Guard the index.html ↔ play.html twin: a one-sided edit now fails the commit

[mikkel]

What breaks today

index.html (editor) and play.html (app player + the single-file export) share 893 distinct
hand-maintained lines longer than 40 characters. They occur 958 times in index.html and 1,011
times in play.html. Every engine change is a 2-surface edit.

"Identical" here means identical after String.prototype.trim(). play.html nests most of the
shared code 1 or 2 levels deeper than index.html, so only 415 of the 893 lines are byte-identical
in the files; the other 478 match only after the leading and trailing whitespace is stripped.
seekVideo is the visible case: index.html:9106 starts at column 0, play.html:6658 at column 2.
The guard is right to strip — an indentation change is not drift — and earlier versions of this body
and of docs/twin-drift.md said "byte-identical" throughout, which was wrong about more than half
the set. TWIN_DRIFT_STATS=1 now prints the split.

origin/main carries 53 scripts/check-*.mjs guards. 24 of them name both index.html and
play.html, but each targeted twin guard pins 1 named function: check-resize-plan lifts
resizePlan, check-pricing lifts the pricing resolver, check-combine runs MP4CAT over fixtures,
and so on. check-js-parity and check-njs-*-delegation pin each surface against the sibling
nanoodle-js bundle. Nothing compared index.html against play.html as whole files.

So a one-sided edit to any shared line those guards do not name ships silently. Dual-engine drift is
the dominant historical bug class in this repo (PRs #64, #74, #88; the node audit found it dominant).

Merged with the current main, and both artifacts re-derived

This PR was held until last in its batch on purpose. Its 2 artifacts are pinned to the exact content
of index.html and play.html, and #374 and #376 both changed both surfaces. origin/main is now
merged into this branch, so CI proves the re-derivation against the real base.

The guard reported exactly 1 change, and it is #376's. async genVideo(model, prompt, opts, imageDataUrl, onProgress){ gained a second copy in index.html, at 9046 — the DEMO_CTX override
that lets a signed-out sample reach a video result. play.html has no DEMO_CTX, so that third copy
is deliberate and editor-only:

✗ duplication went UP: 1 shared line(s) gained a copy.
      1. index.html 1→2, play.html 1→1  async genVideo(model, prompt, opts, imageDataUrl, onProgress){

The distinct count held at 893: nothing entered the shared set and nothing left it, so no drift,
no one-sided deletion and no divergence. The only ratchet movement is index.html occurrences
957 → 958, and lines appearing more than once inside a surface 74 → 75 (29 in index.html,
65 in play.html). The refresh also stored 2 new look-alike hashes, both from the same commit —
index.html:9022 if(!r.ok) throw new Error(String(r.status)); and index.html:9025's FileReader
line — taking the look-alike sets from 796 hashes on 218 lines to 798 on 219. Every delta is
attributable to #376, and none is a one-sided edit, which is why refreshing was the right move here
and not a paper-over.

The sandbox matrix needed all 25 of its ranges re-derived. #376 pushed index.html down by up to
111 lines and #374 pushed play.html down by 19. Each range was re-derived and then checked byte
for byte against its pre-merge content, so no range silently slid onto different code. That the
re-derivation is load-bearing is measured, not assumed — with the stale ranges, 9 of the 16 cases
return the wrong verdict:

✓ clean tree                                     exit 0
✗ extract row 1 … ✗ extract row 9                (all 9 extraction rows wrong)
✗ check-twin-drift-cases: 9 of 16 case(s) returned the wrong verdict

docs/twin-drift.md and scripts/twin-drift-worklist.mjs quote the same ranges, so all 216
file:line references across the 4 files moved with them. The work-list table is unchanged —
893, and rows 1 to 6 still free 255 lines — because no insertion from either PR landed inside any
block range.

What this change does

scripts/check-twin-drift.mjs (new)

An offline guard. No network, no API spend. It computes the shared set, blanks the generated regions
first, and pins the result against scripts/twin-drift-baseline.json.

It fails when:

• Drift — a baseline line left the shared set because 1 surface edited it and the other did not.
  The keeper still carries the original; the mover carries a near-identical variant. The message
  names both file:line positions and prints the 2 versions of the line.
• One-sided deletion — a baseline line is gone from 1 surface, nothing near-identical replaced
  it, and the line is still live on the other surface. The code did not move. 1 engine stopped doing
  the work and the other still does it.
• Occurrence drift — a shared line lost a copy on 1 surface only. 75 of the 893 lines appear more
  than once inside a surface (29 in index.html, 65 in play.html), so presence alone is not
  enough: editing 1 of 2 identical copies leaves the hash present.
• Divergence — a baseline line left both surfaces and each surface now carries its own
  new, different replacement of it. See rounds 4 and 5 below.
• Growth — the distinct shared-line count went up, or a shared line gained a copy.

