== A. the one shared client asset == PASS the shared sharing asset is committed PASS the embed loads the shared asset PASS the Event Link page loads the shared asset PASS both pages reference it from the site root, not relative to their own path PASS there is exactly ONE share/copy implementation (no second copy of the algorithm) PASS the embed still has its own inline glue script PASS the comment strippers really did remove the prose PASS the embed share glue never uses fetch( PASS the shared asset never uses fetch( PASS the embed share glue never uses XMLHttpRequest PASS the shared asset never uses XMLHttpRequest PASS the embed share glue never uses sendBeacon PASS the shared asset never uses sendBeacon PASS the embed share glue never uses a mint POST PASS the shared asset never uses a mint POST PASS the embed share glue never uses EventSource PASS the shared asset never uses EventSource PASS the embed share glue never uses a WebSocket PASS the shared asset never uses a WebSocket PASS the shared asset awaits nothing at all, so nothing precedes navigator.share() PASS the embed never mints over HTTP from PHP either PASS the embed mints through the production helper, not the HTTP endpoint PASS the embed uses the EXPLICIT source calendar timezone context for identity PASS the embed never derives Event Link identity from the display timezone PASS the embed never reads CALEE_CALENDAR_TIMEZONE for identity PASS the embed reimplements no identity rules of its own PASS the embed never reads the Event Link secret itself PASS the shared asset is served same-origin PASS the served asset is the committed file, byte for byte PASS the served asset is JavaScript == B. embed renders pre-minted canonical Event Links == PASS the embedded calendar renders (200) PASS every fixture event is rendered PASS the timed one-off is rendered once PASS the timed one-off carries the canonical Event Link PASS the all-day one-off is rendered once PASS the all-day one-off carries the canonical Event Link PASS the all-day event still shows "All day" PASS the recurring series renders several occurrences PASS every generated occurrence carries an Event Link PASS each occurrence of a series gets its OWN link PASS the 25 August occurrence carries its canonical recurrence identity PASS the detached override is rendered PASS the detached override keeps its ORIGINAL recurrence identity PASS the detached override does NOT use its moved DTSTART PASS the detached override is still displayed on its moved day PASS the multi-day event is rendered in three day cells PASS every repeated fragment of one occurrence carries the SAME URL PASS ...and it is the canonical Event Link for that occurrence PASS a second render of the same month produces identical share URLs PASS an occurrence visible in two different month grids keeps one URL PASS ...and it is the canonical link for 1 September PASS the existing title/date/time detail is untouched == C. embed refuses rather than invents, and degrades safely == PASS an event with no source UID is still displayed PASS ...and carries NO share URL at all PASS ...and no empty share attribute either PASS ...but keeps its title/date/time detail PASS a floating series with no portable calendar context is still displayed PASS ...and no occurrence of it is shareable PASS a one-off in the same feed is still shareable (identity needs no instant) PASS the unshareable feed still renders a complete calendar page PASS with NO Event Link secret the calendar still renders (200) PASS ...with every event still visible PASS ...with every title/date/time still present PASS ...and no share URL anywhere PASS ...and no PHP error or warning leaked into the page PASS ...and the page is not a 500 PASS no raw source UID reaches the embed DOM PASS no canonical recurrence identity reaches the embed DOM PASS no event fragment exposes a DAV/public ICS export URL PASS no event fragment exposes the public calendar token as plain text PASS the share URL itself is a /e/ Event Link and nothing else PASS the decoded Event Link payload is never rendered beside the URL PASS the event-scoped display attributes are still exactly title/date/time PASS an event element carries exactly the three display attributes plus the share URL PASS the detail modal has a Share event button PASS the detail modal has a Copy event link button PASS both are real buttons of type button PASS the action area starts hidden until an event with a link is opened PASS the embed has an aria-live status region PASS the status region is a status role PASS the manual-copy field is a labelled readonly input PASS the manual-copy field is hidden until it is needed PASS the giant URL is not printed as visible page text PASS the existing detail modal slots are untouched PASS the detail modal still has its Date and Time labels PASS the detail modal still closes on Escape and via its close button PASS the detail modal still restores body scroll on close PASS the existing subscribe modal is untouched PASS the embed adds no inline event-handler attribute PASS the embed never alerts == D. /e/ re-share is the exact same URL == PASS the active Event Link page renders (200) PASS the active page offers Share event PASS the active page offers Copy event link PASS the re-share URL is this page's own canonical URL PASS the manual-copy field carries the same URL PASS og:url is the same URL PASS rel=canonical is the same URL PASS pageUrl == og:url == canonical == shared == copied, exactly PASS every Event Link URL in the page is the canonical URL or its own preview image PASS the share title is the current source title PASS the page never creates a new reference PASS the page never mints a URL from an identity PASS the page never calls the mint endpoint PASS the page builds its URL only from the verified reference PASS the share controls reuse $pageUrl rather than rebuilding it PASS the manual field reuses $pageUrl too PASS a cancelled page offers no Share event PASS a cancelled page offers no Copy event link PASS a cancelled page offers no Follow this calendar PASS a cancelled page loads no script at all PASS a cancelled page exposes no share container PASS an unavailable page offers no Share event PASS an unavailable page offers no Copy event link PASS an unavailable page offers no Follow this calendar PASS an unavailable page loads no script at all PASS an unavailable page exposes no share container PASS an invalid page offers no Share event PASS an invalid page offers no Copy event link PASS an invalid page offers no Follow this calendar PASS an invalid page loads no script at all PASS an invalid page exposes no share container PASS a temporary page is 503 PASS a temporary page offers no share action PASS a temporary page loads no script == E. /e/ security after adding a script == PASS the CSP still starts from default-src 'none' PASS the CSP allows script from 'self' ONLY PASS the CSP never allows unsafe-inline PASS the CSP never allows unsafe-eval PASS the CSP script-src is not a wildcard PASS the CSP script-src does not allow https: generally PASS the CSP script-src does not allow data: PASS the CSP script-src allows no host at all PASS the CSP still pins the inline stylesheet by hash PASS the CSP still restricts images to same-origin PASS the CSP still forbids framing PASS the CSP still forbids base tags and form submission PASS the CSP declares no connect-src, so default-src 'none' still blocks the network PASS Referrer-Policy: no-referrer is still sent PASS X-Robots-Tag is still noindex/nofollow/noarchive PASS X-Frame-Options DENY is still sent PASS the page is still no-store PASS the CSP style hash still matches the emitted stylesheet PASS the active page loads exactly one script element PASS that script is the committed same-origin sharing asset PASS the page has no INLINE script PASS the page loads no third-party script PASS the page loads no external subresource of any kind PASS the page still adds no analytics PASS the page emits no inline event handler PASS the page emits no javascript: URL PASS the parsed document contains only the committed external script PASS a hostile title never produces a