes a platform fetch again without a manual re-scrape.

tools/audit-og-images.py accepts a dated suffix now — the rule it enforces is "each page points

at its own card", not "the filename is exactly the slug".

And the card itself was thin. A 224 px circular avatar on an empty dark rectangle: two thirds

of the canvas carried nothing, and it said who he is without saying what the site holds. The new

composer (_identity_card) gives the portrait a real half-bleed panel feathered into the card,

keeps the instrument language (hairlines, mono figures, one amber accent — no glass, no orbs, no

gradient wash), and spends the rest on the four figures the homepage already publishes: **12+ years

ops · 40+ tools built · 27 articles · 100+ pages**. Those are read from index.html's own hero

counters at build time, so the card cannot drift from the page the next time an article lands.

Measured and NOT changed — stated rather than swept

• text-overflow × 88 is the LATEST ticker. Every target resolves to .ticker-item-title inside

the marquee, whose content is meant to run past its box; the repo already has this recorded as a

render-audit false positive. Not a defect, not "fixed".

• large-blank-gap × 4 is section rhythm, verified by measuring the neighbours: .metrics-grid

ends at y 2077, #metrics closes at 2185, #operational-excellence opens at 2263 and its header

starts at 2371 — ~300 px of section padding at 1440 px, identical in both themes. Deliberate, not

missing content.

• prose-font-size × 14 remains at 15 px against the audit's 16 px floor. One consistent card

tier; raising the whole homepage type scale is a design decision, not a bug fix, and it is not

being made silently here.

The rest of the backlog the last release exposed

v3.9.4 made a cache token a function of the file it busts, held that rule STRICT for the two

stylesheets, and **reported the rest honestly: 115 assets whose token no longer matched their file,

13 of them served under more than one token.** That list is the same defect that printed a caption

across the owner's face — a fix that ships but never reaches a returning visitor — so it is not a

backlog to admire.

Changed

• 108 assets retokenised to <yyyymmdd>-<first 8 of sha256> across 177 pages. The worst

offenders were the files every page loads: js/rz-version.js (176 pages), js/rz-mobile-nav.js

and js/rz-cookie-consent.js (159 each), auth.js (153), js/rz-explain-db.js (102). The 13

multi-token assets — js/rz-bms-shell.js alone was served under nine different tokens —

collapse to one token each, because one file under nine URLs is nine caches of the same thing and

a fix that reaches roughly none of them.

• tools/test-asset-cache-tokens.mjs is STRICT for every asset now, with one declared

exemption class: a version pin is not a cache-bust. js/conv-engine.js?v=2.2.0 is compared at

runtime against CONV_CURRENT_ENGINE_VERSION (dc-conventional.html:1430), datahallAI does the

same for its model, engine and registry through datahallRequestedVersion(), and the three

electrical modules share a token pinned by tools/test-datahall-ai-electrical-visual-map.mjs.

Hashing those would break the authority contract they exist to enforce. The gate reads the tag's

own authority attribute, so the exemption is machine-readable rather than a list to maintain —

and it is a property of the FILE, not the tag: seven cockpits load conv-engine.js without the

attribute while comparing the same constant themselves.

Proven RED against the pre-sweep tree at STRICT (108 assets listed, ending with

js/spares-parts-catalog.js ?v=2026-05-12 but the file hashes to 1487b6d8), green after.

Honest boundary

Retokenising 108 assets at once means every returning visitor re-downloads them on their next visit

— roughly one site-wide cache flush. That is the correct outcome for files whose old copies are

genuinely out of date; it is a cost paid once, and the alternative is the state that shipped the

caption over his face. The service worker precaches by path with no token, so it is unaffected.

The caption over his face was a stale stylesheet, and it was not just one page

Two reports, minutes apart. *"Kotak dan tulisan di bawah foto saya terlalu ai design slop kan saya

bilang itu rule yg g boleh lakukan anti-vibe code dan ux law."* Then, with a screenshot of the

caption printed across his own face: *"Kacau sekali tulisannya menutupi foto. Tolol sekali. Position

harus sangat accurate utk semua display resolution."*

Both correct, and the second was mine. **v3.9.1 rewrote the photo card from an absolutely-positioned

caption to a flex column and did not change the stylesheet's cache token.** Every browser holding

the v3.9.0 stylesheet then rendered v3.9.1's four-element caption under v3.9.0's rule —

position:absolute; bottom:1.25rem; left:1.25rem — stacking it upward from the card's corner,

straight over the portrait. No gate could see it: every gate here starts with a cold cache and can

never reproduce a stale one.

The same defect was site-wide and three releases old. styles.min.css has carried

?v=20260908-editorial across 74 pages since 2026-09-09 while the file changed in v3.6.2, v3.6.4

and v3.9.0 — including the 39 contrast fixes, which never reached a returning visitor.

Fixed

• A cache token is now derived from the file it busts — ?v=<yyyymmdd>-<first 8 of the sha256>

— on both stylesheets across all 75 pages that load them. "Did I remember to bump it" stops being

a question a human answers.

• The caption is one line again, and the chips are gone. The three bordered credential badges

(AK3L / SKTTK L6 / SAP HV & LV) repeated the governance row further down the same page, so they

carried no information — §D18 Occam, §D13 Similarity — and a row of three mini-badges is the §A

badge-row tell. A 1px hairline separates the caption from the portrait, which is how §D14 says to

group. The height the chips used went back to the face.

Added

• tools/test-asset-cache-tokens.mjs — for every ?v= asset on every page, recompute the

file's hash and compare. STRICT for styles.min.css and styles-index.min.css; the remaining 115

assets are REPORTED with their expected token, and 13 assets served under more than one token are

listed, so the backlog is visible instead of blocking a caption fix. Proven RED on both stylesheets

before the fix.

• tools/test-index-profile-photo.mjs gained P7, the owner's sentence as an invariant: the

caption's top edge at or below the portrait's bottom, nothing outside the card, and the portrait

never squeezed below 55% of the card — swept across twelve widths × three themes (320 … 1920,

light / dark / rainbow). Proven RED by reconstructing exactly what he saw: v3.9.1's markup with

v3.9.0's stylesheet, which reports "the caption starts 259.9px INSIDE the portrait".

Honest boundary

The token repairs what browsers fetch from now on. A cache that already holds the old file under the

old URL keeps it until its own TTL expires — on GitHub Pages there is no purge to call. Anyone still

seeing the old card can hard-reload once.

A riser is one object and gets named once

The building isometric goes 30 → 12 collisions per view (111 before this sequence started),

labels 114 → 91. The page's geometry monitor falls 427 → 313 (collisions 410 → 266).

Everything removed was a name printed more times than the thing it names exists:

Measured, and reverted

With the specification sub-lines now in cards (v3.8.1), each zone has a single caption line, so

lowering the captions back toward their own slab looked free. It was not: 14 → 15, because the

captions then met their own floor's equipment. Reverted. That is the third measured demonstration

that this drawing is saturated — the first two were in v3.8.1 — and it is why the remaining 12 are

documented rather than nudged.

Still open

Cooling P&ID 126 collisions and 39 of the 47 clipped findings (untouched here; its clipped count is

known to vary between runs on an unchanged tree), the WAN view 16, the data hall 8, the electrical

overview 4, and the isometric's own 12.

The overlap was horizontal

The four hall SLDs carried 8 label collisions each — 240 of the page's geometry findings, one shape

repeated four times. They are now 0, and so is the electrical overview. The page's monitor falls

723 → 427 (collisions 674 → 410, clipped 49 → 17).

What made this quick was reading the overlap geometry instead of guessing at it. Every one of the

six device-to-bus collisions overlapped by 27 px horizontally and only 2–16 px vertically: a

cblSide() device label hung 14 px out from its pole and reached into the span of the bus bar's

centred title. Two vertical nudges were tried first and both traded which pair collided rather

than removing any — lowering the rating stack (8 → 8, different names), then raising the bus titles

(8 → 8, larger overlaps). Both were reverted. Moving the side labels to 26 px out cleared all six at

once.

Fixed

• cblSide() hangs its labels 26 px from the pole, not 14. The horizontal reach was the shared

cause; the vertical position never was.

• The genset machine symbol sits 95 px from its breaker, not 60. cbOpenSide() hangs

"400 V genset incomer" leftward from the breaker, and at 60 the G circle sat on that line —

the same defect class as v3.7.1's symFloorGEN, where a symbol and its own tag named the same

point.

• The auxiliary summary is two columns of two, not four of one. Four strings shared a 440 px box

at 108 px per column, so the longer ones ran into their neighbour. The width was never there; the

height always was.

Changed

• Two ratings that would not fit moved to the MV card rather than being deleted —

CT 600/5 · PT 24 kV/110 V and the 8.4 cal/cm² arc-flash figure, each with a declared basis,

because the card did not previously carry either. Registry R8 reads 241/283 before and after.

Still open

The isometric holds 240 of the remaining 410 collisions (30 per view, unchanged from v3.8.1 and

documented there as needing a re-layout), the cooling P&ID 126, and the WAN view 16.

The space under the portrait is a card, not a hole

The owner, on his phone, on the shipped page: *"Ada area kosong dibiarkan atau apa ya yg bagus utk

white space ini yg di bawah foto saya."* Measured, he was right and it was worst exactly where he

was looking: the photo card stopped at its own 4:5 height while the bento row kept the height of

the identity card beside it, leaving 143 px of empty column at 900 px wide, 81 px at 1024, 37 px

on a desktop, 11 px on a laptop.

Fixed

• The card fills the row again, and the portrait keeps its share. height: 0; min-height: 100%

is the "do not size the row" trick — the card stretches to the height the identity card sets but

contributes nothing to it. Without that pair, a 4:5 portrait plus a real caption strip made the

photo card the tallest thing in the row and the whole hero grew by 180 px. The portrait frame

takes what the strip does not (flex: 1 1 auto, floor of 58% of the card) and stays

object-fit: contain over its blurred fill, so a changing frame shape only changes the width of

the band — it never crops. Below 768px the row stacks and nothing else sizes it, so there the

frame goes back to a fixed 4:5.

• The strip carries facts instead of air: role and employer, location and timezone, and the

three credentials the rest of the page already claims (AK3L, SKTTK L6, SAP HV & LV). All of it is

already true elsewhere on this page — the card states it next to the face, which is where a

visitor looks first.

Empty column below the photo: 143 px → 0 at every width measured, no text overflow in the strip

at any of them.

The whole portrait, on every screen, in every theme

New photographs on the homepage: the studio portrait in dark and rainbow, the office portrait

in day. The owner's constraint was the interesting part — *"jangan sampai terpotong atau tidak

proportional … bisa di compressed cdn tapi jangan sampai pecah utk display laptop atau mobile"* —

because the frames the photo sits in do not agree on a shape.

Measured before touching anything: the bento photo card takes its height from the bento row, so it

renders 315x431 on desktop, 205x399 on tablet and 310x224 on a phone while both new portraits

are 0.949. The card's object-fit: cover would therefore have cut **31% of the height on a phone

and 46% of the width on a tablet** — and the old photos, being taller, had been hiding how much

that rule actually cuts.

Changed

• The card is a portrait frame now (aspect-ratio: 4/5, align-self: start) instead of

whatever shape the row left over. Contain inside a box far from the source aspect means a blurred

band taller than the photo itself — on a tablet that was 55% of the card. At 4:5 it is under 16%

at every width, and the face is the biggest thing on the card.

• .rz-photo-frame — the house blur-letterbox, in CSS (js/rz-hero-fit.js owns calculator

heroes; this is the same contract inside an existing card). The sharp layer is `object-fit:

contain` — the whole photo, never stretched — and the space around it is filled by a blurred copy

of the same photo, aria-hidden with an empty alt. Both stylesheets, per the 2-stylesheet rule.

• The About portrait is theme-aware too, and the site-wide avatar (180 pages) plus the share

card now carry the new face.

Added

• tools/build-profile-photos.py — one place where the derivation lives. AVIF + WebP + JPEG at

320/480/640/960/master, never upscaled, Lanczos + a light unsharp so a 1,200 px portrait reduced

to 320 px does not go soft on a phone. The avatar is the one deliberate crop — a 40 px circle IS

a crop — cut as a face-centred square from an OpenCV face box, not by eye.

• tools/test-index-profile-photo.mjs — the brief, made executable. At 4 viewports x {light,

dark, rainbow}: the right face per theme (rainbow rides data-theme="dark", so it needs no rule

of its own), object-fit: contain with a blur sibling, rendered aspect within 1% of the master,

the rung the browser actually picked at least as wide as box x dpr, a byte budget per rung,

and width/height attributes that match what loads. Proven RED against the pre-change page.

• standarization/UI_FEATURES_STANDARD.md Feature 35 records the pattern.

Note on measuring the right thing

The gate's first draft read naturalWidth to decide whether the browser had picked a sharp enough

file, and failed every viewport: with w descriptors the UA reports a density-corrected

intrinsic size, so a 640 px file chosen at 2.08x reports 307. naturalWidth measures the layout,

not the pixels delivered — the rung has to be read from the file the browser fetched.

Delivered: phone at dpr 3 takes the 960 rung at 16 KB (AVIF), tablet the 480 rung, desktop and

laptop the 640 rung.

Floors are navigation, not equipment

#bldgSvg carried 111 label collisions per view, the worst diagram on the site. It is now

30, with nothing lost: every label that left is either reproduced in a spec card under the

drawing, already drawn on the floor plan one click away, or an ordinal on a glyph the drawing

declares representative.

The decomposition was measured before anything moved:

The cause is projection: an equipment box three units tall projects up-screen into exactly the band

a floating zone caption occupies. There is no free position inside the drawing, which is why two

separate nudging experiments traded collisions instead of removing them — both were reverted rather

than shipped.

Changed

• Twelve zone specification lines left the SVG and became six spec cards below it. This is not a

new idea on this page: standarization/DATAHALL_AI_STANDARD.md states the rule for the rack

drawing — "Spec tables live in the HTML cards below the drawing, not in the SVG" — and

datahallAI.html:8232 records the same migration being done there in v2.12.0. The cards reuse the

existing mc() helper and the existing dh-specwrap markup; no new card system was written.

Every bo(...) hook moved with its line, verified rather than assumed: the registry's R8 rendered

reads are 241/283 before and 241/283 after.

• Forty-three equipment tags left the isometric. Each one is drawn on the floor plan that the

same drawing links to — ATS-*, BAT-*, TX-*, MSB-*, UPS-*, DT-*, AHU-*, N1–N4,

IDF, OPS, RMU, VCB — at 12 px instead of 7. The 3D boxes stay; only the duplicate text

goes. The standard already said what this drawing is for: *"bldgSvg (floors are navigation, not

equipment)"*.

• Representative glyph ordinals dropped — BANK1–6, CH-B1–8, DC-B1–8, VRF×4. The drawing

never had one glyph per installed unit, and the card now says so in writing; an ordinal on a

glyph that stands for a pool names nothing.

Labels on the isometric: 200 → 114. Clipping 0, no label under the legibility floor, smallest

12 px.

tools/test-conv-geometry.mjs reports 30 on the isometric in every one of its eight

viewport/theme combinations, and the page's monitor total falls 786 → 723 (collisions 746 →

674). audit-legibility --strict stays PASS across 179 pages.

Not done

30 is not 0. The remainder is a long tail with no dominant offender — the worst is BD, a 10 px

label, at 8 hits — and it is zone titles meeting the few tags that exist only here (BT, BD,

RPP). Clearing it means re-laying out the isometric, which is a drawing decision rather than a

defect fix, and two measured attempts show that moving a label in a saturated drawing buys nothing.

The roof spends no water it does not have

The roof plan was the last drawing still on the retired plant, and it was not merely stale. It

drew eight dry coolers against an engine that sizes 631, said its risers served "8× 4MW

chillers" against an engine that sizes 143, and named the array *"BAC TrilliumSeries

Adiabatic" in the same tooltip that claimed "WUE 0.00, zero water evap"*.

That last pair is not a stale number, it is a contradiction. An adiabatic cooler spends water by

design; the whole reason this facility runs a 40 °C cold-plate inlet is to reject heat dry, so

that the published WUE of 0.00 is true rather than flattering. The drawing was describing a

different machine from the one the engine sizes and the dashboard reports.

Fixed

• The roof draws the engine's plant. 631 installed dry coolers, 593 duty on the design day,

eight glyphs kept as an aggregation with the divisor printed on the drawing (8 banks × 79), and

every count hooked. "Adiabatic" is gone: the array is described as dry-only V-bank, which is what

makes WUE 0.00 true.

• The ground-floor chiller hall tells the same story. It drew CH-1…CH-7 plus a "CH-8 (N+1

standby)" — an N+1 story about a plant that is N+1 on 142, not on 7. The glyphs are now banks

carrying the engine's installed / design-duty / worst-bin counts (143 / 36 / 142).

• The coverage gate was measuring two floors four times and two floors never. The floor walk

ran ['f2','gf'] once per #floorSvg entry in TAB_SETS; when the floor plan grew to four

entries it repeated the same two floors four times and never opened level 3 or the roof — while

printing four rows that looked like coverage. It now walks gf, f2, f3, roof exactly once. Level

3 has carried engine numbers since the hall redraw; the roof carries them from this release.

• Two more dead adapter reads. DHAX() read d.dryCoolers and d.rowsPerHall, and the live

adapter publishes neither (dryCoolersInstalled / rackRows). o.rows survived on an identity

further down; o.dryCoolers was simply null, waiting for the first drawing that printed a count

to print an em dash instead. tools/test-dcai-basis-map.mjs now fails on any d.<field> DHAX

reads that window.DHE does not publish — the mirror of the v3.7.0 rule, and the same defect

from the other side.

Added

• tools/test-dcai-roof-plan.mjs — the roof must state the engine's dry-cooler counts with a

visible aggregation divisor; a sentence that counts chillers must state the engine's count; **no

water-spending rejection technology may be claimed while the engine publishes WUE 0**; the roof

must carry real hooks rather than one wholesale declaration; and the chiller hall must carry the

installed / duty / worst-bin figures instead of an "N+1 of 8". Proven RED against the pre-change

page — nine findings — and green after.

Note on what a declaration is for

wanSvg and fireSvg still carry zero traceability hooks and that is correct, not a gap: the

engine publishes no corporate-internet quantity and no fire quantity at all, so those numbers are

page-authored design selections and declared as such. A hook there would claim a provenance that

does not exist. The monitor rows stay, and this is why they will not flip.

Sixteen of the isometric's collisions were a caption overlapping its own subtitle

The building isometric carries 127 label collisions per view — the single worst diagram on

datahallAI.html. Sorting them by what actually overlaps shows they are not one problem:

• 16 were a zone caption colliding with its own second line. Every stack was written as a title

at f.z+FH+N and a spec line at f.z+FH+N-1.5, and 1.5 floor-units renders as roughly 10 px —

less than the two text boxes are tall. isoLabel() paints an opaque mask behind each label so

structural edges never cross the text, so the second line's mask was eating the first line's

descenders. "MV SWGR-A" over "SM6 20kV" was not a crowded drawing; it was one label drawn through

another.

• The rest are captions over equipment and equipment over equipment, which is a layout question,

not a spacing bug. Left alone deliberately — see below.

Fixed

• The gap in all sixteen caption stacks is now 3 units rather than 1.5, applied by raising the

title rather than lowering the subtitle, so nothing moved down into the equipment field. The

exploded view has 12 units of headroom above each slab (FH 6, GAP 18), so the highest caption

now sits at +8.5 with room to spare.

• Collisions on the isometric 127 → 111; stack self-overlaps 16 → 1. The one that remains is

the "BMS / EPMS" zone caption over the "BMS" equipment chip — a caption-over-equipment case, not a

stack. Verified at 1680, 1440, 1024 and 360 px, with clipping still 0 and no label under the

legibility floor.

Not done, and why

The remaining 111 are the saturated-layout problem. Measured: moving three of the worst-placed zone

captions (AHU / AIR HANDLING, VRF CONDENSING, CW PUMP STATION) onto the floor plane and

forward took 127 → 124 and put each of them into a new collision — LOADING, BAT-A, R1·7.

There is no free strip; in an isometric a 3-unit-tall equipment box projects up-screen into exactly

the band a floating zone caption occupies. That change was reverted rather than shipped. Clearing it

needs a decision about the drawing — level-of-detail that drops chip labels while a zone caption is

shown, leader lines outside the footprint, or fewer labels at this zoom — not more nudging.

The step is drawn where the voltage changes

v3.2.0 answered the owner's arithmetic — "aneh masak 150kv di step-down ke 400v pakai trafo" — by

giving the engine three published levels and a gate that checks every transformer ratio against

adjacent ones. It did not answer the drawing. The per-hall single-line still opened with a

PLN 150 kV box wired straight into a 20 kV vacuum breaker, and the 150/20 kV machine that makes

that legal existed only inside a section header's sentence. A transformer a reader cannot click and

a scenario cannot fault is not on the drawing.