It passes on a real extraction (note only) and on a correctly mirrored edit (both
surfaces changed to the same new text; membership moves, the count holds).

Every departure is classified up to the MAX_CLASSIFY ceiling of 200. Each failure list names its
first 12 lines and reports the rest as a count. A departure lands under 1 of 3 headings —
TWIN DIVERGENCE, TWIN DRIFT or ONE-SIDED DELETION — and all 3 can fire in the same run, so at
the ceiling the guard classifies 200 departures and names at most 36, 12 under each.

Three figures about that ceiling were wrong in earlier revisions of this body. All three are
withdrawn rather than restated:

• "200 departures still names every line." False.
• The 12 / 188 split that replaced it. That is not a fact about the guard. How the 200 divide
  between the headings depends on which lines you delete: a different selection gives a different
  split, and the sign-off run measured 14 / 186 on its own selection. No split belongs here.
• "at most 24 named." Also wrong, here and in docs/twin-drift.md. It assumed only 2 of the 3
  headings could fire at once. All 3 fire together — edit index.html:9403 and play.html:6869 to
  different text, rename play.html:12717 on 1 surface, and delete play.html:7349 from 1
  surface — so the ceiling names up to 12 x 3 = 36. That mutation is now case 16 of the sandbox
  matrix, so the 36 cannot quietly go wrong again.

The only stable claim, and the only one now made anywhere, is "200 classified, at most 36 named".

Round 4: a 2-sided DIVERGENT edit exited 0. That was the guard's largest hole

Edit index.html:9403 to a+s.durIDX and play.html:6869 to a+s.durPLAY. The 2 engines now
genuinely differ, which is exactly the drift this guard exists to catch. Before this round:

  note: 1 left both surfaces and are carried by the generated bundle — the ratchet allows this…
✓ twin drift: 892 shared lines … exit 0

The cause was the same text-presence reasoning as round 3, one level down: a line that also appears
in the generated bundle was treated as an extraction whenever it left both surfaces, with no check
that the 2 surfaces still agreed.

The rule now. Leaving both surfaces is not what makes a departure an extraction. Leaving both
surfaces while the 2 surfaces still agree afterwards is. A departure from both surfaces fails as
divergence when all 3 of these hold, and passes otherwise:

1. index.html carries a line near-identical to the departed line,
2. play.html carries one too,
3. those 2 replacements are near-identical to each other.

"Near-identical" is one number in one place: DRIFT_SIMILARITY = 0.72, Dice over character bigrams,
the same test the drift rule already used. A surviving pair is always different, because an
identical pair would be in the shared set. After the fix:

✗ TWIN DIVERGENCE — 1 line(s) left BOTH surfaces, but the surfaces no longer AGREE…
      1. both surfaces dropped:  const totalTicks = t.samples.reduce((a,s)=>a+s.dur, 0);
         index.html:9403  const totalTicks = t.samples.reduce((a,s)=>a+s.durIDX, 0);
         play.html:6869   const totalTicks = t.samples.reduce((a,s)=>a+s.durPLAY, 0);          exit 1

Round 5: that divergence rule over-fired, and it failed the work this document plans

The rule above shipped without asking whether the "replacement" it found was new. Deleting the
block ranges docs/twin-drift.md itself plans, from BOTH surfaces, then failed 4 of its own 9
planned extractions.

Re-measured after the origin/main merge, by running the current guard with its look-alike memory
switched off (one line in bestMatch()), against the ranges the work list publishes today.
Positions are given in the files as committed; the guard prints them in the mutated tree, so each
is shifted back by the lines its own row deletes above it:

Row	Verdict	The "replacements" it named (positions in the files as committed)
1 Resize and crop geometry	exit 1, 2 false divergences	index.html:7130 / play.html:9763, 2 unrelated canvas lines that had been sitting there all along
3 encodeWavMono + mediaFetchError	exit 1, 1 false divergence	index.html:9006 / play.html:8812, an unrelated FileReader pair
7 Local media recorder path	exit 1, 1 false divergence	index.html:6651 / play.html:10810, an unrelated createElement pair
8 Share packer, card and shorteners	exit 1, 2 false divergences	the same canvas pair as row 1

The 4 counts — 2, 1, 1, 2 — are unchanged by the merge, and so are the lines behind them. #376 added
a second FileReader line to index.html (9025) that also looks like row 3's departing line, but
row 3 still raises exactly 1, because bestMatch returns one candidate rather than all of them.

