fixes 2026-10-21: evidence so far (R-1176 live proof, R-1192 freeze measured, R-1191 on 9202); design notes 03 §8a / 07 §7.0, §8.2a (D25) / 05 §16.5 (DST)

documentation/audits/fixes-2026-10-21/tools/page.py

@@ -0,0 +1,13 @@
+#!/usr/bin/env python3
+"""page.py PATH... — log in (ctl.py; the password by env NAME under `sec run`) and print each page's visible text,
+whitespace-collapsed, plus whether named phrases appear. Endpoint-level: the same GETs a browser sends."""
+import html, os, re, sys
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import ctl
+ctl.login()
+for path in sys.argv[1:]:
+    body = ctl._curl(["-L", "-H", "Cookie: " + ctl._SESS, ctl.BASE + path])
+    body = re.sub(r"<(script|style)[^>]*>.*?</\1>", "", body, flags=re.S)
+    txt = re.sub(r"\s+", " ", html.unescape(re.sub(r"<[^>]+>", " ", body))).strip()
+    print(f"=== {path} ({len(body)} bytes)")
+    print(txt[:2500])