diff --git a/docs/prf-11-budgets.md b/docs/prf-11-budgets.md
new file mode 100644
index 0000000..98f600b
--- /dev/null
+++ b/docs/prf-11-budgets.md
@@ -0,0 +1,83 @@
+# PRF.11 AL-06 budget re-baseline, static-asset file count and WA-08 costing (U6)
+
+This is the reviewed AL-06 record for the Blazor profile asset budgets (`eng/policy/profile-budgets.json`). It changes baseline values only. The 10 percent regression gate (`regressionPercent` 10) is unchanged. It is written in the same commit as the baseline change, so the change is recorded and not silent (WA-08, AL-06).
+
+Reviewer: `w-deku-20261008-rev-prf-11` (pre-assigned, brief S25). Decision recorded at write time: `approved`, reviewedOn `2026-10-09`. That field is a proposal. Only the named reviewer's exact-head approval ratifies it.
+
+## Why a re-baseline is needed
+
+Under WA-08 and AL-06, until a reviewed re-baseline record is merged, the React-measured values stay the enforced ceiling for Blazor builds. The React profile budgets were in `apps/app/budgets.json` at the PRF.08 commit `f8123b6` in Web history. Those values are roughly 119 KB gzip for the whole Account profile. A Blazor WebAssembly runtime alone is about 3.2 MB gzip, so the React ceiling cannot be met by any Blazor build. The WEB.40 baseline, measured at its U5 step (`c5a5f2e`), replaced the React ceiling in CI. This record makes that replacement reviewed, and it is the only AL-06 change for the asset budgets in PRF.11.
+
+## Values
+
+| Metric (gzip bytes unless stated) | React ceiling (PRF.08, `f8123b6`) account / chat | WEB.40 baseline (`c5a5f2e`) | Measured at base `c8588681` (this record) | Delta against WEB.40 |
+| --- | --- | --- | --- | --- |
+| initialRequests | 8 / 8 | 57 | 58 | +1 |
+| htmlBytes | 2967 / 3271 | 719 | 766 | +47 |
+| initialCssGzip | 3050 / 3050 | 2245 | 2380 | +135 |
+| initialJsGzip | 116363 / 144698 | 125944 | 126011 | +67 |
+| initialWasmGzip | not in React file | 3227235 | 3236688 | +9453 |
+| initialDataGzip | not in React file | 848189 | 848189 | 0 |
+| initialOtherGzip | not in React file | 238 | 238 | 0 |
+| totalGzip | 119413 / 147748 | 4203851 | 4213506 | +9655 |
+
+The measured values are the same for `account` and `chat`, because both profiles are served from one published application (the same shell and the same framework set). The U6 baseline recorded in this table (the `c8588681` measurement) was superseded by the head re-measurement and the ceiling decision in the section "Head re-measurement and ceilings (review fix 1)" below. The gate allows 10 percent growth above the baseline. Against the WEB.40 baseline, the relative deltas are: htmlBytes +6.5 percent, initialCssGzip +6.0 percent, initialRequests +1.8 percent (one request), initialWasmGzip +0.3 percent, totalGzip +0.2 percent, initialJsGzip +0.05 percent, and none for the data and other metrics. The large relative changes are on small metrics. The cause of each delta was not isolated. The measurement is at the final WEB.40 head merged as `c8588681`, and the WEB.40 U5 baseline was taken before the later WEB.40 changes.
+
+## Head re-measurement and ceilings (review fix 1)
+
+The independent review of `2643127` found that the U6 baseline raised every ceiling above the pre-PRF.11 WEB.40 ceiling, while every head value fitted under the WEB.40 ceiling. The raised ceilings therefore loosened the gate by a margin the measurement did not require. This section records the re-measurement at the head and the decision that followed.
+
+- Measured under CI conditions (`GITHUB_ACTIONS=true`, `CI=true`, the placeholder run identity `1`, a fresh `NUGET_PACKAGES` folder) at two code heads: `006b4b8` (the first measurement, before the budget commit) and `31888e1` (the gate chain of record, the budget commit). `App` is published to `artifacts/publish/app` and `profiles budget` runs against it. The code between the two heads is test and document only, but the two publishes are not byte-identical: the measured values move by up to 10 bytes (see the run-to-run note below). The figures in the table are the `31888e1` chain values, with the `006b4b8` values in brackets where they differ.
+- The gate is `value <= baseline + baseline * regressionPercent / 100` (`ProfileBudget.Limit`, rounded down), with `regressionPercent` 10 unchanged.
+
+| Metric (gzip bytes unless stated) | WEB.40 baseline (`c5a5f2e`), the pre-PRF.11 ceiling basis | U6 baseline (`2a21bc3`, `c8588681` measurement), before this fix | Head measurement, account and chat (`31888e1`; `006b4b8` in brackets) | Ceiling now (= WEB.40 ceiling) | Headroom at `31888e1` |
+| --- | --- | --- | --- | --- | --- |
+| initialRequests | 57 (ceiling 62) | 58 (ceiling 63) | 58 | 62 | 4 |
+| htmlBytes | 719 (ceiling 790) | 766 (ceiling 842) | 766 | 790 | 24 |
+| initialCssGzip | 2245 (ceiling 2469) | 2380 (ceiling 2618) | 2328 | 2469 | 141 |
+| initialJsGzip | 125944 (ceiling 138538) | 126011 (ceiling 138612) | 126015 (126013) | 138538 | 12523 |
+| initialWasmGzip | 3227235 (ceiling 3549958) | 3236688 (ceiling 3560356) | 3236698 (3236690) | 3549958 | 313260 |
+| initialDataGzip | 848189 (ceiling 933007) | 848189 (ceiling 933007) | 848189 | 933007 | 84818 |
+| initialOtherGzip | 238 (ceiling 261) | 238 (ceiling 261) | 238 | 261 | 23 |
+| totalGzip | 4203851 (ceiling 4624236) | 4213506 (ceiling 4634856) | 4213468 (4213458) | 4624236 | 410768 |
+
+Decision (review fix 1): every head value fits under its pre-PRF.11 WEB.40 ceiling, so no measurement requires a looser ceiling. The baseline of both profiles is therefore the WEB.40 baseline (`eng/policy/profile-budgets.json` is byte-identical to `c5a5f2e`). Each ceiling equals its WEB.40 ceiling, and every ceiling is tighter than the U6 ceiling it replaces.
+
+- **Remaining loosening: none.** No ceiling is looser than the pre-PRF.11 WEB.40 ceiling.
+- The head measurement is above the WEB.40 baseline in six metrics: initialRequests +1, htmlBytes +47, initialCssGzip +83, initialJsGzip +71, initialWasmGzip +9463, and totalGzip +9617 (at `31888e1`). These increases are inside the existing 10 percent allowance and are recorded as the head measurement, not as the baseline. The cause of each increase since `c5a5f2e` was not isolated, and it does not affect any ceiling.
+- Run-to-run note: the same code gave different gzip totals on two clean publishes. At `006b4b8` the values were initialJsGzip 126013, initialWasmGzip 3236690 and totalGzip 4213458; at `31888e1` they were 126015, 3236698 and 4213468. The review's fresh clone at `2643127` recorded initialWasmGzip 3236705 and totalGzip 4213473. The variation is 2 to 15 bytes on the wasm and JS metrics and is not isolated. It is far below every ceiling (for example, the WASM headroom is 313260 bytes), so the decision does not depend on it. The budget gate is a ceiling check, and it does not require byte-stable publishes.
+
+## Largest single static file (review fix 6)
+
+Measured at `31888e1` in `artifacts/publish/app/wwwroot` (174 files, 116 precompressed; the same figures at `006b4b8`):
+
+- The largest single file is `_framework/dotnet.native.rw4kynp763.wasm`, 3,001,422 bytes uncompressed (2.86 MiB). That is 11.4 percent of the 25 MiB (26,214,400 bytes) single-file limit. Its precompressed variants are 1,207,786 bytes (`.gz`) and 976,255 bytes (`.br`).
+- The next largest files are `_framework/System.Private.CoreLib.o10ikxvddh.wasm` (1,682,197 bytes) and `_framework/icudt_no_CJK.lfu7j35m59.dat` (1,107,168 bytes).
+- The single-file limit is therefore met with a margin of 88.6 percent. The earlier statement "the largest single file was not measured" is superseded by this measurement.
+
+## Measurement
+
+- Command, under CI conditions (`GITHUB_ACTIONS=true`, `CI=true`, a fresh `NUGET_PACKAGES`): `dotnet publish src/ArcForges.Web.App/ArcForges.Web.App.csproj --no-restore -c Release -o artifacts/publish/app`, then `dotnet tools/ArcForges.Web.Tooling/bin/Release/net10.0/ArcForges.Web.Tooling.dll profiles budget --publish artifacts/publish/app --budgets eng/policy/profile-budgets.json`.
+- The build is the IL build. `RunAOTCompilation` is `false` (D6, D-007). The publish printed that it published without optimizations and recommended the `wasm-tools` workload, which is not installed. The AOT benchmark is therefore recorded as **not run** (no wasm-tools workload or emscripten was installed, and no user install is performed).
+- SDK 10.0.401, Windows 11, the local publish. The budget tool reported `Profile budgets passed.` against the new baseline, and the Tooling test project passed 56 of 56.
+- Startup time and interaction responsiveness (INP) were not measured offline. They need the deployed profile origin and are blocked on CLOUD.85 (LS3, not proven). `interactionBudgets` stays `re-baseline-pending` with owner PRF.11, and the React interaction numbers (`apps/app/interaction-budgets.json` at `80900a1`) are not carried over. They were derived from one observation and are not comparable with Blazor (D8).
+
+## Static-asset file count (platform limit)
+
+- The published `wwwroot` holds 174 files, 116 of them precompressed (`.br` and `.gz`). Precompressed variants are counted, as the gate requires.
+- The profile bundle (`web-profiles-43f87a11...tar`, built and verified by `profiles bundle` and `profiles verify`) has 175 members: the manifest and 174 served files. The served set is the `wwwroot` set minus the shell and its two encodings (`index.html`, `index.html.br`, `index.html.gz`), plus the profile pages `account/index.html` and `chat/index.html` and `_headers`. The served count is therefore 174.
+- The platform limit, taken from the Cloudflare Workers platform limits page (Static Assets section, read on 2026-10-09): "Files per Worker version" is 20,000 on Workers Free and 100,000 on Workers Paid, and "Individual file size" is 25 MiB on both plans. The page does not say whether precompressed variants count. The gate uses the stricter 20,000.
+- Result: 174 files against 20,000 (0.87 percent), so the Blazor profiles are inside the limit whether or not the precompressed variants count. The Site adds nine files (`artifacts/site`). Even if the two outputs were served from one Worker version, the total is 183 files, 0.92 percent of the limit. The largest single static file is `dotnet.native` (`.wasm`), 3,001,422 bytes uncompressed, 11.4 percent of the 25 MiB single-file limit (measured at `31888e1`; see "Largest single static file (review fix 6)").
+
+## WA-08 costing of the non-virtualised lists
+
+- Chat transcript (`src/ArcForges.Web.App/Pages/Chat.razor`): an `ol` rendered with `@foreach` over `_entries`, each entry an `li` with one `span` and text. The list is capped: `MaxEntries = 20`, and the oldest entries are removed when the cap is exceeded. The list therefore holds at most 20 `li` and 20 `span` elements, 40 elements and 40 text nodes, and is bounded by construction. No virtualisation is needed (Virtualize is refused by the strict `style-src`, and CS-01 states the .NET 10 position).
+- Library lists: the Web App at `c8588681` has no library list, and the Account page renders no list (only a workspace count). No library-list cost is claimed here.
+- Sustained chat memory (WA-08): WA-08 says the sustained chat memory has a recorded budget. The numeric value was not found in the Design authority (`ArcForges-Design` `main`, `b01ae31`) or in the Plan and Web records. The costing is therefore by construction only (the 20-entry cap above). The numeric sustained-memory budget and any measured memory for the chat profile are open and are not claimed. They need the recorded WA-08 value, and a measurement on the deployed profile would be a local opt-in run (blocked on CLOUD.85).
+
+## Not claimed
+
+- No startup, INP or AOT number is claimed. Those are blocked on CLOUD.85 or are not run.
+- No deployed file count is claimed. The count above is for the local publish and the local bundle.
+- The WA-08 numeric sustained chat memory budget is not claimed. It is open pending the recorded value.
+- No deployed measurement is claimed. The head measurement is local and claimant-reported.
diff --git a/docs/prf-11-profile-proof.md b/docs/prf-11-profile-proof.md
new file mode 100644
index 0000000..63d905c
--- /dev/null
+++ b/docs/prf-11-profile-proof.md
@@ -0,0 +1,386 @@
+# PRF.11 Blazor WebAssembly production profile and generated C# SDK proof
+
+Reviewer: `w-deku-20261008-rev-prf-11` (pre-assigned, brief S25). Decision: `approved`. reviewedOn: `2026-10-09`. These fields are written at write time as a proposal. Only the named reviewer's exact-head approval ratifies them, and a refusal blocks the merge.
+
+This is the record of the PRF.11 proof for the Web repository (Design WP-06.05 full, WP-06 package-level contribution, PG-23 foundation contribution). It supersedes PRF.08 (the React proof, `docs/prf-08-profile-proof.md`), whose evidence is not reused. Entries are added as each unit lands. A claim is recorded only with the evidence that backs it. Anything that needs a deployed ingress is recorded as "blocked on CLOUD.21/CLOUD.22, not proven" or as "blocked on CLOUD.85, not proven", never as deferred and never as proven.
+
+## Start identity (U1)
+
+| Item | Value |
+| --- | --- |
+| Task | PRF.11, lane runtime-proofs, kind proof, size L |
+| Repository and branch | Web, `task/prf-11`, local worktree `.worktree/prf-11` |
+| Claim | epoch 1, worker `w-deku-20261009-prf-11` (coordinator-held claim) |
+| Pre-assigned reviewer | `w-deku-20261008-rev-prf-11` (brief section 10, S25); written into every record with `decision: approved` and `reviewedOn` at write time |
+| Base | `origin/main` c8588681 (merge of PR #35 from `task/web-40`, WEB.40) |
+| WEB.40 status | `delivered` in the ledger (`ledger/tasks/web-40.md` on Plan main); merged, deployed and released as `web-0.1.0-ci.111.1` (S28(a)) |
+| Plan authority | the PRF.11 entry of `phase2-plans.json` (units U1 to U9, defaults D1 to D12), the task record, and brief sections 0, 0a, 0b, 10 and 11 |
+
+Base refresh (fix3, 2026-10-10): `origin/main` is now `049f6a5` (Web #38, the WEB.40 completion follow-up for S36 and S37). It is merged into `task/prf-11` as `f4c639c`. The start identity above is the original base and stays as history.
+
+### Start edges
+
+| Start edge | Ledger status | Evidence used by this proof |
+| --- | --- | --- |
+| CON.92 (serialization posture and decode limits) | `inherited` (WP03.02, accepted source e6c4a77) | The decode limits are part of the Contracts source at the pinned identity. Contracts `docs/architecture.md`, "Serialization posture", at ca45f36 states the registry limits: 4 MiB unary and helper messages, 256 KiB inline pages, 32 KiB stream frames, 64 MiB large read projections, and at most 100 nested message levels, with typed `tooLarge`, `tooDeep` and `malformed` refusals. Source e6c4a77 is an ancestor of ca45f36. The P0c precondition holds. |
+| WEB.40 (Blazor profile projects and C# static Site generator) | `delivered` | `src/ArcForges.Web.App`, `src/ArcForges.Web.Site`, `tools/ArcForges.Web.Tooling` at c8588681. |
+| PRF.07 (deployed Cloud AOT probe reachable same-origin) | `complete` | Consumed only through the deployed ingress in the live units. No substitute probe is used. |
+| CON.07 (BrowserSession and NativeAuth HTTP exceptions and generated C# codecs) | `complete` | The NuGet identity is `ArcForges.Contracts.PublicApi 1.0.0-ci.287.1` from source ca45f36cccbdd31380f76b8f6cdecc958fdcb430. That commit is an ancestor of Contracts `origin/main`. Build run 36966686225 published it to NuGet, npm and Maven. The pin is in `Directory.Packages.props` and is unchanged by U1. |
+
+### Completion edges (blocked, not proven)
+
+| Completion edge | Ledger status at start | Consequence for PRF.11 |
+| --- | --- | --- |
+| CLOUD.21 (real generated public methods on the deployed gRPC-Web ingress) | not started (no ledger record; waits on CLOUD.13) | Exact int64, uint64 and decimal calls, and the `WorkspaceService.GetHealth` and `UpdateSettings` round trips, are blocked on CLOUD.21, not proven. |
+| CLOUD.22 (ArcResult and gRPC-Web status and trailer mapping) | not started (waits on CLOUD.21) | Typed failures, deadline and cancel-after-dispatch are blocked on CLOUD.22, not proven. |
+| CLOUD.08 (readiness surfaces) | `complete` | Readiness observation is available for the live units. |
+| CLOUD.71 (proof-origin route families for the React bytes) | `complete` (history for the React bytes only) | The `/api`, `/session/v1` and `/proof/v1` route precedence is not proven for the Blazor bytes. D11 treats the graph inconsistency as history (brief S16(a)). |
+| CLOUD.85 (proof-origin serving of the Blazor Account and Chat shells and the C# Site, under base href "/", CLOUD.85 D1) | not complete at this record; its S36 follow-up Cloud #82 pins the corrected profile policy, and its proof redeploy is not observed here | Same-origin serving, the `/account/` and `/chat/` shells, digest-verified bytes and the exact CSP on served responses are blocked on CLOUD.85, not proven. PRF.11 cannot complete until CLOUD.85 delivers and its checks pass (S27(b)). |
+
+PRF.11 is delivered on its offline units U1 to U9 (brief S20(d)). Its completion is still blocked on CLOUD.21 and CLOUD.22, and the parts that need them are recorded as "blocked on CLOUD.21/CLOUD.22, not proven". Its local opt-in live run against proof.arcforges.com follows the CLOUD.85 follow-up proof redeploy. The `base-uri` stop recorded at fix1 and fix2 is resolved by S36 (see the resolved decision below).