Added

• A 150 kV switchyard band on all four hall single-lines and on the facility overview. Two

independent PLN intakes (4 × 250 MVA circuits, N-1, 3 duty), a line bay per circuit — surge

arrester, 89-L isolator, 150 kV circuit breaker — a 150 kV bus per intake with no tie (the 2N

split starts at the grid, not at the 20 kV board), then the transformer bay and **MAIN-TX:

100 MVA, 150/20 kV, YNyn0 with a buried delta tertiary, Z 14 %**, one machine per feed per hall.

The band prints what the machine costs either side — 385 A primary, 2,887 A secondary, 40.9 %

loaded with both feeds and 81.8 % when one is lost — and what the switchyard costs in civil

terms: 4 line + 16 transformer = 20 bays. L0 is now honestly labelled: a 20 kV incomer from

MAIN-TX, not a grid box.

• HV-INTAKE, HV-BUS and MAIN-TX nodes per feed in the electrical state engine

(84 nodes / 103 edges per hall, was 58 / 97 counting the old spine). The chain is a path —

utility → intake → bus → transformer → board — so a utility loss now darkens it in that order,

and the transformer is an inspectable block with its own payload class (sld-main-tx).

• tools/test-dcai-hv-switchyard.mjs — asserts, per sheet, that a main-transformer block is

drawn, states the engine's ratio / rating / impedance, sits between the 150 kV label and the

20 kV bus, binds its conductors to HV topology edges, states the bay count, and opens an

inspector naming both levels. Proven RED against the pre-change page in a detached worktree.

Fixed

• DHAX() never assigned the seven MV/HV fields the drawings read. Since v3.2.0 the per-hall

single-line printed "PLN — kV" and "— kV Dual Feed from the 150/20 kV Main Transformers",

and the electrical overview subtitle the same. Failing closed to an em dash is the correct

behaviour for a dead binding; an em dash no gate ever looked at is how a whole voltage level goes

missing in plain sight. tools/test-dcai-basis-map.mjs now fails on any X.<field> the

adapter does not assign — the class, not the instance. Also proven RED first.

• The transformer symbol drew the vector group backwards. symTX put Y over Δ while every

label on the page says Dyn11. The letters are now read from the IEC designation, so the upper

(primary) winding follows the group and a YNd machine cannot keep a Dyn symbol.

• The rack mimic said 50 VDC where the rack detail, the payload rows and the inspector all say

48 VDC — one page disagreeing with itself about the bus every rack hangs on.

• The transformer-room caption said "4 units" against an engine that sizes 33 per feed per

hall. It now prints the engine count and says four are drawn, the rule the CRAH and CDU banks

already follow, with the 20/0.4 kV winding ratio declared separately from the counts it is not.

Changed

• Engine 1.2.0 → 1.3.0: publishes main_tx_primary_a, main_tx_impedance_pct, hv_line_bays,

hv_transformer_bays and hv_switchyard_bays, each with its identity in the engine gate

(primary A × 150 kV = secondary A × 20 kV is the same machine measured twice). Registry 278 → 283

parameters, R7 and R8 still STRICT.

• standarization/DATAHALL_AI_STANDARD.md: the SLD hierarchy was still written against the retired

GB200 basis (5 MVA transformers, 54 rack positions, 27 NVL72 domains, 6,300 A busway, 50 VDC).

Rewritten to twelve levels starting at L-HV, against the current engine.

Measurement note — the geometry monitor

The new band cost nothing in label collisions and the first draft of it cost ten. Measured against

this page at HEAD across four viewports and both themes: collisions 746 before, 746 after. The

first layout put the 150 kV breaker's rating text through the 150 kV bus label and the floor-plan

transformer caption through the TX-4A glyph (+80 findings); the band was re-spaced and the caption

made one line with two claims side by side rather than two stacked lines.

The clipped-element count is not a usable signal on this page and is reported here rather than

claimed either way: three runs of the same tree gave 24, 38 and 28, and every finding is an animated

<circle> on coolSvg — a diagram this release does not touch. A metric whose value moves by 14 on

an unchanged tree cannot tell anyone whether a change made the page worse.

The overlay gives way, and a fixture stops counting

Two DC AI cockpit gates went red on main when the floor-plan work landed: the floor plans grew

from one tab entry to four, and nothing that depended on the old shape was told.

Fixed

• datahallAI.html — the room overlay hit-tests through to a traceability mark. Each data hall

on the floor plans carries a transparent room-wide <rect data-tab="dh"> so a click anywhere in

the room opens the Data Hall tab. SVG hit-tests the topmost painted element, and the overlay is

painted last, so it also swallowed the room's own hooked labels: clicking 62 m to ask where the

number comes from navigated away instead of opening the basis record. Paint order cannot simply be

reversed — behind the room the grid pattern and the room fill would swallow the overlay in turn, and

the navigation affordance would die. The overlay now lifts its own pointer-events for one call,

reads what is under the pointer, and forwards the click to a [data-basis-param] or

[data-rz-equipment] group when it finds one. tools/test-dcai-basis-hooks.mjs: floor level 3

FAIL → CLICK-OK, all fifteen hooked diagrams click-verified.

• tools/test-datahall-ai-inspector-runtime.mjs addresses diagrams by label, not by index. The

floor plan became four entries (ground / level 2 / level 3 / roof) and every set.diagrams[n] in

the fixture list silently moved one diagram left: the gate looked for a CDU on the level-2 floor

plan, found none, and died on Cannot read properties of null instead of reporting a finding —

a crash is not a test result. Named lookups (data hall, rack architecture, cooling P&ID,

DH-01 SLD) now throw a sentence naming the missing label if the tab set changes again.

A diagram is not "fine"; it is fine at a width

Two gates disagreed about the same page. tools/audit-legibility.mjs --strict passed 179 pages

with zero findings while tools/test-conv-geometry.mjs reported **944 labels under the 8.5 px

floor on datahallAI.html. Neither was wrong: they measure at different widths.** Desktop and

laptop were clean; tablet and phone were not. Every diagram had correctly applied the scale it was

told to apply — the instruction was in the wrong unit.

Fixed

• js/rz-svg-legible.js takes minWidth, and it overrides the cap. maxScale is a multiple of

the PANE; the floor is an absolute number of pixels. So the multiple a drawing needs grows as the

viewport shrinks: the data-hall plan wanted 3.11× at a 1240 px pane, 3.84× at 1004 px and 9.8× on

a phone — all three the same ~3,840 px drawing. A cap tuned on a laptop therefore fits exactly one

viewport and fails every other, which is precisely the shape of the survey's findings. minWidth

states the requirement in the unit it is actually in. The cap stays as a guard against a runaway

multiplier; the width is the design value.

• All fifteen diagrams now carry a measured width, each taken from the rendered width at which

that drawing's smallest label crosses the floor, carried up ~8 % so a rounding difference on

another engine does not put it back under.

• Five diagrams were registered for the first time — rack architecture, network fabric, WAN,

security zones and the BMS architecture. On a desktop they were always clear, which is why they

had never been listed; a 340 px phone pane renders them at 1:1 and their smallest labels land at

8 px. Being clear on the machine the author happens to use is not the same as being clear.

Measured after the change at 1680, 1440, 1024 and 360 px, every diagram on the page: **no label

under the floor, no page overflow, and no diagram whose note reports a shortfall.** Before it, the

same sweep reported sub-floor labels on nine diagrams at tablet and on fourteen at phone — including

electrical overview at 333 of 333 and the four hall SLDs at 316 of 316 each.

The geometry survey, run after the commit: datahallAI monitor 1,674 → 786, with

G5-illegible 944 → 0. Collisions moved the other way, 694 → 746, and the reason is worth

stating rather than smoothing over: the overlap tolerance is an absolute number of rendered pixels,

so a pair of labels that genuinely overlapped by a fraction of a pixel in a drawing rendered at 1:1

crosses the threshold once the same drawing is rendered three times larger. Those 52 are not new

defects — they are the same defect the floor exposed, measured at a size where it counts. The

building isometric on a phone went from 100 reported collisions to 120 for exactly this reason.

An argument JavaScript throws away leaves no evidence anywhere

The reveal step added in v3.6.3 opened the floor-plan drill-down for the first time. This is what

was behind it.

Fixed

• Eleven calls overran their arity and lost their options object. rmLive() takes 14 parameters

and rm() takes 11; eleven call sites passed 21 and 18 — seven filler zeros and then the

options object. JavaScript discards extra arguments silently, so the object never arrived, and

what it carried was not decoration: sub:bo(...) and equip:bo(...), the basis marks this site

treats as mandatory. **Eleven rooms across the floor plans rendered their numbers with no trace of

where they came from.** Normalised to the real arity, the marks appear — 12 on the ground floor,

13 on level 2, 11 on level 3.

• This was also why the first attempt to move a room's name did nothing. The option was correct;

it was never delivered. There is no error, no warning and no visible difference to distinguish

"the option is wrong" from "the option never arrived" — only the absence of an effect.

• Sixty-three label collisions across the four floor plans, from three causes.

1. A symbol drawn on top of its own tag. symFloorGEN(23,3.5) and

eqLive(21,2,4,3,…,'G1 4MW') name the SAME point, so the IEC "G in a circle" was painted

directly over the tag — six generators, eight transformers. eq()/eqLive() take

labelBelow, which puts the tag under the box and leaves the interior to the symbol, the way

a floor plan is drawn on paper.

2. A room's name printed through its own contents. rm() centred the name stack vertically,

which is exactly where this plan lays out equipment: "MSB-A / ATS-A" over ATS-2A, "Comms Room"

over IDF, "Fuel Storage" over T2, "Video wall + Ops" over OPS. textAt:'top'|'bottom' stacks

the rows from an edge instead. Both stay options — an empty room reads better centred.

3. A frame that stopped at the plan. The upper floors and the roof draw their dimension

strings and stat rows OUTSIDE the plan, which is where dimensions belong on a drawing, but the

viewBox ended at the plan — so 32 elements were counted painted past the frame. The margin is

part of the drawing; the box now says so.

Changed

• TAB_SETS lists all four floors, not just the one the first polygon opens. They share

#floorSvg and are redrawn per floor, so each is its own view: ground 222 labels, level 2 78,

level 3 64, roof 84. Listing one left three as unmeasured as the drill-down itself had been. The

visited-view key is now keyed on how a view is reached, since all four share a selector.

Measured by tools/test-conv-geometry.mjs across all 8 viewport/theme combinations, all four

floors: 0 collisions, 0 clipped. The datahallAI monitor goes 1,776 → 1,674 (collisions

846 → 694) while three new views entered measurement.

One read count moved with it — pue.target on datahallAI.html, 91 → 92 — because the restored

options objects now actually render their basis marks. test-dcai-parameter-registry stays green

(R7 278/278 STRICT, R8 236/278 STRICT).

Thirty-nine contrast failures to zero, and the audit that found them is now a gate

tools/audit-a11y.mjs --strict reported 39 critical or serious axe violations across the sampled

pages in both themes, and it was not wired into the ship gate — so nothing was watching it. It is

wired now, and it reads CLEAN.

One colour, two opposite mistakes

#64748b is a mark colour. Its luminance sits almost exactly in the middle, which makes it the worst

possible value to get wrong in either direction, and the site managed both:

• As a ground it carried dark-theme ink. The author-bio card and the newsletter panel painted

it as a surface while their text stayed #e2e8f0, #cbd5e1, #94a3b8 and #60a5fa — inks

chosen for a dark background. Measured 1.85 to 3.86. White ink would have passed at 4.77, but

these elements are styled for a dark ground, so the ground moved: rgba(15,23,42,0.8), the

same dark card surface the article-body catch-all already uses.

• As body ink it sat on warm near-white grounds and reached 3.97 to 4.35 against the 4.5 its

sizes require. #475569 is the same family one step darker and reaches 6.33 to 6.93 on exactly

those grounds.

Neither is a token that is wrong; it is a token used where it does not belong. A mid-luminance

colour cannot be a ground for light ink or ink on a light ground, and no amount of adjusting the

other side fixes it — one of the two has to leave the middle.

The eleven-card failure was a register override

css/rz-article-dark.css pushes a readable light-surface amber (#92400e) into

.article-card-number whenever the editorial register is on and the theme is light. But that chip

is a dark chip in both themes — articles.html paints it rgba(13,16,20,.72) — so the override

put dark amber on a dark ground, once per card, eleven times. The chip now takes only the mono

family from the register and keeps the light ink its own rule sets.

Also

The CTA on article 13 is an <a>, so the dark-theme link colour was overriding the white ink its

own rule sets and landing at 1.87 on a slate ground; its own white reads 4.76 there. Every

replacement in this release was measured before and after, not chosen by eye.

A clean row meant "never opened"

tools/audit-legibility.mjs reported 130 sub-floor labels on datahallAI.html. Neither cause was

a font size, and chasing them turned up a third defect that no gate had ever been in a position to

see.

Fixed

• A 120 ms race on every tab change. RZSvgLegible rescales on a MutationObserver with a 120 ms

debounce — correct for a window resize, wrong for a tab click, because the panel becomes visible

immediately. For those 120 ms the reader looks at the drawing at 1:1, labels at 5–6 px, and then

it jumps. Measured with no settle delay: hSvg 79 of 202 under the floor, elecOvSvg 114 of 333;

with 600 ms, zero. The fix is not to make the gate wait — the tab bars now say when a panel has

switched, calling RZSvgLegible.apply() synchronously in bubble phase after .on is flipped. The

observer stays as the safety net for paths that are not a click.

• A drill-down nobody had ever measured. #floorSvg lives in #floorDetail, display:none

until a floor is clicked in the building isometric. It has been listed in TAB_SETS for months

and measured every run as a 0×0 box holding 0 labels. Opened: **191 of 222 labels under the 8.5 px

floor, the smallest at 4.0 px** — the worst single view on the page, behind the one thing the

harness could not do. tools/lib/cockpit-tabs.mjs gains reveal: {click, expect}, performed

under that file's own Rule 1 (ASSERT, NEVER ATTEMPT): a trigger matching nothing, or a container

still display:none after the click, throws rather than measuring the closed state. The

visited-view key now includes the reveal, because keyed on tab/sub alone #floorSvg collided

with #bldgSvg's over/ and was skipped before the reveal could run.

• The legibility scaler never worked on a phone — on any diagram. datahallAI.html's responsive

patch carries svg { max-width: 100% !important } under 768 px so a wide drawing cannot push the

page sideways. That !important also beat the inline width the module sets, so **all nine

registered diagrams rendered at 1:1 below 768 px**. The floor plan asked for 4.2×, drew 640 px in

a 362 px pane, and printed a note naming the scale it had asked for rather than the one it got.

The exception is safe for the same reason the clamp exists: a scaled diagram sits in

[data-rz-legible-pane], which is max-width:100% with overflow-x:auto, so the overflow is the

pane's and the document never scrolls. Verified across all 15 views at 390, 768 and 1024 —

zero page scroll — with audit-responsive-layout --strict CLEAN on 160 pages.

Changed

• The floor plan's scale budget was the wrong shape. At maxScale: 2.3 its smallest label was

still 6.4 px at 1440, and the note said so. Raising the cap to 3.2 fixed 1440 and not 1024, which

is the tell: the module states its budget as a multiple of the PANE while the 8.5 px floor is

absolute, so the multiple needed grows as the viewport shrinks — 3.11× at a 1240 px pane, 3.84× at

1004 px, the same ~3,840 px either way. The cap is now 4.2 and documented as a **safety limit, not

a design value**; below a ~920 px pane the note reports the shortfall instead of hiding it. A

minWidth option on js/rz-svg-legible.js would state this directly and is where it belongs.

Added

• tools/test-cockpit-reveal.mjs — GREEN opens the drill-down and checks the floor; two REDs

prove a bad trigger and a missing target each throw; an assertion on the dedupe key stops anyone

collapsing a revealed view back into its parent tab; and two more pin both halves of the mobile

contract at 390 and 768 (the drawing must widen past its pane, the page must not scroll). Proven

RED — with the exception removed it reports "asked for 2.3x but rendered 374px in a 374px pane".

audit-legibility --strict: PASS, 179 pages, 130 findings to 0.

Made visible, not created: tools/test-conv-geometry.mjs now opens the floor plan too, so its

datahallAI monitor goes from ~1,598 to 1,776. Those 178 are label collisions inside that

drill-down — pre-existing overlaps that were never measured. They stay on the monitor list.

The footer in dark theme: a ground in the middle, where no ink can reach

axe reported four serious contrast failures on the footer of manual/index.html in dark theme,

and the gate that catches them (tools/test-telemetry-e2e.mjs) was red on main.

The cause was the ground, not the ink

[data-theme="dark"] .footer painted #64748b — the slate token — as a surface. At that mid

luminance neither near-black nor near-white ink can reach 4.5:1, so raising the ink could never have

fixed it: one of the two has to leave the middle. The likely origin is a colour swapped by family,

a banned purple replaced with the slate, without checking that this particular use was a background

rather than a mark.

Two more things were in the way, and both are worth naming because they are the kind of trap that

makes a contrast fix go backwards:

• var(--white) does not mean white here. Dark theme redefines that token to #0f0f1a, so a

first attempt that set the footer ink to var(--white) made it darker. A token whose name says

one thing and whose value says the other cannot be used on trust.

• Three of the four elements carry no colour at all and dim themselves with opacity: 0.9,

0.5 and 0.4. That was survivable on a light ground; on a dark one the effective ink lands

back in the middle. They now take an explicit muted-light ink and the dimming comes out.

Measured after: 14.38, 10.71, 10.71 and 14.38.

Also

js/rz-svg-legible.js emits a zoom note whose numerals — the scale it applied and the pixel floor

it measured against — are properties of the drawing, not engine values. It carried no declared

basis, so the strict coverage walker counted three untraced numerals on every page that uses it. The

declaration is now set where the note element is created, so the note cannot be emitted without it.

Recorded, not fixed

tools/audit-a11y.mjs --strict reports 39 critical or serious violations site-wide, and it is

not wired into the ship gate. The footer four were a subset. Grouped by the ground they sit on:

12 on #64748b, 12 on #f2e9e3, 11 on #0c1117. The #64748b dozen look like the same

slate-as-a-surface substitution this release fixes in one place. That is a measured backlog with a

named cause, not a claim that the site is accessible.

A colour is not a string

v3.6.0, earlier today, swept #6d28d9 and #7c3aed out of 62 files and called the violet family

finished. It was not. The sweep chased the hexes it had a list of, and the list was never the

problem: 1,238 literals across the tree were still in the banned hue band, arriving as

#a855f7, #4f46e5, #6366f1, #c4b5fd, #C3B0FA, #a5b4fc, #7B4FE0, #5b21b6, #4c1d95,

#581c87, #e9d5ff, #f5f3ff, every one of their rgb()/rgba() forms, inside .js files no

string grep ever opened, and once as a token named --prep-green holding violet-800.

Added

• tools/test-purple-family.mjs — a gate that reads the HUE, not the spelling. Any literal

landing in [238°, 310°] with enough saturation to be seen and enough lightness not to read as

near-black is a finding, in HTML, CSS and JS alike. Indigo-600 is inside the band deliberately:

243° is where the family hides when someone says they have moved away from purple. It reports

1,238 findings against the previous tree and none against this one.

• Four exemptions, each naming meaning that no other hue can carry: **ISA-18.2 / EEMUA 191 alarm

states** (shelved / suppressed / out-of-service / trouble are magenta-violet by standard, so an

operator cannot confuse them with an active alarm), the aurora mesh hero (named in CLAUDE.md

as mint + gold + violet + blue + pink), literal spectra, and **published perceptually-uniform

colormaps** (viridis starts at #440154).

Changed

• Seven page identities reskinned off the purple family, each to a hue the site already owns.

FF-1.html becomes the green its --prep-green token always claimed (FF-2 is amber, FF-3 cyan);

tco-calculator.html goes from indigo-600 to teal; article-13.html's AI-gauge widget to

instrument cyan; tier-advisor.html's violet deepening ramp to the same ramp in cyan;

article-1.html, datacenter-solutions.html and opex-calculator.html follow their pages' own

accents.

• css/rz-finance-suite.css closed the item v3.6.0 left open — --fs-acc / --fs-acc2 move

from violet-700/600 to cyan-800/700, and the dark --fs-acc2 from the periwinkle #C3B0FA to

instrument cyan. The AA rationale that had mandated violet was arithmetically wrong: the

comment claimed white on #64748b is "~3.9:1 (fails AA)"; measured it is 4.76:1. The pinning was

right for a different reason — no margin under semibold .82rem type — and cyan-800 gives 7.3:1.

• 219 periwinkle #C3B0FA occurrences across 50 files become slate #94a3b8. That colour was

itself an earlier sweep's replacement; a periwinkle chosen to pair with slate is still the family.

