# Hotfix10 / Build Fix 49 Test Certification

## Release identity

- Product: TeXise
- Release: **R14.28.20 Build Fix 49 / Hotfix10**
- Release focus: template platform, SEO migration, interactive learning and research acquisition
- Certification date: **2026-08-23**


## Build Fix 49 pagination typecheck addendum

The BF48 production installer reached strict `tsgo` and exposed one remaining pagination-only diagnostic: `array[index - 1]` is `number | undefined` under `noUncheckedIndexedAccess` even when runtime logic first checks `index > 0`. BF49 replaces the unsafe subtraction with `value - (array[index - 1] ?? value)`, preserving the same visible pagination behavior while safely suppressing an ellipsis if a previous element were unexpectedly absent. Compiler strictness is not weakened and no non-null assertion is introduced. A standalone global TypeScript probe passes with `--strict --noUncheckedIndexedAccess`.

The dependency-free BF49 matrix passes the 23/23 current R14.28.20 tests, 85/85 historical R14.28.14–19 tests, 65/65 focused Hotfix10/template/SEO/deployment tests, 101/101 runtime-hardening tests, 105/105 `server/*.node.test.mjs` tests, 44/44 SaaS static checks and 362/362 release-contract checks.


## Build Fix 48 template UX reliability addendum

BF48 preserves the BF47 36-template/10-institution directory while fixing the next operational issues found during template-workflow review. Admin Institutions now supports byte-validated PNG/JPEG/WebP logo upload, replacement and removal, with immediate cache revalidation and logo preservation during duplicate-institution merges. The All Templates catalog is paginated at 12 records per page with URL state, filter reset, accessible navigation and a clamped current page. Template application now downloads and validates every project file before any workspace record is created; decoded response bytes are authoritative, avoiding false `Content-Length` mismatches caused by HTTP transfer compression. Firefox/FxiOS no longer receives automatic `navigator.storage.persist()` requests from project storage, local AI or Paper Memory. The expanded in-editor template chooser is searchable and bounded to 12 visible matches.

The dependency-free BF48 matrix passes 23/23 current R14.28.20 tests, 85/85 historical R14.28.14–19 tests, 64/64 focused Hotfix10/template/SEO/deployment tests, 101/101 runtime-hardening tests, 113/113 dependency-free native server tests, 44/44 SaaS static checks and 361/361 release-contract checks. Three Vitest-backed server specs (`license.spec.mjs`, `server.spec.mjs`, `signaling.spec.mjs`) require the workspace dependency installation and are intentionally left to the production dependency-backed gate rather than misreported as local failures.


## Build Fix 47 navigable-template-directory addendum

BF47 preserves the BF46 preview/homepage foundation and seeds 28 explicitly labelled TeXise-created demonstration templates so the redesigned directory can be exercised against realistic breadth rather than the original eight-record catalog. The generated catalog contains **36 published templates across 10 institutions**, with **21 Free / 15 Pro** templates, 13 document categories, institution aliases, country/degree metadata and mixed image/PDF preview modes. All 28 synthetic demo detail pages are `noIndex`, and demo-only institution collections are excluded from the sitemap/noindexed until verified indexable templates are attached. Every seeded institution template states that it is a demonstration and that no institutional endorsement is implied. `/templates` is now an intent-first directory with university discovery, document categories, recently verified content, restrained faceted filtering, Quick Preview, searchable/country-grouped institution navigation, degree filtering and first-class category CollectionPages.

BF47 remains dependency-free certified in the packaging environment. Because BF47 changes TypeScript/TSX UI code, the production installer must still run the authoritative strict TypeScript, Biome and Vite gates before activation. BF45 is the latest deployment known here to have completed the full dependency-backed production pipeline; the BF46/BF47 deltas have not been represented as production-built until a server install proves them.


## Build Fix 46 template-preview and homepage-workflow addendum

The BF45 production installation completed the dependency-backed frontend and trusted-runtime pipeline successfully, establishing a production-verified baseline for strict TypeScript, Biome, BusyTeX, Vite, SaaS preflight, trusted API, Cloud Compile, Console Gateway and Apache homepage routing. BF46 adds the requested Admin image/PDF template-preview workflow with byte-signature validation and automatic `template.pdf`/`main.pdf` fallback, plus the Privacy First homepage H1/capabilities and the new Built for Real Workflows placeholder section. The BF46 packaging environment has no workspace `node_modules`, so its dependency-backed TypeScript/Biome/Vite delta must still be verified by the normal production installer.

## Build Fix 45 Apache homepage routing addendum

The BF44 production deployment supplied authoritative evidence that pinned dependency installation, custom validation, strict TypeScript, Biome, BusyTeX provisioning, the 358-era static contract foundation, Vite production build, trusted-runtime staging, SaaS preflight, trusted API health, Cloud Compile health, Console Gateway health and Apache syntax all pass. The deployment then failed its first public frontend probe because `GET /` returned HTTP 404. BF45 explicitly routes `/` through the trusted public renderer, enables `mod_dir`, declares `DirectoryIndex index.html`, canonicalizes `/index.html` to `/`, and retains strict root/about health checks with stronger diagnostics. The subsequent BF45 production installation passed this corrected homepage/public-route boundary, so the Apache routing correction is now production-verified.