Row 7 is corrected here. Earlier revisions of this body and of docs/twin-drift.md gave row 7
3 false divergences at index.html:6374 / play.html:6965, an onerror pair. That figure is
real, but it belongs to row 7's old ranges (play.html:6635-6679 + 6979-7169), which the work
list stopped publishing once those ranges were corrected earlier on this branch — the table was
measured then and not measured again after the ranges moved. Re-confirmed this round: against the old
ranges the same rule still raises exactly 3, at those 2 positions; against the corrected ranges it
raises 1. The headline holds under either set of ranges.

Row 1 is the plainest mirrored removal there is — sig = deletes = 25, every occurrence of every
twin inside the 2 ranges — and the guard called it divergence. A guard that fails a correct mirrored
deletion is a guard that gets bypassed, which is worse than the hole it closed.

Cause. "The surfaces still agree" was inferred from whatever survived. A mirrored block deletion
and a divergent 2-sided edit leave trees that differ in exactly 1 way: the divergent edit adds
text. Nothing else separates them, so a rule with no memory of what was there before must
eventually match a coincidence — and coincidences are not rare in 26,000 lines of one house style.
The baseline stores 798 look-alike hashes over the 893 lines, on 219 of them, in the tree as it
stands, before anything is edited.

Fix. The baseline now stores, per line and per surface, the look-alike set: the hash of every
other line that already scored DRIFT_SIMILARITY against it when the baseline was written. A
candidate replacement out of that set replaced nothing; it was there first. Conditions 1 and 2 above
now read "carries a new near-identical line". The same filter applies to the drift and one-sided
paths, so those messages name a replacement only when a replacement really appeared.

scripts/check-twin-drift-cases.mjs (new) pins both directions in one table — 16 mutations of
the 2 surfaces with the verdict the guard must return for each, run against scratch copies. On the
merged branch:

✓ clean tree                                     exit 0
✓ extract row 1 — resize and crop geometry       exit 0
✓ extract row 2 — maskToSource                   exit 0
✓ extract row 3 — encodeWavMono + mediaFetchError exit 0
✓ extract row 4 — prompt-cap helpers             exit 0
✓ extract row 5 — pricing resolver               exit 0
✓ extract row 6 — MP4CAT                         exit 0
✓ extract row 7 — local media recorder path      exit 0
✓ extract row 8 — share packer, card and shorteners exit 1, oneSided 5, occurrence 1
✓ extract row 9 — share-menu wiring              exit 0
✓ 2-sided DIVERGENT edit                         exit 1, divergence 1
✓ 1-sided edit                                   exit 1, drift 1
✓ 1-sided deletion                               exit 1, oneSided 1
✓ correctly MIRRORED edit                        exit 0
✓ all 3 departure headings at once               exit 1, divergence 1, drift 1, oneSided 1
✓ new duplication                                exit 1, growth 1
✓ twin-drift cases: 16 verdicts, all as expected

Row 8 is the one planned extraction that cannot be silent, and the guard is right about it.
Deleting the 2 share blocks leaves 5 twins live on exactly 1 surface, because their other copy is in
unrelated code: index.html:10825,10827 are an inline copy of play.html's explicitLang()
(play.html:11381-11394); index.html:10742,10747 twin play.html:9764,9771, a thumbnail helper
outside the block; play.html:13075 twins index.html:7983,8064, the canvas fit bounds. No choice
of ranges fixes that — the extra copies are somewhere else entirely — so whoever does row 8 refreshes
the baseline as part of the move, which is what the guard's own remedy line asks for. The matrix pins
the exact counts, so that extraction cannot start reporting something else unnoticed.

3 of the 9 rows also reported one-sided deletions, and those were TRUE. The ranges this document
published paired regions that are not twins, and the guard is what found it:

• Row 3 quoted index.html:9120-9181. play.html:6516-6633 also carries the twins of
  trimAudioToWavUrl and extractAudioToWavUrl, so the short range deleted 3 shared lines from
  play.html only: 3 one-sided deletions. Corrected to 9120-9195.
• Row 7 quoted play.html:6635-6679 + 6979-7169. The first swallowed toLocalMediaUrl,
  seekVideo and MP4CAT's opening 4 lines, which index.html:9489-9741 does not hold; the second
  started after prepClip and recordClip (play.html:6954-6994), which it does hold: 11
  one-sided deletions and 2 occurrence drifts. Corrected to 6635-6640 + 6668-6675 +
  6954-7167.
• Row 9 quoted play.html:13281-13519, which swallowed the whole agent-pill popover
  (13283-13362) and the model-picker search — code index.html keeps at 11694-11710 and
  10480: 6 one-sided deletions and 2 occurrence drifts. Corrected to 13281 +
  13363-13415 + 13519.