+
+### Shell and base href
+
+The Account and Chat profile shells are served at `/account/` and `/chat/` under base href `"/"` (CLOUD.85 D1, brief S27(b)). The framework files sit at the root. The host page `src/ArcForges.Web.App/wwwroot/index.html` already carries `<base href="/" />`. The earlier base href wording `/account/` and `/chat/` is superseded.
+
+## Inherited WEB.40 surfaces
+
+These surfaces exist at c8588681 and are extended by PRF.11, not duplicated:
+
+- `src/ArcForges.Web.App`: the Account and Chat Razor pages, the `ProfileLayout`, the `HelloProbe`, `SessionProbe`, `ExactUnsigned` and `BoundedBody` probe classes, and the standalone profile project with `RunAOTCompilation` false.
+- `src/ArcForges.Web.Site`: the deterministic static Site generator (`/`, `/hello/` and `/cloud-hello/` as static pages; no runtime JavaScript).
+- `tools/ArcForges.Web.Tooling`: the candidate builder and verifier, the Site archive, the profile bundle (`profiles bundle` and `profiles verify`), and the profile budget tool (`profiles budget`).
+- `tests/ArcForges.Web.App.Tests`, `tests/ArcForges.Web.Site.Tests`, `tests/ArcForges.Web.Tooling.Tests`, and the local opt-in browser project `tests/browser/ArcForges.Web.Browser.Tests` (Microsoft.Playwright for .NET, never built in CI).
+- `eng/policy/profile-budgets.json`: the asset budgets for the `account` and `chat` profiles, with `interactionBudgets` status `re-baseline-pending`, owner PRF.11.
+- The Ui project `src/ArcForges.Web.Ui` (including `WasmContentSecurityPolicy`) is outside PRF.11's write scope. It is consumed, not changed.
+
+## Declared write scope
+
+The write scope is the PRF.11 `writes` list in the task record, with the D3 additions (brief S20(b), S27(f)): `eng/policy/profile-budgets.json`, `tools/ArcForges.Web.Tooling/**`, `tests/ArcForges.Web.Tooling.Tests/**` and `tests/ArcForges.Web.Site.Tests/**`. `src/ArcForges.Web.Ui/**`, its tests and `.github/workflows/ci.yml` are not in scope. An in-browser CSP or framing change that needs a Ui edit stops the task for a new decision.
+
+## Gaps in the plan recorded at start
+
+- The published output of the App publish is produced by CI after the test step, so tests that read emitted files need a local publish first or are covered through the bundle tooling tests. This is recorded in the U2 section.
+- Node is 24.20 locally against the 24.21 pin, so `npm run policy` is recorded as not run locally (hosted CI is authoritative). This is an environment gap and not a fix.
+- The WSL2 Debian SDK is 10.0.400, so a locked Linux restore fails with NU1004 there. Linux checks are not run in this phase unless they are affected.
+- Docker is not on the Windows PATH. gitleaks runs in WSL Debian through docker, with the cached image `c00b6bd0aeb3` (the pinned digest) and `--network none`.
+- actionlint 1.7.12 is the local Windows binary built from source in the Go bin folder. Its version matches the CI pin.
+
+## Local CI conditions used for the gates
+
+The gates run the workflow's commands with `GITHUB_ACTIONS=true`, `CI=true` and `NUGET_PACKAGES` set to an empty folder under the session scratchpad, so every locked restore downloads from the locked feeds. The ArcForges.Build.Policy analyzer (AFP006) requires a complete CI identity under `GITHUB_ACTIONS=true`, so the gate sets `GITHUB_SHA` to the commit under test, `GITHUB_REPOSITORY` to `ArcForges/Web` (the analyzer builds the pipeline-run URL from it, and without it the build fails with AFP006), and `GITHUB_RUN_ID`, `GITHUB_RUN_ATTEMPT` and `GITHUB_RUN_NUMBER` to the placeholder `1`. These placeholders are local emulation values. They name no hosted run, and no artifact from these local gates is published or deployed. Hosted CI remains the authority for the release identity.
+
+The gates also start from a clean state: `git clean -fdX` removes only ignored build output (`bin`, `obj`, `node_modules` and `artifacts`) before the run. This matters because stale files left in `artifacts/publish/app` by an earlier publish fail the profile bundle's static-graph check ("A published file is not named by the build's static web assets manifest"), which a fresh CI checkout never meets.
+
+## CSP and profile shells (U2)
+
+The emitted policy is the one string in `WasmContentSecurityPolicy` for the host page, pinned in `ArcForges.Web.App.Tests` (`WasmProfilePolicyTests.ExactPolicy`) and in `ArcForges.Web.Tooling.Tests` (`EmittedProfileContractTests`):
+
+- `default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'none'`
+
+`script-src` is exactly `'self'` and `'wasm-unsafe-eval'` (the host page has no inline script, so no hash is added). `style-src` is `'self'`. No `'unsafe-inline'`, `'unsafe-eval'` or `'unsafe-hashes'` appears in the policy or the headers file. The bundle test builds the profile bundle from a publish whose shell is the real host page, then reads the served `account/index.html` and `chat/index.html` (identical bytes, one `<base href="/">` each) and the `_headers` file, which names the exact policy on `/account/*` and `/chat/*`.
+
+Resolved (S36, WEB.40 follow-up Web #38): the profile policy carries `base-uri 'self'`, so the `<base href="/">` of the shells is admitted. The earlier open point, under `base-uri 'none'`, is history and is kept in the open-decision section below. The Site policy keeps `base-uri 'none'`, because the public pages have no base element.
+
+## Exact values and CON.92 limits (U3)
+
+The exact-value helpers come from the pinned Contracts Foundation package (`ArcForges.Contracts.Foundation` 1.0.0-ci.287.1), not from new App helpers:
+
+- `ExactInteger.ParseInt64` and `ExactInteger.ParseUInt64` (canonical text, no sign, leading zero or floating point; int64 edges and values above 2^53 stay exact). The App's own `Exact.TryUnsigned` is the probe's uint64 path.
+- `ExactDecimal` (the shared exact decimal bound: at most nine fractional digits and twenty-eight significant digits, declared scale kept, no negative zero).
+
+The CON.92 registry bounds are read from `WireLimits.Bytes` and pinned: unary and helper messages 4 MiB, inline pages 256 KiB, stream frames 32 KiB, large read projections 64 MiB, and 100 nested message levels. `WireLimitTests` decodes at the exact bound (accepted) and one byte over (`TooLarge`), shows that the same bytes are admitted as a unary message and refused as a stream frame, refuses truncated, bare-tag and reserved-wire-type frames as `Malformed`, and checks that encoding refuses one byte over the class.
+
+`HelloProbe` now sets the gRPC channel's `MaxReceiveMessageSize` and `MaxSendMessageSize` to the unary class (4 MiB), so the greeting, a unary call, is bounded explicitly rather than by the library default. Two tests cover the two bounds, with the following limits (review fix 2):
+
+- The send bound is discriminated. The Grpc.Net.Client default for `MaxSendMessageSize` is null (no bound). `HelloProbeTests.AGreetingRequestAboveTheUnaryBoundIsRefusedBeforeItsBytesReachTheTransport` sends a name one byte over the class, and it fails when the explicit line is removed (mutation run: the oversized body reaches the transport and the test fails; with the line restored it passes, 18 of 18 in the targeted run with the stream tests).
+- The receive bound is not discriminated. The library default for `MaxReceiveMessageSize` is 4,194,304 bytes (Grpc.Net.Client 2.84.0 documentation), which is the same value as the unary class, so removing the explicit line is not observable offline. `HelloProbeTests.AGreetingReplyAboveTheUnaryMessageBoundIsRefusedNeverAccepted` pins the behaviour of the bound (a reply over the class is `Malformed` and never a greeting), not the explicit option. The explicit receive line is recorded as a value pin, not as proven.
+
+## Static Site: no-script reading and determinism (U5)
+
+- Determinism: the Site is built twice with the candidate command (`site build --out ... --source-ref <sha>`) and the two output trees are identical (`diff -r`, nine files, including `_headers` and the content-hashed stylesheet). The hosted csharp job repeats this as a gate.
+- Offline, CI-eligible: `SiteOutputTests.EveryPageIsReadableWithScriptingDisabled` (existing) scans every page for script elements, event-handler attributes, framework references and `javascript:` URLs. The new `SiteOutputTests.TheOutputCarriesNoScriptOrWebAssemblyFileAtAll` refuses any `.js`, `.mjs` or `.wasm` output file and any script element in the HTML. The Site test run in the local gate passed 75 cases, skipped 1 (`SiteParityTests.TheCSharpSiteAgreesWithTheRecordedReactPrerenderWhenItIsNamed`, which is skipped by design unless a React prerender is named), and failed none.
+- Local opt-in, not CI: `tests/browser/ArcForges.Web.Browser.Tests/LocalNoScriptBrowserTests.cs` reads `/`, `/hello/` and `/cloud-hello/` with JavaScript disabled and asserts a 200 status, non-empty `main` text, no script element, and no script request. It skips with the opt-in unset. Under CI conditions it skipped (the opt-in gate also refuses any CI host).
+- The one local opt-in run: the Site output was served from `artifacts/site` on `127.0.0.1` (a local static server, not a deployed origin). The browser was the installed Google Chrome, `C:\Program Files\Google\Chrome\Application\chrome.exe`, product version 156.0.8078.12, named by `ARCFORGES_CHROMIUM_PATH`. No browser was downloaded. The test passed: 1 of 1, 4.5 s. Host Windows 11, Microsoft.Playwright 1.62.0 driving the installed binary by path (D10). The match between this Chrome build and the Chromium that Playwright 1.62.0 expects was not verified, so it is recorded as a mismatch risk. Claimant-reported; date 2026-10-09.
+- Not claimed: the no-script reading of the deployed proof origin (blocked on CLOUD.85, not proven).
+
+## Inline-style audit, in-browser CSP and live specs (U7)
+
+- Inline-style audit (static, offline): no `style=` attribute and no `<style>` element in the Razor components in use (`src/ArcForges.Web.App`: `App.razor`, `Layout/ProfileLayout.razor`, `Pages/Account.razor`, `Pages/Chat.razor`; `src/ArcForges.Web.Ui`: `Arrow`, `Button`, `CloudHelloExample`, `HelloExample`, `HomeContent`, `Shell`), and none in the host page, which loads only `app.css`. No C# builder emits a `style` attribute. This is a static audit. It does not prove that the framework sets no inline style at run time, and the in-browser check is the real test.
+- In-browser CSP (local emulation, not the deployed origin): the bundle built from the publish (`profiles-u6`) was extracted and served on `127.0.0.1` with the exact per-profile `Content-Security-Policy` from its `_headers`. Headless Google Chrome 156.0.8078.12 loaded `/account/`. Chrome logged `Setting the document's base URI to 'http://127.0.0.1:4180/' violates the following Content Security Policy directive: "base-uri 'none'". The action has been blocked.` The message reproduced in two enforced runs. The root framework path `/_framework/blazor.webassembly.js` returned 200. The same shell path `/account/_framework/blazor.webassembly.js` returned 404, because the relative framework path resolves under the shell path once the base element is blocked.
+- Render outcome under the policy that fix1 observed (history, `base-uri 'none'`): the Account shell did not start. Four of four runs logged the base-uri violation and never rendered the heading. The live spec `TheShellsLoadInTheInstalledBrowserWithNoContentSecurityPolicyViolation` is the in-browser check on the deployed origin. The S36 boot check under the served headers belongs to the WEB.40 follow-up, and this record does not repeat it.
+- Decision (resolved by S36 and Web #38): the profile policy is `base-uri 'self'`, and the exact string is pinned at that value in the App, Tooling and browser test projects (fix3). The live spec remains the check on the deployed origin that the shells start, and it waits for the CLOUD.85 follow-up proof redeploy.
+- Live specs (`tests/browser/ArcForges.Web.Browser.Tests/LivePrf11Specs.cs`, with `LivePrf11OptIn.cs`): four specs, skipped without `ARCFORGES_LIVE_PRF11=1` and an https proof origin, and skipped on a CI host. Under CI conditions all four skipped, and the 20 guard and opt-in tests passed. The cloud specs (greeting round trip and INP capture) also need `ARCFORGES_PRF11_CLOUD_READY=1`, and skip as "blocked on CLOUD.21/CLOUD.22, not proven" without it. They have not been run against the deployed origin. The runbook is `docs/prf-11-runbook.md`.
+- Not claimed: exact int64, uint64 and decimal calls through the deployed probe, typed failures, cancellation, session and CSRF on the deployed origin (blocked on CLOUD.21 and CLOUD.22, not proven; manual steps in the runbook), and the deployed CSP.
+
+## Asset budgets, file count and WA-08 costing (U6)
+
+The AL-06 re-baseline of the asset baseline (`eng/policy/profile-budgets.json`), the static-asset file count against the Workers platform limit, and the WA-08 costing of the non-virtualised chat list are recorded in `docs/prf-11-budgets.md`. The asset baseline is the measured local publish (174 served files, 116 precompressed; the platform limit is 20,000 files per Worker version on Free). The interaction budgets stay re-baseline-pending (owner PRF.11) until the deployed run (LS3, blocked on CLOUD.85). The AOT benchmark is not run (no `wasm-tools` workload installed).
+
+## Server-stream framing (U4)
+
+The binary and grpc-web-text server-stream framings are recorded as fixtures in `StreamFramingTests`, and the transport decision (binary first, grpc-web-text only if the observed run fails) is recorded in `docs/prf-11-stream-transport.md`. That decision is open until the local opt-in observation (LS2) is made. No deployed stream is claimed.
+
+Still not claimed: the live int64, uint64 and decimal calls through the deployed Cloud probe (blocked on CLOUD.21 and CLOUD.22, not proven), and the framing of server-streamed frames on the deployed ingress (U4 records the offline framing fixtures only).
+
+## Offline proof record and completion handoff (U9)
+
+### Status
+
+Note (2026-10-10, fix cycle 4, appended): the local opt-in live run against the proof origin is recorded in the section "Live record and review fixes (fix cycle 4)" at the end of this file. It supersedes the statements in this status section that no deployed result was observed.
+
+PRF.11 is **delivered on its offline units U1 to U9** (brief S20(d)). The offline units are committed in local commits on `task/prf-11`. The `base-uri` stop that fix1 and fix2 recorded is resolved by S36 and WEB.40 follow-up Web #38, and the fix3 merge carries that fix into this branch. The task is **not complete**: the completion edges CLOUD.21 and CLOUD.22 are not started, so the parts that need them are recorded as "blocked on CLOUD.21/CLOUD.22, not proven". Its local opt-in live run against proof.arcforges.com follows the CLOUD.85 follow-up proof redeploy, and no deployed result is claimed here. The task record names PRF.08 as superseded, and this record supersedes PRF.08 (`docs/prf-08-profile-proof.md` is history). PRF.11 is the successor of the WEB.40 app-proof row (ruling S28(i)).