## Build Fix 44 trusted-runtime packaging addendum

The BF43 production deployment supplied authoritative dependency-backed evidence that pinned dependency installation, custom validation, strict `tsgo`, Biome lint, BusyTeX provisioning, the 357-check static contract audit and the Vite production browser build all pass. The deployment then failed only after trusted-runtime activation because the staged `server/` snapshot imported `../scripts/generate-template-manifest.mjs`, a file that is intentionally absent from `texise-data/runtime/current`. BF44 moves reusable manifest logic into the staged server module graph, verifies that exact staged graph before activation, routes Admin template writes to canonical live filesystem paths, grants the narrowly required systemd write boundaries and publishes catalog JSON only. The subsequent BF44/BF45 deployment sequence verified the corrected trusted-runtime health path in production.

## Build Fix 43 production-lint addendum

The BF42 production install passed dependency installation, custom validation and strict `tsgo`, then stopped at six Biome diagnostics. BF43 corrects those exact lint-only defects. Dependency-free BF43 verification passed the current 21/21 regression, historical/current 106/106 chain, 38/38 focused SEO/template/blog/platform subset, 101/101 runtime hardening, 44/44 SaaS audit and 357/357 release audit. The authoritative production Biome/Vite build remains to be rerun on deployment.

## Working-tree certification

The dependency-free working tree was certified before archive creation with the following results:

| Gate | Result |
| --- | --- |
| BF49 source guard | PASS |
| BF49/Hotfix10 focused SEO/template/blog/platform/directory/reliability suite | **65/65 PASS** |
| R14.28.20 current regression | **23/23 PASS** |
| R14.28.14 historical regression | **22/22 PASS** |
| R14.28.15 historical regression | **14/14 PASS** |
| R14.28.16 historical regression | **16/16 PASS** |
| R14.28.17 historical regression | **8/8 PASS** |
| R14.28.18 historical regression | **14/14 PASS** |
| R14.28.19 historical regression | **11/11 PASS** |
| Runtime hardening | **101/101 PASS** |
| Dependency-free native Node server tests (`server/*.node.test.mjs`) | **105/105 PASS** |
| SaaS static audit | **44/44 PASS** |
| Release static audit | **362/362 PASS** |
| TeXise branding/provenance audit | PASS |
| Frozen pnpm lock graph | PASS |
| Workspace dependency consistency | PASS — 68 packages |
| Public package-barrel validation | PASS — 67 entries |
| Template Assets Sync | PASS — 36 published templates (8 baseline + 28 explicit demos) across 10 institutions |

The final ZIP is not considered delivery-certified solely from these results. The release process separately extracts the generated ZIP to a clean directory and reruns the dependency-free gates against that extracted artifact. The external archive SHA-256 and extracted-artifact result are reported with the delivered ZIP.

## Template-platform security assertions

The Hotfix10 guards verify that raw `texise-templates/free` and `texise-templates/pro` trees are not intended as public static download surfaces, generated manifests do not expose raw source paths, and Pro project-file delivery is mediated through server-side entitlement checks with private/no-store caching. ZIP upload validation rejects unsafe traversal/symlink/executable-like archive entries and applies unpacked-size/file-count protections before promotion into the canonical template filesystem.

This is access-control hardening rather than DRM: source lawfully delivered to an authorized user's browser can necessarily be inspected or copied.

## SEO/indexing assertions

The release guards cover stable `/templates/{slug}` canonical URLs, permanent `/latex-templates` migration behavior, institution collection metadata, real 404 behavior, route-specific server-rendered metadata, hydrated faceted `noindex,follow` policy, protected/private application-route indexing behavior, RSS/sitemap generation, blog/template imagery and the exact requested homepage title/H1.

## Known limitations and deployment dependencies

1. **Historical template corpus:** BF47 contains the eight baseline template packages plus 28 deliberately synthetic TeXise demonstration templates used to exercise the directory. These demos are not substitutes for the materially larger historical production template corpus identified in the earlier public-index audit. Recover/import verified historical packages before retiring any still-indexed legacy URLs that lack real replacements.
2. **BF49 dependency-backed delta verification:** BF48 production reached strict `tsgo` and failed only on the pagination lookup corrected by BF49. This packaging environment has no installed workspace dependencies, so the normal BF49 production installer must authoritatively rerun repository-wide strict TypeScript, Biome, Vitest and Vite before activation. A standalone strict TypeScript probe for the corrected expression and all dependency-free source/server/static/regression gates are green.
3. **Uploaded-template execution:** administrator-uploaded templates receive structural validation in the privileged server process. Automatic TeX execution is intentionally deferred unless routed through an appropriately isolated compiler worker.
4. **Image derivatives:** blog covers are required to meet useful social dimensions (at least 1200×630), but a new server-side derivative pipeline was not introduced without a verified production image-transform dependency. Existing route-specific cover/template preview selection remains in place.
5. **Public-body SSR:** route-specific SEO head data is server-rendered. A broad React public-body SSR/prerender rewrite is intentionally deferred rather than destabilizing this release without dependency-backed build/browser certification.

## Release rule

The delivered release archive must contain a top-level `public_html/` directory. No source modification should occur after final archive certification without rebuilding the ZIP and repeating extracted-artifact verification.