Build Notes: isolating two publications in one pipeline

This is a Build Note — a short, dated engineering log entry with the evidence attached. Today: proving that Journal and Notes cannot leak into each other despite sharing one renderer.

The invariant

We hold every claim to the same bar: it must be reproducible from an exact commit. Isolation is no different. The pipeline reads a frozen revision set, renders each article through one Markdown policy, and emits an isolated static site — no runtime API, no credentials, no cookies. That constraint is not decoration; it is what makes the writing trustworthy. If a reader cannot rebuild the artifact behind a sentence, the sentence does not ship. The same discipline governs how we measure success: a small, closed set of privacy-minimal signals, never fingerprinting, never article-level PII. The result is a publication that behaves like the products it describes — deterministic, isolated, and honest about its own evidence.

const issues = findRegistryIssues(TARGETS); // must be []

We hold every claim to the same bar: it must be reproducible from an exact commit. Fail-closed is no different. The pipeline reads a frozen revision set, renders each article through one Markdown policy, and emits an isolated static site — no runtime API, no credentials, no cookies. That constraint is not decoration; it is what makes the writing trustworthy. If a reader cannot rebuild the artifact behind a sentence, the sentence does not ship. The same discipline governs how we measure success: a small, closed set of privacy-minimal signals, never fingerprinting, never article-level PII. The result is a publication that behaves like the products it describes — deterministic, isolated, and honest about its own evidence.