How this instrument is built

• Runtimeursy-estate-runtime 2.5.16
• Familymu — the shared package under mu-plugins provides every module this site has not ruled off
• Response headerX-URSY-Runtime: 2.5.16
• Package fingerprint1a33fb22b6a9cf9646c51c15d694fbcc
• Files fingerprinted41
• This host's site fileursy-recipes.php 622de98d

loader constant URSY_ESTATE_RUNTIME_VERSION · as at 12 Sep 2026 · intended to be the same on every built URSY site; this page can vouch for this host only — compare the fingerprint at each site's /wp-json/ursy-runtime/v1/status · Live

files on disk under mu-plugins/ursy-estate · read now · one md5 over the loader, every module and every asset (41 files) · Live

config family · as at 12 Sep 2026 · mu or theme, as the site file declares; header line from the loader constant · Frozen until the site file changes

Package fingerprint 1a33fb22b6a9cf9646c51c15d694fbcc · the same fingerprint and file list are served to machines at https://ursy.recipes/wp-json/ursy-runtime/v1/status · the live REST server · this request · the parity proof; a reader compares the string across sites · Live

16 from the shared runtime · 0 (honest zero) from this site's theme · 0 (honest zero) ruled off · the loader's module record · this request · counts of the table above · Live

• Security headersconfigured on — the hospitality module is configured to send them; not tested by this page
• Lockdownruntime — only the runtime's own admin surfaces are sealed to the operator door
• Hardening extrasfile_mod, app_passwords, registration, pings — 4 configured, applied at init regardless of lockdown; stated as configuration, not tested
• Hardeningon — provided by the shared runtime
• SEO crawlers blocked in robotsconfigured yes — the hardening module is configured to append a Disallow block for SemrushBot, AhrefsBot and MJ12bot to robots.txt; not tested by this page
• Users sitemapdropped — configured: the hardening module removes the core users sitemap provider wherever it runs (revision 2.0.2, 4 September 2026)
• Rate limiteron — the hospitality module's published buckets apply, per client hash; the limits themselves are in The Doors

config and the loader's module record · as at 12 Sep 2026 · what the site is configured to do, stated as configuration, not as a test result · Frozen until the site file changes

3 corrections and revisions listed, of which 0 (honest zero) are specific to this site · honesty.corrections · as at 12 Sep 2026 · the estate list in uth2/rooms/workings.php plus config uth_corrections, newest first; "revised" or "corrected", never "patched" · Live

• Server-renderedOne facts tree is built per request and held for up to 120 seconds; every figure on this page was in the HTML before the browser opened it. Nothing is fetched, computed or filled in on the client.
• JavaScriptScript this page ships: 0 (honest zero). The page renders fully without it, tables scroll inside their own panel by CSS, and there is no data assembled in the browser to need it; its one script element is the JSON-LD data block, which is data, not code, and is never executed. Inline script elements counted in the delivered document, the JSON-LD data block excepted: 7. Those elements were added by WordPress core, the theme or another plugin through wp_head and wp_footer, not by this page; the runtime removes the core ones it knows of (the emoji script, the admin bar) and counts whatever remains rather than hiding it. the wp_head and wp_footer output captured for this document · this request · every <style> block and every <script> element other than the JSON-LD data block, counted in the captured markup · Live
• StylesheetOne file, assets/uth2.css, enqueued by the runtime. This page's own markup carries no inline style attribute and no inline style block: ursy.fm's Content-Security-Policy is style-src 'self', which silently drops anything inline, and one estate runs one stylesheet so no site's page is the odd one out. Inline style blocks counted in this document: 2. Those blocks were added by WordPress core, the theme or another plugin through wp_head and wp_footer, not by this page; the runtime removes the core ones it knows of (emoji, global styles, admin bar) and counts whatever remains rather than hiding it. the wp_head and wp_footer output captured for this document · this request · every <style> block and every <script> element other than the JSON-LD data block, counted in the captured markup · Live
• Theme handlersOn a theme-family site the theme may register its own anonymous handler for /under-the-hood/ ahead of this page; the router removes those closures for a claimed room request and counts them. Theme handlers stood aside on this request: not counted — the router recorded no count on this render. uth2/router.php ursy_estate_uth2_clear_theme_closures · this request · anonymous closures on template_redirect at priorities 0 to 5 removed for a claimed room on a theme-family site so uth2 can render; named handlers are never touched · Live
• JSON twinhttps://ursy.recipes/wp-json/ursy-runtime/v1/uth?room=workings serves the same facts tree from the same 120-second cache, one shape for every room; the room key tells a machine reader which sections this page shows.
• Headers sent by this pageCache-Control: public, max-age=120 · X-Robots-Tag: index, follow · X-URSY-Runtime: 2.5.16 · Link: <https://ursy.recipes/wp-json/ursy-runtime/v1/uth?room=workings>; rel="alternate"; type="application/json". No Content-Security-Policy is sent by this page: the site's own policy stands, and two would conflict.
• What the brand layer addsThe estate brand layer wraps this document through its output buffer: the network bar after the body opens, the aurora field and the network footer before it closes, data-theme=light where the host is configured light, and rel=nofollow on every cross-estate link. This page prints no header, wordmark or footer of its own.

uth2/router.php, uth2/components.php and this file · as at 12 Sep 2026 · stated by the code that renders this page · Frozen until the runtime changes

• 01 · Lint gate — php -l on every uth2 file and the stylesheet before it is called finished; a failure stops the build.
• 02 · Class audit — every uth2-* class in components.php and rooms/*.php has a rule in assets/uth2.css, and every rule has a use; both lists match the blueprint's contract.
• 03 · Inline audit — a search of uth2/ and the stylesheet for inline style attributes, style blocks and script elements returns only the JSON-LD data block in components.php; then a plain GET of a rendered room counts the inline style blocks and script elements in the delivered document, because wp_head and wp_footer can add what the source audit cannot see.
• 04 · Escaping audit — every echo and every string built into HTML in rooms/*.php passes through a component helper or an esc_* call.
• 05 · Render proof without WordPress — every room rendered against three fixture trees (nothing installed; installed and empty; realistic): every stat carries a provenance line, every table a reconciliation pill and a source line, the absence words appear where the blueprint says, and no zero appears without the words (honest zero) beside it.
• 06 · Facts proof with WordPress — the facts tree builds without a notice under WP_DEBUG and the JSON twin validates as JSON.
• 07 · Deploy proof — one site first, then a plain GET of all twelve rooms and the twin on each site before the next.

The checks are named, not scored: their last result is not printed because this page cannot know it, and a page about verifiable state must not claim a pass it did not witness. The build log lives with the build, not on the site.

Honesty note