+
+### Offline receipt (WP-06.05, offline portion)
+
+| Item | Evidence | Result |
+| --- | --- | --- |
+| Start identity and edges (U1) | `docs/prf-11-profile-proof.md` start section; CON.92 limits in Contracts `docs/architecture.md` at ca45f36; CON.07 identity `ArcForges.Contracts.PublicApi 1.0.0-ci.287.1` | Recorded; P0c holds |
+| Exact CSP token set and base hrefs (U2) | `WasmProfilePolicyTests.TheEmittedPolicyIsTheExactReviewedString`, `TheHostPageDeclaresExactlyOneBaseAtTheRootAndTheShellsRelyOnIt`; `EmittedProfileContractTests` (4 cases) | Passes offline; the string is pinned at `base-uri 'self'` (S36, fix3). The earlier `base-uri 'none'` string stopped the shells in the browser; that stop is resolved (see the resolved decision below) |
+| Exact int64, uint64, decimal and CON.92 limits (U3) | `ExactUnsignedTests` (9 cases: int64 and decimal values, the typed `FormatException` refusals, and the shared decimal bound at both edges); `WireLimitTests` (7 cases, including the `TooDeep` refusal at 101 nested levels); `HelloProbeTests.AGreetingReplyAboveTheUnaryMessageBoundIsRefusedNeverAccepted` | Passes offline |
+| Server-stream framing fixtures and decision (U4) | `StreamFramingTests` (6 cases); `docs/prf-11-stream-transport.md` | Fixtures pass; the decision is open until the observed run (LS2) |
+| No-script reading and determinism (U5) | `SiteOutputTests.TheOutputCarriesNoScriptOrWebAssemblyFileAtAll` and the existing `EveryPageIsReadableWithScriptingDisabled`; Site built twice and diffed (identical, nine files); `LocalNoScriptBrowserTests` (local opt-in, one run with installed Chrome 156.0.8078.12, passed) | Offline and local evidence recorded; claimant-reported |
+| AL-06 asset re-baseline, file count, WA-08 costing (U6) | `docs/prf-11-budgets.md`; `profiles budget` passed; `profiles bundle` and `profiles verify` (174 served files, 116 precompressed, limit 20,000 on Free) | Recorded; interaction budgets stay re-baseline-pending |
+| Inline-style audit, in-browser CSP and live specs (U7) | `docs/prf-11-runbook.md`; `LivePrf11Specs` (4, skipped without the opt-in); `LivePrf11OptInTests` and `LocalOptInTests` (guards) | Audit clean (static); live specs not run; see the decision below |
+| NuGet closure admission (U8) | Conditional. The `git diff` against the WEB.40 base shows no change to any `*.csproj`, `packages.lock.json`, `Directory.Packages.props`, `Directory.Build.props`, `NuGet.config` or `eng/policy/dependency-policy.json` | Skipped (no closure change) |
+
+### Resolved decision (history): `base-uri 'none'` blocked the shells' base href
+
+Resolved by S36 and WEB.40 follow-up Web #38 (merged as `049f6a58`, released as `web-0.1.0-ci.117.1`). `WasmContentSecurityPolicy` now emits `base-uri 'self'` for the profiles, and the Site policy keeps `base-uri 'none'`. Fix3 (`2038716`) moves every PRF.11 pin of the profile policy to `'self'`. The bullets below are the fix1 evidence that led to the fix. They are kept as history, not as a current stop.
+
+The served policy (`WasmContentSecurityPolicy`, Ui, outside the PRF.11 write scope) contains `base-uri 'none'`. Under that policy the Account and Chat shells do not start. This is the observed outcome of fix1 (2026-10-09), not an open question, and it was reproduced locally with the installed Google Chrome 156.0.8078.12, driven by path with no download:
+
+- The bundle was built under CI conditions (App publish, then `profiles bundle` and `profiles verify`, 175 members), extracted to a scratch folder, and served on `127.0.0.1` with the exact per-profile `Content-Security-Policy` from its `_headers`. Four of four headless runs of `/account/` logged `Setting the document's base URI to 'http://127.0.0.1:4190/' violates the following Content Security Policy directive: "base-uri 'none'". The action has been blocked.` and left the DOM on `Loading…`. The heading `Your session, as the server sees it.` never rendered.
+- The mechanism is the relative framework loader. With the base element blocked, `_framework/blazor.webassembly.js` resolves to `/account/_framework/blazor.webassembly.js`, which returns 404, while the root path returns 200. Blazor therefore never boots.
+- Control, in a scratch server only (not in the repository): the same bundle with `base-uri 'self'` logged no violation, and the heading rendered in 2 of 4 runs. The other two runs stayed on `Loading…` with no violation logged. The `--dump-dom` method is not reliable enough to settle the render in every control run. What the control does establish is that no violation is logged under `base-uri 'self'`, in all four runs. With no CSP header the heading rendered in 2 of 2 runs.
+- Claimant-reported, local, not the deployed origin. The live spec on the deployed origin remains the check that the shells start.
+
+The offline tests could not see this, because they pinned the policy string and did not run a browser. The reviewed change was the Ui policy `base-uri 'self'` (S36), which Web #38 merged. Fix1 and fix2 made no code change in `src/ArcForges.Web.Ui/**`, which was outside the PRF.11 write scope at that time.
+
+### Gates (fix1 re-run under CI conditions, code head `b84e2e3`)
+
+The gates were re-run after the fix1 record changes, from a clean state (`git clean -fdX`, then an empty NuGet folder under the scratchpad), at `b84e2e3`. Every step ran in the build slot. Three local conditions were corrected on the way and are recorded in the local CI conditions section: `GITHUB_REPOSITORY` for AFP006, the clean start against stale publish output, and building the C# tool before `npm test`, which the CI source job does first on Linux. These are local-condition fixes, not product changes.
+
+| Gate | Result | Notes |
+| --- | --- | --- |
+| Locked restores (every CSHARP_PROJECTS entry, `--locked-mode`) | passed | `NUGET_PACKAGES` is an empty scratch folder |
+| `dotnet format --verify-no-changes --no-restore` (every CSHARP_PROJECTS entry) | passed | |
+| `dotnet build -c Release --no-restore` (every CSHARP_PROJECTS entry) | passed | 11 projects, zero errors and zero warnings |
+| `dotnet test --no-build -c Release` (every CSHARP_TEST_PROJECTS entry) | Tooling 56/56; Site 75 passed, 1 skipped by design (`SiteParityTests`, no React prerender named); Ui 14/14; App 91/91; Operations 5/5; Policy 108/108 | |
+| Profile publish (App to `artifacts/profiles/app`, Operations to `artifacts/profiles/operations`) | passed | IL build; `RunAOTCompilation` false; no `wasm-tools` workload, so AOT is not run |
+| Static Site (`site build` twice, `diff -r`) | identical | |
+| Candidate job: tooling restore and build, App locked restore and publish to `artifacts/publish/app` | passed | |
+| Profile budgets (`profiles budget`) | passed | against the re-baselined values |
+| Candidate (worker and identity emitted, built twice, `diff -r`, verified) | passed; the two trees are identical; verified at 20 members | Local identity placeholders (see the local CI conditions section) |
+| Profile bundle (`profiles bundle` and `profiles verify`) | passed (175 members) | |
+| `npm ci --ignore-scripts --engine-strict=false` | passed | `--engine-strict=false` is needed locally (see the environment gaps) |
+| `npm audit --audit-level=high` | 0 vulnerabilities | |
+| `npm run check:dependencies` | passed | |
+| `npm run typecheck` | passed | |
+| `npm run test:dependencies` | 15 of 15 passed | |
+| `npm run test` | 94 of 94 passed | Run after the C# tool was built. `tests/provenance/csharp-candidate.test.ts` needs the built tool, as the CI source job builds it first |
+| `npm run policy` | fails at the Node version assertion (`v24.20.0` against the `v24.21.0` pin) | Environment gap, unchanged from the U9 record. The later assertions are not reached locally. Hosted CI is authoritative |
+| `node tooling/project.ts licence-evaluated` (Windows source leg) | passed | |
+| `actionlint` 1.7.12 on `.github/workflows/ci.yml` | passed | Workflow not changed |
+| gitleaks (pinned image `c00b6bd0`, WSL Debian Docker, `--network none`, over a fresh clone at `b84e2e3`) | no leaks found; 102 commits scanned | The image was already cached, so it was run by its image ID and not pulled. The `git` mode scans the history reachable from HEAD |
+| Hosted only (not run here) | CodeQL (javascript-typescript, actions, csharp), dependency review (PR only), the Linux legs of the csharp and source jobs, the candidate job on Linux, the verify job, and the deploy job (main push only) | Recorded as hosted. `npm run deploy` was not run |
+
+### Gates (fix2 re-run under CI conditions, code head `792af5a`)
+
+The gates were re-run from a clean state (`git clean -fdX` in the worktree, which removes only ignored build output), with `NUGET_PACKAGES` set to a new empty folder under the scratchpad, and with the CI environment of the local CI conditions section. The candidate job then starts from its own clean state, as a fresh checkout does. Every CPU-heavy step ran in the build slot. The first pass at `792af5a` gave the same results, and its logs are not cited separately.
+
+| Gate | Result | Notes |
+| --- | --- | --- |
+| Locked restores (every CSHARP_PROJECTS entry, `--locked-mode`) | passed | |
+| `dotnet format --verify-no-changes --no-restore` (every CSHARP_PROJECTS entry) | passed | |
+| `dotnet build -c Release --no-restore` (every CSHARP_PROJECTS entry) | passed | 11 projects, zero errors and zero warnings |
+| `dotnet test --no-build -c Release` (every CSHARP_TEST_PROJECTS entry) | Tooling 56/56; Site 75 passed, 1 skipped by design (`SiteParityTests`, no React prerender named); Ui 14/14; App 94/94 (91 at fix1, plus the three fix2 tests); Operations 5/5; Policy 108/108 | |
+| Profile publish (App to `artifacts/profiles/app`, Operations to `artifacts/profiles/operations`) | passed | IL build; `RunAOTCompilation` false; no `wasm-tools` workload, so AOT is not run |
+| Static Site (`site build` twice, compared) | identical | nine files |
+| Candidate job: clean, `npm ci`, tooling restore and build, App locked restore and publish to `artifacts/publish/app` | passed | |
+| Profile budgets (`profiles budget` against `eng/policy/profile-budgets.json`) | passed | |
+| Worker and build identity (`candidate.ts worker`, `candidate.ts identity`) | emitted | identity `0.1.0-ci.1.1` (the placeholder run identity) |
+| Candidate (built twice, compared, verified) | identical; verified `0.1.0-ci.1.1` at `792af5a`, 20 members | |
+| Profile bundle (`profiles bundle` and `profiles verify`) | passed | 175 members |
+| `npm ci --ignore-scripts --engine-strict=false` | passed | `--engine-strict=false` is needed locally (see the environment gaps) |
+| `npm audit --audit-level=high` | 0 vulnerabilities | |
+| `npm run check:dependencies` | passed | |
+| `npm run policy` | fails at the Node version assertion (`v24.20.0` against the `v24.21.0` pin) | Environment gap, unchanged. The later assertions are not reached locally. Hosted CI is authoritative |
+| `npm run typecheck` | passed | |
+| `npm run test:dependencies` | 15 of 15 passed | |
+| `npm run test` | 90 of 94 passed at the Source leg, with 4 skipped; 94 of 94 after the candidate publish | The four skipped are the profile bundle tests, which need `artifacts/publish/app`, as in the CI Source job. They pass once the App is published |
+| `node tooling/project.ts licence-evaluated` (Windows source leg) | passed | |
+| `actionlint` on `.github/workflows/ci.yml` | passed | Workflow not changed |
+| gitleaks (pinned image `c00b6bd0`, WSL Debian Docker, `--network none`, over a fresh clone at `792af5a`) | no leaks found; 105 commits scanned | The image was already cached and was run by its image ID, not pulled (S31) |
+| Hosted only (not run here) | CodeQL (javascript-typescript, actions, csharp), dependency review (PR only), the Linux legs of the source and csharp jobs, the candidate job on Linux, the verify job, and the deploy job (main push only) | Recorded as hosted. `npm run deploy` was not run |
+
+### Gates (fix3 re-run under CI conditions, code head `2038716`)
+
+The gates ran after the S36 merge (`f4c639c`) and the pin commit (`2038716`), from a clean state (`git clean -fdX`, which removes only ignored build output), with `NUGET_PACKAGES` set to a new empty folder under the scratchpad. The CI environment of the local CI conditions section applies (`GITHUB_ACTIONS=true`, `CI=true`, the placeholder run identity `1`). Every CPU-heavy step ran in the build slot, one foreground call per chunk. The browser opt-in project is local tooling and is not part of CI. It was restored from the default NuGet cache.
+
+| Gate | Result | Notes |
+| --- | --- | --- |
+| `npm ci --ignore-scripts --engine-strict=false` | passed | `--engine-strict=false` is needed locally (Node 24.20 against the 24.21 pin; npm 12.0.2 against 11.19.0) |
+| `npm audit --audit-level=high` | 0 vulnerabilities | |
+| `npm run check:dependencies` | passed | 114 dependencies, 39 inputs |
+| `npm run typecheck` | passed | |
+| `npm run test:dependencies` | 15 of 15 passed | |
+| `npm run policy` | fails at the Node version assertion (`v24.20.0` against `v24.21.0`) | Environment gap. The later assertions are not reached locally. Hosted CI is authoritative |
+| `npm run test` | 94 of 94 passed | Run after the C# tool was built and the App was published, so the profile bundle tests run |
+| `node tooling/project.ts licence-evaluated` | passed | |
+| Locked restores (every CSHARP_PROJECTS entry, `--locked-mode`) | passed | |
+| `dotnet format --verify-no-changes --no-restore` (every CSHARP_PROJECTS entry) | passed | |
+| `dotnet build -c Release --no-restore` (every CSHARP_PROJECTS entry) | passed | 11 projects, zero errors and zero warnings |
+| `dotnet test --no-build -c Release` (every CSHARP_TEST_PROJECTS entry) | Tooling 56/56; Site 76 passed, 1 skipped by design (`SiteParityTests`); Ui 15/15; App 95/95; Operations 6/6; Policy 108/108 | The counts rise from fix2 because the merge adds tests |
+| Profile publish (App to `artifacts/profiles/app`, Operations to `artifacts/profiles/operations`) | passed | |
+| Static Site (`site build` twice, `diff -r`) | identical | nine files |
+| Candidate job: tooling restore and build, App locked restore and publish to `artifacts/publish/app` | passed | |
+| Profile budgets (`profiles budget`) | passed | |
+| Worker and identity (`candidate.ts worker`, `candidate.ts identity`) | emitted | identity `0.1.0-ci.1.1` (the placeholder run identity) |
+| Candidate (built twice, compared, verified) | identical; verified `0.1.0-ci.1.1` at `2038716`, 20 members | |
+| Profile bundle (`profiles bundle` and `profiles verify`) | passed | 175 members, 18,673,152 bytes |
+| `actionlint` v1.7.12 on `.github/workflows/ci.yml` | passed | Workflow not changed |
+| gitleaks (pinned image `c00b6bd0`, WSL Debian Docker, `--network none`, over a fresh clone at `2038716`) | no leaks found; 109 commits scanned | The cached image was run by its ID, not pulled |
+| Browser opt-in project (`tests/browser/ArcForges.Web.Browser.Tests`, local only) | restore (`--locked-mode`), build (0 warnings, 0 errors) and test passed; 43 total, 20 passed, 23 skipped | The opt-ins are off, so the live specs skip |
+| Hosted only (not run here) | the Linux legs of the source and csharp jobs (the locked Linux restore fails with NU1004 in WSL2), the candidate job on Linux, CodeQL, dependency review (PR only), the verify job, and the deploy job (main push only) | Recorded as hosted. `npm run deploy` was not run |
+
+### Environment gaps (not fixes)
+
+- Node 24.20.0 is installed locally against the 24.21.0 pin, and npm 12.0.2 against the 11.19.0 pin. No toolchain was installed for this run.
+- The WSL2 Debian SDK is 10.0.400, so the locked Linux restore fails with NU1004 there. Linux checks were not run, because they are hosted in CI.
+
+### Commits (local, on `task/prf-11`, not pushed)
+
+`fc4fba0` (U1), `f27a9b4` (U2), `9edf001` (U3), `b21aa64` (U4), `a1ede81` (U5), `2a21bc3` (U6), `db38e2c` (U7), `98547cb` (inventory fix), `3283edf` (U9), then `b84e2e3` (fix1: the shell outcome and the S25 review fields). The fix1 gate re-run record is `8b52483`. Fix2 adds `0b42cb4` (typed refusals, the decimal bound and the TooDeep test) and `792af5a` (the Status and the fix2 review section). The fix2 gate re-run record is the commit after `792af5a`. U8 is skipped by its own condition. Fix3 merges `origin/main` at `049f6a5` (Web #38) as `f4c639c`, pins the exact profile policy to `base-uri 'self'` in `2038716`, and records the fix3 gate re-run in the commit after it.
+
+### Completion blockers (blocked, not proven)
+
+- CLOUD.21 and CLOUD.22 are not started. The exact int64, uint64 and decimal calls, typed failures, cancellation after dispatch, session and CSRF on the deployed origin are blocked on them, not proven.
+- CLOUD.85 is not complete at this record. Its S36 follow-up (Cloud #82) and the proof redeploy are not observed here. Same-origin serving of the shells at `/account/` and `/chat/` under base href `/`, the framework at the root and the exact CSP on the served responses are blocked on it, not proven.
