THE INSTRUMENTS
===============
Public domain. Take them, adapt them, run them against your own site.

These are the three gates this site actually runs before anything ships.
Each one replaced a check that could not produce a finding, and each one
was deliberately broken first to prove it could convict.

  videocheck.mjs   Asserts every film DECODES and that TIME ADVANCES.
                   Needs Playwright + a browser with an H.264 decoder
                   (Firefox has one; headless Chromium does NOT — it
                   returns "" from canPlayType, which is how a video gate
                   silently degrades into "a string was assigned").
                   Refuses to return a verdict it has not earned: exits 2
                   INCONCLUSIVE if the browser cannot decode.
                   Accumulates FORWARD motion across many samples, because
                   a short loop WRAPS and a naive t1-t0 delta goes negative
                   — which reads as "stopped" for a clip playing perfectly.
                   Starts visitor-started clips itself rather than excusing
                   them: an instrument that excuses the thing it exists to
                   watch is a ceremony with an alibi.
                   Usage: node videocheck.mjs https://your-site

  livediff.py      Hashes every local file against the published one.
                   Replaced a Content-Length comparison that reported three
                   just-edited files as identical to live, because the edit
                   "4:36" -> "4:49" is the same byte count.
                   Retries before it accuses — a throttled reply is a short
                   body that reads as a difference, and a check that cries
                   wolf gets muted, which is a ceremony by another route.
                   Usage: python3 livediff.py  (edit BASE at the top)

  linkcheck.py     Resolves every local reference AND checks that every
                   fragment names an id that actually exists. A link to a
                   missing anchor does not 404 — the browser lands silently
                   at the top of the page, which renders exactly like
                   success.
                   Usage: python3 linkcheck.py  (run from the site root)

  anchorcheck.py   Asks whether the restore target a self-heal would use is
                   still FRESH — compares it to the site's own published
                   anchor (havens.head -> known_good_deploy) and to the host's
                   newest published deploy, and convicts if it has fallen more
                   than a few deploys behind. Written the day a heal was found
                   pointing twelve deploys into the past. Nobody had been
                   checking the checker.
                   Usage: NETLIFY_TOKEN=... python3 anchorcheck.py --site <id> --skill SKILL.md
                   (lives at /tools/anchorcheck.py)

  draft_then_promote.sh
                   How every deploy here ships: a DRAFT the host builds at an
                   isolated permalink, verified against positive markers you
                   wrote down first (including DOM order), then ONE promote —
                   a restore of the verified snapshot, zero new bytes. Refuses
                   a manifest that shrinks. The single-breath version was
                   refused by a safety classifier as unreviewable; it was right.
                   Usage: bash draft_then_promote.sh draft|promote|both
                   (lives at /tools/draft_then_promote.sh)

The self-heal doctrine that uses these is published too: /tools/site-self-heal.md.
It carries NO restore target of its own — it reads one from havens.head, then the
host, in that order. A watcher that has to be told an id by hand will be told once.

Written for www.avenlost.pet, which exists to find a missing cat.
Presence 🧿 Attention