daemon-sec-lotl

IMPROVEMENT-PLAN.md (48710B)

---

 # DÆMONBins — Improvement Plan
 
 > Living document, written incrementally during the planning session on 2026-09-04. Lives at
 > `docs/IMPROVEMENT-PLAN.md`; tick items off here as they land.
 
 ## Context
 
 DÆMONBins is a static catalog merging GTFOBins × LOLBAS × WADComs (+ DÆMON-authored additions)
 into one filterable Technique index. The site has just been migrated from GitHub Pages to Vercel
 (uncommitted working tree: `deploy.yml` deleted, `vercel.json` added, `robots.txt.ts`,
 `HeroDeck.astro`, `hero.ts`, `fuzz.ts` new). The user wants a **prioritised plan for the next
 round of improvements** — not a single feature — so this document surveys the site as it stands,
 records concrete findings, and turns them into an ordered backlog with enough detail to execute.
 
 ## Second pass — 2026-10-04
 
 The main catalog work from this plan is now landed. The committed dataset contains 3,085
 techniques across 907 tools: GTFOBins, LOLBAS, WADComs, the pinned LOOBins snapshot, and 196
 DÆMON-authored rows. The catalog is now server-rendered for the initial result set and has a
 compact workbench with multi-word search, contextual facet counts, grouped variants, sorting,
 shareable URL state, a details inspector, shell-aware template configuration, bookmarks, saved
 views, density/font/wrapping controls, and reduced-motion persistence. The data pipeline no longer
 depends on a sibling checkout for authored rows: `src/data/sources/` and
 `src/data/catalog-additions.json` are the committed inputs, with `npm run data:enrich` available
 for metadata-only refreshes. LOOBins provenance and GPL-3.0 attribution are documented in
 `THIRD_PARTY_NOTICES.md` and `/credits`.
 
 The original survey below remains useful as historical context; its counts and “deferred” labels
 describe the first-pass checkout, not the current catalog.
 
 ## Survey log (what was inspected, in order)
 
 - [x] `package.json`, `astro.config.mjs`, `vercel.json`, `README.md` — read.
   - Build: `data:public` → `astro build` → `pagefind --site dist` → copies pagefind into `public/`
     (odd: `public/pagefind` is regenerated from `dist/pagefind` after the build; only matters for
     `astro dev`).
   - `test` script is `node --test` but no test files are known yet — verify.
   - `site` is `https://lotl.daemon-sec.xyz`; sitemap + MDX integrations on; Shiki `rose-pine-moon`.
   - Headers in `vercel.json`: nosniff, referrer, frame-ancestors, HSTS. No full CSP yet.
 - [ ] `src/pages/*` — routes, SEO tags, OG image.
 - [ ] `src/scripts/{app,catalog,hero,fuzz}.ts` — the client islands.
 - [ ] `src/lib/*` — taxonomy, techniques, url helpers.
 - [ ] `src/data/*.json` + `scripts/build-dataset.mjs` — data quality.
 - [ ] `src/styles/*`, `src/components/*` — design system, a11y.
 - [x] Working-tree diff (`git diff`) — what the in-flight Vercel migration changed.
   - `astro.config.mjs`: dropped `base: '/daemon-sec-lotl'` + the `rehypeBaseLinks` plugin; `site`
     is now `https://lotl.daemon-sec.xyz`. `url()` helper kept as the link chokepoint.
   - `Base.astro`: added Vercel Web Analytics + Speed Insights `<script>`s (PROD only) and a
     `.skip-link` (styled in `global.css`). Uses `<ClientRouter />` (view transitions).
   - `Header.astro`: GitHub icon + nav link (`DAEMON-404/daemon-sec-lotl`).
   - `app.ts`: new `initFuzz()`, `initHero()`, `initCounters()` (data-count roll-up with
     reduced-motion + IntersectionObserver).
   - `build-dataset.mjs`: Impacket suite split + family case-fold via `wadcoms-normalize.mjs`.
   - `SectionBanner.astro`: −212 lines = its inline `<script>` (the canvas "fuzz" signal field)
     was lifted into `src/scripts/fuzz.ts` and is now driven by `app.ts` → `initFuzz()`. Still
     used by `404.astro` and `[source]/index.astro`.
   - `index.astro`: `SlantTitle` hero replaced by new `HeroDeck.astro`; added "By platform"
     counters (`data-count`) and `data-reveal` on deck cards.
   - **No test files anywhere** (`find . -name '*.test.*'` → 0). `npm test` is a no-op.
   - **`vendor/` is absent on this machine** — `npm run data` cannot run here until
     `scripts/setup-vendor.sh` / submodules are checked out. Builds don't need it (committed JSON).
   - `.github/workflows/deploy.yml` deleted → **no CI at all now** (Vercel builds on push, but
     nothing runs data validation / typecheck / tests before merge).
 - [x] `dist/` output size + Lighthouse-style checks (sizes measured below; no Lighthouse run —
   the site is not deployed yet, so Speed Insights will provide field data after Track 1).
   - Sizes: `dist/` 34 MB total; `public/pagefind` 4.5 MB; `src/data/techniques.json` 2.0 MB and
     copied verbatim to `public/data/techniques.json` (client payload); `tools.json` 244 KB.
   - `dist/sitemap-0.xml` 57 KB (~850 URLs).
 
 ## Findings
 
 ### F1. No CI / quality gate after the Pages→Vercel move
 `deploy.yml` was deleted with the migration. `package.json` still has `"test": "node --test"`
 but no test files exist (to confirm). Nothing runs `astro check`, the Zod validation in
 `build-dataset.mjs`, or link checks before a deploy. Vercel will happily deploy a broken data
 file as long as `astro build` passes.
 
 ### F2. Client payload: the full 2 MB dataset ships to the browser
 `public/data/techniques.json` is a byte-for-byte copy of the canonical file. Measured:
 
 | artefact | raw | gzip -9 | brotli -11 |
 |---|--:|--:|--:|
 | `techniques.json` | 2,046,894 B | 220,979 B | 165,461 B |
 
 Vercel serves brotli for static files, so the wire cost is ~165 KB — acceptable but it is
 parsed into ~2 MB of JS objects on every catalog visit. Still worth a slim list projection
 (who fetches it and which fields dominate → data-agent findings below).
 
 Built page sizes (uncompressed HTML): `/catalog` 17 KB (so the catalog is client-rendered),
 `/gtfobins` 181 KB, `/lolbas` 104 KB, `/gtfobins/bash` 89 KB, home 30 KB. The per-deck index
 pages are heavy because every tool card is server-rendered — fine for SEO, but check that the
 `_tool_` CSS (78 KB!) isn't shipping unused rules. Largest JS chunk: `Base.astro` script 13.6 KB
 + `ClientRouter` 15 KB + `catalog` 9 KB + `SearchModal` 5 KB. Fonts: 15 woff2 files, the
 variable Noto Sans Display alone is 70 KB — check `font-display` and preload strategy.
 