• 125 nav links (Future Forward in purple, TCO Calculator in indigo) take the slate the rest

of the dropdown already used, and the seven pages carrying contrast patches keyed on those two

hexes drop the rules that no longer match anything.

• 118 two-stop gradients with a purple stop flatten to their non-purple stop.
• Chart palettes were fixed for legibility, not only for brand. Mapping every purple onto cyan

gave rz-engine.js a six-colour categorical palette containing three cyans; it now carries

#1d4ed8 and #be185d in those slots. The LTC lab's pump-drive breakdown was five shades of

violet against a teal liquid loop — it is a BRANCH of that loop, so it is now five lightness steps

of the same teal. The sixth donut slice, which was violet only because the palette ran out, takes

slate.

• The --oe-violet categorical slot moves to rose (333°). v1.134.21 had already moved it once,

to #5B34C4, described as "a clear step off the banned pair" — but a step inside violet is still

violet, and this gate reads the angle.

Fixed

• A footer link that was never styled, on 72 pages. <a href="glossary.html">Glossary</a> sat

among four siblings that each carry an inline colour, and rendered in the browser's default

#0000EE. Found by a render scan looking for something else entirely.

• The version stamp rendered as a default blue link on every bespoke page. script.js injects

the stamp site-wide, but its skin lived only in styles.css, which tco-calculator.html and the

other own-stylesheet builds do not load. The module now carries its own baseline, inserted first

in <head> so any real stylesheet still outranks it.

• .rz-pro-link:hover was still Anthropic violet. The v1.134.20 mint sweep converted the auth

component's base colours and left the hover state — the one state a reader reaches by pointing at

the link.

The violet family, the two-stop washes, and the last framework swatches

The owner pointed at article-27.html and said the highlight boxes were still slop. Three sweeps

came out of that, and this release closes all three across the whole tree.

Changed

• Violet is gone from the reading surfaces. #6d28d9 and #7c3aed were the AI-default purple

family under a different name — 300 occurrences across 62 pages, mostly inline style on links and

headings. They are now #64748b, which is not a taste call: 14 of the tree's 20 --accent-purple

definitions already resolved to that slate, and 35 pages already drew their terms links with it

against 9 that did not. The sweep made the majority the rule instead of leaving two colours for one

job. The two comparison pages' --cmp-b moves to #0e7490, matching

compare-fm200-vs-novec.html, which had already made that choice.

• Ten dark-mode patches removed. They were written as

[style*="color: #6d28d9"] { color: #a5b4fc !important } — a repair keyed on the exact string the

sweep was about to delete. Left in place with the search text updated they would have repainted

every slate inline colour periwinkle, so they went out with the colour they were patching.

• 357 two-stop gradients flattened to their first stop across 81 pages. Two stops on a data fill,

a severity pill or a reading surface is decoration wearing the clothes of a scale; three or more

stops is an actual axis and is untouched. tools/test-data-fill-gradients.mjs now holds that line —

it reports 60+ findings against the previous tree and none against this one.

Fixed

• tools/normalize-cache-bust.py --check is a flag the tool answers to. Its docstring has

described --check as the default since the v2.19.0 rewrite, but argparse only ever declared

--apply, so a gate typing the documented word got unrecognized arguments: --check and exit 2.

The version before the rewrite was worse in the same place: it accepted --check silently and

wrote, converging 294 tokens onto a hardcoded May constant. Both readings are now pinned by

behavioural tests, and --check --apply together is refused rather than resolved.

Documentation

• standarization/ANTI_VIBECODE_STANDARD.md records the violet sweep with the count that justified

the target colour, so the next change to that palette argues with evidence rather than preference.

Every page that issues a document now issues it through the shared shell

Owner comment (22) asked for a mature PDF template "required across all the engines". The monitor

that has run since v3.1.0 is now a gate, because the count it was watching reached zero.

Heading-structured documents, without touching their markup

The last nine pages had no <section> wrappers at all — the article family and the calculators run

a flat sequence of <h2> siblings, which is an ordinary way to write a document and should not force

markup changes on nine pages just to be exportable. discoverHeadingSections() slices the body at

each heading: the id comes from the heading's own anchor, so a table-of-contents link and an export

option are the same handle, and the label comes from the heading text, so the two cannot drift.

Adopted this way: articles 10, 11, 12, 13 and geopolitics-1.html — 10, 12, 12, 11 and 9 sections

respectively, discovered live.

The last hand-built report moved onto the shell

cdu-calculator.html built its whole document by hand: its own inline CSS, its own header and

footer, its own page rules — and it embedded a <script> into the template to trigger printing,

which is the exact construction that terminated the parent script block and broke five calculator

pages on 2026-05-09. All of it now comes from the shell, and printing is the shell's job, so no

script is embedded at all. Its report sections are built from the live calculation rather than read

from the page, so it registers its own list and still gets the picker: a free-tier export offers

Sizing results, a Pro session also offers the Pro analysis.

Four pages are declared, not converted

A bare window.print() is not automatically a defect, and treating it as one would have pushed four

pages into a shape that does not fit them. Each is named in the gate with its reason:

• article-9-paper.html — a paper document with A4 @page rules where printing is the

deliverable; the standard already exempts it from the screen palette.

• rz-ops-p7x3k9m.html — an internal operations page, in no sitemap and no export; its print is

a working printout for one operator.

• ict.html — its button is titled "Print this view" and prints the cockpit screen as it

stands. That is a screenshot by printer, not a document with sections and provenance.

• article-15.html — exportQuotePDF() prints a generated quotation composed from the

reader's own inputs, not the article; there are no page sections to choose between.

The gate rejects any other page, and rejects a declaration whose page no longer exists. *"It would

take work to convert"* is not a reason the list accepts.

Provenance is the part the shared module must not invent

Every adopter states what its numbers are and are not, on the export cover. The readiness reviews

say they are a reading against published criteria and not a certification — those pages cannot

award a tier, an approval or an ISO registration. The articles say their calculators reflect inputs

entered on screen and carry no claim. The calculator says it is an educational estimate anchored to

ASHRAE TC9.9 and OCP, not a vendor selection and not a measurement.

The mobile patch was shrinking the reading column

Closing out the render-audit sweep. The one that matters most: eight article pages carried a

@media (max-width: 768px) rule setting .article-body, .article-content, article to

font-size: 0.95rem !important — 15.2 px on a phone. A mobile patch that makes body text

smaller on the one screen where reading is hardest is the wrong direction, and the !important

meant nothing downstream could recover it. Reading size does not go down on a phone.

The rest were single families, each read rather than glanced at, each raised to reading size: the

sentence that says what each LTC lab covers (.detail-card p, 12.5 px), the verdict boxes on

article-19, the section-header descriptions and hero subtitle on standards-ltc-lab, the paper

titles on the research roadmap, and four more .mn-* families on the manual pages that a minified

copy of the same rule had kept at .86rem after the expanded copy was fixed.

Two more families of site chrome joined the non-prose list for the same reason as the cookie banner

and the copyright line before them: .legal-disclaimer — which is what .article-disclaimer and

.calc-disclaimer, already excluded, are — and .newsletter-box, the sibling of the already

excluded .newsletter-signup.

Left alone, on purpose

Article/Article_9 02.02.26/ is a dated snapshot of the site copied into a subfolder: 10 of its 10

images are broken and 13 assets 404, styles.css among them, because its relative paths only

resolve at the site root. It is not in the sitemap, nothing links to it, and the audit classifies

Article/ as internal. Repairing paths in an archive nobody serves is work with no reader.

Two cockpits that promised an export and printed the screen

v3.4.0 moved six pages onto the shared shell and left twelve still calling window.print(). Reading

what each of those twelve actually does, they are not one group:

• Seven are honest print buttons. The six article pages and geopolitics-1.html offer to print

a reading page, ict.html's button says "Print this view" and carries a printer icon, and

rz-ops-p7x3k9m.html says "Print / Save PDF". A page that says print and prints is not a defect.

• Two promised a document and delivered a screenshot. water-system.html had a button labelled

Export PDF and fire-system.html one labelled EXPORT PDF; both called window.print(),

so what came out was the cockpit as it sat on screen, chrome and all.

• One builds its own. cdu-calculator.html assembles a document string and opens a print

window — a working hand-built builder, and the third one this codebase has had. Migrating it is a

consolidation worth doing, but it needs its output compared against the shell's side by side

rather than swapped in on the way past, so it is not in this release.

The two that promised are adopted. Each declares its sections in its own markup and gets the dialog,

the picker and the document shell from one RZPdfExport.adopt() call: water-system offers six

sections (KPI band, P&ID, WUE reconciliation, site water scope, active alarms, 24-hour trend),

fire-system five (P&ID, cause and effect, pump set, water reserve, alarm and event log). Both state

on the cover what their numbers are and are not — engine-derived where a basis marker is shown,

simulated and declared where it is not, and in fire-system's case that the detection state is a

stage machine and not a fire-alarm record.

Adopters now 9; pages printing directly 10, and seven of those ten are meant to.

Six more engines issue their PDF through the shared shell

Owner comment (22) said the mature template was "required across all the engines". v3.1.0 built the

shell and adopted one page; one adopter is a start, not the deliverable.

Adopted: fire-checklist.html and the five LTC readiness reviews — Uptime tier alignment, NFPA fire

risk, ANSI/TIA topology, ASHRAE thermal control, ISO energy governance. Each discovers its own

sections from its own markup: 9, 12, 12, 12, 13 and 12 respectively, every label taken from the

heading that is already on the page.

Adoption is now one call

Wiring a page used to be about sixty lines of registration copied into it — which is exactly how the

site ended up with three hand-built PDF builders before any of this. RZPdfExport.adopt() is the

whole of it now: a page says which of its elements are sections and what its provenance is, and gets

the dialog, the section picker and the document shell. The first adopter was refactored onto it, so

there is one wiring path and not two.

What stays a parameter is what a shared module must not invent: each page's own title, accent, and

what its numbers are and are not. Every one of the six states plainly that it runs no engine, so

nothing in it is a computed quantity, and each readiness review states that it is a reading against

published criteria and not a certification — the LTC pages cannot award a tier, an approval or an

ISO registration, and their exports say so on the cover.

The gate was reading its own release notes

tools/test-rz-pdf-export.mjs decided adoption by whether a page's source text contained

RZPdfExport. changelog.html quotes the API in these very notes, inside <code>, so the public

changelog was asserted against as though it shipped the feature — it slid past two assertions on

quoted strings and failed the third, and it would have done so for every module this site ever

documents. Documentation is stripped before the scan now, and adoption is decided by an actual

<script src> tag rather than a mention anywhere in the file.

That miscount is also why the table above first read 19 → 13: changelog.html was counted among the

pages calling window.print() directly because the string appears in its prose. The real figures,

measured on both trees, are 18 → 12 — six pages moved, which is the six adopted.

Read before shipped: what the six actually discover

Verified rather than asserted — the section counts in the paragraph above were re-measured on the

rendered pages, from each page's own sectionSelector: 9, 12, 12, 12, 13, 12.

Text a reader could not read

Separately, the render-audit sweep finished its remaining rule classes.

• The public changelog body was 14.72 px on a phone. .changelog-body was 0.92rem: 7,722

elements below the 16 px reading floor at 390 and 768, on the page whose whole purpose is reading.

It now takes reading size and grows slightly on a wide screen instead of shrinking on a narrow one.

• 39 manual pages had four families of body text just under the floor, every one of them read

rather than skimmed: citations (13.8 px — the editorial stylesheet already sets .references at

reading size), worked examples, link-list descriptions, and the sentence that says what a paper

argues.

• Four pages still buried their own H1 under the fixed nav at 390 — the defect the 18-page sweep

at a8d65a9e fixed elsewhere. Measured: changelog 29 px under, future-forward 61 px (its H1

was almost entirely hidden), network-visualization-hub 5 px, network-compare 4 px; the last two

had been raised by that sweep and still did not clear the bar.

And two rules were reporting the browser working correctly. missing-image raised 1,255 findings

across 69 pages, every one a loading="lazy" image below the fold — not fetched because it is not

needed yet. Proof rather than argument: 20 incomplete images on articles.html before scrolling,

zero after. prose-font-size counted site chrome — the cookie-consent sentence and the footer

copyright line appear on every page at their own size on purpose, so every page carried a finding it

could never legitimately fix.

Not acted on, and why: large-blank-gap findings on article pages sit inside

[data-rz-scrolly] (article-16's root spans y 7577–10453; the reported gaps start at 8416) — that

runway is the mechanism, and only the full runner's verifyScrollingGaps() can judge it;

document-overflow is entirely archive and build output, including .qa-screens/overflow-check.html,

which overflows because it is the fixture for that check.

A cache-token drift, caught before it shipped

Adding the section picker changed js/rz-design-studio.js and its stylesheet, and the two existing

adopters — datahallAI.html and dc-conventional.html — still referenced them at ?v=1.130.0 and

?v=2.0.0. Both would have kept serving the previous file from cache while the six new pages served

the new one: the same asset live under three URLs. All nine references now carry one token.

A retraction, and the flow-direction invariant that does hold

v2.18.0 shipped a MONITOR on this line, printed on every ship-gate run since:

> 2,880 of 9,630 tagged lines carry a flow class opposing their declared direction.

That number was wrong, and the error was mine. It assumed the fR / fD classes mean forward

and fL / fU mean reverse, so every leftward-drawn pipe whose logical flow is forward counted as

a defect. Re-measured against the geometry the lines actually carry, the pairing is exact and has no

exceptions at all:

The two attributes are orthogonal and both were right the whole time. The class names which way

the dashes travel across the screen; data-direction names the logical from-to of the line in

the process. A pipe drawn right-to-left whose flow is logically forward correctly carries fL.

What replaces it

The monitor is gone and the invariant that does hold is now a gate, checked at runtime across every

diagram: a line's flow class must match the direction its own endpoints run. That catches the

defect the monitor was reaching for — dashes travelling backwards up their own pipe, which on a

mimic reads as flow going the wrong way — without inventing a conflict between two attributes that

never disagreed.

6,750 tagged lines are checked. Proven red by injecting one reversed class into a detached copy: the

gate names the line, the view, the class, and the direction the line is actually drawn.

Why this is in the changelog rather than quietly deleted

A wrong number printed on every gate run is worse than no number, and a number that is retracted

without saying so is worse still. The retraction is recorded in the four places the original was

published: the gate's own output, this changelog, the plan file and the project memory.

A gate for the hall plan — and it caught a duplicate CDU on its first run

Three owner rejections in a row on datahallAI.html were the same class of defect, and **no gate

saw any of them**: the mimic renders, the engine tests pass, the numbers are traceable, and the

drawing still puts the CDUs on the wrong wall, animates nothing out of them, prints one temperature

for a twenty-row hall and leaves the CRAH banks unlabelled. A drawing can be entirely correct by

every existing check and still say the wrong thing.

tools/test-datahall-ai-hall-plan.mjs asserts what the owner actually asked for, measured on the

rendered DOM and counted against the engine at run time (never a literal, so a basis change

moves the test with it rather than breaking it):

• one CDU glyph per installed unit — no aggregation divisor;
• the CDUs stand between the two banks, i.e. in the cross aisle, at the end of the rows they serve;
• every row carries its own flow animation, not just the two header trunks;
• every aisle reports temperature at several points, in both banks, all of them reading;
• the points along one aisle do not all print the same number;
• every CRAH bank states how many units it stands for.

Run against 01488121 — the build the owner was looking at — it reports 7 broken contracts.

Against the fix, none. Wired into ship-gate.sh.

What it caught

The hall had 56 CDU targets for 55 installed units. The extra one was a legacy "mechanical bank

chip" at x=752 that wrapped a second data-rz-equipment="cdu:1" around itself — a clickable CDU-01

sitting 190 px from where CDU-01 actually stands, opening its HMI from a place no CDU occupies.

Both chips existed for "the counts a per-glyph drawing cannot show", and after v3.3.0 the drawing

shows them: the CDU count stands on its own gallery, and every CRAH bank carries its unit count on

its face. The CDU chip is removed; the CRAH one stays as a single hall-level summary.

standarization/DATAHALL_AI_STANDARD.md gains the hall-plan contract: where each band stands and

why, the flow-animation binding, the aisle-instrumentation rule (and the trap that three readouts

sharing one RZ_SIM seed key print one number three times), and how to measure legibility here —

effective px rather than the font-size attribute, getBoundingClientRect() rather than

getBBox(), which ignores transform and reported 34 collisions where the reader sees 2.

The CDUs move to the end of the rows they serve, and the hall says what it is doing

Owner, on the live drawing: *"Kok masih sama? Nggak proper positioning rack, cdu dan jumlah dan

aliran simulasi air cdu ke row tidak ada. Tidak ada crah dll", then "No hac temp indication in

several point across row, and cdu weird positioning"*.

The first answer was not in any diff. Production serves origin/main, and two releases sat

unpushed — v2.19.0 and the whole v3.0.0 hall rebasing. Nothing the owner was looking at had ever

been deployed. Deploy lag looks exactly like a broken fix; check

git rev-parse origin/main HEAD and curl the live URL for a marker before diagnosing a rendering

complaint. What follows is what was still open once it was deployed.

CDU positioning

A CoolIT CHx1000 is an end-of-row CDU. The drawing put four galleries on the short walls —

which are the ends of the cross aisle, not the ends of the rows. Rows run top to bottom on this

plan, so a row's end is the cross aisle: a row's coolant used to leave the drawing sideways,

travel the length of the hall and come back. All 55 installed CDUs now stand in the cross aisle,

spread across the same span the rows occupy, and the row directly above or below each one drops

straight into it. One glyph per installed unit — no aggregation divisor, so the count on the

drawing is the count in the registry.

The water, animated, at the engine's own rate

Three animations existed on this plan: two header trunks and one blink. The twenty row branches

were static and nothing moved out of a CDU at all. The supply path now flows end to end — CDU band,

row drop, row riser, and the return — 61 animations in place of 3. The dash period is not

decorative: it comes from the row flow the engine publishes (tcsFlowRackLpm × racksPerRow, clamped

to 1.2–6 s), so a row moving more litres a minute visibly moves faster. Motion that encodes a

number is a reading, not decoration.

CRAH

They were drawn. They just said nothing: twenty banks whose only number was ≈ 4.5 units, which

reads as noise. A bank is an integer of real machines, so the remainder is spread one per bank and

each bank now carries its own count on its face (T01 ×5). The owner's other question — *"memang

nggak perlu crah utk hot aislenya?"* — had no answer anywhere on the drawing: each contained aisle

now shows its return path overhead to the CRAH wall it faces, drawn as a path because a ceiling

plenum takes no floor.

HAC temperature, and the legibility floor

There was one readout pair per containment pair, parked in the cross aisle, bank A only: five

numbers for a hall of twenty rows, none of them standing in the aisle it measured. Each aisle now

carries three points at a quarter, a half and three quarters of the row, in both banks — 30 hot

and 30 cold, all reading. The id scheme (H{pair}{point}t) already allowed it; the loop bound in

upd() was capped at si<1 and the drawing emitted only b===0. The seed key now carries the

aisle and the point too, because all three used to read 'page1' and printed the same number

three times.

Then the sizes. audit-legibility reports this page rather than gating it, and it was reporting

584 sub-floor labels: the aisle temperatures rendered at 3.8 px against an 8.5 px floor, which

is why they read as absent. Raising them was previously blocked by overlap, so the space came

first — the bank captions turned 90° into the left margin (they had run across the top inside the

north CRAH band, under the row labels: three strings on one line), the CDU caption moved to the

clear strip east of the band, and the CRAH id and its count merged onto one line. With that room,

the readouts go to 8.5 px — the floor itself — row and bank ids to 6.8, and the **measured

text/text overlap count is unchanged at 2**, both of them pre-existing corridor-services labels.

Verified on production after deploy: 440 racks, 20 CRAH banks, 56 CDU glyphs, 61 animations,

30 + 30 aisle readouts with none left showing an em dash, no page errors, and the render-audit rule

set clean at 390/768/1440 in both themes.

The missing voltage level, and the array that blanked the page

Owner, from the live single-line: *"ini gimana sih tulisannya 20kv dan 150kv secara bersamaan. Ini

harusnya memang 150kv dan ini juga aneh masak 150kv di step-down ke 400v pakai trafo."* Both halves

were right, and both are arithmetic.

And a 2.5 MVA cast-resin unit substation is a 20 kV machine. At 150 kV the impulse withstand is

650–750 kV BIL, so the device the drawing implied cannot be built.

Why no gate caught it

electrical.voltageLL (400) was the only voltage in the whole engine — js/dcai-engine.js

labelled its own block "LV distribution" — so every kV string on the page was page-authored prose

inside a declared-basis escape hatch, and a search of tools/ found zero tests asserting any

voltage anywhere. A contradiction between two prose strings is not something a numeric gate can see.