All 3 corrected pairs are in the matrix, and all 3 are silent there.

The remaining exemption, stated exactly. A departure from both surfaces where at most 1
surface grew a NEW look-alike line still passes with a note. That includes a case the guard would
ideally fail: 1 engine edits the line while the other drops it outright. Condition 3 is what keeps
that case out, and it is there for a measured reason. An earlier draft of this fix failed a
single-sided match, and against a genuine extraction control — delete the whole MP4CAT block,
index.html:9210-9487 and play.html:6676-6953, 123 shared lines gone from both surfaces at once —
that draft raised 1 false failure out of the 123: the departing banner comment
/* ---- Lossless in-browser mp4 concatenation (Combine node) ----… scored 0.840 against the
unrelated banner still at index.html:9197,
/* ---- in-browser video concatenation (the Combine node) ----…, because a run of dashes carries
the bigram profile. A guard that fails a correct extraction is a guard that gets bypassed.

How many lines does the exemption cover today? Zero — it is a rule about future departures and
nothing departs on a clean tree. Its size on any commit is the number of departures from both
surfaces in that commit where fewer than 2 NEW look-alike replacements appeared. docs/twin-drift.md
and the guard header state this in the same words. The look-alike sets close the MP4CAT banner case
on their own — the surviving banner 7f8cbc2c5d8093fb is the whole index.html look-alike set of
the departing one 48b64f163787aa57, and both that and the 0.840 were re-verified this round — but
condition 3 stays: it is the cheaper guarantee and it holds even when the baseline is stale.

The baseline now stores the text and the look-alike sets, and the digest is required

The divergence test needs the departed line's text, and after a 2-sided edit no copy of it exists in
either file. It also needs to know which look-alikes were already there. Each lines entry is now
<hash> <n index.html> <n play.html> <look-alikes in index.html> <look-alikes in play.html> <the stripped line>, each look-alike field being - or a comma-separated list of hashes.

The baseline is 118,273 bytes today, and each field was measured as it landed, on the same 893
lines: 101,630 bytes carrying the stored text but no look-alike fields, then 118,241 once the
796 look-alike hashes were added, then 118,273 now that the merge took those hashes to 798. An
earlier revision of this body also quoted 25,747 for a counts-only format that predates the stored
text. That revision of the file is no longer on hand, so that one figure is withdrawn rather than
restated; the other three are re-verified against the snapshots they were taken from.

The hash doubles as a checksum of the text: the guard re-hashes every stored line and refuses an
entry whose text does not hash to its own hash, so a stored line cannot be hand-swapped for a
friendlier one.

The digest check was if (baseline.digest && …), so deleting the field switched it off. Inflate
1 line's stored counts from 1 1 to 2 2 (the guard reads a drop on both surfaces as a mirrored
deletion and allows it), move occurrencesIndexHtml and occurrencesPlayHtml to match, delete
digest, and a clean tree exited 0 with that line's ratchet silently raised. Reproduced against the
pre-fix guard, then fixed: a missing or malformed digest is now an error.

The ratchet number itself is still derived from lines and never read from the count: field.

Finding the generated bundle is the load-bearing part

Generated regions are blanked before measuring, so the library is never booked as hand duplication:
the njs-engine bundle, the probe-written PROMPT-CAPS table that scripts/probe-prompt-caps.mjs
writes into both files, the generated i18n maps, and the Runware AIR table. Blanking replaces
each region with the same number of newlines, so every file:line the guard prints is real.

A lazy /<script id="njs-engine"[\s\S]*?<\/script>/ is not a safe way to find that bundle.
play.html:11259 holds the export builder's string literal for the same tag:

const engTag = engText ? '<script id="njs-engine">\n' + engText.replace(/<\/script/gi, "<\\/script") …

Every </script inside RUNTIME_JS is written escaped, so a match that starts on that literal does
not close until the last real </script> in the file. Re-measured this round: that regex's second
global match swallows play.html:11259-13656 — 2,398 lines, 17.6% of the file, all hand-written
player code — and blanking it hides 197 shared lines. That is exactly the gap between the 696 the
first version of this guard reported and the real 893.