+- The `base-uri` decision is resolved by S36 and Web #38 (`base-uri 'self'`). The check that the shells start on the proof origin is the live spec, which waits for the CLOUD.85 follow-up proof redeploy.
+- The observed server-stream run (LS2), the INP measurement for the AL-06 interaction re-baseline (LS3), and the AOT benchmark (not run).
+- The deployed proof origin is not observed. Every local result is claimant-reported.
+
+### Review fixes (fix1, 2026-10-09)
+
+The independent reviewer's material findings at `3283edf` and their dispositions:
+
+- **Shells do not start under the pinned policy (material).** Confirmed locally; see the open-decision section. The finding asks for `base-uri` to change in `src/ArcForges.Web.Ui/WasmContentSecurityPolicy.cs`. That file is outside the PRF.11 write scope, and brief 5.13 and S20(b) make an in-browser CSP change that needs a Ui edit a stop for a new decision. So no code is changed. The record now states the observed outcome, and the decision is listed in the completion blockers for the coordinator. The pinned string and its test pins are unchanged.
+- **S25 review fields missing (material).** This record now carries the reviewer, `decision: approved` and `reviewedOn` fields at its head (above). `docs/prf-11-stream-transport.md` carries the same fields, and `docs/prf-11-budgets.md` already did. The S25 fields are a proposal ratified only by the named reviewer's exact-head approval.
+
+### Review fixes (fix2, 2026-10-09)
+
+The independent reviewer's material findings at `8b52483` and their dispositions:
+
+- **Status conflicted with the planning stop rule (material).** Fixed in the Status section above: the task is stopped pending the coordinator's Ui decision, and it is not delivered. No Ui change is made, because `src/ArcForges.Web.Ui/**` is outside the write scope (Plan D3).
+- **Exact-value refusals accepted any exception (material, a).** `ExactUnsignedTests` now asserts the parser's typed `FormatException` for every int64 refusal (`ExactInteger.ParseInt64`) and every decimal syntax refusal (the `ExactDecimal` constructor), with `Assert.Throws<FormatException>` in place of `Assert.ThrowsAny<Exception>`.
+- **The shared decimal bound was not tested (material, b).** `DecimalsAtTheSharedBoundAreAcceptedAndRoundTrip` accepts 28 significant digits and nine fractional digits, and round-trips them. `DecimalsOverTheSharedBoundAreRefusedNotRounded` refuses ten fractional digits and 29 significant digits, both as an integer and after 28 integer digits, each as `FormatException`.
+- **The tooDeep refusal was not tested (material, c).** `ANestingAtTheRegistryLevelsDecodesAndOneLevelDeeperIsTooDeep` decodes 100 nested levels and refuses 101 as `ContractSerializationFailure.TooDeep`, through `ContractWire.TryDecode` and `ContractWire.Decode`. The nesting is built from unknown group fields (field 1000), because the test type `V1.Decimal` has no message field. Each group counts against the parser's recursion limit, and `ContractWire` maps the parser's "levels of nesting" refusal to `TooDeep`.
+
+Cases still not covered by a test:
+
+- Nesting through a generated message type that has a message field. The Foundation type the tests decode (`V1.Decimal`) has no such field, so the depth test exercises the parser's recursion limit through unknown groups only.
+- Negative zero and leading-zero decimals (`-0`, `-0.0`, `01.5`). The `ExactDecimal` constructor refuses them, but no test in this fix pins that refusal.
+
+### S36 follow-up (fix3, 2026-10-10)
+
+- The merge: `origin/main` at `049f6a5` (Web #38, from `task/web-40`) is merged into `task/prf-11` as `f4c639c`. It brings the S36 `base-uri 'self'` profile policy in `WasmContentSecurityPolicy` and the S37 removal of the Tailwind preamble from both profile stylesheets. There were no conflicts.
+- The pins: `WasmProfilePolicyTests.ExactPolicy`, `EmittedProfileContractTests.ExactPolicy` and `LivePrf11Specs.ExactPolicy` carry `base-uri 'self'` (`2038716`). The Site policy keeps `base-uri 'none'`, and the Site tests are unchanged.
+- The record: the status, the CSP section, the open decision and the completion blockers now state the resolved decision. The stop recorded at fix1 and fix2 is history.
+- Not claimed at fix3: a separate local headless boot check of the shells under the served headers (the S36 check, which belongs to the WEB.40 follow-up), any deployed result, and the CLOUD.85 follow-up proof redeploy.
+
+### CLOUD.71 history (D11)
+
+CLOUD.71 is ledger-complete for the React bytes only. Its start edge names PRF.11 while PRF.11 has a complete edge on it. Treated as complete-task history (brief S16(a)); no action in this run.
+
+### Not claimed
+
+- PRF.11 completion, and WP-06.05 and PG-23 as proven (only the offline portions are recorded).
+- Any deployed result: the deployed CSP, the deployed shells, the live calls, the live streams, the live INP.
+- Startup time and interaction responsiveness budgets (not measured), and the AOT benchmark (not run).
+- The WA-08 numeric sustained chat memory budget (not found in the Design authority at `b01ae31`; the costing is by construction only).
+- Any macOS result (out of scope, P2-023), and any WSL2 or Linux result (hosted).
+- The deployed proof origin's shells, CSP and live calls: blocked on the CLOUD.85 follow-up redeploy and the local opt-in live run (not proven).
+
+## Live record and review fixes (fix cycle 4, 2026-10-10)
+
+Claimant: `w-deku-20261009-prf-11` (execution agent, Haiku 5.5, local-only). Reviewer of record: `w-deku-20261008-rev-prf-11` (S25; decision `approved`, reviewedOn `2026-10-09` on the earlier heads). Code head of the gate chain and the live run: `31888e1`. The commits after it change no gated input.
+
+This record cites CLOUD.85. It is the PRF.11 deployed proof-origin same-origin and base-href record that the CLOUD.85 evidence clause requires (the S36 follow-up, Cloud #82, deployed at `3c59ce34`).
+
+### Review findings at `2643127` (non-blocking, dispositions)
+
+| Finding | Disposition | Commits |
+| --- | --- | --- |
+| 1. Budget ceilings looser than the pre-PRF.11 WEB.40 ceiling | Re-measured at head. The baseline is restored to the WEB.40 values, byte-identical to `c5a5f2e`. Every ceiling equals its WEB.40 ceiling, so no ceiling is looser and no loosening remains. The table, the cross-check and the run-to-run variation are in `docs/prf-11-budgets.md`, "Head re-measurement and ceilings (review fix 1)". | `31888e1`, `6615398` |
+| 2. HelloProbe explicit bounds not discriminated | The send bound is discriminated. `HelloProbeTests.AGreetingRequestAboveTheUnaryBoundIsRefusedBeforeItsBytesReachTheTransport` fails when `MaxSendMessageSize` is removed (mutation run: the oversized body reaches the transport) and passes with the line restored. The receive bound cannot be discriminated offline, because the Grpc.Net.Client default receive bound is 4,194,304 bytes, the same as the unary class. The explicit receive line is recorded as a value pin, not as proven. | `158d8e9` |
+| 3. StreamFramingTests did not assert the kind | Every case whose name says Malformed asserts `FailureKind.Malformed`, through one helper. | `158d8e9` |
+| 4. Runbook without S25 fields | The reviewer, `decision: approved` and `reviewedOn` are in `docs/prf-11-runbook.md`. | `006b4b8` |
+| 5. D3 reading for `EmittedProfileContractTests` | Accepted. No change. | none |
+| 6. Largest static file not recorded | `_framework/dotnet.native.rw4kynp763.wasm`, 3,001,422 bytes (11.4 percent of the 25 MiB single-file limit), is recorded in the budgets doc and here. | `31888e1`, `6615398` |
+
+App tests are now 96 of 96 (95 before, plus the send-bound test). The mutation run was made in the worktree and reverted before the commit.
+
+### Gate chain at `31888e1` (CI conditions)
+
+Conditions: `GITHUB_ACTIONS=true`, `CI=true`, `GITHUB_REPOSITORY=ArcForges/Web`, placeholder run identity `1` (AFP006), a fresh `NUGET_PACKAGES` folder under the session scratchpad, and `git clean -fdX` first (ignored build output only). Every heavy command ran through `delivery.py build-slot run`, one stage script per call.
+
+| Gate | Result |
+| --- | --- |
+| Locked restores (`--locked-mode`), all 11 CSHARP_PROJECTS | passed |
+| `dotnet format --verify-no-changes --no-restore`, all 11 | passed |
+| `dotnet build -c Release --no-restore`, all 11 | passed, 0 warnings and 0 errors each |
+| `dotnet test --no-build -c Release`, the 6 CSHARP_TEST_PROJECTS | Tooling 56 of 56; Site 76 passed and 1 skipped by design (`SiteParityTests`); Ui 15 of 15; App 96 of 96; Operations 6 of 6; Policy 108 of 108 |
+| Profile publish: App to `artifacts/profiles/app`, Operations to `artifacts/profiles/operations` | passed (IL build, no AOT) |
+| Static Site built twice and compared | identical, 9 files |
+| Candidate publish of App to `artifacts/publish/app` | passed; 174 wwwroot files, 116 precompressed |
+| `profiles budget` | passed. Values at `31888e1`, the same for account and chat: initialRequests 58 (limit 62), htmlBytes 766 (790), initialCssGzip 2328 (2469), initialJsGzip 126015 (138538), initialWasmGzip 3236698 (3549958), initialDataGzip 848189 (933007), initialOtherGzip 238 (261), totalGzip 4213468 (4624236) |
+| `npm ci --ignore-scripts --engine-strict=false` | passed. The engine check is off because the local Node is 24.20.0 against the 24.21.0 pin |
+| Candidate worker and identity (`0.1.0-ci.1.1`, placeholder identity) | emitted |
+| Sealed candidate built twice and compared | identical, 21 files; verified, 20 members, at `31888e1` |
+| Profile bundle (`profiles bundle` and `profiles verify`) | passed; 175 members, 18,672,640 bytes |
+| `npm audit --audit-level=high` | 0 vulnerabilities |
+| `node tooling/project.ts licence-evaluated` | passed |
+| `npm run check:dependencies`, `npm run typecheck`, `npm run test:dependencies` | passed; the dependency tests are 15 of 15 |
+| `npm test` | 94 of 94 |
+| `npm run policy` | fails at the Node version assertion (`v24.20.0` against `v24.21.0`). Recorded as hosted, as the coordinator directed; the later assertions are not reached locally |
+| Browser opt-in project, restore (`--locked-mode`) and Release build | passed, 0 warnings and 0 errors. Built outside CI conditions, which the live run requires |
+
+Not rerun in this cycle: actionlint and gitleaks. The workflow is unchanged since the fix3 run, and the history scan is in the fix3 record. Hosted only, not run here: the Linux legs, CodeQL, dependency review (PR only), the verify job and the deploy job. `npm run deploy` was not run.
+
+### Preconditions observed for the live run (read-only)
+
+- Web PR #38 is merged at `049f6a58583c2b88ed03232d7d18bb975c428a95` (S36 `base-uri 'self'`, S37 Tailwind removal).
+- Cloud PR #82 (the CLOUD.85 S36 follow-up) is merged at `3c59ce34413c94c86ce400fd2950b6372d45abbd`, merged 2026-10-10T00:09:24Z. The Cloud CI run `38009326285` (workflow_dispatch on `main`) concluded success for that head. The proof Worker version `0de3e45a` and the release `web-0.1.0-ci.117.1` are as the coordinator reported. They were not read back from Cloudflare here.
+- Headers on the proof origin, by GET only on 2026-10-10: `/account/` and `/chat/` return 200 with the exact profile policy, which ends `base-uri 'self'; frame-ancestors 'none'; form-action 'none'`. `/` returns 200 with the Site policy, `base-uri 'none'`, as expected. The shell body has one `<base href="/" />` and loads `_framework/blazor.webassembly.js` from the root.
+
+### Live run against `https://proof.arcforges.com/` (local opt-in, installed Chrome)
+
+- Browser: Google Chrome 156.0.8078.12 (`C:\Program Files\Google\Chrome\Application\chrome.exe`; product version read from the file). It is named by `ARCFORGES_CHROMIUM_PATH` and driven by Microsoft.Playwright 1.62.0 through `ExecutablePath`. No browser was downloaded, and `playwright install` was not run. Host: Windows 11 Pro for Workstations 10.0.26300. Claimant-reported.
+- Opt-in: `ARCFORGES_LIVE_PRF11=1`, `ARCFORGES_PROOF_ORIGIN=https://proof.arcforges.com/`, `ARCFORGES_CHROMIUM_PATH` as above, and `ARCFORGES_PRF11_RESULTS` set to a folder outside the repository. `CI`, `GITHUB_ACTIONS`, `TF_BUILD`, `BUILD_BUILDID` and `GITLAB_CI` were unset. `ARCFORGES_PRF11_CLOUD_READY` was unset, because CLOUD.21 and CLOUD.22 are not delivered.
+- Command: `dotnet test tests/browser/ArcForges.Web.Browser.Tests/ArcForges.Web.Browser.Tests.csproj -c Release --filter "FullyQualifiedName~LivePrf11Specs"` at `31888e1`. Result: 4 total, 2 passed, 0 failed, 2 skipped, 14.97 s.
+- Requests: GET only, to the two profile shells, the root framework path and the two pages in the browser. No credential, form or write request was sent.
+
+| Spec | Result | CSP violations | Same-origin and base-href | App roots rendered | Timings |
+| --- | --- | --- | --- | --- | --- |
+| `TheShellsAreServedOnTheProofOriginWithRootBaseAndTheExactPolicy` | passed (HTTP only) | none. The exact profile policy is on both responses | one `<base href="/">` in each shell; `/_framework/blazor.webassembly.js` returns 200 at the root | not applicable (HTTP) | not applicable |
+| `TheShellsLoadInTheInstalledBrowserWithNoContentSecurityPolicyViolation` | passed | 0 reported on `/account/` and `/chat/`. The spec fails on any console or page error that names a Content Security Policy violation | inferred from the render: the root-relative framework loaded and the page rendered. The spec does not record request URLs, so this is not a recorded request trace | the heading in `#app h1` appeared within 60 s on both `/account/` and `/chat/` | not applicable |
+| `TheAnonymousGreetingRoundTripsOnTheDeployedIngress` | skipped: "Blocked on CLOUD.21/CLOUD.22 (and CLOUD.85 for the shells), not proven" | not run | not run | not run | not applicable |
+| `TheGreetingInteractionResponsivenessIsCapturedForTheRebaseline` | skipped: blocked on CLOUD.21/CLOUD.22, not proven | not run | not run | not run | no INP or interaction timing is captured or claimed. The AL-06 interaction re-baseline stays pending, owner PRF.11 |
+
+Items the specs do not cover:
+
+- Binary `application/grpc-web+proto` server stream (LS2): blocked on CLOUD.21/CLOUD.22, not proven. No stream was observed, and the transport decision stays open (grpc-web-text is not needed).
+- Exact int64, uint64 and decimal calls through the deployed probe, typed failures (CLOUD.22), cancellation after dispatch, and session, CSRF and logout receipt: blocked on CLOUD.21/CLOUD.22, not proven. None was attempted, because the runbook makes these manual and authenticated.
+- AOT benchmark: not run (no `wasm-tools` workload). Startup time: not measured.
+
+Operational notes:
+
+- The first attempts used `dotnet test ... --report-trx`. With the trx reporter, the Microsoft Testing Platform run reported "Zero tests ran" and exit code 5. With the same filter and no trx flag, the four specs ran. Two `--no-build` runs also reported zero tests in the first attempts; that was not isolated further. The recorded run is the build form without the trx flag, and `docs/prf-11-runbook.md` now gives that command.
+- The result is one local run on one host on 2026-10-10. It is claimant-reported. Nothing here is a CI result.
+
+### Completion status after this record
+
+- PRF.11 stays delivered on its offline units U1 to U9 and on this local live run (brief S20(d)). Its completion still waits on CLOUD.21 and CLOUD.22. Every part that needs them is recorded as "blocked on CLOUD.21/CLOUD.22, not proven", and none is recorded as passed or deferred.
+- The proof-origin shells, the exact served CSP, the root framework path and the in-browser CSP check are observed in this run. That is the deployed evidence that CLOUD.85 cites.
+- Still not claimed: the greeting round trip, INP, the binary stream, the exact-value calls, typed failures, cancellation, session and CSRF on the deployed origin, startup time, and the AOT benchmark.
diff --git a/docs/prf-11-runbook.md b/docs/prf-11-runbook.md
new file mode 100644
index 0000000..7bdb257
--- /dev/null
+++ b/docs/prf-11-runbook.md
@@ -0,0 +1,55 @@
+# PRF.11 live runbook (local opt-in, not executed in CI)
+
+Reviewer: `w-deku-20261008-rev-prf-11` (pre-assigned, brief S25). Decision: `approved`. reviewedOn: `2026-10-09`. These fields are a proposal written at write time. Only the named reviewer's exact-head approval ratifies them, and a refusal blocks the merge.