The chain, now four levels

PLN 150 kV      4 × 250 MVA circuits (3 duty + 1) from two independent substations · 2,702 A
   ↓
150/20 kV       16 × 100 MVA ONAF — one per hall per feed
   ↓            secondary 2,887 A on a 3,150 A busbar · 41 % normal, 82 % carrying the hall alone
20 kV board     fault 20.6 kA into 31.5 kA gear · BUS TIE NORMALLY OPEN, because two mains
   ↓            paralleled would deliver 41 kA and exceed it
20 kV feeders   5 per hall per feed at 630 A, each carrying 8 unit substations
   ↓
20/0.4 kV       2.5 MVA drawing 72 A at 20 kV

Every figure is an engine parameter with its own basis hook, printed on a new MV & HV chain

card. The source boxes now read one voltage, taken from the engine, on all six drawings that carried

the contradiction.

Gated — the complaint made executable

tools/test-dcai-voltage-chain.mjs is new: three descending levels, **every drawn transformer ratio

must step exactly one of them** (a 150 kV → 400 V label fails), every rendered kV must be a

published level, a reading within 10 % of one, or a declared gear class, and no source box may state

two different voltages. Proven RED against the pre-fix tree, where it stops at the first assertion

because the engine published no level above 400 V at all.

Found while shipping: an array in the snapshot blanks the whole page

Publishing the three levels as a convenience array alongside the scalars took the entire cockpit to

AUTHORITY UNAVAILABLE with nothing logged anywhere. The registry generator digests a nested array

to a string ("[3 items] sha1:…"), the page's authority check compares typeof registry value

against typeof live value, and string !== object made datahallSnapshotValid() reject the whole

snapshot. This is the same class as the engine-version pin that once blanked eight cockpits: a

silent, total failure from a change that looked purely additive. The array is gone — the three

scalars already said everything it said — and tools/test-dcai-engine.mjs now walks every snapshot

branch and fails on a nested array, so the next one fails a gate instead of a page.

Also corrected

Four transformer mimic sites hardcoded 10 MVA against the engine's 2.5, and a VCB spec claimed

12.6 MVA where 20 kV × 630 A is 21.8. Both now read the engine.

Honest boundary

250 MVA per 150 kV circuit is an ADOPTED thermal rating for an ACSR double-circuit line, not a PLN

grid study: the page states what the intake requires, not that it has been granted. Sixteen

150 kV transformer bays plus four line bays is a very large switchyard, and that is what 628 MW at

150 kV costs. The single-line still draws the 20 kV level and below; the 150 kV switchyard is

published in figures and named on the source boxes, not yet drawn as its own band.

One PDF shell, and a document can now be issued partial or whole

Owner backlog item (22): "export to PDF with a mature template, partial or whole", starting from

cdu-checklist.html but required across all the engines.

What was there

js/rz-design-studio.js already shared the dialog half — document type, issue scope, revision

note, bound snapshot, provenance — and then handed off to a per-page generate(). The document

half was never shared, so datahallAI.html, dc-conventional.html and changelog.html each carry

their own builder, and the other twenty-one pages have no template at all: no cover, no provenance,

no section choice, and whatever the screen stylesheet happens to do at print size.

What landed

• js/rz-pdf-export.js — the document half, shared. Its palette is the table in

standarization/PDF_EXPORT_STANDARD.md and its skeleton is that document's structure template.

An accent colour is configurable; body ink is not, because the standard marks it CRITICAL

never to set body copy to the muted greys and a shared shell is the place to make that

impossible.

• Partial or whole. discoverSections() reads a page's sections from that page's own markup,

taking each label from its first heading, so a renamed heading renames the export option and the

two cannot drift. The dialog gained a section picker, shown only when a registration declares

sections — the two existing adopters see no change.

• A partial export declares itself. A document issued with sections removed carries a notice

naming every section that is missing, not merely a count. Partial is only safe if the part and

the whole are distinguishable afterwards.

• First adopter: cdu-checklist.html. Eleven sections, discovered live. Its snapshot states

plainly that the page runs no engine, so nothing in it is a computed quantity, and that ticked

boxes are the reader's own and are not carried into the export.

The escape rule is enforced by construction

PDF_EXPORT_STANDARD.md records the 2026-05-09 incident where an unescaped </script> inside a

JS-built print template terminated the parent document's script block and broke five calculator

pages. Every string the shell emits passes through escapeScript(), and the gate feeds the builder

a hostile section containing a script tag and asserts none survives.

Gated

tools/test-rz-pdf-export.mjs is new and wired into the ship gate: the palette still matches the

standard's own table, the skeleton is complete (doctype, charset, 15 mm page margin, both

print-colour-adjust properties, the prescribed footer line), body copy is never a muted grey, a

partial export names what it dropped, and no built document carries an unescaped closing script tag.

Adopters must load both modules and issue through the shared dialog.

Carried as a MONITOR with the count: 19 pages still print directly instead of issuing through

the shell. It is not a gate today because converting a page is a per-page design decision — the

shell needs that page's sections and provenance — and a gate failing on nineteen pages would be

answered by weakening it. It flips when the count reaches zero.

Also

tools/test-rz-design-studio.mjs pinned the dialog's h3 count at three, which was the shape it

happened to have. The invariant it protected is that every dialog section carries exactly one h3

under the dialog's h2, so a screen reader gets a heading tree. Asserted directly, it survives a

fourth section.

The hall was not buildable. Its own numbers proved it twice.

Owner, from the live drawing: "antara row dan cdu nggak match konsepnya, positioning", *"memang

nggak perlu crah utk hot aislenya?", "kacau", and "racknya kan bisa pakai nvl72 itu 140an kw,

harusnya kan nggak sebanyak itu datahallnya". Then, asked to choose the partition: "atur yang

terbaik, super accurate"*.

MAJOR, because the published hall count and per-hall capacity both change. The facility does not:

still 3,520 GB300 NVL72 racks at 142 kW, still 499.84 MW rack IT.

Two proofs, both from the engine's own published numbers

FLOOR   880 racks x 0.72 m2                          =   634 m2
        aisles, 40 rows at the declared 3.1 m pitch  = 1,288 m2
                                                       ---------
                                                       1,922 m2   = the entire hall

So the 108 CDUs and 179 CRAHs the same engine specified had zero floor.

AIR     35,509 kWth of air heat per hall at 25 -> 36 C  =  2,677 m3/s
        coil face at 2.5 m/s                            =  1,071 m2
        the whole hall envelope                         =  1,023 m2

The air could not pass through the room's own walls. Stated the way the layout actually works —

a perimeter gallery 3 m deep — 179 CRAH cells needed 298 m of frontage against a 186 m perimeter.

One change fixes both, and a third defect with them

Eight halls of 440 racks. No room dimension changes: 62 x 31 m is the right room for half the

racks it was given.

That last row is the one worth reading twice. The page already printed 33× 2.5 MVA/feed beside a

"true 2N" claim. It was a 1N total divided by halls × 2 for display, so each feed covered half

its hall and every transformer ran at 99.9 % with no design ceiling — unlike the UPS, which has one.

2N is a contingency rule, not a division: each feed must carry the whole hall when the other is

lost. Sized that way at eight halls, the printed 33 becomes true, loading falls to **49.6 % normal

and 99.1 % on one feed**, and the facility count moves 262 → 528.

The floor is now budgeted, not asserted

New engine outputs, each with an identity in tools/test-dcai-engine.mjs: rack_field_m2,

cross_aisle_m2, cdu_gallery_m2, air_plant_m2, floor_used_m2, floor_spare_m2,

floor_budget_closes, air_flow_m3s_per_hall, fan_wall_face_m2, air_plant_frontage_m,

fan_wall_fits. Row pitch stops being prose: it was 3.1 m asserted inside one model comment and

is now derived as rack depth + cold aisle + hot aisle = 1.2 + 1.2 + 0.7, landing on the same 3.1 m

the comment claimed. The rack pitch, depth and both aisle widths are published parameters for the

first time, so nothing can draw a 2.37 m rack against a 0.73 m aisle again without failing a gate.

A model contradiction went with them: electrical.racksPerRppGroup justified itself with

"880 = 10 rows × 4 × 22" while geometry.rows said 40 rows of 22. Both shipped for three releases.

One row is one group.

The hall drawing, redrawn

Measured before: 10.13 px/m along the hall and 17.67 px/m across it — a 1.74× stretch, so

nothing was comparable between axes; 2.37 m of rack against 0.73 m of aisle, inverted; a cross aisle

drawn at 1.7 m where the model declared 4.6 m; 179 CRAH units drawn as 40 boxes with the divisor

hidden in a tooltip; no hot-aisle return path anywhere; and CDU galleries as side strips while

the model, the PDF and the layout card all said end-of-row.

Now one isotropic scale, and every band is the engine's floor budget divided by the hall width:

air plant W | row column A | cross aisle | CDU gallery | row column B | air plant E

Rows run along the aisles, so a cold aisle is a straight 13.2 m throw from the gallery feeding it.

Each row is drawn as cold aisle, rack, contained hot aisle at the engine's own dimensions. One glyph

per CRAH unit and one per CDU — no aggregation divisor. Aisle sensors sit in the aisles they measure

instead of in a row down the middle of the hall.

A new panel answers the question directly

The hall tab gains Floor and air budget, printing every term with its basis hook, plus the air

share of hall IT — which is 26.3 %, not the 15 % two places on the page still claimed. Fifteen

per cent is the rack-only share; the fabric tier, OOB, storage, UPS loss, distribution loss and

auxiliaries are all air cooled, and that is why the CRAH count is what it is.

Verified

tools/test-dcai-engine.mjs 287 assertions green (was 250). Registry 256 parameters, R7 256/256

gated and R8 strict. Coverage strict: the hall drawing reads 47 numerals, 26 hooked, 21 declared,

0 untraced, 0 mismatched. Electrical topology re-pinned to 58 nodes / 97 edges per hall, from

the same formula.

Honest boundary

The 4 m² serviced floor per CDU, 5 m² per CRAH cell, 3 m gallery depth and 2.5 m/s coil face

velocity are ADOPTED engineering allowances, not vendor data, and ship declared as such. A 200 kW

CRAH at an 11 K rise moves 54,000 m³/h, which is AHU class rather than CRAH class; the model keeps

the label it had and the number is now checkable. The eight-hall count supersedes the owner's

2026-09-05 request for four, and the model comment says so rather than quietly overwriting it.

Text that was drawn but could not be read, and the detector that was blaming the wrong things

The render audit had been reporting text-overflow on 46 pages and editorial-translucent-wash on

• Every finding was opened and looked at before a line was changed. Roughly half were real, and

about half of what the tool reported was the tool's own fault — both halves are fixed here.

The real defects

datahall.html — the CRAH rail and the row footers. The rail set

gridTemplateColumns = repeat(N, 1fr) inline across the whole 59-unit fleet, so a cell was 23px

wide at 1440, 18px at 768 and 5px at 390 for a 26px tag: every CRAH-A01 rendered as A0,

every A11 as A1. A unit tag cut mid-digit names a different unit. The zone footers were worse

— the owner's v2.10.0 per-row readings (322 kW · IN 25.1°C · HOT 36.9°C) measure 169px and the

column was 28px, so all 75 numbers were drawn and none could be read. Rail and field now hold a

legible track minimum (38px / 64px) and scroll sideways; the footers stack; the zone head and foot

stop being squeezed. Below 1024 the 100vh app frame unlocks, because on a 390px phone the balance

band alone took 543px of it and the floor plan was handed 18px with the bottom of the stage cut

off and unreachable. Measured 284 → 0 clipped text elements per render.

dc-market-tracker.html — one line, the whole page. body is a column flex container (the

sticky-footer guard), which makes .dmt-main a flex item whose auto cross size is fit-content,

floored by its own min-content. The market table's white-space: nowrap headers set that to

1,294px, so on a 390px screen the page laid out 1,329px wide and overflow-x: hidden cut it

off with nothing to scroll. 624 findings at 390 and 454 at 768 went to zero on width: 100%.

Calculators with locked PRO charts. A <canvas> carries intrinsic width from its width=

attribute, and Chart.js never resizes a chart it never instantiates — so the 600px PRO canvases on

carbon-footprint.html and roi-calculator.html set the grid track and pushed the calculator

column off a 390px screen. Their toolbars carried an inline padding: 0 2rem that a media query

could not reach without !important.

The rest, each verified on the page: pln-java-grid.html's generation-mix bar was a 28px-tall flex

row sharing its line with the legend it should sit above (the bar rendered 84px wide and the

legend's three lines were cut to 17px); article-12's comparison grid kept three inline tracks on

a phone and put the third card off-screen; article-10's stress chart held 180px 1fr 60px;

article-11 and asean-dc-report-2026 printed values inside bar fills too narrow to hold them;

article-26's series badge and PFAS KPI grid; the shared .newsletter-form, which stacked at a

600px viewport while the article rail is 288px wide at every viewport; changelog.html and the

manual pages, where slash-joined identifier runs offer Chrome no break opportunity; 43 incident

pages whose nowrap chips carry a full operator name; Apps/second brain's fixed nav, whose own

controls sat past the right edge at 1440. article-9-paper.html and the internal audit reports had

no responsive block at all.

One page defect was found by eye rather than by the audit: carbon-footprint.html carried a bare

// NOTE: line in its markup, rendering a developer comment as body text above the Cooling

Type field.

The detector

Five classes of finding were the tool, not the site. Each is now fixed with a fixture that fails

first:

• A closed <details> hides its body by design. The CDU checklists author

details { overflow: hidden }, and every span inside was reported as clipped — 121 findings on

cdu-checklist.html alone, none of them visible to any reader.

• A marquee queues its next items outside the window it scrolls them through. That is the

mechanism. It accounted for every text-overflow finding on index.html, articles.html and

datacenter-solutions.html — the homepage needed no change at all.

• text-overflow: ellipsis and -webkit-line-clamp are authored truncation. The cut is

declared and the reader can see it happened. A box that clips with no ellipsis still counts.

• Off-canvas panels, 1×1 live regions, and boxes that can scroll. A parked drawer paints

nothing; the visually-hidden idiom paints nothing; and a box with overflow-x: auto either

scrolls or its content fits. white-space: pre-wrap hangs preserved indentation, so

article-26's chemistry blocks measured a 504px range inside a 347px box that scrollWidth

correctly reports as fitting.

• editorial-translucent-wash was flagging the site's own replacement pattern. §A bans

translucent card washes; the approved alternative is a flat tint plus a 1px hairline, which is

exactly what .quote-callout renders. Tinted instrument chips were 1,332 of the 1,988 findings.

The rule now needs a card/panel/block surface and no hairline.

Each exemption was checked against the unfixed datahall.html: the new probe still reports all

284 findings there, so none of this laundered a real defect away.

Two more the sweep surfaced once the noise was gone: fuel-system.html's alarm strip cut its own

last reading — the scenario name Simulated — by 17px in dark theme only, where the state label

runs longer; and embed/index.html still carried decorative backdrop-filter: blur(10px) on

.info-card, outside the scope of the 22-file glass sweep at 0b4e9115. A sixth detector class

went with them: prose-highlight-wash was reporting status chips (.confidence-badge,

.mn-status) as banned highlighter runs. A chip is display: inline-block with its own padding

and radius and it labels the sentence; a highlighter is plain inline text that tints it. Only

the second is the §A tell.

The cache-bust normalizer was itself a regression generator

Found while running the ship gates. tools/normalize-cache-bust.py parsed no arguments and

hardcoded NEW_BUST = "2026-05-09-v1", so --check was swallowed silently and the tool wrote:

294 tokens across 155 files walked backwards to a May value, index.html's

styles-index.min.css?v=2026-09-06-slop included. A normalizer that moves tokens backwards causes

exactly the stale-asset bug it exists to prevent. Rewritten: --check is the default and exits 1

on drift, --apply writes, and the target is the newest token already in the tree, chosen by its

digit run — never a constant baked into the file. Four tests pin it, including "prose quoting an

old token is documentation, not a load".

It then found a real one: auth.js was requested under 2026-08-26-h1h2 on 151 pages and

2026-08-27-contract-tab-order elsewhere, while the file itself last changed 2026-09-05 — both

tokens stale. All 150 pages now carry 2026-09-05-mint, the token its own auth.min.js twin

already used. Both checks are wired into ship-gate.sh.

One banned colour

tools/build-changelog-html.py still emitted Anthropic-default violet #8b5cf6 — the MAJOR tier

pill and two nav links. §A bans it and the rest of the site uses #64748b for those links.

Raw floats stop reaching the panels, and the flow animation closes its own cycle

Owner, from the live page: "angka belakang koma banyak sekali spill semua", and *"garis-garis dan

animasinya nggak tepat"*. Both were real, and each had one root cause.

The numbers

js/datahall-ai/hmi-payloads.js publishes two accessors per point. P.v() returns the payload's

own text at its declared precision; P.n() returns the raw engine number, for arithmetic. Only

simulated points round their stored value — engine, authored and plane points do not. Every spill

was a renderer printing P.n() with a unit concatenated onto it.

Display sites now use a *Txt twin from P.v(); the numeric variable stays where arithmetic needs

it, such as the CRAH air-side ΔT identity. The hall drawing's cold-aisle sensors were a separate

one-character bug: RZ_SIM('page3', …, 5) asked for five decimals where its three siblings ask

for one, printing 25.78698 °C on a 2.8 px glyph. And kwTon was null-guarded on assignment then

dereferenced unguarded by .toFixed(3), which threw whenever that point was unpublished.

The animation

A dash cycle only closes when the offset travels a whole number of dash periods. The page ran

24 against a 10+5 period and 16 against 6+4 — 1.60 periods each, so every flow line on every

diagram snapped back six tenths of a dash every four seconds. Now 30 and 20, exactly two periods.

Under reduced motion the dashes also settle to offset 0 instead of freezing at an arbitrary phase.

Two more, found while measuring:

• rz-flow-partial had no rule. operator-ui.js has toggled it since the electrical state

machine landed, so a path carrying load with its **redundancy lost rendered identically to a

healthy 2N path** — the one distinction that drawing exists to show. It now separates by texture

and weight while keeping its feed colour, because identity must never borrow the alarm palette.

• Reduced motion could not reach SMIL. A CSS media query has no authority over SVG animation,

and this page carries 135 <animate> / <animateMotion> / <animateTransform> elements — the

TCS header dashes, the heat-exchanger particles, the rotating CRAH fans, the leak blink — all of

which kept moving for a viewer who had asked the system to stop. A matchMedia listener now

calls pauseAnimations() on every SVG root and re-applies to panels rendered later. Measured:

26 roots running normally, 26 paused under reduce.

The 2.1 bar · 1,497 L/min per CDU annotation was centred on the CDU gallery at x=39, so at 2.8 px

monospace it spanned x 15.5 to 62.5 — outside the drawing margin, across the gallery rectangle and

its rotated label, into the first rack row. It is now anchored to the ends of the header it

describes.

Gated

Two new gates, both proven RED against the pre-fix tree in a detached worktree and GREEN after.

• tools/test-dcai-rendered-precision.mjs walks every tab, sub-tab and tier-2 modal. **14 distinct

over-precise values across 4 views → 0. The test is significant digits, not decimal places**,

and that distinction is load-bearing: a first cut flagged four VESDA obscuration readings at

0.0024 %/m, which are correct — an aspirating detector is specified in the 0.0015–0.02 %/m band,

so four decimals there carry two significant digits. 1497.2441888329738 carries seventeen. The

ceiling is six.

• tools/test-dcai-flow-animation.mjs checks dash-cycle closure from the stylesheet source, that

every class the runtime toggles is styled, and that reduced motion reaches SMIL. 7 failures → 0.

Recorded, not fixed

2,880 of the 9,630 tagged lines that carry both a declared direction and a flow class carry a class

whose travel opposes that direction, nearly all in the dh1-semantic-* family on the building

isometric. The cause is structural: direction is a hand-written cssClass literal kept in sync with

the model's own field by hand, and styleAttrs() in js/rz-line-model.js never reads

spec.direction. The gate carries this as a MONITOR with the count and a written flip condition —

it becomes a gate when the class is derived rather than typed.

A bar does not need a gradient (owner comment 21, deferred backlog)

Owner comment (21) named the tell: "saturated red/amber/green bar charts" still on the article and

calculator family after earlier reskins. A bar, gauge, meter or score fill encodes a value — its

length is the datum, its colour the severity. A two-stop gradient across it adds a second visual axis

that carries no information, and that is what produces the glossy-pill look. The site's own cockpits

already get this right: .bar-fill in datahall.html declares no background at all and takes one

flat colour from the engine.

The distinction is structural, not taste

Four multi-stop scales exist and were deliberately kept: .gauge-bar on articles 16, 17 and 18, and

.risk-gauge-bar on article 5. Flattening those would have destroyed the gauge.

Measured

No colour was invented: each fill takes its own gradient's first stop. One side effect worth naming —

.tco-inline-bar-fill.cloud ran #64748b → #C3B0FA, so flattening removed a lavender the palette

does not contain. A white-to-transparent gloss overlay on .ig-bar-fill::after, which also carried an

8 px radius, was removed rather than flattened: a sheen laid over an encoded value is the same defect

wearing a pseudo-element.