 Pagefind: 4.5 MB index (21 `.pf_index` + 842 fragments) — loaded on demand from
 `SearchModal.astro:325`. Only `[source]/[tool].astro:48` carries `data-pagefind-body` (+ a
 `source:` meta), so search hits are **tool pages only**; the catalog, deck indexes and home are
 not indexed (correct — avoids duplicate hits) but the modal can't deep-link to a technique row.
 The SearchModal still references a `BASE` constant from the Pages era (`SearchModal.astro:321`)
 — confirm it resolves to `''` now.
 
 CSS: the shared bundle `_tool_.BP7bOQ_a.css` (78 KB) is linked from **every** page (home,
 catalog, credits, deck index, tool). Source is 126 KB across 7 files; `daemon.css` (29 KB) and
 `global.css` (43 KB) are the cheatsheet design system cloned wholesale — likely a large share of
 unused selectors (`.download-library__head`, TOC, callouts, CPTS scroll-progress remain in
 `app.ts` too). Candidate for a coverage pass, not a rewrite.
 
 ### F3. Deployment is half-migrated
 - `https://lotl.daemon-sec.xyz` **does not resolve** (NXDOMAIN at 2026-09-04) — DNS for the
   custom domain is not set up, yet `site`, canonical URLs, OG tags, sitemap and README badges all
   point there. Until DNS lands, every canonical/sitemap URL is dead for crawlers.
 - The old GitHub Pages URL `https://daemon-404.github.io/daemon-sec-lotl/` still returns 200
   for `/` and `/catalog/`, with `<link rel="canonical">` pointing at **itself** → once Vercel is
   live this is true duplicate content competing for the same queries. Pages can't redirect
   server-side; options are (a) disable Pages for the repo, or (b) keep a one-off `gh-pages`
   branch that only holds stub pages with `<meta http-equiv="refresh">` + canonical → new domain
   for every old URL. (a) is simpler; (b) preserves inbound links. Recommend (b) for ~30 days
   then (a). Confirmed via `gh api repos/DAEMON-404/daemon-sec-lotl/pages`: Pages is still
   **enabled** with `build_type: workflow` — since the workflow is now deleted, the last Pages
   deployment will stay live indefinitely until Pages is switched off in repo settings.
 - `.github/` directory no longer exists at all (no issue templates, no dependabot, no CI).
 - Local toolchain: node v26.7.0 / npm 11.19.0 — `engines: >=20` is satisfied; pin Vercel's
   Node version explicitly (project setting or `"node": "22.x"`) so a Vercel default bump can't
   silently change the build.
 - `https://daemon-sec-lotl.vercel.app` → 404. Checked the Vercel account via the Vercel MCP:
   team `00xnetrunners-projects` (Pro plan) has only two projects, `daemon-sec` (the main site)
   and `eve-chat-template`. **There is no Vercel project for this repo yet.** The migration in
   the working tree (vercel.json, analytics scripts, `site` URL) is ahead of the actual
   infrastructure: create the project (GitHub import, preset Astro), add the `lotl.daemon-sec.xyz`
   domain, then a CNAME/ALIAS in the `daemon-sec.xyz` DNS.
 - `vercel.json` has no `redirects`, and no `Cache-Control` override for `/data/*.json` or
   `/pagefind/*` (Vercel defaults are fine for hashed `_astro/*`, but `/data/techniques.json` is
   unhashed → stale-after-deploy risk unless cache headers are short or the URL is versioned).
 
 ### F4. Catalog island (`src/scripts/catalog.ts`, 211 lines) — functional gaps
 Verified by reading the code (line refs are to the working tree):
 - **Back button is broken for filters.** URL sync uses `history.replaceState` only
   (`catalog.ts:122`) and there is no `popstate` listener. Changing a filter never creates a
   history entry, so Back leaves the page instead of undoing the filter. Deep links do work on
   first load (`:91`).
 - **No sort.** Results render in dataset order only (GTFOBins first, alphabetical by tool).
   No "by tool / by source / by capability / NEW first".
 - **Facet chips lose keyboard focus.** Clicking a chip calls `renderFacets()` (`:95`) which
   `innerHTML`-rebuilds the chip bar (`:133-141`), destroying the focused button → focus drops to
   `<body>`. Counts on chips are global totals computed once (`:80-89`), not contextual, so the
   rebuild is pure waste.
 - **"Show more" collapses expanded rows.** Open state lives only in the DOM (`:168-171`) and
   `render()` (`:106`) replaces the whole list; every keystroke re-serialises all visible rows
   (400 after ten "Show more" clicks). `PAGE = 40` (`:16`).
 - **Text query is a per-call substring scan** (`lib/techniques.ts:85-91`) that concatenates and
   lowercases every record on each keystroke (130 ms debounce at `catalog.ts:143-147`). Fine at
   2885 rows but a precomputed lowercase haystack per record would cut allocation to zero.
 - Copy does a linear `all.find` per click (`:159`); clipboard logic is duplicated three times
   (`copy.ts:5-28`, `catalog.ts:178-189`, `app.ts:317-330`); `url()` is reimplemented at
   `catalog.ts:15` instead of importing `lib/url.ts`; `escapeHtml` duplicated in
   `SearchModal.astro:350`.
 - `Technique.context` and `toolType` are never rendered by the island; `isEmpty` and
   `accentOf` in lib are dead exports.
 - No fuzzy matching anywhere (`fuzz.ts` is the canvas background, not a fuzzy matcher).
 
 ### F5. Search (`SearchModal.astro`) — solid, but tool-page-only
 Opens on `/`, Cmd/Ctrl+K, and `[data-search-open]`; Pagefind loads lazily on first open
 (`:316-330`), 8 results, 120 ms debounce, stale-response guard, full listbox ARIA + keyboard
 nav. Limitation: results are tool pages, never a specific technique row, and no facet
 (platform/source) filtering inside the modal even though `source:` is emitted as Pagefind meta
 (`[tool].astro:49`). `escapeHtml` there also escapes `'`, unlike `lib/highlight.ts:6`.
 
 ### F6. XSS surface — clean, with one unvalidated sink
 Every `innerHTML`/`set:html` site interpolates through `escapeHtml`/`highlightCommand`. The one
 gap: `href` built from `detection.value` and `references[]` (`catalog.ts:48-49`,
 `[tool].astro:113,115`) escapes quotes but does not validate the URL scheme; the Zod schema
 (`build-dataset.mjs:201`) types references as bare `z.string()`. 0/2885 records are non-http
 today, but a bad upstream merge would become a `javascript:` link. Fix at the schema
 (`z.string().url()` + `^https?:`), not at render time.
 
