Data-flow ledger · current code and honest boundaries
The explorer keeps its controls in the browser and its shareable state in the visible URL. App code sets no cookies, analytics, accounts, submissions or persistent profiles; browser, host and external-site boundaries remain explicit.
Meaning of zero
Zero application-controlled visitor records does not mean zero network metadata. The browser must request static files from a host, URL state can be present in that request and a reader-selected external destination applies its own systems after navigation.
Host review gated7 data-flow records · recipient and persistence attached
Open one record at a time. The hash stores reading focus only; it does not change a privacy setting, start processing or hide the remaining static records.
A reader requests a page, stylesheet, script, image or font.
A reader selects a pair, changes a research-priority slider or adjusts a weighted comparison; scripts replace the documented query state or build a copyable link.
A reader activates Copy research brief or Copy citation link.
A reader opens a details record, dialog, mobile menu or editorial lens.
A reader types a word or phrase into the global research index to filter locally rendered publication records.
No event: corrections, accessibility feedback, accounts, messages, uploads and payments are deliberately inactive.
Five app-local controls
These controls describe the production bundle generated here. They are not a host audit, legal opinion, privacy certification or guarantee about a reader's browser.
Production source and build checks find no localStorage, sessionStorage, IndexedDB or application cookie assignment.
Browser history, cache and clipboard remain browser-controlled. Cookies are host-scoped rather than port-scoped, so loopback QA can inherit unrelated cookies from another local service using the same host name.
The app has no fetch, XMLHttpRequest, sendBeacon, WebSocket, EventSource, form submission or upload path.
Static asset delivery still uses ordinary HTTP requests to the selected host.
Official records are local structured data; government pages open only after an explicit reader action.
The selected destination operates independently once the reader leaves.
The page and preview headers use a no-referrer policy; external source links also use noreferrer.
The destination still receives its own request's network metadata.
Page metadata, robots rules and headers all request no indexing, following, caching snippets or archiving.
Noindex is a crawler instruction, not authentication or a substitute for a private-access layer.
Service quarantine
No service below can receive visitor data in this build. Each row states the review needed before activation.
Approve provider, access model, logging, retention, security headers and rollback.
Separate product approval, purpose/minimisation review, accurate notice and default-off implementation.
Approve owner, fields, purpose, notice, security, response standard and event-based retention.
Approve data model, access controls, deletion/export design, processor terms and threat review.
Release ledger
Production behavior must be inspected on the exact host. Local absence of collection cannot silently become a deployed privacy promise.
App source, production build, network/storage inspection and focused integrity checks.
Reproduced locallyNo production host, project, binding, access plan or credential is configured.
GatedNo provider-specific log inventory, purpose, access owner or deletion event exists.
GatedMust be reproduced against the exact deployed build and host, not inferred from local output.
GatedAnalytics, forms, accounts, messages, uploads and persistent storage remain outside scope.
GatedThe local engineering record is not a legal assessment, certification or production guarantee.
GatedActive application processors
This is an inspected local-build statement, not a promise about a future host. Update the processor, retention and threat records before any service is connected.
Carry the boundary forward
The explorer accepts only pair identifiers and bounded research-priority values. A copied link is intentionally portable, not confidential storage.
Article revision record
This register begins with the private-preview editorial rebuild. It records material content, method, interface and trust-policy changes without inventing a history that predates the available repository evidence.
PRIVACY-20260828-03No legal source changed; this entry records method, interface or trust policy.
PRIVACY-20260826-02No legal source changed; this entry records method, interface or trust policy.
PRIVACY-20260821-01No legal source changed; this entry records method, interface or trust policy.