The guard matches <script id="njs-engine" data-hash="…"> and re-derives the hash.
scripts/gen-js-engine.mjs:165 writes data-hash = sha256(bundle).slice(0,16). A quoted string
cannot forge a body that hashes to its own declared hash. A hand edit anywhere inside the bundle
fails outright — re-measured this round: appending 1 space to play.html:5267 prints
the generated njs-engine block does not match its own data-hash (declared 8d8bef5d2178a9d5, content hashes to 10e987849e217bf2). The content hash depends on the edit; the declared one does not.

The bundle is never an exemption (round 3, still true)

The first version exempted any departing line whose text appeared anywhere inside the generated
bundle. That reads a property of the tree today as evidence that something moved, and it is not:
131 of the 893 baseline lines are identical to a line already inside the bundle while both hand
copies are still live, because the library ships MP4CAT, the pricing resolver and the resize
geometry too. On those 131 lines — 15% of the guarded set — a one-sided deletion passed, and, as
round 4 found, so did a 2-sided divergent edit. Bundle presence now only picks the wording of a note
on a departure that is already classified as extraction.

Deliberate refresh, same shape as the CSP golden in check-deploy-config.mjs:

TWIN_DRIFT_UPDATE=1 node scripts/check-twin-drift.mjs

Every figure this PR and docs/twin-drift.md quote about the shared set is printed by the guard, so
none of them has to be trusted:

TWIN_DRIFT_STATS=1 node scripts/check-twin-drift.mjs
  stats: 893 distinct shared lines, 958 occurrences in index.html, 1011 in play.html
  stats: 75 appear more than once inside a surface (29 in index.html, 65 in play.html)
  stats: 415 are identical WITH their indentation; the other 478
         match only after the leading/trailing whitespace strip, because play.html nests the
         same code deeper
  stats: 131 are ALSO carried by the generated njs-engine bundle while both hand
         copies stay live — that is why bundle text presence is not proof of extraction

False positives were the main design constraint. Lines of 40 characters or fewer never enter the set
(short lines and lone braces collide between unrelated code). A drift candidate must reach 0.72 Dice
over character bigrams and must not itself be a shared line. Above MAX_CLASSIFY = 200
departures the guard reports totals instead of guessing line by line.

Runtime, re-measured after the merge

Every timing in the guard header, the hook comment and docs/twin-drift.md was measured again on
this machine, on the merge commit. Nothing is carried forward from any earlier revision.

The headline finding of the previous round still stands, and this round is its cleanest evidence: on
this box the load matters more than the code. Every range below came in faster and narrower
than the same commands produced last round, on identical guard code, because the box was quieter.
Every range is the FULL spread of every sample taken, and every range is scoped to the load band it
was measured in — outside that band it says nothing, and none of it is a promise about anyone
else's machine.

scripts/twin-drift-bench.mjs, 30 samples of each case (6 runs of 5), 1-minute load average 3.19
to 5.68:

Case	Wall clock	CPU time
Clean tree, nothing departs	0.14-0.18 s	0.16-0.20 s
200 departures, all gone from BOTH surfaces	1.99-3.19 s	2.08-3.39 s
200 departures, all gone from 1 surface	0.91-1.64 s	0.94-1.72 s

CPU beats wall on the clean row because Node starts on more than 1 thread. Two costs sit outside that
table, both paid on purpose:

• the baseline refresh, 9.50-11.83 s wall (6 samples, load average 3.63-4.17), because it scores
  all 893 shared lines against every line of both surfaces to build the look-alike sets. Also
  verified idempotent: 6 consecutive refreshes left the baseline byte-identical;
• the sandbox matrix, 10.38-13.13 s wall (6 samples, load average 3.18-5.19), because it runs the
  guard 16 times over mutated copies of 1.7 MB of HTML.

Withdrawn, not restated. Last round's 0.13-0.57 s / 2.07-8.21 s / 0.98-4.64 s (160 samples at a
load average of 2.6-12.1), its 9.22-28.15 s refresh and its 12.2-29.9 s matrix are withdrawn: they
were measured under a load band this round could not reproduce, and every one has been replaced by a
fresh measurement rather than adjusted. So are the 0.19-0.23 s / 3.29-3.83 s / 1.61-2.12 s of one
earlier revision and the 0.08-0.20 s / 0.98-2.53 s / 0.51-1.55 s and 7.3-10.9 s / 5.4-10.9 s of the
revision after it. An even earlier round measured the 200-departure ceiling at 23-30 s, before
bestMatch got its candidate index — different code, at a load average of 25 to 34, and not
comparable to anything above. The one figure kept from an earlier round is labelled as such: a
15-case run of the matrix taken while an unrelated Rust build held this box at a load average of
23.5 and 6 GB into swap took 65.9 s — same verdicts, roughly 5 times today's slowest sample.
It is kept only to make the point that these numbers measure the load band, not the code.