+
+This runbook is for the local opt-in live run of the PRF.11 proof, against the deployed proof origin. It is not a CI job, and nothing in it runs on a CI host. The live specs are in `tests/browser/ArcForges.Web.Browser.Tests/LivePrf11Specs.cs` and skip without the opt-in. The record of what has been observed is in `docs/prf-11-profile-proof.md`. No credential is in this file or in the specs. Do not add one.
+
+## Preconditions (all must hold before a run is recorded as evidence)
+
+- CLOUD.85 is delivered: the Account and Chat shells are served at `/account/` and `/chat/` under base href `/`, with the framework at the root and the exact CSP on the served responses (CLOUD.85 D1). Until then, the shell checks are "blocked on CLOUD.85, not proven".
+- CLOUD.21 and CLOUD.22 are delivered: the real generated methods are on the deployed gRPC-Web ingress, with the typed mapping. Until then, the exact-value, typed-failure and cancellation checks are "blocked on CLOUD.21/CLOUD.22, not proven".
+- The lease `RES-cloud-deployment` is held by the claimant for the live run only (the coordinator grants it). Release it when the run ends. Nothing in this runbook takes or renews a lease.
+- The browser is the installed Google Chrome or Microsoft Edge, named by path. No browser is downloaded (no `playwright install`).
+- The run is on a developer machine (Windows 11 for this proof). It is not a CI host: `CI`, `GITHUB_ACTIONS`, `TF_BUILD`, `BUILD_BUILDID` and `GITLAB_CI` must be unset, or the gate refuses the run.
+
+## Opt-in variables
+
+| Variable | Value | Meaning |
+| --- | --- | --- |
+| `ARCFORGES_LIVE_PRF11` | `1` | Enables the live specs. |
+| `ARCFORGES_PROOF_ORIGIN` | `https://proof.arcforges.com/` | The proof origin. It must be https, with no path, query, fragment or user information. |
+| `ARCFORGES_CHROMIUM_PATH` | the installed `chrome.exe` or `msedge.exe` path | The browser executable. |
+| `ARCFORGES_PRF11_CLOUD_READY` | `1` | Marks the cloud parts ready. Set only after CLOUD.21, CLOUD.22 and CLOUD.85 are delivered and the ingress is observed. |
+| `ARCFORGES_PRF11_RESULTS` | a local folder outside the repository | Where the INP measurement is written. The folder is not committed. |
+
+## Run
+
+1. Build the browser project locally, after a locked restore of `tests/browser/ArcForges.Web.Browser.Tests/ArcForges.Web.Browser.Tests.csproj`.
+2. Run the live specs with the variables above set, and with the CI markers unset:
+
+   `dotnet test tests/browser/ArcForges.Web.Browser.Tests/ArcForges.Web.Browser.Tests.csproj -c Release --filter "FullyQualifiedName~LivePrf11Specs"`
+
+3. Read the skip reasons. A skipped cloud spec is "blocked on CLOUD.21/CLOUD.22, not proven" and is not evidence.
+
+## What each spec records
+
+- `TheShellsAreServedOnTheProofOriginWithRootBaseAndTheExactPolicy`: HTTP 200 for `/account/` and `/chat/`, one `<base href="/">`, the exact CSP string on each response, and `/_framework/blazor.webassembly.js` at the root.
+- `TheShellsLoadInTheInstalledBrowserWithNoContentSecurityPolicyViolation`: the in-browser CSP check. The page is loaded with JavaScript enabled, and any console or page-error message that names a Content-Security-Policy violation fails the run. This is the check for the `base-uri 'none'` open point.
+- `TheAnonymousGreetingRoundTripsOnTheDeployedIngress` (cloud-ready only): the Chat greeting for a name returns the exact text on the deployed origin.
+- `TheGreetingInteractionResponsivenessIsCapturedForTheRebaseline` (cloud-ready only): five greetings and the `event`-type INP durations, written as JSON under `ARCFORGES_PRF11_RESULTS`. No budget is asserted. The values feed the AL-06 interaction re-baseline (owner PRF.11).
+
+## Manual steps (not automated, and not run by these specs)
+
+These need an authenticated session or the CLOUD.21 methods, and they must not be automated with credentials here:
+
+- The exact int64, uint64 and decimal values through the real Cloud probe (for example `WorkspaceService.GetHealth` counters and an `UpdateSettings` revision precondition), read back exactly.
+- Typed failures from the real mapping (CLOUD.22), including an HTTP 200 with error trailers, and a deadline.
+- Cancellation after dispatch.
+- Session expiry, the CSRF token on a state change, and logout receipt handling on the deployed origin.
+- The binary `application/grpc-web+proto` server stream observation (LS2 in `docs/prf-11-stream-transport.md`), and grpc-web-text only if the binary observation fails.
+
+Record each manual step with the host, the browser and its version, the commit, the date, the deployment identity, and that the result is claimant-reported. Do not record a manual step as automated.
+
+## Recording
+
+The claimant records the host, browser, commit, date and deployment identity in `docs/prf-11-profile-proof.md` for every run that is cited as evidence. Failed or skipped runs are recorded as such. Nothing here is a CI result.
diff --git a/docs/prf-11-stream-transport.md b/docs/prf-11-stream-transport.md
new file mode 100644
index 0000000..f369d35
--- /dev/null
+++ b/docs/prf-11-stream-transport.md
@@ -0,0 +1,44 @@
+# PRF.11 server-stream transport decision (pending the observed run)
+
+Reviewer: `w-deku-20261008-rev-prf-11` (pre-assigned, brief S25). Decision: `approved`. reviewedOn: `2026-10-09`. The decision field records the review of this record, its candidate order and its evidence. It is not a transport choice, which stays open until the observed run (LS2). These fields are a proposal that only the named reviewer's exact-head approval ratifies.
+
+Status: open. The decision is recorded as a candidate order with the offline evidence below. It is not final until the local opt-in run against the deployed ingress observes the binary stream (LS2 in the PRF.11 plan). Until then, no transport is claimed as proven.
+
+## The two candidate framings
+
+| Framing | Content type | Browser path | Offline evidence |
+| --- | --- | --- | --- |
+| Binary server stream | `application/grpc-web+proto` | .NET 10 browser streaming client (`HttpClient` streaming response in Blazor WebAssembly) | `tests/ArcForges.Web.App.Tests/StreamFramingTests.cs`: frames decode in order, the trailers frame carries `grpc-status: 0`, a truncated frame is malformed, and a data frame over the 32 KiB stream bound is refused. |
+| grpc-web-text server stream | `application/grpc-web-text` | the whole body is base64 and decodes before the frames are read | `StreamFramingTests`: the text body decodes to the same bytes as the binary body; a body that is not a whole number of four-character groups, or that has a character outside the base64 alphabet, is malformed. |
+
+Both framings are tested as fixtures only. The decoders in the test are not product code. The App has no streaming surface in this phase, and a streamed message is decoded through the generated parser with the CON.92 stream frame class (`WireLimit.StreamFrame`, 32 KiB).
+
+## Decision order
+
+1. Binary `application/grpc-web+proto` first. Requirement 12 (line 418) makes binary server streaming the required path, and the brief (section 11, S3) keeps streaming in V1.
+2. grpc-web-text only on server-stream routes, and only if the binary stream is observed to fail in the deployed run. The variant is then recorded here with the observed behaviour.
+
+Nothing in this record selects grpc-web-text in advance, because the sources conflict (brief section 5, item 12).
+
+## Source pages (cited, to be re-read at the observed run)
+
+These are the two sources the brief records as verified (brief section 7, item 5.12 refined). They are cited here with the statement that the brief attributes to each. Their exact text is re-read and quoted when the observed run is recorded, because the two sources conflict.
+
+- The grpc-web README, `https://raw.githubusercontent.com/grpc/grpc-web/master/README.md`. Brief section 7 records that it states server streaming is supported only in grpc-web-text mode in browsers.
+- The Microsoft Learn gRPC-Web page for .NET (the page the brief calls the Learn gRPC-Web page; its exact address is recorded in the PRF.11 observed run, because the brief does not record it). Brief section 7 records that it returned 404 in two earlier passes, was retrieved with HTTP 200 on 2026-10-08 by the decision-record reviewers, and states that `GrpcWebText` is required for server streaming in browsers.
+
+The conflict is the reason the decision is open. The .NET 10 browser streaming client is expected to read a binary stream, and the grpc-web README says browsers need the text mode. The observed run settles it.
+
+## What the observed run must record (LS2)
+
+- The host, browser (installed Chrome or Edge, with its version), the commit, the date and the deployment identity, claimant-reported.
+- The binary `application/grpc-web+proto` stream against the deployed ingress: the frames received in order, the trailers status, and whether the stream was delivered incrementally or only at the end.
+- The grpc-web-text stream only if the binary stream fails, with the same fields.
+- The exact source text quoted from both pages at the time of the run.
+- A wire-registry row, if the framing variant needs one, as a handoff to Contracts. It is not a PRF.11 write.
+
+## Not claimed
+
+- No live stream is observed in this phase. The deployed ingress depends on CLOUD.21 and CLOUD.22 (blocked, not proven) and on CLOUD.85 (blocked, not proven).
+- The offline fixtures prove the framing and the bounds only. They do not prove that a browser delivers a server stream incrementally.
+- The .NET 10 browser streaming client is not exercised offline in this phase.
diff --git a/eng/provenance/files.json b/eng/provenance/files.json
index 692aef7..91a90fb 100644
--- a/eng/provenance/files.json
+++ b/eng/provenance/files.json
@@ -280,7 +280,18 @@
     "tsconfig.json",
     "win.slnx",
     "worker/index.ts",
-    "wrangler.json"
+    "wrangler.json",
+    "docs/prf-11-budgets.md",
+    "docs/prf-11-profile-proof.md",
+    "docs/prf-11-runbook.md",
+    "docs/prf-11-stream-transport.md",
+    "tests/ArcForges.Web.App.Tests/StreamFramingTests.cs",
+    "tests/ArcForges.Web.App.Tests/WireLimitTests.cs",
+    "tests/ArcForges.Web.Tooling.Tests/EmittedProfileContractTests.cs",
+    "tests/browser/ArcForges.Web.Browser.Tests/LivePrf11OptIn.cs",
+    "tests/browser/ArcForges.Web.Browser.Tests/LivePrf11OptInTests.cs",
+    "tests/browser/ArcForges.Web.Browser.Tests/LivePrf11Specs.cs",
+    "tests/browser/ArcForges.Web.Browser.Tests/LocalNoScriptBrowserTests.cs"
   ],
   "reused": {
     "LICENSE": "canonical-agpl-legal-r1",
diff --git a/src/ArcForges.Web.App/Probe/HelloProbe.cs b/src/ArcForges.Web.App/Probe/HelloProbe.cs
index f4a5628..adf5cd2 100644
--- a/src/ArcForges.Web.App/Probe/HelloProbe.cs
+++ b/src/ArcForges.Web.App/Probe/HelloProbe.cs
@@ -2,6 +2,7 @@
 using System.Globalization;
 using System.Net;
 using System.Text;
+using ArcForges.Contracts.Foundation.Serialization;
 using ArcForges.Contracts.Hello.V1;
 using Grpc.Core;
 using Grpc.Net.Client;
@@ -62,6 +63,9 @@ public async Task<string> SayHelloAsync(string name, CancellationToken cancellat
             HttpHandler = new GrpcWebHandler(GrpcWebMode.GrpcWeb, new ObservingHandler(_transport, seen)),
             DisposeHttpClient = false,
             ThrowOperationCanceledOnCancellation = true,
+            // The greeting is a unary call, so both directions are bounded by the CON.92 unary message class (4 MiB).
+            MaxReceiveMessageSize = WireLimits.Bytes(WireLimit.UnaryMessage),
+            MaxSendMessageSize = WireLimits.Bytes(WireLimit.UnaryMessage),
         });
         try
         {
diff --git a/tests/ArcForges.Web.App.Tests/ExactUnsignedTests.cs b/tests/ArcForges.Web.App.Tests/ExactUnsignedTests.cs
index 0e0509a..df79fd4 100644
--- a/tests/ArcForges.Web.App.Tests/ExactUnsignedTests.cs
+++ b/tests/ArcForges.Web.App.Tests/ExactUnsignedTests.cs
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Port of the 64-bit case of tests/unit/app-session.test.ts: canonical decimal text in, the same text out, and no value passes
 // through a floating-point number.
+using ArcForges.Contracts.Foundation.Values;
 using ArcForges.Web.App.Probe;
 using Xunit;
 
@@ -55,4 +56,79 @@ public void AnythingThatIsNotCanonicalUint64TextIsRefused()
             Assert.False(Exact.TryUnsigned(value, out _), value);
         Assert.False(Exact.TryUnsigned(null, out _));
     }
+
+    [Fact]
+    public void SignedSixtyFourBitValuesAtTheirEdgesAndAboveTheDoubleRangeStayExact()
+    {
+        // The generated Contracts parser (ExactInteger.ParseInt64) holds int64 values exactly, at both edges and above 2^53.
+        Assert.Equal(long.MinValue, ExactInteger.ParseInt64("-9223372036854775808"));
+        Assert.Equal(long.MaxValue, ExactInteger.ParseInt64("9223372036854775807"));
+        Assert.Equal(9007199254740993L, ExactInteger.ParseInt64("9007199254740993"));
+        Assert.NotEqual(ExactInteger.ParseInt64("9007199254740993"), ExactInteger.ParseInt64("9007199254740992"));
+    }
+
+    [Fact]
+    public void NonCanonicalOrOutOfRangeSignedTextIsRefusedNotRounded()
+    {
+        // The parser refuses with its typed FormatException, and no other exception type passes.
+        foreach (var value in new[] { "-0", "01", "+1", "1e3", " 1", "1 ", "0x10", "9223372036854775808", "-9223372036854775809" })
+            Assert.Throws<FormatException>(() => ExactInteger.ParseInt64(value));
+    }
+
+    [Fact]
+    public void DecimalTextKeepsItsCoefficientAndDeclaredScaleExactly()
+    {
+        // Shared exact decimal (Foundation): canonical wire text, declared scale preserved, no binary floating point.
+        // The shared bound admits at most nine fractional digits and twenty-eight significant digits.
+        foreach (var value in new[] { "0", "-12.5", "12345678901234567890.1200", "0.000000001" })
+        {
+            var exact = new ExactDecimal(value);
+            Assert.Equal(value, exact.Value);
+            Assert.Equal(value, new ExactDecimal(value).ToWire().Value);
+        }
+        var trailing = new ExactDecimal("12345678901234567890.1200");
+        Assert.Equal(4, trailing.Scale);
+        Assert.Equal(System.Numerics.BigInteger.Parse("123456789012345678901200", System.Globalization.CultureInfo.InvariantCulture), trailing.Coefficient);
+    }
+
+    [Fact]
+    public void NonCanonicalDecimalTextIsRefused()
+    {
+        // The constructor refuses syntax with its typed FormatException, and no other exception type passes.
+        foreach (var value in new[] { "1e3", "+1", " 1", "NaN", "Infinity" })
+            Assert.Throws<FormatException>(() => new ExactDecimal(value));
+    }
+
+    [Fact]
+    public void DecimalsAtTheSharedBoundAreAcceptedAndRoundTrip()
+    {
+        // The shared bound admits at most nine fractional digits and twenty-eight significant digits.
+        foreach (var value in new[]
+                 {
+                     "1234567890123456789.123456789",
+                     "-1234567890123456789.123456789",
+                     "0.123456789",
+                     "1234567890123456789012345678",
+                 })
+        {
+            var exact = new ExactDecimal(value);
+            Assert.Equal(value, exact.Value);
+            Assert.Equal(value, exact.ToWire().Value);
+        }
+        Assert.Equal(9, new ExactDecimal("1234567890123456789.123456789").Scale);
+    }
+
+    [Fact]
+    public void DecimalsOverTheSharedBoundAreRefusedNotRounded()
+    {
+        // Ten fractional digits, and 29 significant digits (an integer, and a fraction after 28 integer digits), are over the bound.
