# v0.24.0 report-reference context validation Date: 2026-08-12 Release: 0.24.0 ## Scope This validation covers the v0.24.0 per-report external-reference context and section-traceability pass while preserving the accepted v0.23.0 compact global References representation, v0.22.0 delivery/cache contract, 109-route public surface, 49-report research authority, 42-entry source-bundle ledger, responsive media, accessibility/print behavior, clean URLs, and UAIX/taboo boundaries. ## Report-local reference traceability The local extractor still recomputes exactly: - **49** curated reports; - **3,932** external URL occurrences; - **1,900** unique normalized external URLs; - **1,070** normalized domain groups; - **2,014** unique normalized-URL-to-report relationships. For every report, the detailed line-aware extractor was compared to the existing report-local URL extractor and required to produce the identical normalized URL multiset and occurrence count. The detailed layer adds only nearest-preceding rendered-heading context; it does not change URL normalization or global evidence totals. Rendered report-reader checks require: - exactly one **References in this report** disclosure on each of the **49** report readers; - **2,014** report-local unique URL rows across the corpus, exactly matching the unique URL-to-report relationship count; - exact report-local occurrence counts on every URL row; - a deterministic section-key legend generated from the same shared collision-safe `md_heading_id()` helper used by report TOCs and section permalinks; - every emitted section fragment to exist in that rendered report; - every report-local domain backlink to resolve to one of the existing **1,070** stable fragments on `/research/references/`; - explicit zero-reference presentation for the **4** curated reports with no extracted external HTTP/HTTPS URLs; - server-rendered/no-JavaScript access to all report-local reference rows and section/global-index links. Across the rendered report-local rows, **2,019** section links are emitted. Section association remains lexical/structural occurrence evidence only. It does not establish that an external source supports every statement in a section, or that the source is current, correct, reachable, authoritative, or endorsed. ## Global References regression The compact `/research/references/` representation remains unchanged from v0.23.0: - raw HTML: **772,144 bytes**; - **3,932** occurrences; - **1,900** unique normalized URLs; - **1,070** stable domain fragments; - **2,014** URL-to-report relationships. The v0.23.0 67.1% raw-HTML compaction gain is therefore preserved. ## Report-reader local performance budget Deterministic v0.23.0-to-v0.24.0 raw response comparison across all 49 report readers: - v0.23.0 report readers: **62,112–162,463 bytes**, mean **112,438.8 bytes**; - v0.24.0 report readers: **63,078–198,320 bytes**, mean **136,276.7 bytes**; - added report-local traceability markup: **966–42,483 bytes**, mean **23,837.9 bytes**; - largest percentage growth: **44.7%**; - largest resulting report reader remains below **200 KB** raw HTML in the local renderer. Human-readable budget: `../performance/v0.24.0-report-reference-context-budget.md#v0240-report-reference-context-budget` Machine-readable budget: `../performance/v0.24.0-report-reference-context-budget.json` These byte measurements are repository-local comparison evidence, not field performance or deployed network-transfer measurements. ## Public route, metadata, and delivery regression The canonical sitemap remains **109** clean public routes with **8** image entries and **1** video entry. The regression suite checks all canonical routes for HTTP 200, one H1/main/footer, unique non-empty titles and descriptions, self-canonical identity, matching Open Graph URL, parseable JSON-LD, unique IDs/resolving ARIA references, named controls/image alternatives, release-aware `/assets/css/site.css?v=0.24.0` and `/assets/js/site.js?v=0.24.0`, and absence of local public `.php` navigation targets. Clean-URL coverage remains **230 redirect assertions**: 108 missing-trailing-slash variants, 108 clean-route `/index.php` variants, root `/index.php`, and 13 retained legacy root PHP endpoints. The v0.22.0 optional Apache delivery configuration remains guarded with `` and production module/cache/compression behavior remains unverified. ## Research authority preservation No curated research body or accepted glossary definition changed in this release. - **49/49** curated report SHA-256 values match `report-manifest.json`; - **49/49** original source SHA-256 values re-match available supplied task evidence by hash; - all 49 reports remain byte-identical to the accepted v0.23.0 package; - every curated report retains `#curation-boundary` and `#research-body`; - `report-manifest.json`, `includes/glossary-data.php`, and `source-bundle-intake-2026-08-12.json` remain byte-identical to v0.23.0; - the source-bundle ledger remains exactly **42 entries: 24 new-curated + 18 duplicate-existing**. ## Syntax, links, UAIX, and hygiene The final validation cycle passes: - **130/130 PHP files** through `php -l`; - native JavaScript syntax through `node --check`; - **7,738** rendered local path/fragment target combinations; - **316** repository-local Markdown links; - **101** durable UAIX pointer records with **100** declared section checks; - **325** explicit repository-path references in active UAIX records; - **46** rendered responsive-candidate occurrences representing **24** unique local candidate path/descriptor pairs, with declared widths checked against actual image widths; - the exact UAIX update URL once in each required owning file; - only inert `.keep` files in the two active handoff buckets; - zero taboo leakage outside the owning taboo record; - zero findings in the focused raw-secret marker scan. ## Evidence limitations This is repository/local-server validation. It does **not** establish external reference reachability, source correctness/authority/currentness, production Apache modules, HTTP compression, cache behavior, browser/network timing, Core Web Vitals, live DNS/TLS/redirect state, indexing, webmaster-console state, accessibility certification, or independently verifiable machine-execution provenance. No live deployment was performed. ## Next bounded action Create a deterministic release-integrity manifest plus a public Transparency integrity page that lets readers recompute package-file hashes while explicitly separating package-byte integrity from live deployment, authorship, external factual correctness, or autonomous execution. The full bounded task is stored in `.uai/next-recursive-prompt.uai`. ## Root-package validation A candidate root archive was clean-extracted into a separate directory and the same full validation suite passed again against the extracted bytes: 130 PHP files, 109 canonical routes, 230 redirect assertions, all report-local reference/section checks, global References totals/size, all 49 research authority hashes, bundle-ledger preservation, local links/fragments, UAIX pointers, taboo containment, secret hygiene, and media/delivery regressions. The archive uses direct web-root shape with no enclosing project directory. The final ZIP is rebuilt only after this validation report write-back and is re-extracted/rechecked before handoff; its final SHA-256 is supplied with the release handoff rather than self-recorded inside the archive.