Gated

tools/test-data-fill-gradients.mjs is new and wired into the ship gate. Proven RED at 53 findings

against the pre-sweep tree in a detached worktree, GREEN at 0 after. It also catches the pseudo-element

gloss case.

Also on main between v2.16.0 and this release

0b4e9115 removed decorative glassmorphism from 19 blocks across 16 files and retokened three

calculators whose --glass-blur: blur(20px) fed the same effect through var() indirection. It also

rewrote the glass-decoration detector: the old rule matched selectors with a regex that could not

tell a selector from CSS comment text and only fired at three or more glass surfaces per file, so it

read clean site-wide while [data-theme="dark"] .article-card carried blur(8px) on live pages. One

decorative glass surface is now a finding, and backdrop joined the functional exemptions with a

fixture. That commit carried no version of its own; it is recorded here so this release covers

everything shipped since v2.16.0.

Honest boundary

This closes the bar-chart half of comment (21). The other two classes it names — filled gradient

severity pills and card washes — remain: 178 saturated multi-stop gradients sit on non-instrument

pages, mostly button and hero surfaces, which the existing gate exempts as functional. Those are a

separate judgement and a separate ship. The rule lives in its own file rather than inside

tools/audit-vibecode.mjs because that file was under concurrent edit when this landed.

Whole-site editorial and anti-vibecode sweep, one crawler inventory, and a robots.txt that actually restricts

The owner asked for a whole-site anti-vibecode and article-readability pass covering containers,

whitespace, sitemap and robots. This lands that work: 215 pages, 7 stylesheets, the three discovery

builders and the design gate itself.

The design gate now gates

tools/audit-vibecode.mjs carried three rules as MONITORS that failed only on index.html and two

stylesheets, because landing them strict site-wide would have turned main red on 220 files. The tail

is now swept, so they are gating everywhere. Measured, with the new gate run against the

pre-sweep tree:

That is 257 gating findings across 167 files reduced to none, by editing the pages: decorative radii

moved to the 4 px instrument scale and coloured rails from 3–4 px to the 2 px semantic rail. The

exemptions the rules gained are narrow and named (functional geometry, safety rails, printed paper,

circles, the aurora), each with a fixture. The gate also stops printing "safe to push" from a static

scan, gained a --json inventory, and its block parser no longer breaks on braces inside strings or

skips selectors over 400 characters.

One publication inventory behind all three discovery builders

tools/build-sitemap.py, build-llms-txt.py and build-llms-full.py each kept their own copy of

the public-directory list, and none of them recursed. tools/crawler_inventory.py is now the single

publication policy for all three. The sitemap grows 155 to 180 URLs — the 25 additions are the

entire /network/ protocol library, which no builder had ever seen. Nothing was removed, no noindex

page entered, and the private pages stay out.

robots.txt was permitting what it meant to forbid

A named user-agent group does not inherit the wildcard group's rules. ClaudeBot, anthropic-ai,

PerplexityBot, CCBot, Applebot, Bingbot and six more each had Allow: / with **no Disallow

lines at all**, so /tools/, /prompts/, /Data/, /standarization/, /Apps/ and /dcmoc/ were

open to them; GPTBot had four of the eleven. Every agent now shares one group carrying the full

list, and Yandex repeats it in full beside its crawl delay. llms.txt is no longer declared as a

Sitemap:, which is not a format that directive accepts.

Fixed while integrating: the export withheld 40 public pages

The new inventory treated any pro / gated / locked class as page-level access control. Forty

public pages carry one for a calculator's paid tier, so the first build exported the **entire article

corpus as metadata-only** while sitemap.xml and llms.txt published the same URLs as public in the

same run. Where the marker sits now decides what it means: on <html>, <body> or <main> it

withholds the page; anywhere nested it strips that region from the exported body and leaves a stated

notice. Four pages are genuinely access-controlled and stay metadata-only. llms-full.txt settles at

90,107 lines, down from 104,399 — the difference is the four gated cockpit bodies, which a public

export should never have carried, plus 150 stripped tier-gated regions.

Also in this ship

• 35 article-family files received an editorial pass on openings, headings and endings, and meta and

Open Graph descriptions were rewritten from atmosphere to what the page actually does.

• A reading-text floor of 16 px with sufficient leading across every .article-body, outside

instrument, chart, caption and navigation contexts. Observed RED at 14 px, GREEN at 16 px.

• Article 1 no longer presents UPS bypass as the default reliable operating state.
• Article 9's related-rail thumbnail pointed at two URLs that do not exist; it now uses the asset it

has. Articles 2–8 had unrelated historic titles in the search index. Article 19 linked to article 5

as cybersecurity, which it is not.

• Seven serious contrast failures in articles 13 and 26 were corrected; the rerun passed all eight

representative pages in both themes with zero critical or serious findings.

• Shared asset references consolidated on one 20260908-editorial token, including the

css/rz-bms-shell.css reference on datahallAI.html, which was the last page still on the

retired token after that stylesheet changed.

• New tooling, each with its own fixtures: a site-render audit harness, an article-series

synchroniser, and regression suites for the design gate, editorial reading, prose styles and the

crawler. 36 crawler tests and 8 Node suites pass.

• output/ and tools/.site-render-audit/ are gitignored — 401 MB of per-run evidence that is not

source.

Honest boundary

A clean static design scan is not a visual approval, and this ship does not claim one. The route

audit remains diagnostic: its own report says filtered pages, gate-blocked content and environment

failures cannot be merged into a pass. Article prose received an editorial pass, not full fact

verification. The crawler workstream owns discovery only — it does not certify deployed HTTP headers,

auth enforcement or search-engine indexing.

One modal system: two declared types, one proportion, one entrance (Track A, owner comment 3)

Owner: "modals: type, proportion, animation." All three were measured on the eleven centred HMI panels of

datahallAI.html before a line was changed, and all three were real:

Added

• A modal system block in css/datahall-ai-operator.css, applied through the .dh-modal-host class that

DHModal already puts on every registered panel, so no panel markup changed.

• Type is now declared, not accidental, and there are two. A PANEL is a centred equipment read-out

(eleven of them: 820 px, or 960 px for #irCduHmi, whose in-rack mimic genuinely needs the column). A

DIALOG is a centred short form (#fireIsoDialog: 600 px, because a four-field form set 820 px wide reads

as a panel with a hole in it). The two widths are the only difference between them; every other token is

shared.

• One entrance, 160 ms. PANELs rise (dhmRise, opacity + a 4 px translate) because their opener

positions them with inline left/top. #fireIsoDialog centres itself with translate(-50%,-50%), so a

second transform would throw it off centre — it fades (dhmFade). The scrim fades with it. Under

prefers-reduced-motion: reduce every one of them is animation-name: none, proven.

Changed

• Surface follows the instrument language for all twelve: opaque var(--bg1) ground with the gradient wash

removed, one 1 px var(--bd2) hairline, 4 px radius, one elevation, and system identity carried by a 2 px

top rail (--dhm-accent) instead of a coloured box. Blur stays on the dim layer, never on the panel.

• Header and body type normalised: one 12 px mono header, one uppercase outline status pill, one 10/14 px

header padding and 12/14 px body padding, tabular figures throughout.

• DHModal.onOpen() gained one centring rule. Each opener positioned its panel from a width it hard-coded

(760 / 780 / 800 / 820 / 960), which the one proportion made wrong by up to 60 px, and each also guessed

its own height. The panel is now re-centred from the box the browser actually laid out. The drawer, the

full-screen overlay and the transform-centred dialog position themselves and are skipped by id.

Not changed, deliberately

#bodDrawer (a 560 px full-height right drawer) and #sldMimic (a full-screen overlay) carry

.dh-modal-host for the focus trap but are not modals. Every rule in the system excludes them by id, and

both were measured unchanged after the sweep (560 px / 1500 px, radius 0, animation-name: none).

Verified

Measured open, not just in source: twelve panels at one width tier each, one 90 vh max-height, one 4 px

radius, one 2 px rail, one flat opaque surface, one header font. Real opener path at 1500 px — every panel

centres to 0 px horizontal and ≤ 1 px vertical error once the entrance settles. 375 px and 768 px — all

twelve fit with no sideways page scroll. Light theme — all twelve opaque and flat. Reduced motion — all

twelve plus the scrim still.

BMS tab: every block opens a detail modal, and the vendor-name cards are gone (Track A, owner comment 6)

Owner: "BMS: no modals, cards are AI design slop." Three faults, measured: most of the drawing carried no

equipment hook at all — the redundant servers, the seven ring switches and the four application tiles opened

nothing, so "no modals" was literally true for the majority of the architecture; the label tier ran 2.8–6

user units, so almost every string on the sheet sat under the 8.5 px legibility floor; and the four

specification cards were lists of vendor names ("Schneider EcoStruxure / Nlyte", "Maximo/Fiix/eMaint")

with no engineering in them.

The tab is redrawn from one shared model (BMS_MODEL) that feeds both the drawing and the detail panels, so

the sheet and the modal cannot drift. Six labelled layers — L0 field, L1 gateways, L1 controllers, L2 local

display controllers, the ring, L3 operations — at the same three label tiers the rack and network views use

(minimum 10.9 px rendered, 0 strings under the floor, down from most of them). All 35 decorative animations

are gone: no pulsing LED on every block, no five competing dash-flows. The ring is drawn flat with a real

return path instead of a 400-unit decorative ellipse, so it still reads as a ring and stays legible.

Every block now opens #bmsModal on a plain click (Shift/right-click still opens the right-side

inspector). Three new payload classes cover the layers that had none — bms-field, bms-ldc, bms-app —

and all seven bms-* classes carry a tier-2 opener; the sheet went from 28 hooks to 46. Each panel states

identity, protocol and transport with its port, points and poll interval, what the element serves, its

failure domain (a gateway loss makes its segment STALE, not dark), the alarm-priority mapping, and — on

every panel — the authority section: this cockpit is monitor-only, the FACP is the authority for life

safety, plant sequences run on the L1 controllers, and local override happens at the L2 panel, never here.

The four slop cards are replaced by three that carry the monitoring contract instead of brand names:

what this layer may and may not do, the field-to-operations data path, and how the view fails honestly

(stale marking, retention, and what is explicitly not modelled). Protocol and platform detail moved into

the modals where it can be stated precisely.

Proven: 375 px and 768 px with zero page-level overflow, light theme, and modal keyboard behaviour — focus

lands inside, Tab stays trapped, Escape closes and focus returns to the clicked block.

Gates: coverage --strict --settle=9000 --modals clean on every row (bmsSvg 14 numerals, seven inspector

rows, seven modal rows, 0 untraced), inspector runtime, operator UI, basis map, basis hooks, no retired

literals, anti-vibecode strict.

Network split into compute fabric / corporate internet / security (Track A, owner comment 4)

Owner: *"Network: modal per block, split into rack-fabric / corporate-internet / security sub-tabs, most

scalable and advanced, firewall + cyber architecture."* Measured: one flat drawing of 4 spines, 8 leaves and

27 "representative racks" — a GB200-era sketch sitting beside an engine that computes **880 leaves, 660

spines and 220 cores** per hall from radix arithmetic; no corporate/DC-internet view at all; security

present only as a line of text.

The tab is now three views behind a scoped sub-bar (#netTabs, data-np, np-* — its own class names and

its own handler, because the electrical strip's handler is document-global):

Compute fabric redraws at hall scale: four tier bands (core, spine, leaf, NVL72 endpoints) each printing

the engine's count, the link counts between them (63,360 leaf→spine, 31,680 spine→core, 63,360 GPU

downlinks), and a radix arithmetic panel that shows every division that produced them — leaf radix 144,

72 down / 72 up (1:1), spine 96 down / 48 up (2:1), leaves = downlinks ÷ down, spines = uplinks ÷ down,

cores = uplinks ÷ radix, 1,760 switches = exactly 2 per rack, integer by construction. The glyph banks are

declared as a representative sample and say how many of how many are drawn; per-switch readings are

simulated and say so, and are painted on the first frame instead of after the first 4 s tick.

Corporate & DC internet is new: carrier A/B → diverse entry → always-on scrubbing → border routers →

NGFW pair → campus core, with the demand build-up shown as arithmetic (10 PB/week dataset refresh →

132.3 Gb/s sustained → ×3 diurnal = 396.8, + 120 replication + 40 distribution + 19 ops = 576 Gb/s peak)

against 800 Gb/s committed and 4.8 Tb/s installed, the single-carrier verdict (400 Gb/s survives, peak

exceeds it, the replication queue sheds first) and an honest-boundary note that nothing here is measured.

Security network is new: eight IEC 62443 zones (ZI, Z4, Z3, ZF, ZM, Z2, Z1, Z0) with SL-T targets and

seven named conduits carrying a protocol and a direction (no write path into life safety), enforcement

points (BlueField-3 DPUs and 802.1X scope from the engine, hooked), and SIEM sizing shown as arithmetic

(100,000 EPS → 8.64 G events/day → 3.02 TB raw → 302 GB stored at 10:1). SL-T is labelled a target, never a

verified achieved level.

Every block opens a detail modal. The owner's rule for this ship — *"jangan banyak tulisan, setiap block

atau gambar itu pop up modal yang sangat detail dan presisi"* — is why the two new sheets carry a drawing and

four headline tiles instead of tables: the detail moved into #netModal, a per-block pop-up reached by a

plain click (Shift/right-click still opens the right-side inspector, the v2.4.0 gesture order). A fabric

element's modal states its tag, tier, class and radix, its port map and oversubscription, the tier and link

counts it belongs to, and its dependencies and failure domain; a domain's modal separates intra-rack NVLink

from the scale-out fabric; a WAN block's modal carries the full demand arithmetic term by term; a zone's

modal carries its purpose, target level, inbound and outbound conduits with protocol and direction, the

enforcement points and the SIEM sizing, and what is never allowed. Six inspector payload classes now carry a

tier-2 opener (net-core, net-spine, net-leaf, net-domain, net-wan, net-zone — the last three

new). Registered in the tab set as three entries with the fire workstation's per-entry

sub-bar override. Every drawn numeral is hooked to the registry or carries a written declaration; the two

new views are page-authored architecture and say so on the sheet, in the cards and in the inspector.

Gates: coverage --strict --settle=9000 --modals clean on all rows (netSvg 82 numerals, wanSvg 13, secSvg

11, 0 untraced), inspector runtime, operator UI, basis map (168 fields), basis hooks, no retired literals,

anti-vibecode strict, full ship gate.

DC AI rack architecture redrawn (Track A, owner comment 2) + the SLD line-model follow-up

Owner: "Rack Architecture overlaps, animation, responsiveness, non-standard symbols." Measured: 136

labels, 75 of them under the 8.5 px legibility floor at 1,680 px and all 136 under it at 1,024 px (type

authored at 3–4 user units); three published per-tray figures rendered as — because the adapter never

carried them (Grace per tray, NVSwitch chips per tray, the 800 G port speed); evidence marks overlapping

text; pulsing <animate> risers and rail lines; three spec panels drawn inside the SVG at 5-unit type.

Now #rackSvg (960 × 690, never rendered below 1,200 px — it scrolls inside its zoom wrapper instead of

shrinking) draws the rack as a front elevation with three label tiers (9 / 7.5 / 7 units; minimum 8.8 px

at a 1,024 px viewport, 11 px at 1,680): eight power shelves with an AC/DC glyph, PSU modules and the

shelf-level duty / spare rule; eighteen compute trays with GPU / CPU / NIC / DPU glyphs; nine NVSwitch

trays; manifold, 48 VDC bus, leak detection and NVLink backplane rows; the power chip (rack kW, installed

kW, shelf rule, feed current at line voltage); static coolant risers with arrowheads. The rail group shows

four rack elevations, the leaf switch as a port-row switch symbol, the per-tray NIC / DPU line and the

hall's rack / rail-group counts; the network rack is a stack of port-row blocks. The three spec panels

moved to legible HTML cards under the drawing (#rackCards), hooks preserved. The adapter now carries

cpuPerTray, nvswitchPerTray and cx8Gbps from the model's published GB300 leaves (declared as such —

no registry id exists for them). Every data-rz-equipment hook (`rack-psu/ct/ns/manifold/busbar/leak/

backplane`) and every modal opener is unchanged.

Also in this ship: every SLD semantic line carries data-from / to / medium / state parsed from its

topology edge id, and the runtime projection re-states data-state beside data-semantic-state, so

tools/probe-line-model.mjs is green on datahallAI.html for the first time since v2.0.0.

Gates: basis map (163 fields), inspector runtime, HMI payloads, basis hooks, no retired literals,

operator UI, coverage --strict --settle=9000 --modals (rackSvg 21 numerals · 0 untraced), full ship gate.

One navigation language for both cockpit hubs (Track C, owner comment 18)

Owner: "align the DC AI and DC Conventional navigation menus." Measured: the AI hub used a horizontal

nav.tabs with a filled green pill for the active module (design.md: "active = 2px amber underline,

never a filled tab"); the Conventional hub used a vertical sidebar of gradient-backed 8 px cards with

tinted icon tiles, a hover translateX(3px) slide and emoji icons (⚡ ❄) mixed with Font Awesome

(anti-vibecode §A 5). Two hubs of one suite, two vocabularies.

Now css/rz-cockpit-nav.css states the one vocabulary from documentation/design.md §Tab strip — mono,

uppercase, 0.06 em, a tier-2 hairline, active = a 2 px signal-amber stripe, no fill, no gradient, no

slide — in two variants: --strip (the AI hub's module tabs: amber underline) and --rail (the

Conventional hub's subsystem links: amber left rail, which becomes an underline strip below 900 px so both

hubs read the same on a tablet). Icons are one thin-line set (Font Awesome, aria-hidden); the emoji are

gone. Both pages keep their own ids, classes, handlers and the verbatim tab CSS the operator-ui gate pins —

the sheet only restates the look. The dark-theme position regression that let the AI tab bar overlap the

data-mode strip was closed in v2.4.0 and stays closed.

Gates: anti-vibecode strict, DC AI operator-UI contract, dark coverage strict, a11y strict, responsive

layout strict, full ship gate.

Data hall: a continuous heat-map ramp, min / avg / max per row and per hall (Track B, owner comment 12)

Owner: "datahall.html rack-grid gradient + min/max/avg per row and in the sidebar." Measured: the field

painted 463 occupied cabinets with four flat tiers, and in the default rack-inlet mode every cabinet in a row

shared one row value — one uniform green, the differences a heat map exists to show invisible (doc-03 "too

much uniform green"); no row or hall statistic existed anywhere.

Now every colour mode with a continuous quantity paints a continuous severity ramp between stops that sit

exactly on the thresholds the tiers used (the thresholds are the alarm philosophy, the ramp is presentation):

power — muted slate → green → amber at 70 % → orange at 85 % → red at 95 % of the cabinet rating; rack inlet

— 18 → 22 → 25.4 target → 27 recommended max → 30 °C; cooling margin — 0 → 1 → 3 → 5 → 7 K. Red remains

reserved for breach. The legend is one ramp bar with threshold ticks instead of swatches. Rack inlet is now

per cabinet: the row's cold-aisle temperature plus a declared simulated aisle-end recirculation allowance

(+0.6 K at the two end positions, +0.3 K at the next), so the field shows the aisle-end gradient a contained

row actually has; the row footer keeps the row plane the coverage gate reconciles and gains min–max / avg

of the row's cabinets (kW in power mode, °C in temperature modes), declared as an aggregate of the simulated

field. The Environment panel gains hall-level rack load min / avg / max, **row load min / max (row

letter) and rack-inlet min / avg / max**; the tooltip and the selected-cabinet inspector show the

cabinet inlet beside its row value. The cabinet field still sums to the engine's hall IT load (463 cells →

7,500.6 kW) and every gated id, label and fail-closed string is preserved; the cockpit-regressions gate now

asserts the side of the ramp (green channel dominant inside 18–27 °C) instead of one literal swatch.

Gates: data-hall operator engineering, data-hall authority fan-out, ICT/data-hall runtime, hall scope

(field re-scopes per hall, sum reconciles), conv coverage STRICT (36/36 traced, four distributions

reconcile), alarm runtime, basis drawer, explain wiring, snapshot binding, cockpit regressions, telemetry

e2e, anti-vibecode strict.

ICT: the architecture canvas that did not exist (Track B, owner comment 17)

Owner: "ict.html — no architecture/flow diagram at all"; ledger DCUI-011: *"rancang dengan proper schematic, atau

architecture … dengan sangat accurate dan detail."* Measured: thirteen <svg> elements on the page, all icons; the

"Architecture / Topology" panel was four columns of text cards; six operational segments, deterministic alarms

and a link table existed with no drawing that related any of them.