+        foreach (var value in new[]
+                 {
+                     "0.1234567890",
+                     "1.0000000000",
+                     "12345678901234567890123456789",
+                     "1234567890123456789012345678.9",
+                 })
+            Assert.Throws<FormatException>(() => new ExactDecimal(value));
+    }
 }
diff --git a/tests/ArcForges.Web.App.Tests/HelloProbeTests.cs b/tests/ArcForges.Web.App.Tests/HelloProbeTests.cs
index ad3dacb..d4d5070 100644
--- a/tests/ArcForges.Web.App.Tests/HelloProbeTests.cs
+++ b/tests/ArcForges.Web.App.Tests/HelloProbeTests.cs
@@ -3,10 +3,12 @@
 // Grpc.Net.Client.Web. The server is a test-only double; every answer is a real gRPC-Web frame sequence.
 using System.Net;
 using System.Text;
+using ArcForges.Contracts.Foundation.Serialization;
 using ArcForges.Contracts.Hello.V1;
 using ArcForges.Web.App.Probe;
 using ArcForges.Web.App.Tests.Fixtures;
 using ArcForges.Web.App.Tests.TestDoubles;
+using Google.Protobuf;
 using Grpc.Core;
 using Xunit;
 
@@ -160,6 +162,37 @@ public async Task AReplyThatIsNotTheGreetingForThisNameIsMalformed()
         Assert.True(await FailureOf(() => ProbeFor(server).SayHelloAsync("ArcForges", CancellationToken.None)) == FailureKind.Malformed);
     }
 
+    [Fact]
+    public async Task AGreetingRequestAboveTheUnaryBoundIsRefusedBeforeItsBytesReachTheTransport()
+    {
+        // CON.92: the greeting is unary, so its request is bounded by the 4 MiB unary message class. The client refuses a
+        // request over the explicit send bound before its bytes are written. The library default for the send bound is null
+        // (no bound), so removing the explicit MaxSendMessageSize line lets the oversized body reach the transport, and this
+        // test then fails. The name is one byte over the class, so the request message is over the bound.
+        var bound = (int)WireLimits.Bytes(WireLimit.UnaryMessage);
+        var server = ScriptedServer.Always(() => Answer(ProbeFixtures.HelloReply()));
+
+        await Assert.ThrowsAnyAsync<ProbeFailureException>(
+            () => ProbeFor(server).SayHelloAsync(new string('a', bound + 1), CancellationToken.None));
+        Assert.All(server.Requests, request => Assert.True(request.Body.Length <= bound, "An oversized request reached the transport."));
+    }
+
+    [Fact]
+    public async Task AGreetingReplyAboveTheUnaryMessageBoundIsRefusedNeverAccepted()
+    {
+        // CON.92: a unary reply is bounded by the 4 MiB unary message class. A data frame whose message is over the class is
+        // refused by the client's receive bound, and the probe never presents it as a greeting. The library default receive
+        // bound is also 4,194,304 bytes, so this test pins the bound's behaviour, not the explicit MaxReceiveMessageSize line
+        // (its removal is not observable here; docs/prf-11-profile-proof.md records this).
+        var bound = (int)WireLimits.Bytes(WireLimit.UnaryMessage);
+        var oversized = new SayHelloResponse { Message = new string('h', bound) }.ToByteArray();
+        var body = ProbeFixtures.Concat(ProbeFixtures.Frame(oversized, 0), ProbeFixtures.Trailers("grpc-status: 0\r\n"));
+        var server = ScriptedServer.Always(() => Answer(body));
+
+        // The client refuses the frame before any greeting is decoded, and a successful status with no readable reply is malformed.
+        Assert.Equal(FailureKind.Malformed, await FailureOf(() => ProbeFor(server).SayHelloAsync("ArcForges", CancellationToken.None)));
+    }
+
     [Fact]
     public async Task TheUsersCancellationAbortsTheRequestAndIsReportedAsCancelled()
     {
diff --git a/tests/ArcForges.Web.App.Tests/StreamFramingTests.cs b/tests/ArcForges.Web.App.Tests/StreamFramingTests.cs
new file mode 100644
index 0000000..a9d92e2
--- /dev/null
+++ b/tests/ArcForges.Web.App.Tests/StreamFramingTests.cs
@@ -0,0 +1,151 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Offline server-stream framing fixtures (PRF.11 U4). Both candidate framings are tested as fixtures only: the binary
+// application/grpc-web+proto stream (the first choice, requirement 12 line 418) and the grpc-web-text variant
+// (application/grpc-web-text, the base64 encoding of the same frames). The decoders here are test-only and check the
+// framing, the CON.92 stream frame bound and the malformed cases. They make no claim about the deployed ingress, which is
+// observed only in the local opt-in run (U7 and LS2).
+using System.Buffers.Binary;
+using System.Text;
+using ArcForges.Contracts.Foundation.Serialization;
+using ArcForges.Web.App.Probe;
+using ArcForges.Web.App.Tests.Fixtures;
+using Google.Protobuf;
+using Xunit;
+using WireDecimal = ArcForges.Contracts.Foundation.V1.Decimal;
+
+namespace ArcForges.Web.App.Tests;
+
+public sealed class StreamFramingTests
+{
+    /// <summary>One decoded frame: its flag byte and its payload.</summary>
+    private sealed record Frame(byte Flag, byte[] Payload);
+
+    /// <summary>
+    /// The test-only binary decoder: a flag byte, a big-endian 32-bit length and the payload, repeated. A frame that declares
+    /// more bytes than remain is malformed, and a data frame above the stream frame bound is too large.
+    /// </summary>
+    private static List<Frame> DecodeBinary(ReadOnlySpan<byte> body)
+    {
+        var frames = new List<Frame>();
+        var offset = 0;
+        while (offset < body.Length)
+        {
+            if (body.Length - offset < 5)
+                throw new ProbeFailureException(FailureKind.Malformed);
+            var flag = body[offset];
+            var length = BinaryPrimitives.ReadUInt32BigEndian(body.Slice(offset + 1, 4));
+            offset += 5;
+            if (length > body.Length - offset)
+                throw new ProbeFailureException(FailureKind.Malformed);
+            var isTrailer = (flag & 0x80) != 0;
+            if (!isTrailer && length > WireLimits.Bytes(WireLimit.StreamFrame))
+                throw new ProbeFailureException(FailureKind.Malformed);
+            frames.Add(new Frame(flag, body.Slice(offset, (int)length).ToArray()));
+            offset += (int)length;
+        }
+        return frames;
+    }
+
+    /// <summary>Asserts that a decode refuses its input as a malformed frame or body (never a partial message).</summary>
+    private static void AssertMalformed(Action decode) =>
+        Assert.Equal(FailureKind.Malformed, Assert.Throws<ProbeFailureException>(decode).Kind);
+
+    /// <summary>The test-only grpc-web-text decoder: the whole body is base64, decoded before the frames are read.</summary>
+    private static byte[] DecodeText(string body)
+    {
+        // A complete grpc-web-text body is a whole number of four-character base64 groups.
+        if (body.Length % 4 != 0)
+            throw new ProbeFailureException(FailureKind.Malformed);
+        try
+        {
+            return Convert.FromBase64String(body);
+        }
+        catch (FormatException exception)
+        {
+            throw new ProbeFailureException(FailureKind.Malformed, exception);
+        }
+    }
+
+    /// <summary>A server stream of three data messages and an OK trailers frame, as binary frames.</summary>
+    private static byte[] ThreeMessageStream()
+    {
+        var parts = new List<byte[]>();
+        foreach (var text in new[] { "9007199254740993", "18446744073709551615", "-9223372036854775808" })
+            parts.Add(ProbeFixtures.Frame(new WireDecimal { Value = text }.ToByteArray(), 0));
+        parts.Add(ProbeFixtures.Trailers("grpc-status: 0\r\n"));
+        return ProbeFixtures.Concat([.. parts]);
+    }
+
+    [Fact]
+    public void TheBinaryStreamDecodesToItsMessagesInOrderAndEndsWithItsStatus()
+    {
+        var frames = DecodeBinary(ThreeMessageStream());
+
+        Assert.Equal(4, frames.Count);
+        Assert.Equal(new[] { "9007199254740993", "18446744073709551615", "-9223372036854775808" },
+            frames.Take(3).Select(frame => WireDecimal.Parser.ParseFrom(frame.Payload).Value).ToArray());
+        Assert.True((frames[3].Flag & 0x80) != 0);
+        Assert.Equal("grpc-status: 0\r\n", Encoding.UTF8.GetString(frames[3].Payload));
+    }
+
+    [Fact]
+    public void TheGrpcWebTextStreamCarriesTheSameFramesAsTheBinaryStream()
+    {
+        var binary = ThreeMessageStream();
+        var text = Convert.ToBase64String(binary);
+
+        var decoded = DecodeText(text);
+
+        Assert.Equal(binary, decoded);
+        Assert.Equal(
+            DecodeBinary(binary).Select(frame => Convert.ToBase64String(frame.Payload)),
+            DecodeBinary(decoded).Select(frame => Convert.ToBase64String(frame.Payload)));
+    }
+
+    [Fact]
+    public void AStreamFrameAtTheBoundIsAcceptedAndOneByteOverIsMalformedNeverAPartialMessage()
+    {
+        var bound = (int)WireLimits.Bytes(WireLimit.StreamFrame);
+        // A data frame of exactly the stream bound is accepted; the payload is an opaque byte run for the framing check.
+        var atBound = ProbeFixtures.Frame(new byte[bound], 0);
+        Assert.Single(DecodeBinary(atBound));
+
+        var overBound = ProbeFixtures.Frame(new byte[bound + 1], 0);
+        AssertMalformed(() => DecodeBinary(overBound));
+    }
+
+    [Fact]
+    public void ATruncatedBinaryFrameIsMalformedAndNeverAMessage()
+    {
+        // The header declares five payload bytes; only one remains.
+        byte[] truncated = [0x00, 0x00, 0x00, 0x00, 0x05, 0x61];
+        AssertMalformed(() => DecodeBinary(truncated));
+
+        // A header cut short is malformed too.
+        byte[] shortHeader = [0x00, 0x00, 0x00];
+        AssertMalformed(() => DecodeBinary(shortHeader));
+    }
+
+    [Fact]
+    public void AMalformedGrpcWebTextBodyIsMalformedAndNeverAMessage()
+    {
+        // Not a whole number of four-character groups.
+        AssertMalformed(() => DecodeText("AAAAA"));
+        // A character outside the base64 alphabet.
+        AssertMalformed(() => DecodeText("AA!A"));
+        // A body that is valid base64 but whose frames are truncated is malformed at the framing layer.
+        var truncated = Convert.ToBase64String(new byte[] { 0x00, 0x00, 0x00, 0x00, 0x09, 0x61 });
+        AssertMalformed(() => DecodeBinary(DecodeText(truncated)));
+    }
+
+    [Fact]
+    public void EachStreamedMessageDecodesAsAStreamFrameMessageWithinTheBound()
+    {
+        // The payloads are the generated messages, checked against the stream frame class of CON.92.
+        foreach (var frame in DecodeBinary(ThreeMessageStream()).Where(frame => (frame.Flag & 0x80) == 0))
+        {
+            Assert.True(ContractWire.TryDecode(WireDecimal.Parser, frame.Payload, WireLimit.StreamFrame, out var message, out _));
+            Assert.NotNull(message);
+        }
+    }
+}
diff --git a/tests/ArcForges.Web.App.Tests/WasmProfilePolicyTests.cs b/tests/ArcForges.Web.App.Tests/WasmProfilePolicyTests.cs
index 8a4deb6..8a54fe3 100644
--- a/tests/ArcForges.Web.App.Tests/WasmProfilePolicyTests.cs
+++ b/tests/ArcForges.Web.App.Tests/WasmProfilePolicyTests.cs
@@ -31,6 +31,31 @@ public void TheAppPolicyHasExactlyTheWasmScriptTokensAndSelfOnlyStyles()
         Assert.True(policy.Length < WasmContentSecurityPolicy.HeaderLineBudget);
     }
 
+    /// <summary>
+    /// The exact policy that the emitted host page produces (PRF.11 U2, base-uri corrected by S36 and WEB.40 follow-up Web #38).
+    /// The shells carry the base element, so base-uri is 'self'; the Site policy keeps 'none'. Any change to the directive set
+    /// or to its order is a reviewed decision, because the proof deployment serves exactly this string on both profile paths.
+    /// </summary>
+    internal const string ExactPolicy =
+        "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'none'";
+
+    [Fact]
+    public void TheEmittedPolicyIsTheExactReviewedString()
+    {
+        Assert.Equal(ExactPolicy, WasmContentSecurityPolicy.FromHostPages([AppSource("wwwroot/index.html")]));
+    }
+
+    [Fact]
+    public void TheHostPageDeclaresExactlyOneBaseAtTheRootAndTheShellsRelyOnIt()
+    {
+        // CLOUD.85 D1: the Account and Chat shells are served at /account/ and /chat/ under base href "/", so the framework
+        // resolves from the root. The host page carries one base element and it names the root.
+        var html = AppSource("wwwroot/index.html");
+        var bases = Regex.Matches(html, @"<base\s[^>]*>", RegexOptions.IgnoreCase);
+        var only = Assert.Single(bases);
+        Assert.Matches(@"^<base\s+href=""/""\s*/?>$", only.Value);
+    }
+
     [Fact]
     public void ARequiredInlineScriptAddsItsHashAndNothingElseToScriptSources()
     {
diff --git a/tests/ArcForges.Web.App.Tests/WireLimitTests.cs b/tests/ArcForges.Web.App.Tests/WireLimitTests.cs
new file mode 100644
index 0000000..200fa30
--- /dev/null
+++ b/tests/ArcForges.Web.App.Tests/WireLimitTests.cs
@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// The CON.92 decode and encode limits (PRF.11 U3, offline). The bounds are the registry values of the Contracts wire codec, and
+// the boundary is checked on the real generated parser: the exact bound decodes, one byte over is refused as too large, and a
+// truncated frame is malformed. Live cases (the deployed ingress) are local opt-in and stay in U7.
+using ArcForges.Contracts.Foundation.Serialization;
+using Google.Protobuf;
+using Xunit;
+using WireDecimal = ArcForges.Contracts.Foundation.V1.Decimal;
+
+namespace ArcForges.Web.App.Tests;
+
+public sealed class WireLimitTests
+{
+    /// <summary>A decimal message whose binary encoding is exactly <paramref name="size"/> bytes.</summary>
+    private static WireDecimal MessageOfEncodedSize(int size)
+    {
+        // The encoding is one tag byte, a length varint and the text, so it grows with the text. The text length that gives
+        // the size is found by counting down from the size, which is at most a few steps because the varint adds at most five.
+        for (var length = size; length >= 0; length--)
+        {
+            var candidate = new WireDecimal { Value = new string('7', length) };
+            if (candidate.CalculateSize() == size)
+                return candidate;
+        }
+        throw new InvalidOperationException("No text length gives the requested encoded size.");
+    }
+
+    [Fact]
+    public void TheRegistryByteBoundsAreTheReviewedCon92Values()
+    {
+        Assert.Equal(4 * 1024 * 1024, WireLimits.Bytes(WireLimit.UnaryMessage));
+        Assert.Equal(4 * 1024 * 1024, WireLimits.Bytes(WireLimit.HelperMessage));
+        Assert.Equal(256 * 1024, WireLimits.Bytes(WireLimit.InlinePage));
+        Assert.Equal(32 * 1024, WireLimits.Bytes(WireLimit.StreamFrame));
+        Assert.Equal(64 * 1024 * 1024, WireLimits.Bytes(WireLimit.LargeProjection));
+        Assert.Equal(100, WireLimits.NestedMessageLevels);
+    }
+
+    [Fact]
+    public void ADecodeAtTheStreamFrameBoundIsAcceptedAndOneByteOverIsTooLarge()
+    {
+        var bound = WireLimits.Bytes(WireLimit.StreamFrame);
+        var atBound = MessageOfEncodedSize(bound).ToByteArray();
+        Assert.Equal(bound, atBound.Length);
+        Assert.True(ContractWire.TryDecode(WireDecimal.Parser, atBound, WireLimit.StreamFrame, out var decoded, out _));
+        Assert.NotNull(decoded);
+        Assert.Equal(MessageOfEncodedSize(bound).Value, decoded.Value);
+
+        var overBound = MessageOfEncodedSize(bound + 1).ToByteArray();
+        Assert.Equal(bound + 1, overBound.Length);
+        Assert.False(ContractWire.TryDecode(WireDecimal.Parser, overBound, WireLimit.StreamFrame, out _, out var refused));
+        Assert.Equal(ContractSerializationFailure.TooLarge, refused);
+    }
+
+    /// <summary>
+    /// Bytes of <paramref name="levels"/> unknown groups, each nested in the one before (field 1000, start group then end
+    /// group). The decimal parser keeps no field 1000, so it skips each group recursively, and each group is one message
+    /// level against the parser's recursion limit. The bytes are small, so only the nesting can refuse them.