 ### F7. Background animation cost (`fuzz.ts`)
 The canvas signal field runs a permanent 60 fps rAF loop with a DPR-scaled backing store
 (`fuzz.ts:175-179`) and has **no visibility/IntersectionObserver pause** — it keeps painting
 while scrolled off-screen and in background tabs (rAF throttles in hidden tabs, but not when
 merely off-screen). `hero.ts` already pauses on `visibilitychange` (`:55`); `fuzz.ts` should get
 both. Reduced motion is handled (single still frame).
 
 ### F8. Leaks / lifecycle
 `initTOC()` in `app.ts:414-432` is the only init without a `data-*-bound` guard: it creates a
 new `IntersectionObserver` on every `astro:page-load` and never disconnects. Harmless on this
 site (no TOCs) but it's live code that runs on every navigation. `copy.ts:26` fallback never
 calls `done()` when `execCommand` throws.
 
 ### F9. Zero tests, zero CI
 `"test": "node --test"` runs against nothing. Pure, DOM-free surface that is trivially
 testable with `node:test` + no extra deps: `lib/techniques.ts` (`toolSlug`, `filtersToSearch`
 ↔ `filtersFromSearch` round-trip, `matches`), `lib/highlight.ts` (`escapeHtml`,
 `highlightCommand` output never contains raw `<` from input), `scripts/wadcoms-normalize.mjs`
 (`impacketScript`, `canonicalizeFamilyCase`). No TODO/FIXME anywhere in `src/`.
 
 ### F10. The catalog is invisible to crawlers and JS-off readers
 `dist/catalog/index.html` is 17 KB: `[data-cat-results]` ships empty with "Loading the index…"
 (`catalog.astro:40`). Zero of 2885 techniques are in the catalog HTML. They *are* SSR'd on the
 842 tool pages, so the content is indexable, but `/catalog?p=Windows&c=...` deep links share one
 generic title/description and render nothing without JS. Options, cheapest first: (a) SSR the
 first `PAGE` rows into the shell so there is a first paint + crawlable sample; (b) generate
 static per-facet landing pages (`/catalog/windows`, `/catalog/privilege-escalation`) from
 `facets.json` with real titles; (c) both.
 
 ### F11. SEO / social bugs (all in `Base.astro` / `public/og.svg`)
 - `og:image` is **relative** (`Base.astro:41` → `content="/og.svg"`); OG requires absolute.
 - The OG image is an **SVG** — unsupported by Facebook, X, LinkedIn, Slack, Discord.
 - `public/og.svg` is the **wrong site's card** ("DÆMON//SEC — The cheatsheet vault…").
 - Missing: `og:url`, `og:site_name`, `og:image:width/height/alt`, `twitter:title`,
   `twitter:description`, `twitter:image`. `twitter:card=summary_large_image` with no image is a
   no-op.
 - **No JSON-LD** anywhere. Tool pages → `TechArticle` + `BreadcrumbList`; home → `WebSite` with
   `SearchAction`; the dataset itself → `Dataset` (with the GPL licence + upstream `isBasedOn`).
 - **Canonicals and sitemap emit trailing slashes** (`…/catalog/`) but `vercel.json` sets
   `cleanUrls: true, trailingSlash: false` → Vercel 308s `/catalog/` → `/catalog`. All 849
   canonical URLs point at a redirect. Fix: `trailingSlash: 'never'` in `astro.config.mjs` +
   `build.format: 'file'` **or** flip vercel.json to `trailingSlash: true`. Pick one and make
   canonical, sitemap and `url()` agree.
 - `[tool].astro:46` pluralises on `> 1` so a 0-technique tool would read "0 technique".
 - Per-deck index pages do pass a description (`[source]/index.astro:36`) — fine.
 - D1 verified against `node_modules/astro/dist/core/build/generate.js:310`
   (`ending = trailingSlash === "never" ? "" : "/"`) and `@astrojs/sitemap/dist/index.js:76`,
   which special-cases `never`.
 
 ### F12. Accessibility gaps
 - **Heading order**: home is `h1` → `h3` (`HeroDeck.astro:47`, `index.astro:78`), no h2.
   **Tool pages have a single h1 and no other headings** — each technique is an `<article>` with
   a `<span class="tech__name">` (`[tool].astro:83-86`), so heading navigation is useless on the
   site's core content. Make technique names `<h2>` (styled identically).
 - **SearchModal**: `#search-results` lacks `role="listbox"` (`:23-25`) while children are
   `role="option"` → invalid ARIA; **no focus trap**; `close()` (`:340-348`) never restores focus
   to the opener; `[data-search-status]` (`:22`) has no `aria-live`.
 - **Catalog**: `[data-cat-count]` rewritten on every filter with no `aria-live`; row expander
   has `aria-expanded` but no `aria-controls`/`id` pairing (`catalog.ts:53-58`).
 - Skip link uses `:focus-visible` only (fine in evergreen browsers).
 - Contrast ratios pass per `tokens.css:58-60,129-137`; the risk is **size**: `--fg-faint` at
   8.5–10.5 px labels (`[source]/index.astro:73`, `index.astro:130-134`). Bump to ≥11 px.
 - Reduced motion is handled thoroughly everywhere (app/hero/fuzz/css).
 
 ### F13. Theming: no OS dark-mode fallback
 `<html data-theme="light">` is hard-coded (`Base.astro:26`); the pre-paint script (`:44-78`)
 reads `localStorage` only, never `matchMedia('(prefers-color-scheme: dark)')`. `theme-color`
 meta *does* respond to the OS (`:36-37`), so a dark-OS first visit gets a cream page with dark
 browser chrome. One-line fix in the inline script.
 
 ### F14. Dead code and dead bytes
 - Components with **zero imports**: `Operator.astro` (71 lines), `RecordRow.astro` (48, superseded
   by `catalog.ts:53-67`), `SectionHeader.astro` (26, only used by the dead `Operator`).
 - **Dead font**: `'Old Standard TT'` `@font-face` at `tokens.css:50` is referenced by no
   `--font-*` token, yet Vite base64-inlines its 3 KB woff2 into the 78 KB CSS on every page.
 - `sharp` is a dependency but `astro:assets` is unused (no images on the site) — keep it only if
   the OG-PNG task below uses it at build time; otherwise drop.
 - `src/fonts/` has 16 woff2 files; only 2 are preloaded (`Base.astro:34-35`); all
   `font-display: swap`.
 
 ### F15. 404 page doesn't help
 `404.astro` shows a fake `curl -sI` block and two static actions. With 842 slugs known at build
 time, a client-side nearest-slug suggestion ("did you mean /gtfobins/tar?") from
 `Astro.url.pathname` is cheap: ship the slug list (~10 KB) inline on the 404 page only.
 
