PASS  test server is up

== Canonical absolute HTTPS metadata (Host spoofed) ==
PASS  page returns 200
PASS  og:url is absolute canonical HTTPS
PASS  og:image is the absolute canonical preview URL
PASS  og:image:secure_url present
PASS  spoofed Host never appears in metadata

== Required metadata tags ==
PASS  og:type website
PASS  og:site_name Calee Calendar
PASS  og:image:type image/png
PASS  og:image:width 1200
PASS  og:image:height 630
PASS  twitter:card summary_large_image
PASS  twitter:image present

== Versioned og:image URL ==
PASS  og:image carries a version param
PASS  version is <shortfp>-r<version>-s<privacy> and URL-safe
PASS  og:image version reflects summaries-off default (-s0)
PASS  twitter:image carries the same version
PASS  canonical og:url does NOT carry the image version
PASS  same content yields the same og:image version
PASS  different ICS content yields a different og:image version

== Metadata escaping ==
PASS  no raw <script> in output
PASS  angle brackets escaped
PASS  double quotes escaped (attribute-safe)
PASS  ampersand escaped
PASS  metadata never inserted via JavaScript

== Revoked calendar (404) and no internal leakage ==
PASS  revoked calendar returns 404
PASS  404 page shows a friendly message
PASS  404 page hides internal detail: curl
PASS  404 page hides internal detail: BEGIN:VCALENDAR
PASS  404 page hides internal detail: /var/www
PASS  404 page hides internal detail: Exception
PASS  404 page hides internal detail: Fatal error
PASS  404 page hides internal detail: Warning:
PASS  404 page hides internal detail: business.calee.com.au

== Malformed request (400) ==
PASS  malformed token returns 400
PASS  400 page reveals no internal detail

== Array-valued parameters ==
PASS  array-valued token yields 400, not a 500/TypeError
PASS  array-valued token response has no TypeError text

All public-calendar metadata self-tests passed.