Fingerprint

Content delivery drift

Cache-busted probe of every chrome route's rendered prose against the on-disk source-of-truth. Whereas P58 audits headers and P48 audits file bytes, P59 audits the third orthogonal layer: what the visitor actually reads. The page fetches each chrome route via fetch(url, {cache:'no-store'}).text(), parses the response body through new DOMParser().parseFromString(html, 'text/html').documentElement.textContent, canonicalizes the result through the same seven-rule pipeline the on-disk bundle uses (strip <script> · strip <style> · strip HTML comments · strip remaining tags · decode named entities · decode numeric entities · collapse whitespace), then SHA-256s it and compares against the public/fingerprint/prose-sources.json bundle emitted at deploy time. Three way the comparison is done: on-disk prose hash (sha256 of the canonicalized disk source — what the visitor SHOULD receive) vs apex prose hash (sha256 of the canonicalized apex response — what the visitor ACTUALLY receives) vs meta-vs-prose (the <title> and <meta name="description"> content extracted from the apex DOM, cross-checked against the first 160 chars of the rendered prose — a drift here means the page advertises one thing and says another). Catches four bug classes no earlier inspector catches: (a) prose-injection drift — apex serves different visitor-visible text than the on-disk source claims (cycle-170 finding: Cloudflare email-obfuscation wraps the literal guest@hool.dev in /index.html and /portrait/index.html into <a class="__cf_email__">[email protected]</a> and appends the /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js script — visitor sees a different prose than the on-disk html); (b) prose-drop drift — apex serves fewer lines than disk (a deploy half-shipped, or a parent route blanked an inner section); (c) prose-add drift — apex serves more lines than disk (upstream proxy inserted an injected banner, header, or footer); (d) meta-vs-prose drift — <title> or <meta name="description"> describes one thing but the rendered prose describes another. Empirical baseline (cycle-200 PROPOSED): 6 chrome routes /, /work/, /colophon/, /fingerprint/, /receipts/, /stats/ expected to emit MATCH on disk-hash AND apex-hash AND meta-prose after the CF email-decode wrapper is recognized as a transparent envelope (P59 reports PROSE_INJECT with the wrap delta cited, not as a hard fault — same posture P48 takes on the byte layer; P59 is the prose-layer mirror). HOOL_P59_BUCKETS_BEGIN = [MATCH, PROSE_INJECT, PROSE_DROP, PROSE_ADD, META_DRIFT, FETCH_DOWN, NOT_BUNDLED]; HOOL_P59_PROBE_URLS = ["https://hool.dev/", "https://hool.dev/work/", "https://hool.dev/colophon/", "https://hool.dev/fingerprint/", "https://hool.dev/receipts/", "https://hool.dev/stats/"]; HOOL_P59_BUCKETS_END.

Idle — click "Probe all 6 chrome routes" or a preset to compute the canonicalized prose hash for each route and compare against the on-disk bundle.