 ### F16. Data pipeline — clean, but unsorted and unmonitored
 Stats (computed read-only from `src/data/techniques.json`):
 
 | metric | value |
 |---|--:|
 | techniques / tools | 2,885 / 842 |
 | by source | GTFOBins 2,125 · LOLBAS 481 · WADComs 100 · DÆMON 179 |
 | by platform (multi) | Linux 2,306 · macOS 890 · Windows 744 · AD 217 |
 | missing `description` | 1,264 (44%) |
 | empty `mitre` | 190 (7%) |
 | has `detection` | 506 (18%) |
 | truly redundant rows (same toolId+context+command) | 46 (40 groups, e.g. `gtfo:code:download:0:sudo` ×6) |
 | schema / taxonomy / MITRE-id / URL violations | 0 |
 | orphan tools, orphan techniques, dup ids | 0 |
 
 - **Output order is readdir order**, not sorted (`build-dataset.mjs:135-140` `listFiles()` has no
   `.sort()`). Same machine → stable; different FS → a 2 MB reorder diff with no content change.
   Add a stable sort by `id` before emit.
 - **46 genuinely duplicate rows** (identical toolId + context + command) inflate counts. Dedup at
   ingest with a stable "keep first" rule and log what was dropped.
 - **Freshness is invisible**: upstream commit hashes are recorded (`facets.commits`) but there
   is no last-synced date and nothing checks for new upstream commits. A weekly GitHub Actions
   cron that runs `git ls-remote` against the three upstreams and opens an issue/PR when the
   hash moves is cheap.
 - **Cross-repo build input**: `build-dataset.mjs:33` reads
   `../daemon-sec/client/src/data/tools/wadcoms.ts` from a sibling checkout. Present on this
   machine, but if absent the script **silently skips 134 DÆMON additions** (`:428-432`) and
   emits a smaller dataset. Should be a hard error unless `--allow-missing-additions` is passed,
   and ideally the additions should be vendored into this repo (or fetched by URL/commit).
 - `references` schema is `z.string()` — tighten to `z.string().url()` + `^https?://` (see F6).
 - Client projection: the fetched file's byte budget is references 15% · description 14% ·
   detection 14% · command 11%. A list projection dropping `detection` + `references` and
   truncating `description` to 160 chars measures **1,019,976 B = 0.498×**; a minimal
   id/tool/platform/capability/command list is 774 KB (0.38×). Detail fields already exist on
   the SSR'd tool pages, so the island can link out rather than lazy-load.
 - `daemon-backlog.json`: 45 entries, 100% populated, no placeholders. Good.
 
 ### F17. 44% of techniques have no description
 1,264 rows (overwhelmingly GTFOBins, whose upstream YAML has per-function descriptions only
 sometimes) render as bare command + badges. The GTFOBins `_data/functions.yml` has a canonical
 description per function — verified against upstream master, e.g. `shell: "This executable can
 spawn an interactive system shell."`, `reverse-shell: "…can send back a reverse system shell to
 a listening attacker."`; falling back to that at ingest time (and, for the committed JSON, via a
 one-shot migration keyed on `nativeCategory[0]`) gives every GTFOBins row a one-line description
 with zero authoring. Prefix with the context where set ("As sudo: …").
 
 ## Survey complete — summary of the picture
 
 The site is in good shape structurally (clean data, escaped rendering, thorough reduced-motion,
 lazy Pagefind). The problems cluster into five tracks:
 
 1. **Ship it properly** — the Vercel migration is half done (no project, no DNS, wrong OG card,
    canonicals → redirects, old Pages site live, no CI).
 2. **Catalog UX** — back button, sort, focus loss, expanded-row loss, no SSR content.
 3. **Findability/SEO** — JSON-LD, per-facet landing pages, absolute OG PNG, heading structure.
 4. **Weight** — halve the dataset payload, purge unused CSS, drop the dead font/components.
 5. **Data** — sort-stable output, dedup, description fallback, upstream drift check, hard-fail
    on missing additions.
 
 ## Design decisions (resolved, not surveyed)
 
 **D1. Trailing slash → `trailingSlash: 'never'` in `astro.config.mjs`, keep `build.format`
 at its default `directory`.** `never` + `directory` makes Astro's `getUrlForPath` emit
 slash-less URLs (sitemap and `Astro.url.pathname` agree with `vercel.json`'s
 `trailingSlash: false`) while the physical output stays `…/index.html`, which is what keeps
 Pagefind emitting `/gtfobins/bash`-style hrefs. Switching to `file` would make Pagefind index
 `bash.html` and emit `.html` URLs that 308. Also: harden the canonical in `Base.astro:23`
 (`pathname.replace(/(.)\/$/, '$1')`) and strip the trailing slash on Pagefind hrefs in
 `SearchModal.astro:524`. `url()` in `lib/url.ts` needs no change.
 
 **D2. Catalog SSR → server-render the first `PAGE` (40) rows into the shell; per-facet landing
 pages are a follow-on.** `catalog.ts` runs `boot()` at module scope and touches `document`, so
 it can't be imported from Astro frontmatter. Extract the pure renderers (`renderRow`, `chip`,
 `facetGroup`, `badge`) into a new `src/lib/render-row.ts` (zero DOM, zero side effects) and
 import it from both `catalog.ts` and `catalog.astro`. Hand-off: the page renders
 `techniques.slice(0, 40).map(renderRow)` into `[data-cat-results]` with a `data-ssr` marker and
 the real count text. On boot the island reads `filtersFromSearch(location.search)`; if
 `isEmpty(filters)` (currently a dead export in `lib/techniques.ts`) **and** `data-ssr` is set,
 it wires listeners but skips the initial `render()` until the first interaction. Copy reads the
 command from the row's own `<pre><code>` textContent, so it works before the fetch resolves.
 
 **D3. Slim payload → `public/data/index-<sha256[0:8]>.json` (~1.0 MB, 0.5×).** Keep per row:
 `id, toolId, toolName, name, source, platform[], capability[], command, added?, description`
 (truncated to 160 chars). Drop `usecase, mitre, privilege, context, requires, services,
 fullPath, toolType, detection, references, verifyNote`. The expanded row shows description +
 badges + a "full details →" link to `toolRoute(t.toolId)#<technique-id>` (add `id={t.id}` on
 `<article class="tech">` at `[tool].astro:83`). Anchor beats lazy per-tool fetch: the detail is
 already SSR'd there and it needs no new fetch infrastructure. A `scripts/build-index.mjs`
 writes the hashed file plus `src/data/index-hash.json` (`{"file": "index-….json"}`), which
 `catalog.astro` imports → `data-index-url`; the island fetches `root.dataset.indexUrl`.
 `vercel.json` gets `Cache-Control: public, max-age=31536000, immutable` for
 `/data/index-(.*).json`. `.gitignore` already covers `/public/data/`; add `build:index` to
 both `build` and `dev` scripts.
 
