Use bundled Python with -B and installed ReportLab4.4.9/Pillow12.3/pypdf6.10; Node22.23.1 and Playwright locally available. No new install/network/API/host change. Offline technical generate_resources.py --output /tmp/unique-directory rebuilds8SVG/8PDF/complete alternatives17outputs using exact held font prerequisites. Compare exact bytes against stored outputs; it does not render by copying old PDFs. Font files/notices are exact pinned unmodified upstream prerequisites.
Offline technical verify_pack.py is a default read-only inventory/source/semantic/link/PDF/engine gate. Optional --regenerate builds in a private temporary directory and compares17outputs. verify_engine.mjs independently expects state/control outputs and strict invalid rejection; verify_browser.mjs /tmp/unique-directory performs real isolated browser creation/changes/runs/stop/reset and captures full screenshots. No shared Browser/auth or assistant test. Python -B; Ruff --no-cache check and format --check only. Node asset files are .js; .mjs tests remain delivery-held.
Source snapshots/receipts/manifest are offline delivery-held technical records. Raw source/rights facts are reader-facing in crosswalk/source guidance. Counts/audit receipts are author computer evidence, not local/human/classroom certification. Independently inspect complete printed pages and helper views; a gate flag cannot substitute for those views. Root independently reviews/scopes commits from its separate checkout.