Keeping a rendered page inert
One rule binds every surface that turns stored content into something a browser executes: a rendered page makes no request to any host outside the fleet. Links are exempt, because pointing at sources is the point of a knowledge system. The rule is about what loads without being asked: scripts, styles, fonts, images, frames, and whatever a script would pull at runtime. What follows is why the rule binds the surface rather than the content, why the fleet's monitoring cannot enforce it, the check that does, and the two failures on record that shaped both.
The rule binds the surface
The tempting rule is to review captures more carefully, and it fails for a structural reason. The volume of capture is the purpose of the system: research pulls in third-party material constantly, most of it read once and thinly. A rule that depends on catching a script tag inside a fifteen-hundred-line capture depends on attention nobody has at the moment it matters. So the notes may contain anything the owner admits, and the surface is what refuses to act on it. A surface that will not execute what it renders works regardless of what was captured, how carelessly it was read, or how long it sat there.
The monitoring is in the wrong position
The fleet logs its egress at one chokepoint, and for this class of event the chokepoint is useless by construction. A page is served from inside the fleet but rendered in a browser on the operator's device, outside it. A fetch the page triggers at render time leaves from the device's own connection. It never crosses the chokepoint, appears in no fleet log, and raises no alert. The monitoring is watching the wrong wire, and no tuning fixes a position problem. Any architecture that serves content in one place and renders it in another has this property, so the consequence is general: the check has to live with the surface, because nothing downstream of the surface is in a position to notice. On this fleet the device-side blind spot is held as a recorded open, and the surface rule is its compensating control: the event class that would need watching is removed instead of watched.
The incident that ruled it
The rule was written after a real event. A rendering component constructed a third-party import at runtime and put it onto every page of the reading surface at once. No note changed. The import sat latent for weeks, became live the moment a renderer existed, and was found by an agent looking at something else entirely. Nothing had noticed, because nothing was in a position to look.
The response set the pattern the fleet still runs. The import was cut the same day, the rule was ruled in force, and the check below was built and wired into publishing. The library itself was dropped rather than vendored: the ruling was to build the visualisation in-house as artefacts made ahead of time, inert at view, instead of buying the capability with an outbound fetch at render time.
The check, in two passes
The observable is a script with two passes, and the gap between them is the incident's own lesson. The static pass scans every built page and asset for the fetch-vector classes: script sources, stylesheet links, preloads, images, frames, embedded objects, media, style-rule URL calls, dynamic imports, refresh directives, form targets. The runtime pass loads pages in a real browser with request interception and records every request that leaves the internal host. The static pass alone would have missed the incident, because an import constructed at runtime matches no tag. The runtime pass alone misses any page it does not load.
The pass also has to stay runnable, and that was learned at full cost. The first version selected pages for the browser pass by the presence of script tags, which matched every page, because the theme ships its own bundle on all of them. The run blew past its time limit and was killed. A check too slow to finish is a check nobody runs. The fix was to sample by where the risk lives: pages built from notes that carry raw markup are always loaded, and the rest are sampled.
Three verdicts come out, and the third is the honest one: clean, findings, and could not run. Could-not-run is an unknown, and an unknown is never a pass, because unknowns were the original problem. On publish the audit runs after the site lands and its verdict is published beside the build, so it never delays a push and never goes unrun. The trigger logic follows the incident: a content push gets the static pass, and any change to the toolchain, the theme or the configuration gets the full browser run, because a renderer change can add a vector with no note changing at all. That is how the incident happened.
The scanner's own hole
A pattern-based scanner is a guess about syntax, and the record holds the case where the guess was wrong. The static pass's stylesheet pattern expected a tag's attributes in the order the house tools write them. A foreign generator wrote the same tag with the attributes reversed, and its stylesheet fetch passed the static pass. Ordinary content pushes run the static pass alone, so the hole was real. It was found because the foreign artefact was examined before adoption, the pattern was fixed to match either order, and the newer publish gate carries the order-proof pattern with the lesson written beside it. The transferable point: a pattern check fails in the direction of its author's habits, and the differently shaped check beside it, a browser that actually loads the page, bounds the damage when the guess is wrong.
Exceptions are recorded, or they are incidents
The rule has a door, and the door has a shape. An exception exists only if the owner confirms it before it ships, and it is recorded with what fetches what, and why. An outbound request from a rendered page that is not in that record is an incident by definition, whatever its intent. The shape is the transferable part: every exception is confirmed before it ships and recorded where compliance is checked, so the exceptions can be audited exactly as the rule is.
The fleet's shape describes the chokepoint this event bypasses. Privilege in two planes carries the other structural answer to untrusted content. The narrative of the fleet is the fleet chapter.