From d50eedc3a4991e68b0b499d6b6652cde56a25e13 Mon Sep 17 00:00:00 2001
From: bradgroux <brad@digitalmeld.io>
Date: Mon, 7 Sep 2026 19:48:13 -0500
Subject: [PATCH 1/2] fix: retain signed large-board evidence during promotion

---
 scripts/docs-media/restore-candidate.mjs      |  2 +-
 scripts/docs-media/restore-candidate.test.mjs | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/scripts/docs-media/restore-candidate.mjs b/scripts/docs-media/restore-candidate.mjs
index a70cb141..87707eef 100644
--- a/scripts/docs-media/restore-candidate.mjs
+++ b/scripts/docs-media/restore-candidate.mjs
@@ -38,7 +38,7 @@ export function validateArchiveEntries(names, listing) {
       name &&
         !path.posix.isAbsolute(name) &&
         !name.split('/').includes('..') &&
-        /^(?:release\/|native-ui-evidence\/|documentation-media\/|native-distribution\.sha256$|release-candidate\.json$)/.test(
+        /^(?:release\/|native-ui-evidence\/|documentation-media\/|large-board-evidence\/|native-distribution\.sha256$|release-candidate\.json$)/.test(
           name
         ),
       `Unsafe candidate archive entry: ${name}`
diff --git a/scripts/docs-media/restore-candidate.test.mjs b/scripts/docs-media/restore-candidate.test.mjs
index e082c00e..17d2fb89 100644
--- a/scripts/docs-media/restore-candidate.test.mjs
+++ b/scripts/docs-media/restore-candidate.test.mjs
@@ -79,6 +79,21 @@ test('candidate archives reject traversal, links, devices, and unexpected roots'
     assert.throws(() => validateArchiveEntries('release/file', mode), /link or special/);
 });
 
+test('signed large-board evidence survives archive validation without accepting unsafe paths', () => {
+  assert.doesNotThrow(() =>
+    validateArchiveEntries(
+      'large-board-evidence/\nlarge-board-evidence/report.json\nlarge-board-evidence/board-5000.png\n',
+      'drwxr-xr-x folder\n-rw-r--r-- report\n-rw-r--r-- image\n'
+    )
+  );
+  for (const name of ['large-board-evidence/../outside', 'large-board-evidence-other/report.json'])
+    assert.throws(() => validateArchiveEntries(name, '-rw-r--r-- file'), /Unsafe/);
+  assert.throws(
+    () => validateArchiveEntries('large-board-evidence/report.json', 'lrwxrwxrwx link'),
+    /link or special/
+  );
+});
+
 test('the distribution checksum list contains each exact release artifact once', () => {
   const names = [
     'latest-mac.yml',

From 59d03d78d899d1a361fcca43eb3bed82206b5836 Mon Sep 17 00:00:00 2001
From: bradgroux <brad@digitalmeld.io>
Date: Mon, 7 Sep 2026 19:49:55 -0500
Subject: [PATCH 2/2] fix: record the actual capture host comparison

---
 scripts/docs-media/run.mjs | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/scripts/docs-media/run.mjs b/scripts/docs-media/run.mjs
index cd23ff87..d070bc0d 100644
--- a/scripts/docs-media/run.mjs
+++ b/scripts/docs-media/run.mjs
@@ -67,7 +67,6 @@ const report = {
     unmatched: [
       'Original showcase dataset is unavailable; uses the documentation fixture.',
       'Native content capture excludes the baseline window frame and shadow.',
-      'Host OS differs from the baseline macOS 15.7.9.',
     ],
   },
 };
@@ -279,6 +278,13 @@ try {
   const launched = await session.launch();
   ({ app, page } = launched);
   report.identity = launched.identity;
+  const baseline = JSON.parse(
+    await readFile(path.join(root, report.taskModeComparison.baseline), 'utf8')
+  );
+  const osMatch = baseline.host.osVersion === launched.identity.osVersion;
+  report.taskModeComparison[osMatch ? 'matched' : 'unmatched'].push(
+    `Host macOS: baseline ${baseline.host.osVersion}; candidate ${launched.identity.osVersion}.`
+  );
   await app.evaluate(({ BrowserWindow }, sizes) => {
     const win = BrowserWindow.getAllWindows().find((w) => w.isVisible());
     win.webContents.setZoomFactor(1);