Now every segment renders a Network Architecture canvas (svg.ict-arch, 1180 wide) above the layer grid:

four bands (External / DCI · Edge / Core · Fabric / Access · Racks / Services), zone frames (campus IT fabric;

OT zone segmented with controlled conduits, not an air gap; security zone; OOB plane), orthogonal edges routed

so a path that skips a layer runs down the margin and a same-row link that passes a neighbour runs above it.

The IT view draws ISP-1/2 → DDoS scrubbing → RTR-BKS01 → SW-CORE-A duty / SW-CORE-B hot standby (MLAG peer)

→ SPINE 1-4 → ToR groups per Hall A–D → hall rack groups (the governed study's 500 racks · 42 groups) and the

customer L3 edge; WAN, BMS/OT (DMZ, OT firewall pair, BMS-GW-01, OT access pair, six facility gateways),

Security, Management/OOB and Monitoring have their own. Nodes and edges come from the SAME authored inventory

the services strip, layer grid and link table already state — no count was invented. Every edge with a link

row is bound to it: clicking an edge selects the row and opens the link inspector, clicking a row highlights

the edge (cyan, packet animation only while selected — doc-08 "too much neon"; reduced motion static). Clicking

a node opens a node inspector with role, layer, state, upstream, downstream and its fault domain (the live

downstream set — standby paths, peer links and upward edges are not walked), and dims everything outside it.

A Scenario control (Normal · Core A fail · WAN primary loss · BMS gateway offline · Camera VLAN degraded ·

Historian unreachable) re-states node and edge states on the drawing with an impact note; the panel says the

authored alarm register is not rewritten by a drawing scenario. Nineteen tagged lines on the default segment

(data-rz-line, medium fiber / copper / signal), registered in the geometry gate, the tab-set table and the

line-model probe; the link table's ↔ rows now tag both endpoints. Every gated string and id is preserved

(layer labels, .network-topology, alarm-query controls, capacity basis).

Gates: ICT operator architecture, ICT/data-hall runtime, secondary authority, geometry 0/0 (default segment),

legibility strict, conv coverage STRICT (4/4 traced), alarm runtime, explain wiring, basis drawer,

anti-vibecode strict, line-model 19/19.

Water system: the make-up path, a real booster train, and traceability on the drawing (Track B, owner comment 16)

Owner: "mimic poor, parameters must be wired with traceability, cards are AI design slop"; ledger DCUI-010:

*"pump harusnya ada 2 ada duty dan running, make up waternya juga nggak jelas, rancang modalnya dengan proper …

sangat accurat dan HD dan engineering."* Measured: the drawing ended in a black "Make-up Water System" box

although conv-engine.js adopts water-cooled centrifugal chillers rejecting to an evaporative cooling tower

(cooling.chiller_type) and publishes the tower balance (evaporation 447.8, blowdown 149.3, drift 3.00,

make-up 600.0 L/min at 4 cycles); the two pumps were play-button glyphs without valves; no valve, check valve or

instrument existed; not one number inside the SVG carried a registry hook; the KPI hero, scope pills, severity

chips and note boxes used tinted washes, dashed frames and 3–4 px rails.

Now #water-svg (1180 × 520) draws: FM-101 meter + isolation valve → TK-101 raw tank (LIT; 150 m³, sized as

4 h of the engine's total treated flow and declared as such; autonomy printed from the engine flow) → FLT-201

with inlet/outlet PI and DP, XV-202 backwash to the drain header → booster train P-301A DUTY · RUNNING /

P-301B STANDBY · AVAILABLE as ISA centrifugal-pump symbols with suction isolation, discharge check + isolation

valves, PT-301 → DOS-302 dosing pump injecting at the tee → UV-401 → treated header → TK-402 (FT-402 service

branch, autonomy) and the cooling make-up branch (FM-501, LCV-501) into CT-501 cooling tower cell + basin

with evaporation and drift leaving the cell, XV-502 blowdown to drain, and the condenser-water loop to the

chiller plant at the engine's 32.0 / 37.0 °C rejecting 31,250 kW; one drain header carries backwash and

blowdown. Twelve tagged lines (two new, cw_supply / cw_return). Traceability on the drawing: ten values

(treated total, make-up, evaporation, blowdown, drift, domestic, cycles, CDW supply/return, heat rejected) are

data-basis-param hooks with an evidence mark coloured from the registry through rz-evidence.js, placed from

the text's own bbox after layout, hidden when authority is missing; a BASIS legend is drawn once. Click on any

equipment opens the shared right-side inspector with the A5 payload shape (Live / Capacity / Deps / Alarms /

Trend / Maint), engine rows hooked, simulated and authored rows declared. Cards: 2 px semantic rails, 1 px

hairlines, no washes, no dashed frames, outline chips. Fail-closed contract unchanged (every gated id and

string kept).

Gates: cooling/water UI, geometry 0/0, legibility strict, conv coverage STRICT (22/22 traced), basis drawer

(108 hooks), line-model 12/12, hall scope, alarm runtime, explain wiring, document parity, snapshot binding,

cockpit regressions, anti-vibecode strict.

Fuel system: a process diagram where there was none (Track B, owner comment 15)

Owner: "fuel-system same" (mimic poor, not a readable P&ID). Reviews doc-17 §3.5, doc-18, doc-19 §8 and the

ledger's DCUI-009 (preserve the visual baseline, improve the engineering content). Measured: the page had **no

process drawing at all** — the only <svg> was a 200 × 56 sparkline; the "flow path" was five Font Awesome

glyphs joined by four arrow icons; no pipe, valve, header, return line, containment geometry or genset symbol

existed anywhere; zero line-model adoption.

Now a full-width Fuel Process panel heads the cockpit with #fuel-svg (1180 × 452, water-system idiom:

muted base pipe + medium-coloured flow overlay + junction dots + arrowheads): fill coupling XV-101 → UST-01 in

its bund (LIT/TIT, level fill, usable reserve, LDS-101 interstitial and LS-102 sump leak points) → strainer →

P-101 duty / P-102 standby with isolation and check valves → PT-101 / FT-101 → transfer header → XV-A/B/C

solenoids → DT-GEN-A/B/C day tanks (level fill, LS) → GEN-A/B/C with drip-tray leak points; FPU-01 side-stream

(prefilter → coalescer → fine filter, DPT-201 / WIF-201) returning to UST-01 on a return header that also

carries the day-tank overflow. Fourteen lines carry line-model metadata (fs-*), fail closed at first paint

(data-state="unavailable", hairline dashes) and are re-stated every second by renderPid() from the same

deterministic state the cards use: pump run → suction, discharge, header and the running day tank's feed

flow; running genset → its supply line flows at the engine's facility burn; polishing loop follows the FPU

interlock; leak points follow the containment interlocks. renderUnavailable() blanks the drawing with the

page. The existing flow-path ribbon and every gated id are kept under the drawing. Registered in the

geometry gate (#fuel-svg), the tab-set table and the line-model probe (fuel-system.html: 14). Reduced

motion keeps the state readable (flowing solid, stopped dim). Every drawn value is either the engine's

bulk-tank level/usable reserve or declared simulated state (one declaration on the drawing root); the engine

still publishes no pump schedule, day-tank sizing or instrument reading, and the page says so.

Gates: fire/fuel operator, conv coverage STRICT (26/26 traced), geometry 0/0 on the new drawing, legibility

strict, line-model 14/14, alarm runtime, basis drawer, explain wiring, document parity, snapshot binding,

cockpit regressions, anti-vibecode strict.

Fire system: a readable P&ID with a detection layer (Track B, owner comment 14)

Owner: "fire-system mimic poor, flow animation lacking, not a readable P&ID." Measured: the drawing was a

tank, three pumps and thirteen bare pipes with no valves, no check valves, no instruments, no arrowheads and

no detection side at all — the FACP, VESDA, zones and manual stations the cause-and-effect matrix talks

about were words in a table; at stage 0 nothing on the screen moved, so a live system and a dead one

rendered identically; every pipe label was 9 px.

Now #fire-svg is recomposed in three layers on a 1400 × 770 sheet. Detection & control (top band):

FACP-01, VESDA-01/02 with a sampling pulse, five zone chips (Hall A–D, Electrical) each with spot smoke

and heat symbols and a state line, MCP-01 / ABORT-01 — all driven by the same stage machine as the water

train (NORMAL → VESDA ALERT → SMOKE PRE-ALARM → FIRE CONFIRMED → ARMED → RELEASE → LOCKOUT on Zone 1;

UNAVAILABLE at first paint and whenever fire authority is missing). Fire water: landlord make-up →

TK-FW-01 → suction header with isolation valves and a PI → FP-01 / JP-01 / FP-02 each with check valve and

isolation valve → PSL/PSH on the jockey line → discharge header with PT, PRV, a test header (FE) to drain

and an FH/HR riser branch → wet-pipe zone valves (alarm check + FS + TS per zone). **Pre-action / inert

gas**: N2 generator → supervised header → five PACVs with solenoid, PS and FS (double interlock). Every

pipe end carries an arrowhead; the jockey line breathes at stage 0 (pressure maintained), the fire paths

run red from confirmed, the N2 paths amber at release; pump state labels follow the pump (RUNNING / AUTO /

STANDBY) instead of a static string. Tooltips for FACP, VESDA, MCP, tank, WAV and PACV banks. All 13

tagged lines, the three centrifugal-pump symbols, every label-*-state id and the staged simulation

contract are unchanged; every new numeral sits under a declared authored basis (the engine publishes no

hydraulic sizing or per-device state). Gates: fire runtime authority, fire/fuel operator, conv coverage

STRICT (27/27 traced), geometry 0/0, legibility, line-model ≥14, alarm runtime, basis drawer, document

parity, anti-vibecode strict.

Chiller plant: the outlet reaches the CRAH coils (Track B §B3, owner comment 13)

Owner: *"chiller-plant colouring inconsistent, mimic poor, outlet stops — should continue to DAHU/CRAH

with their performance and flow on the same screen, add per-equipment pressure/flow."* Measured: the

drawing had no headers at all — the four branch drops rose to coordinates of headers that were never

drawn (HDR_CHWS_Y/HDR_CHWR_Y consumed, never rendered), so every train ended in a SEC OUT / SEC IN

box in empty space; 153 distinct hex colours and 39 rgba values against 16 tokens, the same red and amber

authored in two tones each, and the line-model's chilled-water palette overridden to grey currentColor

at all four call sites; the air side — which conv-engine.js already publishes (crah_running/installed,

crah_unit_sensible_kw, available and N+1 capacity, supply/return air, hot aisle, air-side ΔT, coil

approach, CHW ΔT) — was rendered nowhere.

Now the two primary collection headers are drawn (CHWS 19.4 °C / CHWR 27.0 °C, tagged line-model

lines), continue as risers down the right margin into a DISTRIBUTION & AIR-SIDE band: a secondary CHWS

distribution header (IT-reference flow, calculated · not metered), a secondary pump station (duty /

standby, declared simulated), and four hall CRAH banks — each with its branch and isolation valve

from the supply header, an EC fan wall, a coil, a control valve on the return, and the engine's numbers:

unit sensible duty, available and N+1 capacity, hall IT load and racks (hall snapshot), supply / return

air, air ΔT, hot aisle, CHW coil ΔT and approach, the hall's CHW share (IT-reference flow ÷ halls, an

identity) and the header temperatures in and out — then the return header back to the plant. The canvas

grows downward (viewBox 1460 × 1930) so nothing shrinks. Per equipment: each primary pump now prints its

flow (the branch reference, under the same distribution declaration) and differential pressure, each

chiller its condenser-water flow (an identity over tower rejection ÷ 4.186 × range ÷ running machines,

declared) and evaporator DP. Colour: one chilled-water palette — supply cyan, return amber, condenser

water violet — the line-model's, shared with every cockpit; status colours in the builder come from the

tokens and are never re-typed. Tagged semantic lines on the page: 16 → 30 (probe-line-model

target 18). Gates: conventional coverage STRICT, geometry STRICT (0 collisions, 0 clipped at 8 passes),

legibility STRICT, operator-cockpit regressions, cooling/water UI, alarm runtime, basis drawer, hall

scope, document parity — all green.

Known, not in this ship: probe-line-model (not a ship gate) reports the AI page's SLD semantic lines

(dh1-semantic-*, v2.0.0) without from/to/medium — a Track A follow-up.

Changed — the Data Hall plan is drawn per rack again: 40 rows × 22 racks in two banks (owner 2026-09-07)

The v2.0.0 rebase drew the 880-rack hall as ten strips of 88 ticks; the owner's verdict was blunt —

*"ini harusnya per rack … per row itu cukup max 24 rack … distribusi CDU ke rack juga nggak ada

garis-garisnya."* The hall geometry leaf is re-adopted from the engineering, not the drawing: **one row =

one RPP group of 22 racks (13.2 m at 0.6 m pitch), two banks of 20 rows at a 3.1 m row pitch fill the

62 m length, and 2 × 13.2 m + a 4.6 m cross aisle fill the 31 m width** — geometry.rows 10 → 40,

new geometry.banks 2, engine publishes rows_per_bank and racks_per_bank (integer by construction,

gated). The plan view now draws every rack as its own clickable block (a plain click opens the rack HMI,

Shift+click the inspector; new rack-unit payload class with the rack's IT load, feed current, TCS flow

and planes, its RPP group and fire zone), hot-aisle containment in pairs, the central cross aisle

carrying the TCS supply and return headers with one branch and isolation valve per row feeding a row

manifold with a QD pair per rack — the CDU-to-rack distribution lines that were missing — four **CDU

galleries** at the short walls (every one of the 108 CHx1000 units drawn and clickable, duty/standby from

the engine), and CRAH walls along both long sides (40 clickable banks, 179 units per hall). Floor plans,

the fire zone template (rows 1–10 / 11–20 / 21–30 / 31–40) and the electrical topology follow the same

geometry. In-rack: the manifold and QDs are drawn per rack; a second CDU inside the rack is not part of

the GB300 basis (CHx1000 end-of-row), so none is drawn — the CoolChip HMI stays reachable from the rack

manifold.

Changed — a click on a block opens its HMI modal again (owner decision 2026-09-07)

The v2.2.0 two-tier order (click → inspector, modal on demand) is reversed at the owner's request: a

plain click on any equipment block opens its HMI modal directly, as before v2.2.0; Shift+click,

right-click and Shift+Enter open the right-side inspector; classes without a deep mimic (fire points

and zones, network, BMS, rooms, roof) still open the inspector on a plain click. Payload mode, the

actions, the modal lifecycle and every gate stay; the runtime gates use Shift+click for the inspector

and assert that a plain CDU click opens #cduHmi.

Fixed — the data-mode notice no longer covers the tab buttons (owner comment 7)

Measured in dark theme at 1080–1680 px: css/rz-cockpit-instrument.css forced .hdr and .tabs to

position:relative; z-index:1 for its flat-field intent, but the page's base rule `.tabs{position:sticky;

top:44px} kept top:44px` — as a RELATIVE offset. The tab bar slid 44 px down over the content and the

"DATA MODE: SIMULATED · Legal & methodology notice" strip sat under the tab buttons on every cockpit in the

instrument register. Light theme was unaffected, which is why the earlier survey measured a 31 px overlap

"in dark only". .hdr and .tabs are removed from that rule; the two keep their sticky positions and

z-index on every cockpit. Also fixed: the v2.3.0 fire banner's display:flex beat the hidden attribute, so

a 41 px empty band sat above the tab bar on every tab while nothing was impaired; [hidden] now wins.

The Fire & Safety workstation: a list before a drawing (Track A §A6)

The owner's words on the fire tab were *"harus ada yang bentuk list … interlock ke lift, ke pintu2, ke

AHU, ke building" and "cannot isolate one detector in one room, reads as a process diagram"*; doc-27

§5.6, doc-24 §8 and doc-08 asked for the same things in detail (zone map, action chain, timer and inhibit

state, bypassed devices shown prominently, a fire/leak overlay on every page). Measured before this ship:

the panel's own primary read — "what is bypassed?" — had nothing behind it (#sbDisabled was a die

roll, #sbInAlarm / #sbFire / #sbLeak were never written), no point object existed, the twelve zone

rectangles carried no equipment hook, every fire state was frozen at normal because nobody passed a fire

context, the cause-and-effect engine's applyRuntime had no caller and evaluateFire() hardcoded

elapsedSeconds: 0, the alarm workspace held a private fixture with no append path, and the four VESDA

status circles had never rendered (class="ep" is the electrical sub-panel switch and is display:none).

The fire tab is now a workstation whose home screen is a point list. Four scoped sub-tabs

(points → zones → mimic → cause & effect, new classes — the electrical strip's handler is

document-global). js/datahall-ai/fire-points.js (DOM-free, deep-frozen, no clock, no die roll)

generates the point inventory for all four halls from the engine hall geometry × ADOPTED NFPA 72 spacing

(9.1 m spot smoke on two cross-zoned loops, 15.2 m listed heat, 7.5 m aspirating port): about 1,100 points

in 15 types — counts are formulas and are declared, never hooked, because the engine publishes no fire

quantity. Isolation is an operator act with rules, and the rules are the content: life-safety points

(manual call points, EPO, release and abort circuits) are never isolable; nothing is isolated while the

FACP is in alarm; an owner, a reason of ten characters and an explicit expiry are required; two extensions

at most. Dropping a clean-agent zone below two independent detection means is not refused — it is a

consequence the operator must acknowledge, after which the zone is IMPAIRED, its release is inhibited

(the CE-SUPPRESSION-ARMED row and the release interlock) and a fire watch is raised on every tab.

An expired isolation stays isolated, flagged, with its own record. Every act is an alarm-query record

(system:'fire', quality:'simulated', scenario:'training') appended to the Alarms workspace through

the new RZDatahallAIAlarmWorkspace.appendEvents() — the workspace is the isolation log (saved view

Fire). The register is a training register kept in this browser (localStorage, versioned, discarded

with a record when it fails validation, cleared with a record); no command leaves the page.

One snapshot per 4 s tick (evaluate(inventory, register, run, tick), pinned by window.__rzSimTick)

feeds everything: the point list (fire-point:<id> rows open the inspector with **Isolate… / Restore /

Extend…** actions — payload.actions.custom[], js/rz-inspector.js 1.46.0, named handlers in

window.RZDatahallAIInspectorActions; life-safety points show the action disabled with the reason), the

zone tiles (means available vs total, IMPAIRED / RELEASE INHIBITED / FIRE WATCH), the summary strip

(FIRE · VESDA · LEAK · EPO · DISABLED · MAINT · FACP COMMS · LAST POLL), the **page-wide banner above

the tab bar** (doc-27: fire/leak alarm overlays every page), the sidebar counters, the alarm-strip terms

(confirmed fire / discharge / EPO / wet leak = critical; impaired zone or expired isolation = warning;

maintenance = isolated count — the hardcoded maint:2 is gone), the mimic (zone rectangles are now

fire-zone blocks, ids in inventory format, chips print inventory counts, the exit stations became

manual call points and EPO sits in the electrical rooms per Tech Spec §6.9, the dead ticker became

RZDatahallAIFireMimic.paint(snapshot)), the equipment payloads (ctx.fire finally populated; a new

fire-point class; fire-zone reads means / impairment / release) and the cause-and-effect matrix (a

staged training run supplies real elapsed seconds, applyRuntime + release interlocks finally have a

caller, all 14 initiating events and 12 zones are selectable, and a status column reads DUE / PENDING

T-n s / BLOCKED). The isolation dialog is the workstation's only modal. The agent label follows doc-30

§10.5: clean-agent suppression — project selection pending.

Gates

tools/test-datahall-ai-fire-points.mjs (Node, 12): inventory is a formula (a smaller hall carries

fewer detectors) and deterministic; everything frozen; every refusal code; the two-means chain

(consequence → acknowledge → IMPAIRED + release inhibited + fire watch → restore clears); every record

valid alone and concatenated with the workspace fixture; tick-based expiry with an idempotent record;

static scan for Math.random / Date.now / bare new Date(); purity; ctxFire shape; ROW_INHIBITED

and a blocked release through the real engine; the stage model; persistence round trip that fails closed.

tools/test-datahall-ai-fire-runtime.mjs (Puppeteer, 12): scoped sub-tabs both ways; isolate through

the inspector and the dialog (focus trapped, submit gated, focus returned, record in the Alarms

workspace); a manual call point refuses with the reason; impairing Z12 shows FIRE WATCH on the cooling

tab with the strip and sidebar agreeing; suppression_release + the impaired zone reads BLOCKED; restore

clears; three reloads identical; a staged run turns pending rows DUE at T+60 s; ESC leaves no timer or

inert; zero Math.random calls; the register survives a reload and clears with a record; the coverage

walker finds no untraced numeral in the new views with an isolation applied. Coverage

--strict --settle=9000 --modals now walks the workstation views as rows: **5,010 numerals · 2,520 hooked

· 2,490 declared · 0 mismatch · 0 untraced**. Both gates are in tools/ship-gate.sh.