 **D4. History → push on discrete intent, replace on keystroke.** `sync(push: boolean)`:
 `pushState` for facet toggle / NEW / clear / sort, `replaceState` from the debounced query
 handler. `popstate` handler re-reads `filtersFromSearch(location.search)`, resets `limit`,
 re-renders, and never calls `sync` (no echo entry).
 
 **D5. CI → two workflows, no deploy job (Vercel deploys).** `ci.yml`: job `quality`
 (`npm ci` → `npm run check` → `npm test` → `npm run validate:data`) and job `build`
 (`npm ci` → `npm run build`). `upstream-drift.yml`: weekly cron, `git ls-remote <upstream> HEAD`
 ×3, compare the short hash against `facets.json .commits`, `gh issue create` on divergence.
 New scripts: `check: astro check`, `test: node --test test/`,
 `validate:data: node scripts/validate-data.mjs`, `build:index`. New devDep: `@astrojs/check`
 (not installed today; `typescript` is).
 
 **D6. OG image → one site-wide 1200×630 PNG rendered at build by `sharp`** from a corrected
 DÆMONBins SVG template (`scripts/og.mjs` → `public/og.png`), run before `astro build` so it
 lands in `dist/`. Per-source variants are a nice-to-have later.
 
 **D7. JSON-LD → `src/lib/jsonld.ts` builders, injected by a `jsonLd` prop on `Base.astro`.**
 Tool page: `TechArticle` (headline = tool name, `articleSection` = source label, `keywords` =
 capabilities, `about` = MITRE ids) + `BreadcrumbList` (Catalog → Source → Tool). Home:
 `WebSite` + `SearchAction` targeting `/catalog?q={search_term_string}`. Catalog:
 `CollectionPage`. Credits: `Dataset` (`license` = GPL-3.0 URL, `isBasedOn` = the three
 upstream repos from `SOURCE_META`).
 
 **D8. Tests → `node --test test/*.test.mjs`, TS loaded through esbuild.** A tiny
 `test/_loadts.mjs` bundles a TS entry with `esbuild.build({bundle: true, format: 'esm',
 write: false})` and imports it as a `data:` URL — the exact pattern `build-dataset.mjs:435`
 already uses, so zero new deps and extensionless intra-lib imports resolve. Plain
 `--experimental-strip-types` would not resolve those.
 
 **D9. GitHub Pages → disable it once Vercel + DNS are live.** No CI can update it any more, so
 it will only rot. If inbound links matter, first push a one-off `gh-pages` branch of stub pages
 with `<meta http-equiv="refresh">` + canonical to the new domain, keep it ~30 days, then
 disable.
 
 ## Prerequisites (user-side, outside the repo)
 
 These block Track 1 verification and cannot be done from code:
 
 1. Create the Vercel project: import `DAEMON-404/daemon-sec-lotl` into team
    `00xnetrunners-projects`, framework preset Astro (vercel.json pins the rest). Set Node to
    `22.x` in project settings. Enable Web Analytics + Speed Insights (the `<head>` scripts in
    `Base.astro` are already wired and no-op until then).
 2. Add the domain `lotl.daemon-sec.xyz` to the project; add the CNAME (or ALIAS) record in the
    `daemon-sec.xyz` DNS zone.
 3. After the first successful production deploy: disable GitHub Pages in repo settings (D9).
 4. Locally, when Track 5 needs to regenerate data: run `scripts/setup-vendor.sh` /
    `git submodule update --init` to populate `vendor/`.
 
 ## Backlog (ordered)
 
 Effort S ≈ <1 h, M ≈ half a day, L ≈ a day. Impact is user-visible impact.
 
 ### Track 0 — Tooling / CI (guardrail first)
 
 **T0.1 Extract the Zod schema + `validate:data`** · S · dev
 Files: new `scripts/technique-schema.mjs` (move `TechniqueSchema` + enums out of
 `build-dataset.mjs:181-204`; `build-dataset.mjs` imports it), new `scripts/validate-data.mjs`
 (reads `src/data/techniques.json`, `safeParse` every row, dup-id check mirroring
 `build-dataset.mjs:534-549`, exit 1 on any failure). Verify: `node scripts/validate-data.mjs`
 exits 0 today.
 
 **T0.2 Test suite** · M · dev
 Files: `test/_loadts.mjs`, `test/techniques.test.mjs`, `test/highlight.test.mjs`,
 `test/wadcoms.test.mjs`; `package.json` `test` script. Assertions:
 - `toolSlug('gtfo:vim') === 'vim'`; `toolSlug('wadcoms:Impacket-GetUserSPNs')` lower-cases;
   `filtersFromSearch(filtersToSearch(f))` deep-equals `f`; `filtersToSearch(EMPTY_FILTERS) === ''`;
   `matches` passes a Linux row for `{platform:['Linux']}`, fails for `['Windows']`; `addedOnly`
   excludes non-`added`.
 - `escapeHtml('<b>&"')` has no `<` or `"`; `highlightCommand('echo <x>')` has no raw `<x>`.
 - `impacketScript(['…/examples/secretsdump.py'], cmd) === 'secretsdump'`, falls back to the
   command basename, `null` otherwise; `canonicalizeFamilyCase` folds `Enum4Linux`/`enum4linux`.
 Verify: `npm test` green. Deps: none.
 
 **T0.3 CI + upstream-drift workflows** · S · dev
 Files: `.github/workflows/ci.yml`, `.github/workflows/upstream-drift.yml`, `package.json`
 (`check`), devDep `@astrojs/check`. Per D5. Verify: `npm run check` locally, then a push.
 Deps: T0.1, T0.2.
 
 ### Track 1 — Ship it properly
 
 **T1.1 Trailing-slash canonicalisation** · S · high
 Files: `astro.config.mjs` (`trailingSlash: 'never'`), `Base.astro:23`, `SearchModal.astro:524`.
 Per D1. Verify: rebuild; `grep -c '/</loc>' dist/sitemap-0.xml` → 1 (only `/`); canonical in
 `dist/gtfobins/bash/index.html` is `…/gtfobins/bash`. Deps: none.
 
 **T1.2 OG PNG + complete social meta** · M · high
 Files: new `scripts/og.mjs`, corrected `public/og.svg` (currently the cheatsheet's card),
 `Base.astro:38-42`, `package.json` build chain. Add absolute `og:image`
 (`new URL('/og.png', Astro.site)`), `og:url`, `og:site_name`, `og:image:width/height/alt`,
 `twitter:title/description/image`. Verify: `file dist/og.png` → PNG 1200×630; view-source shows
 absolute URLs; paste a tool URL into a card debugger once live. Deps: none.
 
