What this implementation still gets wrong

Why this chapter is free

A document claiming to be a complete implementation inventory has an obvious problem: you cannot verify completeness from the inside. The only useful evidence is a specific, checkable list of what is missing.

So here is that list. It is generated from the same self-audit that produces the public proof page, which means it cannot quietly stop being accurate.

Gap 1: the Content-Security-Policy allows inline script

What it is

script-src includes 'unsafe-inline'. Everything else in the policy is locked down: no external script origins, object-src 'none', base-uri 'self', a constrained form-action, and frame-ancestors 'none'.

What it costs

If an XSS hole exists, the CSP will not stop it from executing. It will still stop remote script loading, base-tag hijacking, plugin execution and form exfiltration.

Why it has not been fixed

A strict script-src requires a per-request nonce. A nonce requires reading request headers in the root layout, which makes every route dynamic. That contradicts the static-first requirement, which exists so a database outage cannot take down the sales funnel.

How to fix it

Two options, both real. Move to nonce-based CSP and accept dynamic rendering on marketing routes, which costs roughly 200ms of TTFB and the CDN cache hit rate. Or split the deployment so authenticated routes use nonces and static routes do not, which is more configuration and more surface for the two policies to drift.

The Code Kit supports both modes. This site runs the second-best one and says so.

Gap 2: no image CDN, and hero images are hand-optimised

What it is

Images are optimised at build time rather than served through a transforming CDN.

What it costs

A device that would be better served by an intermediate size gets the next size up. The measured difference on the landing page is under 40ms, so this is a small gap, but it is a gap.

How to fix it

Point the image loader at a transforming CDN. It is a configuration change plus a cost line.

Gap 3: the search index is built at build time and does not cover paid chapters for free users

What it is

Full-text search covers only the chapters the user can access. For a signed-out user, that is the free chapters.

What it costs

A signed-out user searching for a term that only appears in a paid chapter gets no result, rather than a result that says the term appears in a chapter they could buy. The second would convert better.

How to fix it

Build two indexes: a full one with titles and section headings only, and a body index restricted to accessible content. Show the first as locked results. This is on the roadmap and is not built.

Gap 4: the citation check covers three engines, not five

What it is

The monthly seed query check runs against three answer engines. There are more.

What it costs

The trend line is directionally right and incomplete. Adding engines mid-series would also break comparability, which is why it has not been done casually.

How to fix it

Add the remaining engines as a second series with its own start date, rather than merging them into the existing one.

Gap 5: no automated Rich Results validation in CI

What it is

Structured data is validated by unit tests for shape and by manual runs of the Rich Results Test for eligibility. The second is not automated.

What it costs

A change that produces valid JSON-LD which is nonetheless ineligible for a rich result would not be caught until someone checked manually.

How to fix it

The Rich Results Test has no public API. The practical substitute is a schema validation library in CI plus a scheduled manual check, which is what the checklist prescribes and what is currently done.

Gap 6: internal link depth is uneven across the programmatic tiers

What it is

Sibling linking distributes links evenly within a tier, but tiers are not equally linked from the rest of the site. The glossary is linked from every chapter that uses a term; the schema type pages are linked mostly from one hub.

What it costs

Uneven crawl frequency across tiers that should be equivalent.

How to fix it

Automatic term detection in chapter content, linking the first occurrence of any glossary term or schema type name. The mechanism exists for the glossary and has not been extended.

The general principle

A proof page showing 100 percent on everything is less credible than one showing 94 percent and naming the six misses. The first is what a marketing page says. The second is what an audit says, and this product's entire claim is that it is an audit.

Publish the failures. If a score drops, show the drop.