[appdevelopsk]

Status: DRAFT / NO-GO

PR #40 is merged; superseded PR #38 is closed without merge. PR #41 contains post-merge hardening. Do not merge or deploy based on isolated test results. GitHub Actions were not invoked.

Implemented

• HTML-safe iframe and attribution link builder. Reject credentials, control characters, unsafe/relative schemes and remote HTTP; preserve valid HTTPS/local-development links.
• ShareBar uses the isolated helper; new Vitest tests and dependency-free Node execution tests cover the embed builder.
• On this PR branch only, the deploy workflow is manual-only (on: workflow_dispatch), keeping VPS lock and release-SHA checks. Current main retains its preexisting auto-deploy workflow until an authorized merge.
• Root scripts/check-postmerge-embed-release.sh checks its exact branch, fetches current origin/main, requires ancestry, and uses the strict scripts/verify-manual-deploy.mjs parser to reject all unreviewed workflow event syntax (including on: [push], inline event lists/mappings, duplicate events). It then runs four dependency-free verifier regression test groups, six embed Node tests, npm install, smoke/integration, typecheck, Vitest, validation, SEO/i18n/index audits and Next build.

Executed evidence (not simulated)

• Exact GitHub-blob-matched verifier and test source materialized locally. node --test verify-manual-deploy.test.mjs: 4/4 passed, including actual CLI accept (0) and reject (4).
• Exact GitHub-blob-matched release gate bash -n: passed. Actual CLI rejects on: [push] with exit 4.
• Fetched real PR41 deploy workflow; event-block verification found one manual-dispatch block and no unexpected events.
• Previously, exact GitHub-blob-matched embed HTML source/test ran under Node 22.16: 6/6 passed, isolated TypeScript strict check passed.
• Latest compare 42 commits ahead of main, zero behind, 10 changed files; no submitted reviews or successful status checks.

Release blockers

• Full private repo checkout/npm ci, project-wide Vitest, complete production Next.js build, cross-browser mobile/desktop/17-locale QA, ad/consent & GA4 DebugView validation, and deployment remain unverified.
• Owner-accessible checkout must run bash scripts/check-postmerge-embed-release.sh on fix/toolify-postmerge-embed-safety-20261107, fix any failures, review the workflow trigger change and browser behavior, then approve PR41. Owner performs manual production deploy and SITE_URL=https://toolify365.com npm run audit:live-growth.

Full evidence: docs/PR40_POSTMERGE_FOLLOWUP_2026-11-07.md. No traffic, conversion or revenue uplift claimed.