 **T1.3 OS dark-mode fallback** · S · med
 File: `Base.astro:48-50` — when `localStorage.theme` is unset, use
 `matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light'`. Verify: dark-OS
 first visit paints Night, toggle still persists. Deps: none.
 
 **T1.4 Cache headers + Node pin** · S · med
 File: `vercel.json` — immutable header for `/data/index-(.*).json`; `max-age=600` for the
 unhashed `/data/techniques.json` while it still exists; leave `_astro/*` to Vercel defaults.
 Node `22.x` in the Vercel project. Deps: T4.1 for the hashed name (header can land first).
 
 **T1.5 Pages sunset** · S · med — per D9; user-side switch after T1.1/T1.2 are live.
 
 ### Track 2 — Catalog UX (one coherent island refactor)
 
 **T2.1 Back button** · S · high
 File: `catalog.ts:119-151`. Per D4. Verify: toggle two facets, Back undoes them one at a time;
 typing does not spam history; reload keeps state. Deps: none.
 
 **T2.2 Facet focus retention + live counts** · S · med
 Files: `catalog.ts:94-101,133-141`; `catalog.astro:40` (`aria-live="polite"` on
 `[data-cat-count]`). Toggle `aria-checked` on the clicked chip in place instead of rebuilding
 `facetsEl.innerHTML`; rebuild only on clear/popstate. Verify: keyboard-toggle a chip, focus
 stays on it; screen reader announces the new count. Deps: T2.1.
 
 **T2.3 Persist expanded rows across "Show more"; copy from DOM** · S · med
 Files: `catalog.ts:103-117,151,154-172`. "Show more" appends only the new slice via
 `insertAdjacentHTML('beforeend', …)`; copy reads `.trow__cmd code` textContent (drops the
 `all.find` and lets `copy.ts` be the single clipboard helper — delete the duplicate in
 `catalog.ts:178-189`). Add `aria-controls`/`id` pairing on the expander. Verify: expand, Show
 more, row stays open. Deps: T2.1.
 
 **T2.4 Sort control** · M · med
 Files: `catalog.astro` (`<select data-cat-sort>`: tool · source · capability · NEW first),
 `lib/techniques.ts` (`sortTechniques(list, key)` pure fn; `sort=` in `filtersTo/FromSearch`),
 `catalog.ts` (sort before slice). Verify: unit test on `sortTechniques`; URL carries `sort=`.
 Deps: T2.1.
 
 **T2.5 Small island hygiene** · S · low
 `catalog.ts:14-15` import `url()` from `lib/url.ts` instead of reimplementing; delete dead
 exports `accentOf` (unless T3.4 uses it); precompute a lowercase haystack per record once at
 boot instead of per keystroke in `lib/techniques.ts:85-91`. Deps: T2.1.
 
 ### Track 3 — Findability / SEO / a11y
 
 **T3.1 Heading structure** · S · med
 Files: `[tool].astro:85-86` (`<span class="tech__name">` → `<h2 class="tech__name">`, CSS keys
 off the class so visuals hold), `index.astro` (an `h2` before the deck grid so home is not
 h1→h3), `[tool].astro:46,58` (pluralise on `!== 1`). Verify: heading outline in devtools /
 axe. Deps: none.
 
 **T3.2 SearchModal ARIA** · S · med
 File: `SearchModal.astro:22-25,340-348`. Add `role="listbox"` on `#search-results`,
 `aria-live="polite"` on `[data-search-status]`, remember the opener and restore focus in
 `close()`, trap Tab inside the dialog while open. Verify: open with `/`, Tab cycles inside,
 Esc returns focus to the trigger. Deps: none.
 
 **T3.3 JSON-LD** · M · med
 Files: new `src/lib/jsonld.ts`, `Base.astro` (`jsonLd` prop → `<script type="application/ld+json" set:html={JSON.stringify(obj)}>`),
 `[tool].astro`, `index.astro`, `catalog.astro`, `credits.astro`. Per D7. Verify: paste dist HTML
 into Google's Rich Results test. Deps: T1.1 (URLs in breadcrumbs must be canonical).
 
 **T3.4 SSR the first 40 catalog rows** · L · high
 Files: new `src/lib/render-row.ts`, `catalog.ts`, `catalog.astro`. Per D2. Verify:
 `wc -c dist/catalog/index.html` grows from 17 KB to ~60 KB; with JS disabled the page shows 40
 rows; no double-render flash; deep link `/catalog?p=Windows` still applies filters on boot.
 Deps: T2.1–T2.3.
 
 **T3.5 Per-facet landing pages** · M · med
 File: new `src/pages/catalog/[facet].astro` — `getStaticPaths` from `facets.json`
 (platforms + sources + capabilities ≈ 26 pages), each with a real title/description/canonical,
 reusing `render-row.ts` + `filterTechniques`, linking into `/catalog?…` for the interactive
 view. Verify: `ls dist/catalog/`; sitemap gains 26 URLs. Deps: T3.4, T1.1.
 
 **T3.6 Smarter 404** · S · low
 File: `404.astro` — inline the 842 slugs from `tools.json` (~10 KB, this page only), nearest
 match on `location.pathname` → "Did you mean /gtfobins/tar?". Deps: none.
 
 **T3.7 Label legibility** · S · low
 Bump `--fg-faint` micro-labels from 8.5–10.5 px to ≥ 11 px at `[source]/index.astro:73` and
 `index.astro:130-134`. Deps: none.
 
 ### Track 4 — Weight
 
 **T4.1 Slim hashed list payload** · M · med
 Files: new `scripts/build-index.mjs`, generated `src/data/index-hash.json`, `catalog.ts:200`,
 `catalog.astro`, `[tool].astro:83` (`id={t.id}`), `package.json` (`build:index` in `build` and
 `dev`). Per D3. Verify: `wc -c public/data/index-*.json` ≈ 1.0 MB; catalog still filters;
 "full details →" lands on the right anchor. Deps: T3.4.
 
 **T4.2 Canvas pause + lifecycle leaks** · S · low
 Files: `fuzz.ts:175-179` (pause the rAF loop on `visibilitychange` and when the canvas leaves
 the viewport via IntersectionObserver, like `hero.ts:55`), `app.ts:414-432` (guard `initTOC`
 with `data-toc-bound` and disconnect on `astro:before-swap`, or delete it — no TOCs exist),
 `copy.ts:26` (call `done()` before the `execCommand` try can throw). Verify: scroll the hero
 off-screen, CPU drops in the performance panel. Deps: none.
 
 **T4.3 Dead font + dead components** · S · low
 Remove the `'Old Standard TT'` `@font-face` at `tokens.css:50` (base64-inlined into every
 page's CSS); delete `Operator.astro`, `RecordRow.astro`, `SectionHeader.astro` after a final
 `grep -rn` confirms zero imports. Verify: bundle CSS shrinks by ~4 KB; build passes. Deps: none.
 