+    /// </summary>
+    private static byte[] NestedGroups(int levels)
+    {
+        var bytes = new byte[levels * 4];
+        for (var i = 0; i < levels; i++)
+        {
+            bytes[2 * i] = 0xC3;           // field 1000, wire type 3 (start group)
+            bytes[2 * i + 1] = 0x3E;
+        }
+        for (var i = 0; i < levels; i++)
+        {
+            bytes[2 * levels + 2 * i] = 0xC4;  // field 1000, wire type 4 (end group)
+            bytes[2 * levels + 2 * i + 1] = 0x3E;
+        }
+        return bytes;
+    }
+
+    [Fact]
+    public void ANestingAtTheRegistryLevelsDecodesAndOneLevelDeeperIsTooDeep()
+    {
+        var atLevels = NestedGroups(WireLimits.NestedMessageLevels);
+        Assert.True(ContractWire.TryDecode(WireDecimal.Parser, atLevels, WireLimit.StreamFrame, out _, out _));
+
+        var deeper = NestedGroups(WireLimits.NestedMessageLevels + 1);
+        Assert.False(ContractWire.TryDecode(WireDecimal.Parser, deeper, WireLimit.StreamFrame, out _, out var tooDeep));
+        Assert.Equal(ContractSerializationFailure.TooDeep, tooDeep);
+
+        var refusal = Assert.Throws<ContractSerializationException>(() => ContractWire.Decode(WireDecimal.Parser, deeper, WireLimit.StreamFrame));
+        Assert.Equal(ContractSerializationFailure.TooDeep, refusal.Failure);
+    }
+
+    [Fact]
+    public void TheSameBytesAreAdmittedAsAUnaryMessageAndRefusedAsAStreamFrame()
+    {
+        var bytes = MessageOfEncodedSize(WireLimits.Bytes(WireLimit.StreamFrame) + 1).ToByteArray();
+
+        Assert.True(ContractWire.TryDecode(WireDecimal.Parser, bytes, WireLimit.UnaryMessage, out _, out _));
+        Assert.False(ContractWire.TryDecode(WireDecimal.Parser, bytes, WireLimit.StreamFrame, out _, out var failure));
+        Assert.Equal(ContractSerializationFailure.TooLarge, failure);
+    }
+
+    [Fact]
+    public void AUnaryBoundMessageDecodesAndOneByteOverIsRefused()
+    {
+        var bound = WireLimits.Bytes(WireLimit.UnaryMessage);
+        Assert.True(ContractWire.TryDecode(WireDecimal.Parser, MessageOfEncodedSize(bound).ToByteArray(), WireLimit.UnaryMessage, out _, out _));
+        Assert.False(ContractWire.TryDecode(WireDecimal.Parser, MessageOfEncodedSize(bound + 1).ToByteArray(), WireLimit.UnaryMessage, out _, out var failure));
+        Assert.Equal(ContractSerializationFailure.TooLarge, failure);
+    }
+
+    [Fact]
+    public void AMalformedOrTruncatedFrameIsMalformedNeverAMessage()
+    {
+        // Field 1, length-delimited, declares five bytes and carries one.
+        byte[] truncated = [0x0A, 0x05, 0x61];
+        Assert.False(ContractWire.TryDecode(WireDecimal.Parser, truncated, WireLimit.StreamFrame, out _, out var truncatedFailure));
+        Assert.Equal(ContractSerializationFailure.Malformed, truncatedFailure);
+
+        // A tag with no length, and a reserved wire type (7), are both malformed.
+        byte[] bareTag = [0x0A];
+        Assert.False(ContractWire.TryDecode(WireDecimal.Parser, bareTag, WireLimit.StreamFrame, out _, out var bareFailure));
+        Assert.Equal(ContractSerializationFailure.Malformed, bareFailure);
+
+        byte[] reservedWireType = [0x0F, 0x00];
+        Assert.False(ContractWire.TryDecode(WireDecimal.Parser, reservedWireType, WireLimit.StreamFrame, out _, out var reservedFailure));
+        Assert.Equal(ContractSerializationFailure.Malformed, reservedFailure);
+    }
+
+    [Fact]
+    public void EncodingAcceptsTheStreamFrameBoundAndRefusesOneByteOver()
+    {
+        var bound = WireLimits.Bytes(WireLimit.StreamFrame);
+        var encoded = ContractWire.Encode(MessageOfEncodedSize(bound), WireLimit.StreamFrame);
+        Assert.Equal(bound, encoded.Length);
+
+        var refusal = Assert.Throws<ContractSerializationException>(() =>
+            ContractWire.Encode(MessageOfEncodedSize(bound + 1), WireLimit.StreamFrame));
+        Assert.Equal(ContractSerializationFailure.TooLarge, refusal.Failure);
+    }
+}
diff --git a/tests/ArcForges.Web.Site.Tests/SiteOutputTests.cs b/tests/ArcForges.Web.Site.Tests/SiteOutputTests.cs
index d69de49..81676b4 100644
--- a/tests/ArcForges.Web.Site.Tests/SiteOutputTests.cs
+++ b/tests/ArcForges.Web.Site.Tests/SiteOutputTests.cs
@@ -66,6 +66,24 @@ public async Task TwoBuildsOfTheSameInputsProduceTheSameBytes()
         }
     }
 
+    [Fact]
+    public async Task TheOutputCarriesNoScriptOrWebAssemblyFileAtAll()
+    {
+        // PRF.11 U5: the static Site is read without JavaScript, so no output file is a script, a module or a WebAssembly module.
+        var site = await SiteBuilder.BuildAsync(new SiteOptions(), TestContext.Current.CancellationToken);
+
+        Assert.DoesNotContain(site.Files, file =>
+            file.Path.EndsWith(".js", StringComparison.OrdinalIgnoreCase)
+            || file.Path.EndsWith(".mjs", StringComparison.OrdinalIgnoreCase)
+            || file.Path.EndsWith(".wasm", StringComparison.OrdinalIgnoreCase));
+        foreach (var path in HtmlPaths)
+        {
+            var file = Assert.Single(site.Files, candidate => candidate.Path == path);
+            var html = Encoding.UTF8.GetString(file.Content);
+            Assert.DoesNotContain("<script", html, StringComparison.OrdinalIgnoreCase);
+        }
+    }
+
     [Theory]
     [MemberData(nameof(HtmlFiles))]
     public async Task EveryPageIsReadableWithScriptingDisabled(string path)
diff --git a/tests/ArcForges.Web.Tooling.Tests/EmittedProfileContractTests.cs b/tests/ArcForges.Web.Tooling.Tests/EmittedProfileContractTests.cs
new file mode 100644
index 0000000..571c23d
--- /dev/null
+++ b/tests/ArcForges.Web.Tooling.Tests/EmittedProfileContractTests.cs
@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// The emitted Blazor profile contract (PRF.11 U2). The bundle that the candidate job publishes is built from a publish
+// whose application shell is the real host page of ArcForges.Web.App. The test reads the emitted archive, so it checks
+// what is served: the Account and Chat shells with base href "/" (CLOUD.85 D1), and the exact CSP token set on both
+// profile paths of the headers file. Nothing here is a fixture of the policy: the expected string is pinned.
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json.Nodes;
+using System.Text.RegularExpressions;
+using ArcForges.Web.Tooling.Profiles;
+using Xunit;
+
+namespace ArcForges.Web.Tooling.Tests;
+
+public sealed class EmittedProfileContractTests
+{
+    /// <summary>
+    /// The exact emitted policy, pinned in both test projects (ArcForges.Web.App.Tests pins the same string). base-uri is 'self'
+    /// because the shells carry the base element (S36, WEB.40 follow-up Web #38); the Site policy keeps 'none'.
+    /// </summary>
+    private const string ExactPolicy =
+        "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'none'";
+
+    private static readonly string HostPage = File.ReadAllText(
+        Path.Combine(RepositoryRoot.Find(), "src", "ArcForges.Web.App", "wwwroot", "index.html"), Encoding.UTF8);
+
+    /// <summary>The bundle built from a synthetic publish whose shell and framework names come from the real host page.</summary>
+    private static ProfileBundleResult BuildFromHostPage()
+    {
+        var root = Path.Combine(Path.GetTempPath(), "arcforges-emitted-" + Guid.NewGuid().ToString("N"));
+        try
+        {
+            var wwwroot = Path.Combine(root, "wwwroot");
+            Directory.CreateDirectory(Path.Combine(wwwroot, "_framework"));
+            var files = new Dictionary<string, byte[]>(StringComparer.Ordinal)
+            {
+                ["index.html"] = Encoding.UTF8.GetBytes(HostPage),
+                ["app.css"] = Encoding.UTF8.GetBytes("body{margin:0}"),
+                ["favicon.svg"] = Encoding.UTF8.GetBytes("<svg xmlns=\"http://www.w3.org/2000/svg\"/>"),
+                ["robots.txt"] = Encoding.UTF8.GetBytes("User-agent: *\nDisallow: /\n"),
+                ["_framework/blazor.webassembly.js"] = Encoding.UTF8.GetBytes("// loader"),
+                ["_framework/dotnet.js"] = Encoding.UTF8.GetBytes("// dotnet"),
+                ["_framework/ArcForges.Web.App.w1s8cjv5ju.wasm"] = Encoding.UTF8.GetBytes("\0asm"),
+            };
+            var endpoints = new JsonArray();
+            foreach (var (path, bytes) in files)
+            {
+                var target = Path.Combine(wwwroot, path.Replace('/', Path.DirectorySeparatorChar));
+                Directory.CreateDirectory(Path.GetDirectoryName(target)!);
+                File.WriteAllBytes(target, bytes);
+                endpoints.Add(new JsonObject
+                {
+                    ["Route"] = path,
+                    ["AssetFile"] = path,
+                    ["EndpointProperties"] = new JsonArray(new JsonObject
+                    {
+                        ["Name"] = "integrity",
+                        ["Value"] = "sha256-" + Convert.ToBase64String(SHA256.HashData(bytes)),
+                    }),
+                });
+            }
+            File.WriteAllText(Path.Combine(root, "app.staticwebassets.endpoints.json"),
+                new JsonObject { ["Version"] = 1, ["Endpoints"] = endpoints }.ToJsonString());
+            return ProfileBundle.Build(root);
+        }
+        finally
+        {
+            if (Directory.Exists(root))
+                Directory.Delete(root, recursive: true);
+        }
+    }
+
+    private static Dictionary<string, string> Members(ProfileBundleResult bundle) =>
+        TarArchive.Read(bundle.Archive).ToDictionary(entry => entry.Path, entry => Encoding.UTF8.GetString(entry.Bytes), StringComparer.Ordinal);
+
+    [Fact]
+    public void TheBundleServesExactlyTheAccountAndChatProfilesAndVerifies()
+    {
+        var bundle = BuildFromHostPage();
+
+        Assert.Equal(new[] { "account", "chat" }, ProfileBundle.Profiles);
+        var summary = ProfileBundle.Verify(bundle.Archive, bundle.Digest);
+        Assert.Equal(bundle.Members, summary.Members);
+    }
+
+    [Fact]
+    public void EachEmittedProfileShellHasExactlyOneRootBaseAndTheSameBytes()
+    {
+        var members = Members(BuildFromHostPage());
+
+        foreach (var profile in ProfileBundle.Profiles)
+        {
+            var shell = members[profile + "/index.html"];
+            var bases = Regex.Matches(shell, @"<base\s[^>]*>", RegexOptions.IgnoreCase);
+            var only = Assert.Single(bases);
+            Assert.Matches(@"^<base\s+href=""/""\s*/?>$", only.Value);
+            Assert.Contains("_framework/blazor.webassembly.js", shell, StringComparison.Ordinal);
+            Assert.Contains("<div id=\"app\"", shell, StringComparison.Ordinal);
+        }
+        Assert.Equal(members["account/index.html"], members["chat/index.html"]);
+    }
+
+    [Fact]
+    public void TheHeadersCarryTheExactPolicyOnEachProfilePathAndNothingUnsafe()
+    {
+        var headers = Members(BuildFromHostPage())[ProfileBundle.HeadersPath];
+        var lines = headers.Split('\n');
+
+        // Each profile path block is followed by its Content-Security-Policy line, which is the exact pinned policy.
+        foreach (var profile in ProfileBundle.Profiles)
+        {
+            var index = Array.IndexOf(lines, "/" + profile + "/*");
+            Assert.True(index >= 0, "The headers file has no block for /" + profile + "/*.");
+            Assert.Equal("  Content-Security-Policy: " + ExactPolicy, lines[index + 1]);
+        }
+        Assert.Equal(ProfileBundle.Profiles.Length, lines.Count(line => line.StartsWith("  Content-Security-Policy: ", StringComparison.Ordinal)));
+        Assert.Contains("script-src 'self' 'wasm-unsafe-eval';", ExactPolicy, StringComparison.Ordinal);
+        Assert.Contains("style-src 'self';", ExactPolicy, StringComparison.Ordinal);
+        Assert.DoesNotContain("'unsafe-inline'", headers, StringComparison.Ordinal);
+        Assert.DoesNotContain("'unsafe-eval'", headers, StringComparison.Ordinal);
+        Assert.DoesNotContain("'unsafe-hashes'", headers, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ThePolicyLineStaysWithinTheHeaderLineBudget()
+    {
+        Assert.True(ExactPolicy.Length < ProfileBundle.HeaderLineBudget);
+    }
+}
diff --git a/tests/browser/ArcForges.Web.Browser.Tests/LivePrf11OptIn.cs b/tests/browser/ArcForges.Web.Browser.Tests/LivePrf11OptIn.cs
new file mode 100644
index 0000000..2c7e472
--- /dev/null
+++ b/tests/browser/ArcForges.Web.Browser.Tests/LivePrf11OptIn.cs
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// The PRF.11 live opt-in gate (U7). The live specs run only on a developer machine, with an explicit proof origin, and they
+// never run on a CI host. They are test-only: nothing here is executed by the offline gate, and nothing is a CI check (P2-017).
+// A second switch marks the cloud parts as ready. It is set only after CLOUD.21 and CLOUD.22 are delivered and the deployed
+// ingress has been observed, so the cloud specs are skipped as "blocked on CLOUD.21/CLOUD.22, not proven" until then.
+namespace ArcForges.Web.Browser.Tests;
+
+/// <summary>The PRF.11 live opt-in gate.</summary>
+public static class LivePrf11OptIn
+{
+    /// <summary>The variable that opts a local run into the live PRF.11 specs. It must be "1".</summary>
+    public const string OptInVariable = "ARCFORGES_LIVE_PRF11";
+
+    /// <summary>The absolute https origin of the proof deployment (the Account and Chat shells are served under it).</summary>
+    public const string ProofOriginVariable = "ARCFORGES_PROOF_ORIGIN";
+
+    /// <summary>The switch that marks the cloud parts ready. It must be "1" and is set only after CLOUD.21, CLOUD.22 and CLOUD.85.</summary>
+    public const string CloudReadyVariable = "ARCFORGES_PRF11_CLOUD_READY";
+
+    /// <summary>The installed Chromium executable (Chrome or Edge), with no browser download.</summary>
+    public const string ChromiumPathVariable = LocalOptIn.ChromiumPathVariable;
+
+    /// <summary>The folder where a live run records its measurements (created locally, never committed).</summary>
+    public const string ResultsVariable = "ARCFORGES_PRF11_RESULTS";
+
+    /// <summary>True only for a deliberate local live run against an explicit https proof origin: never on CI.</summary>
+    public static bool IsEnabled(IReadOnlyDictionary<string, string?> environment)
+    {
+        ArgumentNullException.ThrowIfNull(environment);
+        if (LocalOptIn.IsCi(environment))
+            return false;
+        return environment.TryGetValue(OptInVariable, out var optIn) && optIn == "1"
+            && ProofOrigin(environment) is not null;
+    }
+
+    /// <summary>True only when the live run is enabled and the cloud parts are marked ready.</summary>
+    public static bool IsCloudReady(IReadOnlyDictionary<string, string?> environment) =>
+        IsEnabled(environment)
+        && environment.TryGetValue(CloudReadyVariable, out var ready) && ready == "1";
+
+    /// <summary>The proof origin as an absolute https URI with no path, query or user information, or null when it is not one.</summary>
+    public static Uri? ProofOrigin(IReadOnlyDictionary<string, string?> environment)
+    {
+        ArgumentNullException.ThrowIfNull(environment);
+        if (!environment.TryGetValue(ProofOriginVariable, out var text) || string.IsNullOrWhiteSpace(text))
+            return null;
+        if (!Uri.TryCreate(text, UriKind.Absolute, out var uri) || uri.Scheme != Uri.UriSchemeHttps)
+            return null;
+        if (!string.IsNullOrEmpty(uri.UserInfo) || !string.IsNullOrEmpty(uri.Query) || !string.IsNullOrEmpty(uri.Fragment))
+            return null;
+        if (uri.AbsolutePath != "/")
+            return null;
+        return uri;
+    }
+
+    /// <summary>The message a cloud spec reports when the cloud parts are not marked ready.</summary>
+    public const string BlockedCloudReason =
+        "Blocked on CLOUD.21/CLOUD.22 (and CLOUD.85 for the shells), not proven. Set ARCFORGES_PRF11_CLOUD_READY=1 only after those are delivered and the deployed ingress is observed.";
+
+    /// <summary>The message a live spec reports when the opt-in is not set.</summary>
+    public const string LiveOptInReason =
+        "Local live run only: set ARCFORGES_LIVE_PRF11=1 and ARCFORGES_PROOF_ORIGIN to the https proof origin on a developer machine; never on CI.";
+}
diff --git a/tests/browser/ArcForges.Web.Browser.Tests/LivePrf11OptInTests.cs b/tests/browser/ArcForges.Web.Browser.Tests/LivePrf11OptInTests.cs
new file mode 100644
index 0000000..8581623
--- /dev/null
+++ b/tests/browser/ArcForges.Web.Browser.Tests/LivePrf11OptInTests.cs
@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// The PRF.11 live gate is pure logic and runs everywhere, so CI proves that the live specs stay off on a CI host and without an
+// explicit https proof origin (U7). The live specs themselves never run here.
