# BF38 — Favicon, Social, Cookie & Analytics — Implementation State

Release: R14.28.19 Build Fix 38
Collaboration: TX7.2.3 preserved unchanged
Date: 2026-08-22

## Objective

Ship the supplied TeXise favicon artwork, add Facebook/X public social surfaces, add a persistent optional-cookie notice, enable Statcounter on every production non-admin surface regardless of the optional-cookie choice, and provision an optional Google Analytics / Google Tag ID through `/etc/texise/texise.env` that loads only after explicit acceptance.

## Implemented

- Replaced the six production favicon/PWA image assets with the exact files from `texise-favicon.zip`.
- Preserved TeXise's generated `site.webmanifest` / legacy `manifest.webmanifest` instead of installing the uploaded generic `MyWebSite` manifest.
- Production head retains the requested favicon, shortcut, Apple touch and site-manifest links plus `apple-mobile-web-app-title=TeXise`.
- Added Facebook (`https://www.facebook.com/TeXiser/`) and X (`https://x.com/texiser`) footer links.
- Added a fixed public-site X CTA for `@texiser`, hidden while the cookie notice is open and omitted from application/editor/admin surfaces.
- Added `texise-cookie-consent-v1` local-storage preference with Accept/Decline actions.
- Statcounter project `12568371`, security `b4a422e2`, invisible mode `1` loads on canonical production non-admin routes independently of Accept/Decline; subsequent SPA route changes use Statcounter `record_pageview()` while `/admin` transitions remain excluded.
- Admin routes render no cookie/social overlay and never initialize Statcounter or Google Tag on an admin page load.
- Added optional `TEXISE_GOOGLE_TAG_ID=` provisioning to `/etc/texise/texise.env` and the checked-in env example.
- The trusted server validates `G-*` and `GT-*` IDs and exposes only the public tag ID through `/api/config/public`.
- Google Tag loads from `googletagmanager.com` only when the tag is configured and the browser preference is `accepted`.
- Updated production CSP for the Statcounter and Google Tag script origins.
- Added `/privacy#cookies-and-analytics` copy explaining unconditional non-admin Statcounter and consent-gated Google analytics.

## Exact supplied favicon hashes

- `favicon.svg`: `6557c48d70bddef97e1f6c46d6d84c254eaaa28a718ee197592f867287e10ac0`
- `favicon-96x96.png`: `fa9ec94ba9525b92a310852f158c93f47091013321221b28710b6206284b585a`
- `favicon.ico`: `52ce8d22328157ea35a3960f7199372a2e5563b0d96906efd3820400e329e627`
- `apple-touch-icon.png`: `b2a5a74e77c8fafac0512788f2a4b6949521ae27f19495cbe7629ca420b55f49`
- `web-app-manifest-192x192.png`: `9f0f6bb40e512bc4c864688979351321448db42b8cf9fc429f55e6a4181adf6d`
- `web-app-manifest-512x512.png`: `d70d02fbabf3accaca63061bafbbd53698b320495ad0c570325afdd34439dc0d`

## Google Tag operator action

BF38 provisions but does not populate the value. Later set, for example:

```dotenv
TEXISE_GOOGLE_TAG_ID=G-XXXXXXXXXX
```

in `/etc/texise/texise.env` and restart the trusted TeXise service. A blank value disables Google analytics without affecting Statcounter.

## Verification observed in the source-only build environment

- BF38 focused regression: 10/10 PASS.
- BF37: 14/14 PASS.
- BF36: 8/8 PASS.
- BF35: 16/16 PASS.
- BF34: 14/14 PASS.
- BF33: 22/22 PASS.
- Runtime hardening: 101/101 PASS.
- Static release audit: 355/355 PASS.
- SaaS static audit: 44/44 PASS.
- Native server tests: 76/76 PASS.
- Native deployment/config tests: 16/16 PASS.
- Frozen lock, workspace dependency versions, public barrels and template/compiler requirements: PASS.
- Changed TS/TSX parse/transpile and changed Node/shell syntax: PASS.

Dependency-backed tsgo/Biome/Vitest/Vite/Playwright are left to the dependency-enabled installer/runtime environment and must not be represented as PASS unless executed there.