 **T4.4 CSS coverage pass** · M · low
 Prune cheatsheet-only selectors from `global.css` / `daemon.css` (`.download-library__head`,
 TOC, callouts, scroll-progress) after a browser coverage run on `/`, `/catalog`, a tool page and
 a deck page. Non-blocking; do last. Deps: none.
 
 ### Track 5 — Data (verify via one-shot migration + unit tests; `vendor/` is absent here)
 
 **T5.1 Stable sort + dedup** · M · low (user) / high (diff hygiene)
 Files: `build-dataset.mjs:135-140` (`.sort()` in `listFiles`), a stable `sort by id` before
 emit, keep-first dedup on `toolId+context+command` with a log line; new one-shot
 `scripts/normalize-order.mjs` (mirror `split-impacket.mjs`) that applies the same sort+dedup to
 the committed JSON now. Verify: run the one-shot; `validate:data` still 0; technique count
 drops by 46; `facets.json` counts regenerate. Deps: T0.1.
 
 **T5.2 Tighten `references` / `detection.value`** · S · low (security)
 File: `scripts/technique-schema.mjs` — `z.string().url().regex(/^https?:\/\//)`. Verify:
 `validate:data` passes (0 non-http today). Deps: T0.1.
 
 **T5.3 Hard-fail on missing DÆMON additions** · S · low
 File: `build-dataset.mjs:428-432` — throw unless `--allow-missing-additions`; longer term,
 vendor the 134 additions into this repo so the build has no sibling-checkout dependency.
 Deps: none.
 
 **T5.4 GTFOBins description fallback** · M · med
 Files: `build-dataset.mjs` (a `GTFO_FN_DESC` table from `_data/functions.yml`, applied when
 `description` is empty, prefixed with the context), plus a one-shot migration keyed on
 `nativeCategory[0]` for the committed JSON. Verify: missing-description count drops from 1,264
 toward ~0 for GTFOBins; unit test on `descFor(fn, context)`. Deps: T5.1.
 
 **T5.5 Freshness signal** · S · low
 Show `facets.commits` short hashes (already recorded) on `/credits` with a link to each
 upstream commit, so readers can see how current each deck is; the drift cron in T0.3 keeps
 them honest. Deps: T0.3.
 
 ## Recommended first pass (~1–2 days)
 
 1. **T0.1 → T0.2 → T0.3** — guardrail first; nothing after this can regress silently.
 2. **T1.1 + T1.3** — one-line, high-leverage: 849 canonicals stop pointing at redirects; dark-OS
    first visit is right.
 3. **T1.2 + T3.3 + T3.1 + T3.2** — the SEO/a11y payload that makes the migration worth shipping;
    all independent, all checkable in `dist/`.
 4. **T2.1 → T2.2 → T2.3 → T2.5** — the island refactor as one coherent change.
 5. **T3.4 + T4.1 (+ T1.4)** if time remains — the biggest single win (crawlable catalog, first
    paint, half the payload) and the riskiest hydration change, so it goes last with tests in
    place.
 
 Second pass: T2.4 sort, T3.5 facet pages, T3.6 404, T3.7, T4.2–T4.4, all of Track 5, T5.5.
 Track 5 lands behind the one-shot migrations + unit tests until `vendor/` is populated.
 
 ## Verification
 
 Per-item checks are listed inline above. End-to-end, after each pass:
 
 ```bash
 npm ci
 npm run check          # astro check (after T0.3)
 npm test               # node --test (after T0.2)
 npm run validate:data  # Zod over the committed JSON (after T0.1)
 npm run build          # data:public → astro build → pagefind
 npm run preview        # http://localhost:4321
 ```
 
 Then, in the browser (Chrome tools available in this session):
 - `/` — dark-OS first visit paints Night; counters animate; hero deck cycles; `/` opens search.
 - `/catalog` — 40 rows visible before the fetch resolves (T3.4); toggle two facets then press
   Back twice (T2.1); Tab to a chip, Space, focus stays (T2.2); expand a row, Show more, still
   open (T2.3); `?p=Windows&c=Execution` deep link applies on load.
 - `/gtfobins/bash` — h1 + h2 outline; JSON-LD validates; `#<technique-id>` anchor scrolls.
 - View-source on any page: canonical without trailing slash, absolute `og:image` PNG.
 - `dist/sitemap-0.xml` — no trailing slashes; `dist/og.png` is 1200×630.
 - Network panel on `/catalog` — one `index-<hash>.json` ≈ 165 KB brotli, `immutable` cached.
 
 Once the Vercel project + DNS exist: `curl -sI https://lotl.daemon-sec.xyz/catalog/` → 308 to
 `/catalog`; `curl -sI …/data/index-<hash>.json` shows the immutable header; social card
 debugger renders the PNG; GitHub Pages returns 404 after T1.5.
 
 ## Progress log (first pass, 2026-09-04)
 
 Ticked as each item lands in the working tree. Nothing is committed — VCS is the user's.
 