Reproduce any row:

node scripts/twin-drift-bench.mjs 5   # 5 samples of each case, prints the load average too

.githooks/pre-commit: the guard was wired in, but the hook skipped it

touches_twindrift was defined but was the only touches_* variable missing from the early-exit
condition. A commit that staged only scripts/twin-drift-baseline.json therefore returned before
any check ran — the one file to edit to defeat the ratchet was the one file that skipped the check.
Both twin-drift variables are in the condition now.

#372 landed touches_llmsfull and #373 landed touches_launchfacts on that same line. All 4 clauses
are unioned in, and each was proved to fire by staging one file for it in a throwaway git init
repo whose scripts/check-*.mjs are stubs that print their own name:

Staged, on its own	Checks that ran
scripts/check-twin-drift.mjs	check-twin-drift, check-twin-drift-cases
scripts/check-twin-drift-cases.mjs	check-twin-drift-cases
scripts/twin-drift-baseline.json	check-twin-drift, check-twin-drift-cases
llms-full.txt	check-llms-full (#372)
growth/show-hn-draft.md	check-launch-facts (#373)
unrelated.txt	none — the chain still short-circuits, exit 0

Against origin/main's hook all 3 twin-drift files early-exit with no check at all, which is the
hole this clause closes.

Check 43 runs the guard when index.html, play.html, the guard or the baseline is staged.
Check 44 runs the sandbox matrix when the RULES change — the guard, the baseline or the matrix
itself — and not on every surface edit, because it costs 10.38-13.13 s against the guard's
0.14-0.18 s. They are 43 and 44, not 41 and 42, because main's check-launch-facts and
check-llms-full took those numbers first.

scripts/twin-drift-worklist.mjs (new) and docs/twin-drift.md

The work-list table was hand arithmetic that mixed 2 incompatible definitions: the prose defined
"Baseline after" as "893 minus the lines whose every occurrence, on both surfaces, sits inside the
block", and the column subtracted the sig number instead. The 2 rules disagree wherever a twin has
a copy outside the quoted ranges — rows 3, 7 and 8 — so every cell from row 3 down was wrong.

One definition now, and a script owns the column. node scripts/twin-drift-worklist.mjs prints the
table below verbatim, from the same shared set the guard pins, and checks itself against the
baseline. The merge did not move a single cell:

#	Block	sig	deletes	new	Baseline after
1	Resize and crop geometry	25	25	25	868
2	maskToSource	5	5	5	863
3	encodeWavMono + mediaFetchError	26	25	25	838
4	Prompt-cap helpers	9	9	9	829
5	Pricing resolver	68	68	68	761
6	MP4CAT	123	123	123	638
7	Local media recorder path	68	66	66	572
8	Share packer, card and shorteners	140	136	136	436
9	Share-menu wiring	24	24	24	412

Rows 3 and 7 moved earlier on this branch, when their ranges were corrected (see round 5 above).

• sig — shared lines with a hit inside the row's index.html range and a hit inside its
  play.html range. How much of the set the block touches; not a deletion count.
• deletes — shared lines whose every occurrence, on both surfaces, sits inside the ranges. Only
  these leave the set when the block goes.
• new — deletes minus everything the rows above already deleted. Baseline after — 893
  minus the running union of new.

No row overlaps another. The rows where sig and deletes disagree are 3 (26/25), 7 (68/66) and
8 (140/136), and every line in the gap is named in docs/twin-drift.md. Two of them:
const AC = window.AudioContext || window.webkitAudioContext; at index.html:9162,9577,9639 and
play.html:6556,6584,7023,7074 — rows 3 and 7 each hold some of those copies and neither holds all,
so neither row deletes it — and const vid = document.createElement("video"); at
index.html:6368,9511 / play.html:6963,7608, which is the rest of row 7's gap.

Rows 1 to 6 sit behind 1 architecture decision, and answering it frees 255 of the 893 lines
(893 down to 638).

