# Separate immutable source/model and input overlay

Source archive and every model/runtime URL remain fixed to
3888c6cf29bacaf2ec5a1d7ce4e5ad1ab1109823. Download sourceArchive.path from that
revision; download inputArchive.path from the SAME immutable revision as this
APP_RELEASE_PAIRING.json. The input commit is separately recorded by the staging
receipt. No self-referencing future CID is embedded in these files.

Check both archive SHA values and every manifest member before executing code.
Use a data-only tar extractor, extract source/ and release-input/ side by side,
This public-mode overlay has no private marker. From source/, install the captured overlay
at its canonical path so build-info and Vite hash the same configured input:

    test ! -e web/background-release
    cp -R ../release-input/input web/background-release
    npm ci --prefix web --ignore-scripts
    npm ci --prefix tools/browser-build --ignore-scripts
    node --input-type=module -e 'import {buildBrowserApp} from "./web/scripts/build.mjs"; console.log(await buildBrowserApp("web/background-release", "../review-app"))'

Use this input overlay, not the historical fixture inside the source archive.
The paired build inventory records this candidate; this recipe alone claims no
fresh install, model inference or public-ready acceptance. Registry access or a
populated npm cache is required; no browser token is provided.
The repository is still private during preparation; original private inputs remain retained. This public-mode artifact has no private marker. Supported devices,
human/general quality, physical print, anonymous HF/Pages and rollback/publication
approval remain separate.