chore: blog dead-weight purge + TIN-3914 exception (2026-08-28)

.gitignore

@@ -48,6 +48,6 @@ playwright-report/
 coverage/
 .lighthouseci/
 bundle-report.json
-packages/blog-agent/.agentuity/app.js.map
+packages/blog-agent/.agentuity/
 workers/dns-guard/.wrangler/
 .gstack/

AGENTS.md

@@ -37,6 +37,7 @@ re-read immediately before their credentialed mutation.
 | Surface | Workflow | Trigger class | Kill switch |
 |---|---|---|---|
 | CI proof (check/test/e2e authority) | `.github/workflows/ci.yml` | push to `main`/`dev` + same-repo PR | none; read-only proof consumed by the exact-source production and rollback lanes |
+| Post date validation | `.github/workflows/validate-blog-dates.yml` | same-repo PR to `main` touching `src/posts/**` | none; secretless read-only proof with no serving-state authority |
 | Production publish (Cloudflare Pages) | `.github/workflows/cloudflare-pages-production-v2.yml` | dispatch-gated (`cloudflare-pages-production-v2`, `deploy=true`, exact current-`main` SHA proven by canonical CI + private-CV authority); its `workflow_run` lane from CI is build-only | repo var `CLOUDFLARE_PAGES_PRODUCTION_ENABLED` (default false), revalidated immediately before publish |
 | Exact-PR parity build | `.github/workflows/cloudflare-pages-parity-v2.yml` | dispatch-gated (`cloudflare-pages-parity-v2`), build-only against an exact open same-repo PR head | none needed; `permissions: {}`, secretless, no deploy step |
 | Cache purge (one production URL) | `.github/workflows/cloudflare-cache-purge-v2.yml` | dispatch-gated (`cloudflare-cache-purge-v2`), one canonical non-root path per run; path-only, with no source SHA | repo var `CLOUDFLARE_CACHE_PURGE_ENABLED`, revalidated immediately before credential use |
@@ -74,6 +75,7 @@ re-read immediately before their credentialed mutation.
 - CI has two lanes. `build-and-test` runs hosted checks such as gitleaks, production dependency audit, lint, npm build, bundle reporting, and Lighthouse. `bazel-remote-gates` is the check/test/e2e authority.
 - Credentialed Cloudflare publication comes only from the default-branch-owned `.github/workflows/cloudflare-pages-production-v2.yml`; it publishes only on the exact typed repository-dispatch request for a current `main` SHA proven by canonical CI and private-CV consistency, plus the live kill switch. Exact-PR parity is secretless in `.github/workflows/cloudflare-pages-parity-v2.yml`. Review-shadow PR code builds without package or secret authority in `.github/workflows/shadow-source-build-v2.yml`; the default-branch `.github/workflows/shadow-source-publish-v2.yml` independently revalidates provenance before any package write. Shadow apply is unavailable: no v2 workflow carries an App key, private sender, or dispatch call. GitHub Pages is not CI/CD: `.github/workflows/github-pages-rollback-v2.yml` is a disabled-by-default, exact-main, explicitly confirmed repository-dispatch rollback path only.
 - `.github/workflows/production-health-v2.yml` runs every 30 minutes and sends ntfy alerts on failure. Treat a red scheduled monitor as production evidence, not noise.
+- Hosted-runner exception, recorded 2026-08-28: the v2 workflow estate pins `runs-on: ubuntu-latest` at 17 sites. That is a recorded exception to TIN-3914 (no `ubuntu-latest` since `ci-templates` v3.0.0), not compliance with it. Closing it means adopting `spoke-ci.yml@v3.1.0` in the week of 2026-09-01, which first needs a `jesssullivan-blog-nix` ARS in `Jesssullivan/jesssullivan-infra` plus a governed apply, `tinyland.repo.json`, and `.github/lanes.json`. Do not hand-migrate individual `runs-on` lines ahead of that adoption. (Count as of 2026-08-28 before the TSS shadow lane; the invariant is that a GitHub-hosted label is used only where no self-hosted pool serves that job class — assert it, do not re-count by hand.)
 
 ## Bazel And GloriousFlywheel
 

Justfile

@@ -59,35 +59,36 @@ validate-frontmatter:
 ingest-tinyland-posts:
     npm run ingest:tinyland-posts
 
-# Type check with svelte-check
+# Check authority: svelte-check, build smoke, package checks, CV sync
 check:
-    npm run check
+    npm run remote:check
+
+# Test authority: graph hygiene, contracts, unit, agent, Chromium smoke
+test:
+    npm run remote:test
+
+# E2E authority: Playwright Chromium
+test-e2e:
+    npm run remote:e2e
 
 # Validate redirects after build
 test-redirects:
     npm run test:redirects
 
-# Run Vitest unit tests
+# Run Vitest unit tests only
 test-unit:
-    npx vitest run
+    npm run test:unit
 
-# Run Playwright E2E tests (builds + serves automatically)
-test-e2e:
-    npx playwright test
-
-# Run a specific E2E test file
+# Debug only, outside the cache-backed graph: run a specific E2E test file
 test-e2e-file file:
     npx playwright test {{file}}
 
-# Run E2E tests with visible browser
+# Debug only, outside the cache-backed graph: E2E with a visible browser
 test-e2e-headed:
     npx playwright test --headed
 
-# Run all tests (unit + redirects + E2E)
-test: test-unit test-redirects test-e2e
-
 # Run full CI pipeline locally
-ci: check test-unit build test-redirects validate-frontmatter test-e2e
+ci: check test build validate-frontmatter test-e2e
 
 # =============================================================================
 # Changelog

docs/README.md

@@ -0,0 +1,14 @@
+# docs
+
+Live: `runbooks/dns-cutover-and-rollback.md` (read before any DNS or Pages
+change), `dns-architecture.md`, `blog-staging.md`, `blog-shadow-preview.md`,
+`blog-node-shadow.md`, `blog-editorial-taxonomy-2026-07-03.md`, the
+`tinyland-pulse-*` contract set, `plans/2026-07-07-blog-operating-priorities.md`,
+and `build-metrics.md` (superseded numbers, kept as the Vite 6 baseline).
+
+`archive/` holds write-once dated notes that nothing in the repo links to any
+more: the `tinyvectors-*` trio, `package-authority-audit-2026-04-16.md`,
+`blog-authoring-linear-investigation-2026-04-17.md`,
+`content-federation-truth-reconciliation-2026-07-14.md`, and
+`tinyland-static-post-pulse-ingest-2026-05-10.md`. They are history, not current
+truth — do not cite them as the live contract.

docs/build-metrics.md

@@ -1,5 +1,8 @@
 # Build Metrics Baseline
 
+> Superseded 2026-08-28: Vite 8 shipped (`package.json` pins `^8.0.14`). The
+> numbers below are the Vite 6.4.1 baseline, kept for comparison only.
+
 Captured: 2026-02-11 | Branch: `feature/sprint3-week8` | Vite 6.4.1
 
 ## Build Time