Docs

DATAHALL_AI_STANDARD "Fire workstation (§A6)"; BMS_SHELL doc-27 §5.6 / doc-24 §8 / doc-08 → SHIPPED;

ACCURACY_VALIDATION Rule 2 "states that are operator acts"; INSPECTOR.md custom actions + the duplicate

leak:dh01 note; PRD FR-45 – FR-48. rz-inspector.js served under one token (?v=2.3.0) everywhere.

Two-tier equipment inspection on the AI cockpit (Track A §A5)

Review doc-27 §3.2 asked, verbatim, that a click on equipment open the right-side inspector and that a

centre modal be reserved for a heavy action; doc-24 #6 and #10 (one inspector across every tab, one

selected-object workflow) had sat DEFERRED in BMS_SHELL.md since v1.134. Until now datahallAI.html

had one tier only: eleven centre modals over a blurred scrim, reachable from 5 of the 13 diagrams,

while Network, Fire, BMS, the roof and floors 2–3 had no click handler at all. Now every equipment

block on every diagram carries data-rz-equipment="<class>:<id>" (about 210 blocks across 13

diagrams and two floor views; 46 classes): a single click opens the right-side inspector in a new

payload mode (js/rz-inspector.js 1.45.0 — six tabs, status chip, dependency cards that navigate,

a sparkline, a provenance line naming the engine version, the scenario and the tick); **the deep

mimic is the explicit second tier** (Open equipment HMI, double-click or Shift+Enter, through named

openers in window.RZDatahallAIHmiOpeners). Network, fire, BMS, room and roof classes get tier 1 only

and say so. The inspector docks at ≥ 1440 px (<body data-rz-inspector-dock="1">, the page keeps its

content clear of it), overlays at 1024–1439, becomes a 55 vh bottom sheet at 768–1023 and a full sheet

below — the owner's 2026-08-26 ladder. Both tiers read ONE payload: js/datahall-ai/hmi-payloads.js

is DOM-free, every row is either registry-hooked at parity or declared with a reason, and

js/datahall-ai/equipment-inspector.js is the only click resolver (capture phase; clicks on a

traceability mark keep the §A3 basis mode). DHModal gained a panel stack, onClose hooks that run

on every close path, a timer registry (activeTimers() must read {} when the stack is empty),

inert on the background and a focus return that survives a re-rendered invoker — the mimic ticker

that kept running after ESC, and the battery-panel timer leak, are closed by construction.

Rule 2 at full depth: 741 die rolls, zero left

The page rolled Math.random 741 times: 351 R( + 357 RI( + 33 direct, about 600 of them inside

the 22 HMI renderers — 11 of which re-rolled engine quantities (TCS and FWS temperatures from the

retired GB200 planes, a chiller COP of 6.5–7.2, a transformer load bar at 72–84 % against an engine

99.9 %, per-rack kW at 126–138 against 142) and 6 of which coin-flipped a state (alarm badges,

UPS mode, leak zones, the fill pump, the STP blower). Every renderer now starts with

var P=RZ_HMI_P(class,id,hall,renderer) and prints P.v() / P.n(); states come from the

electrical scenario, the new #coolingScenario select (normal, cdu-pump-fail, chiller-trip,

leak-z07) or the fire engine; alarm badges come from RZ_ALM(P, point). Sensor-class values are

seeded: js/datahall-ai/sim-telemetry.js derives them from (point, 4 s tick) around an engine

plane or a declared rating, identical on every reload within a tick (window.__rzSimTick pins it for

the gates), declared on every cell, never hooked — no SIMULATED registry record is minted. The

generated manifest js/datahall-ai/hmi-points.js names the extra points each renderer prints. The

page-level R() / RI() helpers are deleted; the 68 declared page-ticker sites go through

RZ_SIM(site, lo, hi, digits), the same seeded law. Found on the way and fixed: the SLD cooling mimic

hooked per-bank glyph counts (79) to the facility ids (593 / 1,000); the floor-2 room wrappers had lost

their hooks to a missing >; the SLD results panel rendered table rows into a <div>; the rack modal

title still said GB200; the UPS mimic threw on its own feed variable; and the STP, AHU and dry-cooler

panels called .toFixed on text.

Gates

tools/test-datahall-ai-hmi-payloads.mjs (Node): every class returns a frozen payload with six tabs;

every hooked row equals the registry value at the printed precision or carries a declared reason of

40+ characters; no NaN; identical at the same tick, only simulated rows move at the next; ups_a_bypass,

cdu-pump-fail and leak-z07 produce their states; no Math.random, R( or RI( inside any

@rz-hmi marker block (26 blocks) or in the modules; fail-closed without an engine.

tools/test-datahall-ai-inspector-runtime.mjs (Puppeteer, tick pinned): a real click on the first

block of each of the 15 views opens the inspector in payload mode with six tabs and no scrim; Deps

navigation and the basis-cell round trip; Open equipment HMI on cdu / chiller / sld-tx / rack-psu

opens the panel with focus inside, background inert, Tab trapped, ESC closes with activeTimers()

{} and focus returned, the inspector still open beneath; the sldMimic → batHmi stack closes in

order; three reloads give identical inspector text; the ladder at 1440 / 1200 / 900 / 390; and with

--strict-rule2 a Math.random counter that must read 0 while each modal is open (it does: 4 / 4).

tools/test-dcai-coverage.mjs --modals opens the inspector for one block per class and every panel it

offers and walks them as rows: **4,757 numerals · 2,520 hooked · 2,237 declared · 0 mismatch · 0

untraced** across 13 diagrams, 2 floor views, HTML, 41 inspector rows and 29 modal rows — STRICT in

the ship gate from this commit. The walker gained includeInspector (header names and dependency

titles are labels). bldgSvg (floors are navigation) and elecOvSvg (an aggregate) are reported as

MONITOR rows in the runtime gate, never as clean. Registry regenerated (223 parameters, R7/R8 STRICT;

design.electrical.dry_cooler_fans_kwe now adapted as pbF_dryCoolerFans for the dry-cooler kW/ton

identity).

Docs

INSPECTOR.md "Payload mode" + adoption row; BMS_SHELL.md doc-24 #6 / #10 → SHIPPED; DATAHALL_AI_STANDARD

"Two-tier equipment inspection"; ACCURACY_VALIDATION Rule 2 "at full depth" (seeded simulated points

• the trap gate); prd/datahallai.html FR-29 widened to every equipment block. rz-inspector.js is

served under one token (?v=2.2.0) on all nine pages that load it. Not done: INSPECTOR.md still cites

conv review doc-17 §3.2 as a second source — that section is about EPMS symbols and status, not the

inspector; the citation is left in place and flagged here rather than silently rewritten.

Traceability symbols on every drawing of the AI cockpit (Track A §A3)

The owner asked for the symbol on the parameter — "dikasi traceability symbol juga di parameter" —

on the drawings, not only on the cards. Every engine number drawn inside the thirteen SVG diagrams of

datahallAI.html now carries a registry hook and a visible mark: a 2.2-unit circle on the value's

baseline coloured by the registry's evidence class (blue PUBLISHED, green DERIVED, amber ADOPTED,

violet SIMULATED …), emitted as ONE declared group by the new js/rz-svg-basis.js. A click on a mark

opens the right-side inspector in a new basis mode (js/rz-inspector.js 1.44.0) with the

registry record — never the centre modal that review doc-27 §3.2 forbade over a topology. HTML cells

keep the centre drawer and show the same dot. The evidence vocabulary lives once in js/rz-evidence.js

(ten classes; the drawer's private table had been missing LABEL and PUBLISHED, so 28 parameters

rendered a grey fallback until now). ACCURACY_VALIDATION Rule 6 is rewritten against the registry

taxonomy; DATAHALL_AI_STANDARD gains "Traceability on drawings"; INSPECTOR.md records basis mode.

The gate that sees a hook, and what it found

tools/test-dcai-coverage.mjs walks every visible numeral in the 13 diagrams (each tab activated,

both floor plans opened) and the HTML of every tab, and counts a number ONLY under a resolving hook

whose drawn string equals the registry value at an accepted scale, or under a declared

data-rz-authored-basis reason. Value-string coincidence counts for nothing. RED baseline on the

untouched page: 3,086 numerals · 199 hooked · 2,868 untraced. After the sweep: **2,923 numerals ·

2,282 hooked · 641 declared · 0 mismatch · 0 untraced** — STRICT from this commit, run with

--settle=9000 so every ticker has fired. tools/test-dcai-basis-hooks.mjs clicks one mark per

diagram and asserts the inspector, not the modal, opens with the registry value;

tools/test-dcai-basis-map.mjs proves the one field→id map (window.DH_BASIS) resolves, is complete

for every bo() read, and is at parity with the adapter. All three enter tools/ship-gate.sh.

What the hook-aware gate exposed that the v2.0.0 numeral gate could not:

• A live lie. The cooling P&ID ticker overwrote the engine planes every few seconds with GB200-era

rolls — 12/22 °C FWS, 35/45 °C TCS, a dry cooler leaving colder than the air, COP 6.5–7.2,

475–510 m³/h. The static draw was right and the live page was wrong. Retired; only declared

telemetry jitters now. The hall header ticker (12 °C / 500 m³/h), the SLD busway meters and the UPS

load jitter go the same way (Rule 2).

• Stale cards the denylist could not name. "8× modular UPS", "88× RPP 800A", "64 MW (8×8MW)",

"80MVA total", "~8,950 kVA | 12,900A", "Active Ports 512/512", "27dom", "36 GPU + 18 CPU + 18 NVS",

"4.8 m³/h (80 LPM) per rack", "4000A Cu Busduct", "24×RPP 630A", "FWS 12→18 °C", "Chiller 3/4 run",

"Approach −3.0 °C", "1400 EF", "253,440× B200" — every one rewritten on the engine or declared as

what it is. A LOW-COP alarm that compared the derived COP with a retired 6.0 threshold (and so fired

forever) now compares with the engine's own COP.

• A broken floor plan. Floor 2 threw F is not defined on every click since the v2.0.0 salvage

merge; nobody had measured it. Fixed, and both floors are measured rows now.

• The dash PUE tile still showed the static 1.30 until the hall tab was opened. It is — until

painted and hooked to pue.design_day.

Engine (v1.1.0, additive)

Per-hall slices of the electrical terms (design.electrical.*_hall_kwe), per-hall flows

(design.flows.tcs_hall_lpm, tcs_rack_lpm, htw/chw_hall_m3h), ups_dist_loss_kwe,

ups_loading_normal_pct (each 2N side carries half), equipment.crah/cdu_duty_per_unit_kwth,

cdu_flow_per_unit_lpm, battery_hall_kwh, gensets_standby, transformer_loading_pct,

power.shelf_kw, geometry.rack_it_row_kwe — each with an identity in tools/test-dcai-engine.mjs,

so a drawing marks the quantity it prints instead of dividing a facility figure itself. Registry

200 → 223 parameters, R7/R8 still strict. The page pin, the three ?v= tokens and the authority test

move to 1.1.0 together (feedback_engine_version_pin_blanks_cockpits).

Honest boundary

The mark states evidence class, not correctness. The five HMI modals are not measured by the

coverage gate (they are not open during measurement) — their remaining randomised readings are Track

A §A5 work. Marks on the Conventional cockpits are a separate change. Legibility monitor on the page:

788 → 785 findings (the marks are not text; the delta is the repaired floor plan being measured).

The AI cockpit now runs on the GB300 / 500 MW basis — MAJOR

datahallAI.html no longer loads the GB200 engine pair. It loads js/dcai-model.js,

js/dcai-engine.js and the generated registry twin js/dcai-parameters.js, all pinned at the

engine version the authority block checks; the retired pair stays on disk byte-frozen under the ship

gate and still proves its own 57 worked examples. Every number the page renders — sidebar, KPI strip,

building isometric, floor plans, hall mimic, rack architecture, cooling P&ID, five electrical SLDs,

network fabric, the Basis-of-Design drawer, both PDFs and the FAQ — is now read from

DCAI_CALC.snapshot. The published IT moves from 14.26 MW to **499.84 MW rack IT / 539.05 MW total

IT, GPUs from 7,776 to 253,440, and the PUE from a tuned 1.30 to a derived 1.165** (design

day) with the free-cooling cliff stated on the page.

A gate that could not exist before this release

tools/test-datahall-ai-no-retired-literals.mjs denylists every NUMERAL of the retired basis

(3,564 / 14.256 / 7,776 / 54 racks / 27 NVL72 / 132 kW / 66 kW / 350 kW / 9 run / 12 installed /

4.5 MW / 5 MVA / 6300 A / 3516E / 2.75 MW / COP 6.8 / Scenario A / rack-pos …). Proven **RED at 456

hits on the pre-switch page, CLEAN** now. The rule it enforces is the one from

feedback_binding_gate_blind_to_scope: a dead binding must never show a plausible retired constant.

The 204 DHE?…:'3,564'-style fallback ternaries were swept to '—' / null; the page already fails

closed when its authority is unavailable, so a fallback's only possible job was to lie convincingly.

What changed, by surface

• Authority. The hand-typed allow-lists (68 numeric + 15 string model paths, 28 function names,

33 state keys) are gone. The page validates the live snapshot against the GENERATED registry — every

id, with its type — plus the engine version, the model's spec version, and the ?v= on three

script tags. A renamed engine quantity fails closed; a new one is covered the day it exists.

tools/test-dcai-engine-version-pin.mjs asserts the four pins agree (the v1.134.23 blank-page

failure, prevented here before it can happen).

• Bind. DHE is now an adapter over the snapshot: ~60 legacy field names kept so ~200 read

sites keep working, each mapped and commented where its meaning changed (kwPerNVL72 equals

kwPerRack — one GB300 rack IS the domain; reqCurrentA is the LV GROUP current). Sixteen dead

fields deleted; cduInstalled and wue stop being literals.

• KPI strip and telemetry spine (WP4). Every cell carries data-basis-param and is painted by

one function, RZDCAIBasis, from the same dotted path the shared js/rz-basis-drawer.js explains

(the drawer's registry global is now configurable; the eight Conventional adopters are untouched).

The hand-written basisFor dictionary and its page-local drawer are deleted. #dkPue shows

1.165 in cyan (Rule 4) with annual / worst / target / gap beside it; #dkGpu and #dkDom are

written from the engine (they were static text); the two Math.random TCS "sensors" are the

engine's design planes (Rule 2). The 0.69 grid factor that lived in nine places is one model leaf.

• Electrical (WP2). js/datahall-ai/electrical-topology.js scales from 54 hardcoded racks to

the engine's 880 through 40 RPP groups of 22 racks (3.12 MW ≈ 4.7 kA on a 5,000 A trunk — the

grouping is an ampacity fact, published as distribution.*, not a drawing convenience). 2N /

DEGRADED / COMMON_SOURCE semantics unchanged; per-group fault counts; hall counts 880 / 3,520;

171 gensets modelled, 8 drawn. Tests derive every expectation from the snapshot.

• Diagrams (WP3). SLD per hall on the 40 groups with the trunk loading DERIVED; overview genset

bank with the facility pool counted; hall mimic as 10 row strips of 88 (≈ today's node count, not

6,000 rack glyphs); rack architecture redrawn for GB300 (18 compute trays, 9 NVSwitch trays, 8 power

shelves — 5 duty, N+3, 4+4 unachievable); cooling P&ID as banks with the cliff panel printing

both sides of the economiser inequality (HTW required 37.0 °C vs achievable 37.0 °C, margin 0.0 K,

cliff 34 °C) in place of a dry cooler that used to leave fluid colder than the air; floor plans and

the building isometric relabelled from the engine.

• Documents (WP5). BoD drawer, BoD PDF, Tech Spec and FAQ describe the plant the engine computes

— the COP is printed with its Carnot-fraction derivation, the busway with its loading, the gensets

as a facility pool of 4 MW machines (the 2.75 MW class was rejected by arithmetic: >200 sets). The

PDF's per-rack table became per-group. The GB200 basis survives only as a labelled retired

reference and in the platform selector as Retired GB200 split-domain basis.

• Registry. R8 "every parameter rendered or declared internal" flipped STRICT in this

commit, as its v1.136.0 flip condition required: 171 of 200 read by the page, 29 declared internal

with a written reason each (ambiguous-leaf twins the adapter reads under an alias, consistency

flags the gate asserts, per-bin values, null-while-free-cooling planes).

Honest boundaries

The building grid is still the retired-basis 72 × 48 m plot and says so on the floor plan: two

62 × 31 m halls and 270 UPS frames per hall do not fit the drawn rooms, and re-gridding the site is

its own change. The Network tab draws 27 representative racks and labels them as such (Track A §A7

redesigns it). The AI page is not yet in the coverage gate as a monitor; the coverage tool is bound

to the Conventional registry. 142 kW per rack is ADOPTED (NVIDIA publishes no rack power); annual

figures are ASSUMED (no TMY). Nothing was tuned: the PUE is what the declared terms produce.

Execution note

Six Opus agents were dispatched in worktrees and all six were terminated by a session rate limit

mid-task, on branches cut from main rather than the switched page. Their partial work was merged

one package at a time and completed by hand; the record is in the plan file.

Standards: ACCURACY_VALIDATION.md (Rule 5 rewritten for GB300 vocabulary; acceptance list

re-pinned), DATAHALL_AI_STANDARD.md (capacity table, LV grouping), manuals and PRD rewritten

against the snapshot. Ship gate: 57 gates; probe-accuracy-validation re-pinned to the snapshot and measured at 82/82 (AI-Test-3 inverted: at GB300 the page must NOT say rack-pos or 66 kW and MUST say 142 kW; TS-AI and BoD-AI assert the derived COP is printed with its Carnot derivation).

Added — a GB300 / 500 MW basis engine for the AI campus, built alongside the retired GB200 one

The owner asked (2026-09-05) for the AI/HPC facility at **300–500 MW IT, four halls, NVL72-class

racks at 100–140 kW or newer, and ruled that 500 MW means rack IT**, that the cooling basis

should be "the best", and that nothing may be invented to reach a PUE. That is a different basis,

not a parameter change, so it ships as a new engine pair — js/dcai-model.js (authored leaves,

every one with a // source: line and an evidence class) and js/dcai-engine.js (pure functions,

one frozen snapshot) — while js/datahall-model.js + js/datahall-calculations.js stay

byte-frozen under the ship gate and keep proving 57/57 against their own worked examples. They are

retired, the way conv-engine.js retired the 1.85 MW hall. datahallAI.html still loads them;

switching the page is the next ship (Track A §A2b) because it touches ~150 literal sites and ten

gate fixtures.

Basis: 880 racks/hall × 4 × 142 kW = 499.84 MW rack IT; fabric (7,040 switches at an

ASSUMED 4 kW), OOB and a 2 % storage/management allowance take the total IT to 539.05 MW.

Inventory follows the DGX SuperPOD GB300 reference architecture: 18 compute trays × (4 Blackwell

Ultra + 2 Grace), 9 NVLink switch trays × 2, 4 ConnectX-8 @ 800 Gb/s and 1 BlueField-3 per tray —

253,440 GPUs, 253,440 NICs at ~203 Pb/s, 63,360 DPUs. One GB300 rack is the NVL72 domain;

the GB200 page split a domain over two.

Why 142 kW is ADOPTED, not "official". The public GB300 NVL72 page prints no rack power. The

RA gives two bounds — 8 × 33 kW power shelves = 264 kW installed, and a 1.2 MW / 8-rack Scalable

Unit = 150 kW/rack all-in — and 142 sits inside both. Consequence the arithmetic states on its own:

duty is 5 shelves, redundancy is N+3, and 4+4 symmetric redundancy is unachievable

(4 × 33 = 132 < 142). The engine publishes that as a boolean rather than the page asserting it.

The thermal chain now has an outdoors

The GB200 engine charged a nameplate COP against 100 % of the heat with no economiser term, so its

PUE could not respond to weather and landed at 1.30 regardless. This engine free-cools the liquid

path whenever ambient + dry-cooler approach ≤ TCS supply − CDU approach, publishes **both sides

of that inequality and their margin, and states the cliff** — the ambient at which the liquid

path lands on a chiller.

Honest result on the adopted basis (TCS 40/50 °C, CoolIT CHx1000's published 3 K approach, a 3 K

dry-cooler approach, Jakarta 34 °C design dry-bulb): the margin at the design day is **exactly

0.0 K. The design point sits on the cliff. The 36 °C bin loses free cooling and needs 142

chillers against 36 at design. Design-day PUE 1.165, annual 1.158, worst bin 1.250, gap to

the 1.12 target +0.045** — inside the 1.12–1.25 band, and not 1.12. The largest non-IT term is the

air-path chiller, not UPS as the plan estimated: everything outside the rack (fabric, OOB,

storage, UPS and distribution losses, aux) is air-cooled through a chiller on a 46 °C dry-cooled

condenser. The one lever the engine names: a warmer TCS moves the cliff one kelvin per kelvin

(asserted by perturbation), and NVIDIA publishes no inlet envelope to say how far that may go.

