Document Step 6.7 packaging verification

test-fixtures/PROVENANCE.md

@@ -43,7 +43,9 @@ Copied files (byte-for-byte from source, no fixture-local corrections):
   surface-attachment bus wiring, `view.pillars`/`view.warp-flight` routing
 - `js/contract-adapter.js` — `surfaces`/`instanceId` constructor options,
   the `view.pillars`/`view.warp-flight` targets, `onLocalChange`/`onLocalAction`
-  hooks, `describe()`'s conditional `surfaces` field, version bump to 5.3.0
+  hooks, `describe()`'s conditional `surfaces` field (the version bump this
+  bullet originally listed was not present in the resynced file; see the
+  handshake correction below)
 - `js/observation-engine.js` — WARP/PILLARS dock buttons now route through
   `onMutation` (matching the existing VIEWPORT/RED ALERT/PRESET pattern)
   instead of mutating engine state directly
@@ -56,9 +58,9 @@ is a faithful mechanical copy of the source as it stood after Step 6.7B.
 `js/audio.js`, `js/config.js`, `js/core-animations.js`, `js/visualizer.js`,
 `js/observation-bezels.js`, `js/generative-experience.js`, and `js/control-bus.js`
 were not touched by Step 6.7B and were not recopied. `dist/` was not
-regenerated (no PowerShell available in the environment that performed this
-resync); it still reflects a pre-6.7B build and should be rebuilt from
-source before any test or procedure that opens the packaged file.
+regenerated at resync time (no PowerShell available in the environment that
+performed the resync); it reflected a pre-6.7B build then and has since been
+rebuilt from source — see the Step 6.7 packaging pass below.
 
 ## SciFi adapter handshake correction (2026-09-15)
 
@@ -95,10 +97,62 @@ flow this file documents:
 The outbound advisory `xzbt: '5.2'` stamps on this adapter's own envelopes were
 deliberately left unchanged: §6.5 makes the value non-authoritative, Step 6.7B
 documented the envelope as unchanged, and no receiver — NGN included — reads
-that value for admission. `dist/` remains a stale generated artifact and was
-not regenerated.
+that value for admission. (`dist/` was rebuilt from source in the packaging
+pass below.)
 
 Resynced file (source and fixture byte-identical,
 SHA-256 `10ED30527153D5B30F23557BA6EC427884D470AB6561AC33C47E7F17AFA28DD9`):
 
 - `js/contract-adapter.js`
+
+## Step 6.7 packaging pass (2026-09-15)
+
+`tools/package.ps1` was run against the SciFi-XZBT source tree to regenerate
+the standalone single-file artifact (that repo's one-input/one-output
+distribution rule):
+
+- Command: `powershell -ExecutionPolicy Bypass -File .\tools\package.ps1 -Force`
+- Output: `G:/.vibe/SciFi-XZBT/dist/SciFiAmbientDisplay_V179b9db.html` —
+  920,730 bytes (12 script blocks + 1 style block inlined), SHA-256
+  `DFD9A91CB04CABD7BD6AAA53DA0FA7A641DBB21E3B3E11FAF3EC75946D6FA271`
+- Replaced: a pre-6.7B build of the same filename (SHA-256
+  `B441820627D3FB23994D129B7425D781797E705867AC02967F96846B243435D4`, dated
+  9/13, before the Step 6.7B source changes). Byte-identical content of that
+  pre-6.7B build is retained unchanged as
+  `dist/SciFiAmbientDisplay_Va723f46=1.html`.
+- Filename caveat: the filename carries SciFi-XZBT's HEAD commit `179b9db`,
+  but the build reads the working tree, which is ahead of that commit — that
+  repo's contract work, including the handshake correction above, is still
+  uncommitted there. The artifact does not correspond to a single commit.
+- Fixture mirror:
+  `test-fixtures/reference-exhibits/scifi/dist/SciFiAmbientDisplay_V179b9db.html`
+  was copied verbatim from the source build; the two files are byte-identical
+  at the hash above.
+
+Verification of the regenerated artifact (raw output in
+`evidence/step6.7-packaging.txt`):
+
+- Structural: each of the 13 inputs (`css/style.css` and the 12 scripts) is
+  inlined verbatim — the built file contains every source file as a
+  contiguous byte-identical block after newline normalization; zero
+  `<script src=`, `<link href=` and `<img src=` references remain; the two
+  Step 6.7B scripts (`surface-mode.js`, `surface-bus.js`) are present in
+  `index.html` order; the corrected handshake filter
+  (`typeof e.data.xzbt !== 'string'`) is present and no exact advisory `xzbt`
+  comparison remains anywhere in the file.
+- Runtime, `file://`: the document boots standalone — 12 inline `<script>`
+  elements, none with `src`, zero `<link>` elements, console UI renders
+  (`readyState: complete`, 4 canvases, theme classes applied), and
+  `window.xzbtContractAdapter` exists with `contractMinor: 3`,
+  `version: 5.3.0`, and the two-entry surface catalog.
+- Runtime, served over `http://127.0.0.1:4173/test-fixtures/...` (the served
+  path NGN fixtures use): a same-origin host simulation stamped
+  `xzbt: '5.3'` negotiates — `hello.result` contract `{major: 5, minor: 3}`,
+  exhibit version `5.3.0`; `describe.result` reports 63 targets plus
+  `surface.console`/`surface.observation`; `state.result` returns. This is
+  the handshake/describe/state path the pre-fix build failed.
+- Boundary note: from `file://`, a same-window `postMessage` cannot exercise
+  the handshake because the adapter's origin guard rejects it (Chrome reports
+  `e.origin` as `"null"` for `file://` documents while `window.location.origin`
+  is `file://`). That is the adapter's designed same-origin/self safety
+  filter, not a defect; NGN attaches exhibits over `http://` only.