+using Xunit;
+
+namespace ArcForges.Web.Browser.Tests;
+
+public sealed class LivePrf11OptInTests
+{
+    private static Dictionary<string, string?> Env(params (string Key, string Value)[] pairs)
+    {
+        var values = new Dictionary<string, string?>(StringComparer.Ordinal);
+        foreach (var (key, value) in pairs)
+            values[key] = value;
+        return values;
+    }
+
+    private const string Origin = "https://proof.arcforges.com/";
+
+    [Fact]
+    public void TheLiveSpecsAreOffWithoutAnExplicitOptInAndAProofOrigin()
+    {
+        Assert.False(LivePrf11OptIn.IsEnabled(Env()));
+        Assert.False(LivePrf11OptIn.IsEnabled(Env((LivePrf11OptIn.OptInVariable, "1"))));
+        Assert.False(LivePrf11OptIn.IsEnabled(Env((LivePrf11OptIn.ProofOriginVariable, Origin))));
+        Assert.False(LivePrf11OptIn.IsEnabled(Env((LivePrf11OptIn.OptInVariable, "yes"), (LivePrf11OptIn.ProofOriginVariable, Origin))));
+    }
+
+    [Fact]
+    public void ALocalLiveRunWithTheOptInAndTheProofOriginIsEnabled()
+    {
+        Assert.True(LivePrf11OptIn.IsEnabled(Env(
+            (LivePrf11OptIn.OptInVariable, "1"),
+            (LivePrf11OptIn.ProofOriginVariable, Origin))));
+    }
+
+    [Theory]
+    [InlineData("CI")]
+    [InlineData("GITHUB_ACTIONS")]
+    [InlineData("TF_BUILD")]
+    [InlineData("GITLAB_CI")]
+    public void ACiHostNeverRunsTheLiveSpecsEvenWhenOptedIn(string marker)
+    {
+        var environment = Env(
+            (LivePrf11OptIn.OptInVariable, "1"),
+            (LivePrf11OptIn.ProofOriginVariable, Origin),
+            (LivePrf11OptIn.CloudReadyVariable, "1"),
+            (marker, "true"));
+        Assert.False(LivePrf11OptIn.IsEnabled(environment));
+        Assert.False(LivePrf11OptIn.IsCloudReady(environment));
+    }
+
+    [Theory]
+    [InlineData("http://proof.arcforges.com/")]
+    [InlineData("https://proof.arcforges.com/account/")]
+    [InlineData("https://proof.arcforges.com/?x=1")]
+    [InlineData("https://user:secret@proof.arcforges.com/")]
+    [InlineData("https://proof.arcforges.com/#frag")]
+    [InlineData("not a uri")]
+    [InlineData("")]
+    public void AProofOriginMustBeAnHttpsOriginWithNoPathQueryUserOrFragment(string origin)
+    {
+        var environment = Env((LivePrf11OptIn.OptInVariable, "1"), (LivePrf11OptIn.ProofOriginVariable, origin));
+        Assert.Null(LivePrf11OptIn.ProofOrigin(environment));
+        Assert.False(LivePrf11OptIn.IsEnabled(environment));
+    }
+
+    [Fact]
+    public void TheCloudPartsAreReadyOnlyWhenTheCloudSwitchIsSetOnALocalLiveRun()
+    {
+        var local = Env(
+            (LivePrf11OptIn.OptInVariable, "1"),
+            (LivePrf11OptIn.ProofOriginVariable, Origin));
+        Assert.False(LivePrf11OptIn.IsCloudReady(local));
+
+        var ready = Env(
+            (LivePrf11OptIn.OptInVariable, "1"),
+            (LivePrf11OptIn.ProofOriginVariable, Origin),
+            (LivePrf11OptIn.CloudReadyVariable, "1"));
+        Assert.True(LivePrf11OptIn.IsCloudReady(ready));
+    }
+}
diff --git a/tests/browser/ArcForges.Web.Browser.Tests/LivePrf11Specs.cs b/tests/browser/ArcForges.Web.Browser.Tests/LivePrf11Specs.cs
new file mode 100644
index 0000000..9209771
--- /dev/null
+++ b/tests/browser/ArcForges.Web.Browser.Tests/LivePrf11Specs.cs
@@ -0,0 +1,162 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// PRF.11 live proof specs (U7). Test-only: they are compiled and skipped without the opt-in, and they are not executed by the
+// offline gate or by CI (P2-017). A live run records its evidence locally under ARCFORGES_PRF11_RESULTS and is claimant-reported.
+//
+// Scope of this file:
+//   - Shells and framework on the proof origin (HTTP only, no browser): the Account and Chat shells at /account/ and /chat/,
+//     base href "/", the framework at the root, and the exact CSP on the served response.
+//   - In-browser CSP: the Account and Chat shells load in the installed Chrome or Edge with JavaScript enabled, and no
+//     Content-Security-Policy violation is reported. This is the check that the profile base-uri 'self' directive admits the
+//     base href (S36, resolved by WEB.40 follow-up Web #38; see docs/prf-11-profile-proof.md).
+//   - Cloud parts: the anonymous greeting round trip, and the interaction-responsiveness (INP) capture. These are skipped as
+//     "blocked on CLOUD.21/CLOUD.22, not proven" until the cloud switch is set. The exact int64, uint64 and decimal calls,
+//     typed failures, session expiry and CSRF need an authenticated session or the CLOUD.21 methods, so they are a manual step
+//     in docs/prf-11-runbook.md and are not automated here.
+using System.Net;
+using System.Text.Json;
+using Microsoft.Playwright;
+using Xunit;
+
+namespace ArcForges.Web.Browser.Tests;
+
+public sealed class LivePrf11Specs
+{
+    /// <summary>The exact policy of the profile paths, the same string the Tooling and App tests pin (base-uri 'self', S36).</summary>
+    private const string ExactPolicy =
+        "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'none'";
+
+    private static readonly string[] Profiles = ["/account/", "/chat/"];
+
+    [Fact]
+    public async Task TheShellsAreServedOnTheProofOriginWithRootBaseAndTheExactPolicy()
+    {
+        var environment = LocalOptIn.Current();
+        if (!LivePrf11OptIn.IsEnabled(environment))
+            Assert.Skip(LivePrf11OptIn.LiveOptInReason);
+        var origin = LivePrf11OptIn.ProofOrigin(environment)!;
+
+        using var http = new HttpClient(new HttpClientHandler { AllowAutoRedirect = false });
+        foreach (var path in Profiles)
+        {
+            var response = await http.GetAsync(new Uri(origin, path), TestContext.Current.CancellationToken);
+            Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+            var html = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
+            Assert.Single(System.Text.RegularExpressions.Regex.Matches(html, "<base\\s[^>]*>", System.Text.RegularExpressions.RegexOptions.IgnoreCase));
+            Assert.Contains("<base href=\"/\"", html, StringComparison.Ordinal);
+            Assert.True(response.Headers.TryGetValues("Content-Security-Policy", out var policies), path);
+            Assert.Equal(ExactPolicy, Assert.Single(policies));
+
+            var framework = await http.GetAsync(new Uri(origin, "/_framework/blazor.webassembly.js"), TestContext.Current.CancellationToken);
+            Assert.Equal(HttpStatusCode.OK, framework.StatusCode);
+        }
+    }
+
+    [Fact]
+    public async Task TheShellsLoadInTheInstalledBrowserWithNoContentSecurityPolicyViolation()
+    {
+        var environment = LocalOptIn.Current();
+        if (!LivePrf11OptIn.IsEnabled(environment))
+            Assert.Skip(LivePrf11OptIn.LiveOptInReason);
+        var origin = LivePrf11OptIn.ProofOrigin(environment)!;
+        var executable = environment.GetValueOrDefault(LivePrf11OptIn.ChromiumPathVariable);
+
+        using var playwright = await Playwright.CreateAsync();
+        await using var browser = await playwright.Chromium.LaunchAsync(new BrowserTypeLaunchOptions
+        {
+            ExecutablePath = string.IsNullOrWhiteSpace(executable) ? null : executable,
+        });
+        await using var context = await browser.NewContextAsync();
+        var page = await context.NewPageAsync();
+        var violations = new List<string>();
+        page.Console += (_, message) =>
+        {
+            if (message.Text.Contains("Content Security Policy", StringComparison.OrdinalIgnoreCase))
+                violations.Add(message.Text);
+        };
+        page.PageError += (_, error) =>
+        {
+            if (error.Contains("Content Security Policy", StringComparison.OrdinalIgnoreCase))
+                violations.Add(error);
+        };
+
+        foreach (var path in Profiles)
+        {
+            var response = await page.GotoAsync(new Uri(origin, path).ToString());
+            Assert.NotNull(response);
+            Assert.Equal(200, response.Status);
+            // The profile renders its heading once the framework has started (the shell shows "Loading…" until then).
+            await page.Locator("#app h1").First.WaitForAsync(new LocatorWaitForOptions { Timeout = 60000 });
+        }
+
+        Assert.Empty(violations);
+    }
+
+    [Fact]
+    public async Task TheAnonymousGreetingRoundTripsOnTheDeployedIngress()
+    {
+        var environment = LocalOptIn.Current();
+        if (!LivePrf11OptIn.IsEnabled(environment))
+            Assert.Skip(LivePrf11OptIn.LiveOptInReason);
+        if (!LivePrf11OptIn.IsCloudReady(environment))
+            Assert.Skip(LivePrf11OptIn.BlockedCloudReason);
+        var origin = LivePrf11OptIn.ProofOrigin(environment)!;
+        var executable = environment.GetValueOrDefault(LivePrf11OptIn.ChromiumPathVariable);
+
+        using var playwright = await Playwright.CreateAsync();
+        await using var browser = await playwright.Chromium.LaunchAsync(new BrowserTypeLaunchOptions
+        {
+            ExecutablePath = string.IsNullOrWhiteSpace(executable) ? null : executable,
+        });
+        var page = await browser.NewPageAsync();
+        await page.GotoAsync(new Uri(origin, "/chat/").ToString());
+        await page.Locator("#app h1").First.WaitForAsync(new LocatorWaitForOptions { Timeout = 60000 });
+
+        await page.GetByLabel("Name").FillAsync("ArcForges");
+        await page.GetByRole(AriaRole.Button, new PageGetByRoleOptions { Name = "Send" }).ClickAsync();
+        await page.Locator(".transcript li").Filter(new LocatorFilterOptions { HasTextString = "Hello, ArcForges!" }).WaitForAsync(new LocatorWaitForOptions { Timeout = 15000 });
+    }
+
+    [Fact]
+    public async Task TheGreetingInteractionResponsivenessIsCapturedForTheRebaseline()
+    {
+        var environment = LocalOptIn.Current();
+        if (!LivePrf11OptIn.IsEnabled(environment))
+            Assert.Skip(LivePrf11OptIn.LiveOptInReason);
+        if (!LivePrf11OptIn.IsCloudReady(environment))
+            Assert.Skip(LivePrf11OptIn.BlockedCloudReason);
+        var origin = LivePrf11OptIn.ProofOrigin(environment)!;
+        var executable = environment.GetValueOrDefault(LivePrf11OptIn.ChromiumPathVariable);
+        var results = environment.GetValueOrDefault(LivePrf11OptIn.ResultsVariable);
+        Assert.False(string.IsNullOrWhiteSpace(results), "Set ARCFORGES_PRF11_RESULTS to a local folder for the measurements.");
+
+        using var playwright = await Playwright.CreateAsync();
+        await using var browser = await playwright.Chromium.LaunchAsync(new BrowserTypeLaunchOptions
+        {
+            ExecutablePath = string.IsNullOrWhiteSpace(executable) ? null : executable,
+        });
+        var page = await browser.NewPageAsync();
+        await page.GotoAsync(new Uri(origin, "/chat/").ToString());
+        await page.Locator("#app h1").First.WaitForAsync(new LocatorWaitForOptions { Timeout = 60000 });
+        await page.EvaluateAsync(@"() => {
+            window.__inp = [];
+            new PerformanceObserver(list => {
+                for (const entry of list.getEntries()) window.__inp.push(entry.duration);
+            }).observe({ type: 'event', durationThreshold: 16, buffered: true });
+        }");
+
+        var samples = new List<double>();
+        for (var index = 0; index < 5; index++)
+        {
+            await page.GetByLabel("Name").FillAsync("ArcForges");
+            await page.GetByRole(AriaRole.Button, new PageGetByRoleOptions { Name = "Send" }).ClickAsync();
+            await page.WaitForTimeoutAsync(1500);
+        }
+        var durations = await page.EvaluateAsync<double[]>("() => window.__inp");
+        samples.AddRange(durations);
+
+        // No budget is asserted here. The values are the measurement for the AL-06 interaction re-baseline (owner PRF.11).
+        Directory.CreateDirectory(results);
+        var path = Path.Combine(results, "inp-chat-" + DateTimeOffset.UtcNow.ToString("yyyyMMddTHHmmssZ", System.Globalization.CultureInfo.InvariantCulture) + ".json");
+        await File.WriteAllTextAsync(path, JsonSerializer.Serialize(new { origin = origin.ToString(), inpDurationsMs = samples }), TestContext.Current.CancellationToken);
+    }
+}
diff --git a/tests/browser/ArcForges.Web.Browser.Tests/LocalNoScriptBrowserTests.cs b/tests/browser/ArcForges.Web.Browser.Tests/LocalNoScriptBrowserTests.cs
new file mode 100644
index 0000000..17ddd45
--- /dev/null
+++ b/tests/browser/ArcForges.Web.Browser.Tests/LocalNoScriptBrowserTests.cs
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Local opt-in no-script reading of the static Site (PRF.11 U5). The test runs only with ARCFORGES_LOCAL_BROWSER=1 and a base
+// URL on a developer machine, never on CI, and it skips cleanly otherwise. The browser is the installed Chrome or Edge named by
+// ARCFORGES_CHROMIUM_PATH, so no browser is downloaded. The offline no-script scan of the Site output is in
+// tests/ArcForges.Web.Site.Tests (SiteOutputTests) and runs in CI.
+using Microsoft.Playwright;
+using Xunit;
+
+namespace ArcForges.Web.Browser.Tests;
+
+public sealed class LocalNoScriptBrowserTests
+{
+    private static readonly string[] PublicPages = ["/", "/hello/", "/cloud-hello/"];
+
+    [Fact]
+    public async Task EveryPublicPageIsReadWithScriptingDisabledAndNoScriptIsRequested()
+    {
+        var environment = LocalOptIn.Current();
+        if (!LocalOptIn.IsEnabled(environment))
+            Assert.Skip("Local opt-in only: set ARCFORGES_LOCAL_BROWSER=1 and ARCFORGES_BROWSER_BASE_URL on a developer machine; never on CI.");
+        var baseUrl = new Uri(environment[LocalOptIn.BaseUrlVariable]!);
+        var executable = environment.GetValueOrDefault(LocalOptIn.ChromiumPathVariable);
+
+        using var playwright = await Playwright.CreateAsync();
+        await using var browser = await playwright.Chromium.LaunchAsync(new BrowserTypeLaunchOptions
+        {
+            ExecutablePath = string.IsNullOrWhiteSpace(executable) ? null : executable,
+        });
+        await using var context = await browser.NewContextAsync(new BrowserNewContextOptions { JavaScriptEnabled = false });
+        var page = await context.NewPageAsync();
+        var scriptRequests = new List<string>();
+        page.Request += (_, request) =>
+        {
+            if (request.ResourceType == "script")
+                scriptRequests.Add(request.Url);
+        };
+
+        foreach (var path in PublicPages)
+        {
+            var response = await page.GotoAsync(new Uri(baseUrl, path).ToString());
+            Assert.NotNull(response);
+            Assert.Equal(200, response.Status);
+            var text = (await page.Locator("main").First.InnerTextAsync()).Trim();
+            Assert.False(string.IsNullOrEmpty(text), path);
+            Assert.Equal(0, await page.Locator("script").CountAsync());
+        }
+
+        Assert.Empty(scriptRequests);
+    }
+}