 - [x] **T0.1** `scripts/technique-schema.mjs` (vocabulary + `TechniqueSchema` + `HttpUrl` +
   `validateTechniques()`), `scripts/validate-data.mjs` (schema, unique ids, tool↔technique
   integrity, facet-count consistency, taxonomy.ts drift). `build-dataset.mjs` now imports both;
   `zod` import dropped there. `npm run validate:data` → OK on the committed data. T5.2 landed
   with it (references must match `^https?://\S+$`, MITRE ids must match `^T\d{4}(\.\d{3})?$`).
 - [x] **T0.2** `test/_loadts.mjs` (esbuild → data: URL loader), `test/techniques.test.mjs`,
   `test/highlight.test.mjs`, `test/wadcoms.test.mjs` — 12 tests, all green via `npm test`.
 - [x] **T0.3** `.github/workflows/ci.yml` (quality + build jobs, canonical-slash sanity check)
   and `.github/workflows/upstream-drift.yml` (weekly `git ls-remote` vs `facets.commits`,
   opens/updates a labelled issue). `@astrojs/check` installed; `npm run check` added.
   `astro check` surfaced 11 pre-existing type errors (implicit `any`s in
   `astro.config.mjs` under `// @ts-check`, `event.key` on `Event` in `app.ts:73`, an
   untyped optional `exact` on the Header NAV items) — all fixed; now **0 errors**.
 - [x] **T1.1** `trailingSlash: 'never'` in `astro.config.mjs`; canonical in `Base.astro` strips
   the slash; Pagefind result hrefs stripped in `SearchModal.astro`. Rebuild + sitemap check
   pending.
 - [x] **T1.2** `Base.astro` now emits absolute `og:image` (PNG), `og:url`, `og:site_name`,
   `og:image:width/height/alt`, `twitter:title/description/image`. New `scripts/og.mjs`
   (`npm run og`) renders `public/og.png` 1200×630 (2× supersampled) from a DÆMONBins template
   with live counts from `facets.json`, using the site's own faces: the WOFF2s in `src/fonts`
   are decompressed to TTF into a temp dir (`woff2_decompress`, fonttools fallback) and served
   to sharp through a private fontconfig — sharp's bundled FreeType renders WOFF2 as tofu.
   Decision change vs. the plan: the PNG is **committed, not built** — Vercel's build image has
   different fonts and a card that differs per environment is worse than one that changes only
   on `npm run og`. `public/og.svg` is now the DÆMONBins template (was the cheatsheet's card).
 - [x] **T1.3** `Base.astro` pre-paint script falls back to `prefers-color-scheme` when no
   stored theme.
 - [x] **T3.2** SearchModal: opener remembered and refocused on close, Tab trapped inside the
   dialog, `aria-live="polite"` on the status line, cheatsheet-era labels ("Search
   cheatsheets", "DÆMON//SEC") corrected. (`role="listbox"` was already toggled dynamically in
   `write()` — the audit's "missing listbox" finding was wrong.)
 - [x] **T3.1** Tool pages: each technique title is an `<h2 class="tech__name">` (metrics
   preserved via `margin:0; line-height:1.3; text-transform:none`); "1 techniques" pluralisation
   fixed in both title meta and description. Home: the two section eyebrows are `<h2>`s with a
   scoped rule that keeps the `<p>` metrics, so the outline is h1 → h2 → h3.
 - [x] **T3.3** `src/lib/jsonld.ts` — `website()` (+ `SearchAction` → `/catalog?q=`),
   `dataset()` (GPL licence, `isBasedOn` the three upstreams with their pinned commit as
   `version`, `DataDownload` → `/data/techniques.json`), `collectionPage()`, `breadcrumbs()`,
   `techArticle()` (keywords = capabilities + platforms + aliases, `about` = MITRE ids with
   ATT&CK URLs, `isBasedOn` = upstream entry), `serialize()` escapes `<`. `Base.astro` takes
   a `jsonLd` prop and emits one inline `application/ld+json` script. Wired on home (WebSite +
   Dataset), /catalog (CollectionPage), /credits (Dataset), every tool page (TechArticle +
   BreadcrumbList).
 - [x] **T2.1 / T2.2 / T2.3 / T2.5** `src/scripts/catalog.ts` rewritten around one `apply()`
   path: facet toggles, NEW and Clear `pushState`; the debounced query `replaceState`s; a
   `popstate` handler re-reads the URL (removed on `astro:before-swap`). Chips are built once and
   their `aria-checked` is toggled in place, so keyboard focus stays on the chip you pressed.
   "Show more" appends the next 40 rows with `insertAdjacentHTML`, so open rows stay open. Each
   expander has `aria-controls` → the panel's `id`. The text query runs against a lowercase
   haystack precomputed once per record. `url()` is imported from `lib/url.ts`. The island no
   longer carries clipboard code: `src/scripts/copy.ts` is now a delegated document-level
   `[data-copy]` handler shared with the tool pages (rows carry `data-cmdbar`), and its fallback
   reports "failed" instead of claiming success when `execCommand` returns false.
   `catalog.astro`: `aria-live="polite"` on the result count. `astro check` 0 errors; build OK.
   **Verified end to end** in headless Chromium over the DevTools protocol against
   `npm run preview` (script: session scratchpad `e2e.mjs`, 32 checks): dark-OS first visit
   paints Night; home outline H1,H2,H2,H3×4; JSON-LD parses; `/` opens search, Esc restores
   focus to the opener; 40 rows render; Windows chip → `?p=Windows`, focus stays on the chip,
   count updates; second facet pushes a second entry; Back undoes one facet at a time and
   restores the count; Forward re-applies; typing → `q=` without pushing history; Clear;
   expander `aria-expanded`/`aria-controls` → panel; Show more → 80 rows with the first row
   still open; deep link `?p=Linux&c=File%20Read&new=1` applies on load; tool pages have h2s,
   slash-less canonical, absolute PNG `og:image`; Pagefind result hrefs carry no trailing
   slash; results container is a listbox. The only console noise is 404s for
   `/_vercel/insights/script.js` and `/_vercel/speed-insights/script.js`, which exist only on
   Vercel (PROD-gated in `Base.astro`) — expected under `astro preview`.
 - [x] **T1.4** `vercel.json`: `Cache-Control: immutable` for `/data/index-(.*).json` (the
   future hashed slim payload) and `max-age=600, must-revalidate` for the unhashed
   `/data/techniques.json`. Node pin is a Vercel project setting (user-side prerequisite #1).
 - [x] **T3.7** Micro-labels raised to 11px: `.src__tplat` (was 8.5px) on deck pages, the
   platform-counter caption and `.home-source__tag` (were 10–10.5px) on the home page.
 
 ### First pass — final gate (all green)
 
 ```
 npm run validate:data   → OK: 2885 techniques, 842 tools, 179 NEW
 npm test                → 12 tests, 12 pass, 0 fail
 npm run check           → 0 errors, 0 warnings
 npm run build           → 850 pages, Pagefind indexed 842
 ```
 
 Headless-Chromium e2e (32 checks): 31 pass; the one "fail" is two `/_vercel/*` script 404s that
 exist only on Vercel and are expected under local preview.
 
 ### Deferred to a second pass (unchanged from the backlog above)
 
 - **T3.4 + T4.1** — SSR the first 40 catalog rows + ship the slim hashed payload. The single
   biggest win and the riskiest hydration change; the shared `render-row.ts` extraction is now
   low-risk because the island is already refactored and unit-tested. Do these together.
 - **T1.5** Pages sunset · **T2.4** sort · **T3.5** per-facet landing pages · **T3.6** smarter
   404 · **T4.2** canvas pause + `initTOC` leak + `copy.ts` fallback (partly done: copy.ts now
   reports failure) · **T4.3** dead font/components · **T4.4** CSS coverage.
 - **Track 5 data** — T5.1 stable sort + dedup, T5.3 hard-fail on missing additions, T5.4
   GTFOBins description fallback, T5.5 freshness on /credits. (T5.2 URL/MITRE schema tightening
   landed with T0.1.) These need `vendor/` for a real `npm run data`; land them behind the
   one-shot migration pattern + unit tests.
 
 ### User-side prerequisites still open (cannot be done from code)
 
 1. Create the Vercel project (import the repo, preset Astro, Node 22.x), enable Analytics +
    Speed Insights.
 2. Add `lotl.daemon-sec.xyz` to the project and the DNS record — the domain does not resolve yet.
 3. After first deploy, sunset GitHub Pages (still live at the old URL with a self-canonical).