Nothing is a typed kW: pumps are ρgQH/η over flows the heat sets, fans are Q·Δp/η over airflows the

heat sets, the chiller COP is a Carnot fraction over the actual lift with a ceiling, and every count

is ceil(duty/unit) plus a declared redundancy rule. WUE is zero by construction — no

evaporative term exists — so the dashboard's WUE 0.00 and free cooling are for the first time

the same statement.

A design finding the first run produced

The first snapshot sized UPS frames at 99.8 % loading, which no Basis-of-Design accepts. The

missing input was a design-loading ceiling; it is now an ASSUMED 80 % leaf, and the frame count

follows it. A model that reports its own bad answer is the point of building one.

Added — the parameter registry, second generation

data/dcai-parameters.json — 176 parameters (131 derived, 0 slack, 45 authored) — from

tools/build-dcai-parameter-registry.mjs. Four changes over the Conventional generator, because

this engine is not affine: every leaf is perturbed in both directions (×1.37 and ×0.73), at

two operating points (design and half a kelvin past the cliff); a third kind slack exists

for a parameter no leaf moves at design but one moves past the cliff (it measured zero here — the

design point is on the cliff, so bidirectional probing reaches the regime everywhere; the kind and

its gate stay); and provenance is read from the model file's own comments — a second

hand-maintained copy of the same source lines is where the six fictional CDUs found room to live.

Gates: tools/test-dcai-engine.mjs — 181 assertions, none a memorised output: identities,

energy balance at every weather bin, a positive dry-cooler approach at every bin, the cliff as a

step, and the snapshot following its inputs under perturbation. tools/test-dcai-parameter-registry.mjs

— schema, staleness, provenance (an authored number with no // source: comment fails), measured

wiring, scope, semantics; **R7 "every parameter asserted by a gate" is STRICT from day one at

176/176** — the Conventional registry carried 77 untested for four releases because its gate

reported instead of failing. R8 "rendered by a cockpit" is REPORTED with the flip condition written:

it goes strict in the commit that switches datahallAI.html.

Boundaries stated

A simulated teaching model. The climate bins are shaped, not a TMY — annual figures carry

ASSUMED and say so. Switch power (4 kW) is the softest electrical input and alone decides ~28 MW

of the total. Dry-cooler fan static (150 Pa) is the softest cooling input and moves PUE by ~0.03

across its credible range. Every equipment nameplate is ASSUMED pending Basis-of-Design.

Standards: DATAHALL_AI_STANDARD.md §v1.136.0 (basis, planes, registry, the flip condition);

ACCURACY_VALIDATION.md (Rule 5 status note and the retirement record). Ship gate: 56 gates.

Seven more §A rules, and what running them actually taught

v1.135.0 made the anti-slop audit a real gate and stated honestly that it covered 11 of the

standard's 26 rules. This adds seven — §A 7, 10, 11, 12, 22, 23, 24 — taking it to **15 gating,

3 monitor-with-strict-scope, 4 monitor-only, 2 render-hosted, 2 declared un-gateable**.

Four of the seven measure zero on today's tree and ship strict on arrival: standalone glowing

orbs, a raw white page background, a bouncing call-to-action, and a decorative hover that moves on

transition: all. Each was proven RED against a fixture before it was wired.

Three carry a real backlog and ship as monitors that are strict on the flagship surfaces —

index.html, styles.css, styles-index.css. Landing them strict site-wide would turn main red

on 220 files and the only available response would be to weaken them, which is exactly how this

tool came to be wired as ; true.

The instrument had to be rewritten before it could run at all

The obvious CSS-block extractor — /([^{}]+)\{([^{}]*)\}/g — is catastrophic here. At a nested

or unbalanced brace the inner [^{}]*\} fails and the engine backtracks the outer [^{}]+ one

character at a time across the preceding prose. Measured: 10.3 seconds on one 238 KB article,

and the whole-tree scan never finished. A linear scanner does the same job in ~2 s over 420 files.

It tracks enclosing at-rules on a stack. A first cut kept one running at string and never

cleared it when the wrapper closed, so every block after a @media print { … } inherited "print"

and was silently exempted. An exemption that leaks forward is worse than no exemption: the gate

goes quiet exactly where a page has the most rules.

Three findings that were the tool's fault, and were fixed rather than muted

• A print stylesheet is not a page background. article-7.html builds a PDF window with

'<style>body{…background:#ffffff…}' inside a JS string. Rule 22 now strips <script> before

reading <style>, and skips any sheet declaring @page — article-9-paper.html sets A4 with

2 cm margins, and printed paper is white. Demanding a token background there produces grey PDFs.

• The aurora hero is §B protected and is made of orbs. It is named aurora-* everywhere, so

the exemption is exact rather than a guess at opacity.

• .bg-orb carries none of the card/panel vocabulary. The orb rule had to stop requiring it.

Rule 11 fell from 93 files to 13 by getting more honest, not weaker

• State blocks. .card:hover { box-shadow: … } lists only what changes; the border is in the

base rule. Nine of the first fifteen flagship findings were correctly built cards read one state

at a time. The rule is about delineation at rest.

• Circles. A status dot's glow ring is its signal. border-radius: 50% is a shape.
• Images. A photograph or logo has no border to be delineated by.

Rule 23 was narrowed for the same reason. A first cut flagged .fp-arrow.active on

fuel-system.html — a P&ID flow indicator whose animation is the reading, telling the operator

the line is live. Deleting information from a process diagram to satisfy a marketing-copy rule is

not a win. It now matches a resting infinite bounce/float on a call-to-action, and nothing else.

Fixed — the flagship sweep

34 blocks across both stylesheets, edited in sync: decorative radii of 8/10/12/16/20 px moved to

var(--rz-radius) (4px — design.md:643, "4px says precision machined panel component"), and

3–4px coloured rails moved to the 2px semantic rail the editorial language prescribes. That

includes the five pastel bento cards, which keep their palette and lose 1px of rail.

Removed — two dead patterns the owner had already rejected

• .floating-side-card* — 132 lines in styles-index.css styling markup that lived only on

articles.html. That page loads styles.min.css, which never had these rules, so the block

rendered entirely unstyled: two bare links with loose dots and chevrons at the foot of the

page. The rotated floating side-cards are listed as a rejected pattern in CLAUDE.md. Markup and

CSS both gone.

• .gradient-orb* — the CSS half of cursor-tracking effect #47, whose JS was disabled in

v1.135.0. Cursor-tracking is also a rejected pattern; only half of it was removed.

Both stylesheets re-minified, audit-min-twins --strict green, ?v=2026-09-06-slop across all 160

stylesheet references.

Standard: standarization/ANTI_VIBECODE_STANDARD.md (coverage table + the monitor/strict-scope

contract + every exemption above, with the measurement that produced it).

Fixed — six CDU products in the engine did not exist

DATA.cduVendors shipped as a "CDU vendor specs database" sourced to "vendor datasheets 2024-25",

and data/cdu/cdu-vendor-specs.csv carried a quote column holding text written as if lifted from

those datasheets. Checked against the vendors' own published product pages:

Every flow_lpm, dp_bar, lead_weeks and cost_usd_per_kw attached to those six was invented,

and the six capacities sat neatly inside the gate's own [50, 600] kW band — which is why the gate

passed. A band gate cannot tell a sourced number from a plausible one. It only rejects the

implausible, and fabricated data is plausible by construction.

Replaced with nine products verified against the vendor pages named in each entry's url, and the

rule inverted: capacityKw and model are PUBLISHED and carry that URL; anything the vendor does

not publish is null with evidence UNAVAILABLE, never a stand-in. One flow figure survives —

CHx1000 at 1,500 Lpm — declared DERIVED, because CoolIT publishes 1.5 LPM/kW at a 3 °C approach

for that model and 1000 × 1.5 is arithmetic, not a datasheet reading.

Removed from the table entirely: per-model lead time and installed $/kW. Neither is a

product property — lead time is a market condition and already has a sourced home in

DATA.leadTimes.cdu_{americas,emea,apac}; installed cost is published by none of these vendors, so

it is absent rather than estimated. Carrying them per model is how six fictional figures got a place

to live.

Changed — the gate now checks provenance, not plausibility

tools/test-ltc-data.mjs §2 no longer asserts five numeric bands. It asserts that every entry names

a real product, carries an https:// vendor URL, declares an evidence class per numeric field, and

holds null wherever that class is UNAVAILABLE. It also asserts the six invented model strings

are gone, so the correction cannot silently regress. Bands are kept only as a sanity floor and

widened to the real market — 30 kW liquid-to-air to 2.5 MW in-row; the old 600 kW ceiling would

reject a shipping product.

499 assertions green.

Fixed — rz-engine.min.js was requested under three different cache tokens

58 pages asked for ?v=2026-09-05-mint, 6 for ?v=2026-08-01-opexfix, 2 for ?v=2026-07-26-h. One

asset in three cache entries means a corrected engine reaches a page only if that page's particular

token happens to move — the same class as the stale-min-twin bug, one layer up. Normalised to a

single ?v=2026-09-06-cdu across all 66 references.

Auto-link chain re-run: build-engine-catalog.mjs (53 namespaces, 235 functions, 162 sources),

test-value-bindings.mjs 85/85, test-rz-engine.mjs 763/763, audit-min-twins.mjs green.

Standards: standarization/SUPER_ENGINE.md §Z (every DATA value carries a source),

standarization/ACCURACY_VALIDATION.md (evidence taxonomy).

The anti-slop gate was never a gate

The owner kept finding AI-design slop on pages the anti-vibecode audit passed — most recently on

index.html itself. The cause was not a sloppy sweep. Two measurements:

• ship-gate.sh ran the audit as node tools/audit-vibecode.mjs; true — the exit code was

forced to 0. The standard has claimed since 2026-08-23 that it was wired as --strict. It was

not wired at all, and it had 2 live findings it was reporting into the void.

• The tool implemented 7 of the standard's 26 rules. Nineteen §A patterns had no detector.

Every sweep I ran fixed what the instrument could see, and the instrument covered 27 %.

So the gate is now genuinely strict, and the coverage table in the standard states honestly which

rules gate, which are monitor-only, which need a render, and which two can never be automated at

all rather than being given a detector that reports clean.

The card the owner pointed at, and what it was doing

.skill-item — the "Core Competencies" cards — rendered with five violations at once:

None of those five had a detector.

The design system existed only as a document

documentation/design.md prescribes --rz-space-*, --rz-line-tier-*, a 4px radius and a single

shadow level. Grep returned zero occurrences of any of them in the shipped stylesheets. The

system was never implemented, which is why every surface was hand-styled and drifted. This release

introduces the token layer — line tiers at 0.18 / 0.12 / 0.07, the 4pt spacing ladder, one shadow

level, one state-transition duration — into both stylesheets, and moves the cards onto it.

Three overrides that were silently undoing the fix

The sweep had to reach past the card definitions to blocks 700–2,600 lines further down that

re-applied what the pattern removes:

• #27: Card Depth Shadow Layers — five stacked shadows on hover, against a standard that caps

the site at one level.

• #29: Card Glass Morphism Intensify on Hover — the glassmorphism finding the gate was

reporting, applied on hover so it survived any fix to the resting state.

• A "glow" layer re-adding box-shadow + a coloured glow to .skill-item, .cert-item and

.experience-card on hover.

A sweep that edited only the first declaration of each selector would have looked correct in the

source and changed nothing on screen.

Two rejected patterns running live, invisible to any CSS rule

• #46: Grid Pattern Reveal painted a dot grid onto a canvas that follows the pointer.
• #47: Mouse-Reactive Gradient Orbs dragged three blurred colour orbs after the cursor on a

requestAnimationFrame loop.

CLAUDE.md lists dot-grid as rejected pattern #1 and cursor-tracking as #4 — and records that

cursor effects were already disabled in this same file (initCardTilt, initSpotlight). These

two were missed, and neither was findable by a stylesheet audit: one paints to a canvas, the other

is injected at runtime. Both disabled with the same early-return idiom, the code left in place as

history.

The owner's "jarak2nya" had a specific cause

index.html opened <div class="certifications-grid"> twice, both closing at the same point.

So margin-top: 2rem applied twice — 4 rem of dead space — the outer flex container held exactly

one child so its gap did nothing, and flex: 0 0 calc(33.333% - 2rem) computed its three-column

width against the wrong box. Underneath it, .cert-item was declared twice across a media

query: the first block set padding: 2rem and min-height: 200px, the second overrode padding to

1rem and left the min-height alone, so the box reserved vertical space for a padding it no longer

had. One wrapper and one declaration now.

Four guard rules, shipped strict on arrival

Terminal-window mocks, testimonial-shaped markup, the "it's not X, it's Y" copy formula, and

pricing-tier templates. All four measure zero today. They cost four regexes and no sweep, and

they exist so these cannot arrive the way the purple did — a rule added after a regression is a

post-mortem; a rule added before one is a gate. Proven RED against a throwaway fixture, GREEN when

removed.

Verified on the render, not in the source

Both themes: .skill-item at 4px radius, a 2px rail, a **1px hairline that did not previously

exist**, no shadow, transition: border-color. One .certifications-grid. Zero .gradient-orb.

Zero grid-reveal canvas. audit-dark-coverage --strict and audit-responsive-layout --strict both

still pass — a design sweep must not buy tidiness with contrast or layout.

Also: eight cockpit tabs entered measurement for the first time

datahallAI.html has ten tabs. Its default tab contains zero <svg> elements, and inactive

panels are display:none, so every render gate measured an empty set and reported the page clean —

audit-legibility.mjs has been running --strict against it in the ship gate the whole time.

New tools/lib/cockpit-tabs.mjs activates each declared tab before measuring, asserting rather

than attempting (the existing probe does if (btn) btn.click(), so a missing tab was silent),

waiting for a real layout box instead of a timer, and yielding two frames so any level-of-detail

pass has applied.

tools/lib/cockpit-audit-state.mjs gained a cockpitRootMeasurable clause: it cleared

body.locked, the overlays and inert, but not data-datahall-authority="unavailable", whose own

CSS display:nones the tab bar — so a probe could pass every check while measuring a hidden page.

Entry baseline, page untouched: 2,678 geometry findings (812 collisions, 1,780 labels below the

8.5 px floor, 86 clipped) and 565 legibility findings, where both gates previously reported

nothing. Both are wired as monitors for that page only with the flip condition written beside

them — failing the build on day one is how a gate gets muted, which is how the page went unmeasured

this long. Every other page stays strict.

The cockpits get the glossary — wired from the registry, not written into the pages

The eight Conventional cockpits carried zero data-explain attributes. They were the only

substantial pages on the site with no glossary access at all, which is backwards: they are the

pages that use "approach temperature", "cycles of concentration", "N+1" and "WUE" as ordinary

vocabulary, and an operator meeting one had nowhere to go.

Plan B2 asked for this with the mapping generated, and that is how it works. The registry

carries an explainKey per parameter; js/rz-basis-drawer.js applies it at render time. **No

page authors any text**, so a definition cannot drift between a cockpit and the glossary.

Two surfaces, deliberately kept apart. The basis drawer on the value cell says where THIS

NUMBER came from; the tooltip on the label says what the TERM means. Those are different

questions, so they never share an element — one element carrying both would have two panels

fighting over the same focus. 72 parameters carry a key; 48 tooltips wire across the 8 pages.

Two things went wrong while building it, and both are worth recording:

• A first version of the label resolver also accepted label, th, dt and .panel-title.

Those match EARLIER in document order inside a row than the cell's own label, so a hook

picked up the heading of the panel it sat in and datahall's wiring fell from nine to four.

A label selector that can match the wrong label is worse than one that matches nothing —

a tooltip on the wrong term is a wrong answer; a missing one is a gap.

• The new gate found four dead keys on its first run — chiller-specific-power,

fire-shortfall, fire-duration, hall-it-load — none of which exist in the glossary.

rz-explain.js skips an unknown key in silence, so a tooltip that never appears looks

exactly like one nobody asked for. Repointed at the terms that actually define the concept

(cop, fire-suppression, it-load) rather than inventing entries to match the keys.

tools/test-conv-explain-wiring.mjs (new ship gate) asserts the keys resolve, the modules load

in the right order, every declared tooltip actually becomes a trigger in a real render, and no

element carries both attributes. Proven RED on a deliberately dead key, then GREEN.

Two Plan B2 gaps closed

• BOUND_PATHS is derived from the registry. It was a hand-maintained list of nine

paths, which is the wrong shape: a list someone must remember to extend falls behind the

moment a page binds something new, and the paths it checks are the ones already least likely

to be wrong. It now covers 132 — every parameter the registry says a cockpit reads —

without anyone maintaining it. (hall. is a scope prefix, not a snapshot branch; those

resolve against the hall snapshot, or every one would report as a phantom key.) The FORBIDDEN

list stays hand-written on purpose: nothing can derive "these keys must never come back" from

an engine that no longer has them.

• Doc anchors are generated and reported. Every parameter now carries docs[] — the files

under manual/ or standarization/ that name it by its snapshot path. Prose that merely

mentions "PUE" is not an anchor for site.pue, because it cannot say which of several PUE

figures it means. Today: **38 of 138 documented, 100 outstanding, listed in full on every

run.** REPORTED, not enforced — about a quarter of the registry is younger than the

methodology pages that would document it, and a gate that fails from day one gets muted

instead of paid down. That is the same reasoning that kept the coverage gate a monitor until

it reached 100 %; the flip condition is written next to the check.

100 % — every number on all eight Conventional cockpits is accounted for

The coverage gate walks the rendered DOM and asks of each number a human can read: can the

parameter registry explain it? It started this programme at roughly 24 %, stood at 54.3 % this

morning and at 79.1 % after v1.134.23. It now reports 189 / 189 traced, with 831 further

numbers in regions DECLARED as authored page basis, each carrying a written reason.

dc-conventional 100 % datahall 100 % chiller-plant 100 % water-system 100 %

fire-system 100 % fuel-system 100 % ict 100 % EPMS 100 %

The gate is now STRICT. The flip condition written into ship-gate.sh when this began has

been met, so it fails on the first untraced number rather than reporting one. Reaching 100 %

is worth little if the next unbound literal can walk back in unnoticed; proven by

reintroducing one (1234.5 kW on the EPMS status strip — RED, exit 1) and removing it again.

Seven more quantities published, and a target that was pretending to be a value

The water cockpit split the cooling-tower balance itself: cycles of concentration and the

drift allowance were authored on the page, so the evaporation and blowdown an operator reads —

447.8 and 149.3 L/min — followed from the engine's makeup flow but had nothing to trace to.

Both constants and all three results moved to the engine, along with WUE evaluated on the

whole treated flow.

Worse was the WUE target. 1.30 was typed as a literal in four places on that page and

compared against a computed WUE to decide whether the KPI turns amber. That is precisely the

marketing-target-versus-derived-value confusion ACCURACY_VALIDATION Rule 4 forbids, and it was

four independent copies of the same claim. It is published as a target, read once.

The rest was classification, not arithmetic

Most of the remaining backlog was never engine work, and saying so plainly is the point — an

undeclared number and a number that cannot be derived are different problems:

• Equipment nameplate data. A pump's rated duty printed from a datasheet (Viking L124A,

180 L/min; fire pumps at 227 m³/h and 75 kW) is a specification, not a measurement.

• Control setpoints and alarm philosophy. Fire-pump cut-in pressures, the low-pressure

alarm, day-tank fill bands, tank LOW / LOW-LOW lines, filter backwash and TDS limits. The

engine models the demand and the reserve that must cover it; at what level an operator

should be warned is a local decision no parameter carries.

• Simulated local state. Day-tank levels, bulk-tank level, treatment-train instrument

readings, UV lamp intensity, header pressure, breaker position counts. The engine models

loads, capacities, the thermal chain and the water balance; it publishes no switchgear

schedule and no treatment-train schedule.

• Viewport state. Zoom percentage says how large a drawing is on a screen. There is

nothing in a data-centre model that could determine it.

Each is declared where it applies, with its own reason — never a blanket over a panel that

also carries engine figures. The fuel inventory table declares its DT- rows and leaves the UST

row counted; the genset cards declare level and volume and leave the load cell counted; the

fire pump cards declare the nameplate and the setpoint lines and leave the state alone.

Four more things the extractor was counting that are not measurements

A semver (conv-engine v2.2.0 read as 2.1), a source citation (lines 133–147), an equipment

designation with a trailing letter (L124A), and the shared auth modal that appears on every

page of the site. Each pushed the reported figure down while pointing at nothing an engineer

could fix — and a backlog full of those is how a coverage number stops being believed.

Engine 2.1.0 -> 2.2.0

Additive again: seven published quantities, none removed. The version pins and cache tokens on

all eight cockpits moved with it — tools/test-conv-engine-version-pins.mjs, added yesterday

after exactly this bump blanked every screen, confirmed the set was complete.