While recomputing this I found a wrong range: the work list quoted play.html:7296-7309 for
maskToSource. That range is audioInputPart. maskToSource is play.html:7320-7338, and with the
wrong range the row measures sig 0. Block 6's ranges are now listed as explicit surface-to-surface
pairs so the mistake cannot be repeated.

The document is otherwise the extraction map: 538 of the 893 lines sit in 87 contiguous blocks of 4
lines or more (node scripts/twin-drift-worklist.mjs prints those 3 figures too), the document ranks
16 of those 87, and each gets a verdict — covered by the nanoodle-js bundle path, safely
extractable through gen-js-engine.mjs, or genuinely surface-specific.

Block	sig	index.html	play.html	Verdict
Share packer, card and shorteners	140	10725-11041	12823-13142	Extractable, and nothing covers it. nanoodle-js/src/share.mjs decodes share links; it has no packer.
MP4CAT mp4 remux	123	9210-9487	6676-6953	Extractable. nanoodle-js/src/mp4cat.mjs is already in the bundle, but browser.mjs does not re-export MP4CAT.
NanoGPT client fallback	81	8576-8916	6179-6499	Already covered by the delegation path. Do not extract again.
Pricing resolver	68	5571-5715	5929-6058	Extractable. A third copy already exists in nanoodle-js/src/estimate.mjs, exported from index.mjs only, so it is absent from the browser bundle.
Local media, MediaRecorder fallback	68	9489-9741	6635-6640, 6668-6675, 6954-7167	Needs a new browser-only library module. The library uses ffmpeg for this case.
Resize and crop geometry	25	6928-6988	7342-7377, 8822-8836	Extractable. browser.mjs already exports resizePlan and resizeCropImage.
Head metadata and share chrome	21	8-31, 1108-1131	8-31, 470-509	Genuinely surface-specific. 2 separate documents with separate CSP paths.

The "What this map does NOT cover" section is still there, because the map is not an exhaustive
partition:

• 16 of the 87 blocks are ranked. The other 71 blocks and all 355 scattered lines are guarded exactly
  like the ranked ones, but this document gives them no verdict.
• A twin can fall between 2 block ranges and be in no block's sig. seekVideo
  (index.html:9106-9115, play.html:6658-6667) is the known example.
• og:title, og:description, og:url, twitter:title and twitter:description are deliberately
  different per page. They were never in the shared set, so they cannot leave it, and no whole-file
  twin guard can cover them. Nothing else covers them either. og:image, the twitter card and
  image tags, the icons and the manifest link are byte-identical on both pages (column 0 on both,
  measured), so those are in the shared set and a 1-page change to any of them fails.
• Lines of 40 characters or fewer are outside the shared set by design. seekVideo shows the trade:
  10 lines, identical on both surfaces after the strip, and only 2 of them longer than 40 characters.

What I did NOT do, and why

I did not delete any block. Both surfaces run the bundle behind a flag. njsOn() reads
?engine=js, ?engine=play and localStorage.njs_engine. index.html:8253 appends
vendor/njs-engine.js asynchronously and only when the flag is on; index.html:8234-8239 states
that until it loads, the built-in runners execute. So each built-in copy is a live fallback path, not
dead code. Deleting the MP4CAT hand copies today breaks ?engine=play and every run that starts
before the bundle arrives.

Extraction needs 1 architecture decision first: does index.html load the bundle unconditionally,
and does the flag-off fallback survive? The guard ships first, so the number is measured and cannot
grow while the decision is pending.

How I verified it

Raw measurement, independent of the guard, over both files with no blanking at all: 1,009 distinct
shared lines, 1,079 occurrences in index.html, 1,267 in play.html. The guard reports 893
because 116 of those lines live inside generated regions. Re-measured after the merge, as was every
other figure in this body: nothing here is carried forward unmeasured.

Scenario matrix. The rows marked committed are now scripts/check-twin-drift-cases.mjs, which
runs them on every commit that changes the guard, the baseline or the matrix; the rest were re-run by
hand against this branch head:

