# Stage 08R remediation evidence — 2026-06-02

Commit: `24371a9`
Deploy: Cloudflare Workers `aieditorrsp`, Version ID `86c0d096-cf38-45e2-8f31-70f95ffda8f5`
URL: https://aieditorrsp.net/

## Lighthouse production result

- Performance: 97
- Accessibility: 98
- Best Practices: 100
- SEO: 100
- FCP: 1.7 s
- LCP: 2.2 s
- TBT: 100 ms
- CLS: 0
- Speed Index: 2.4 s

Raw report: `reports/lighthouse-20260602.json`

## Remediation shipped

- Removed launch CSS dependency on Google Fonts / Material Symbols remote CSS from rendered production page.
- Added CSP, HSTS, frame, content-type and referrer security headers for Worker-rendered routes.
- Added optional GA tag injection via `NEXT_PUBLIC_GA_MEASUREMENT_ID` and retained Plausible event bridge.
- Added optional Google/Bing verification meta tags via `NEXT_PUBLIC_GOOGLE_SITE_VERIFICATION` / `NEXT_PUBLIC_BING_SITE_VERIFICATION`.
- Added IndexNow key file: `/8b7f9b924e7846f9a97393d8a31552b5.txt`.

## Production smoke evidence

- `/`: 200, CSP present, HSTS present, X-Frame-Options DENY, X-Content-Type-Options nosniff.
- `/robots.txt`: 200, sitemap points to `https://aieditorrsp.net/sitemap.xml`.
- `/sitemap.xml`: 200.
- `/api/health`: 200, `{"ok":true,"service":"aieditorrsp"...}`.
- `/8b7f9b924e7846f9a97393d8a31552b5.txt`: 200, body matches key.
- Rendered HTML check: `fonts.googleapis.com=-1`, `material symbols=-1`, `plausible.io` present.
- IndexNow submit: HTTP 202.

## Known blocker / follow-up

- Google Search Console property exists but remains `siteUnverifiedUser`; sitemap PUT returns 403 until domain/site verification is completed.
- Google Site Verification token API returned 403 with current OAuth credentials.
- GA4 Admin/property creation is blocked by current OAuth scopes; no GA measurement ID was available in `/etc/environment`, so GA script is conditionally integrated but not active in production yet.