Scenario	Expected	Result
Unmodified tree	pass	exit 0, ✓ 893 shared lines, unchanged
One-sided rename usd_balance → usdBalance at play.html:12717	fail	exit 1, TWIN DRIFT, both positions named
The same rename at index.html:8147 instead	fail	exit 1, TWIN DRIFT, both positions named
One-sided deletion of play.html:7349 (if(scale>1) scale = 1; // never upscale)	fail	exit 1, ONE-SIDED DELETION … still live at index.html:6958
One-sided deletion of play.html:6869, a line the bundle also carries	fail	exit 1, ONE-SIDED DELETION … still live at index.html:9403
That line deleted from both surfaces	pass	exit 0, extraction note, 893 → 892
2-sided DIVERGENT edit: durIDX in index.html, durPLAY in play.html	fail	exit 1, TWIN DIVERGENCE, both replacements named (exited 0 before this round)
Edit 1 of the 2 copies of index.html:5664 (pricing pickByRes)	fail	exit 1, TWIN DRIFT (occurrence count)
The seekVideo banner comment at index.html:9104 copied into play.html	fail	exit 1, duplication went UP: 893 → 894 shared lines (1 entered, 0 left)
A third copy of an already-shared line inside index.html	fail	exit 1, 1 shared line(s) gained a copy
Mirrored edit, both surfaces changed identically	pass	exit 0, note that the count held
MP4CAT block deleted from both surfaces (123 twins depart)	pass	exit 0, 893 → 770, note only — no false divergence (committed, row 6)
All 9 planned extractions deleted from both surfaces	8 pass, row 8 reports 5 true one-sided deletions	as expected on all 9; 0 divergences on every row (committed)
A divergent edit, a 1-sided edit and a 1-sided deletion in ONE tree	fail, all 3 headings	exit 1, divergence 1, drift 1, oneSided 1 — this is why the ceiling names 36, not 24 (committed)
200 baseline lines deleted from both surfaces, every occurrence	pass	exit 0, note only (scripts/twin-drift-bench.mjs)
Hand edit inside the generated njs-engine bundle	fail	exit 1, names the declared and the actual hash
baseline.count hand-raised to 1200	fail	exit 1, "count" says 1200, but its own "lines" array says 893
baseline.count deleted, then a line added to both surfaces	fail	exit 1, duplication went UP: 893 → 894
baseline.digest DELETED + 1 line's counts inflated 1 1 → 2 2	fail	exit 1, baseline has no usable "digest" field (exited 0 before this round)
A stored line's text swapped while its hash is left alone	fail	exit 1, the stored text does not hash to the stored hash
New unrelated line added to index.html only	pass	exit 0, no false positive
All 25 matrix ranges left at their pre-merge values	fail	exit 1, 9 of 16 cases wrong — the re-derivation is load-bearing

Row 8 was checked independently of the matrix as well, by reading occurrence positions straight out
of both files rather than by asking the guard: after deleting row 8's 2 documented ranges, exactly
5 twins are left live on exactly 1 surface, and they are the same 5 the guard names, at their new
positions. Row 8's failure is real, not a false divergence. Across all 9 rows the divergence count
is 0.

The 3 corrected ranges were re-checked against their OLD values this round, and each reproduced the
count this body claims: row 3 old index.html:9120-9181 gives 3 one-sided deletions, row 7 old
play.html:6635-6679 + 6979-7169 gives 11 one-sided deletions and 2 occurrence drifts, row 9 old
play.html:13281-13519 gives 6 one-sided deletions and 2 occurrence drifts.

Full guard suite, re-run on the merge commit: 55 of 55 check-*.mjs checks pass, 0 fail (53 on
origin/main, plus check-twin-drift.mjs and check-twin-drift-cases.mjs), with
check-js-parity.mjs confirmed not to have skipped.

for f in scripts/check-*.mjs; do node "$f" >/dev/null 2>&1 || echo "FAIL $f"; done

scripts/twin-drift-worklist.mjs and scripts/twin-drift-bench.mjs are document-support scripts,
not guards, so they are not in that count and the hook does not run them.

The pre-commit hook ran on every commit here with no --no-verify, and sh -n .githooks/pre-commit
passes. lora-models.json is restored to its committed content and is not part of any commit on this
branch — a full-suite run bumps its generated date, so it was restored after every run and kept out
of every commit.

Commit messages on this branch carry figures that later measurement replaced, and a commit message on
a branch under review cannot be corrected without a force push. This body is the authority for every
number, and the corrections are here:

• 7a28dbb states 696 shared lines and "90 duplicated blocks". The real figures are 893 lines
  and 87 blocks, of which 16 are ranked.
• 4929e35 and eb26e6a quote the timing ranges as they stood before the post-merge measurement
  round. Every line number in every commit message before the merge commit also predates
  origin/main moving both surfaces. The "Runtime" table above supersedes the timings, and every line
  number in this body is a post-merge one.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	nanoodle	b2a245b	Commit Preview URL Branch Preview URL	Jul 30 2026, 01:20 AM