# Phase 9.0 Web Preview Delivery

## Owner Authorization

On 2026-08-12 the Owner requested a dedicated remote H5 page for phone review
of the accepted P9.0 runtime candidate. This authorizes only a Godot Web export,
local browser verification and private Artifact Gallery deployment.

## Content Boundary

- Product behavior authority remains P9.0 source
  `f881920b1be29933169950429d4e55d8cac825d8`; the Web-compatible successor may
  add only the embedded font, stream-playback selection, export configuration
  and capture-harness cleanup required by this delivery.
- The Web package may expose the preserved Contract page only through the
  already accepted `Start New Game` handoff.
- It may not change Boot, Title, Contract, Recruit, Market, battle, economy,
  save, art, audio or content authority.
- Tests, evidence, build outputs, source documents and repository history must
  not be included in the exported PCK.

## Delivery Contract

- Preset: `Web Preview` in `runtime/export_presets.cfg`.
- Template: Godot 4.6.1 non-threaded Web release, so the private remote page
  does not require cross-origin isolation headers.
- Canvas: browser-window responsive, canvas focused on startup, experimental
  mobile virtual keyboard enabled.
- Portrait phones show an explicit rotate-to-landscape overlay instead of a
  tiny letterboxed game canvas; rotating to landscape reveals the game.
- Local output: ignored `runtime/build/web-preview/<product-source>/`.
- Remote output: the smallest self-contained export directory, published as a
  dedicated Artifact Gallery HTML item.

Verify export success, expected HTML/JS/WASM/PCK files, exact ZIP data-package
contents with zero `tests/`, `evidence/` or `build/` entries, local HTTP loading,
real browser canvas dimensions, portrait rotation guidance, one canvas click
and the `Start New Game` handoff. Verify the Gallery health and signed share URL
after publication.

The browser build embeds `runtime/assets/fonts/NotoSansSC.ttf` and its
`runtime/assets/fonts/OFL.txt` license so Simplified Chinese does not depend on
a host font. `PrototypeSFX` must use Godot stream playback; a Web backend may
not select sample playback for `AudioStreamGenerator`.

This is a browser preview, not physical-device, packaging, store, publishing or
release acceptance. Owner review of the remote page remains a human gate.

## Remote Delivery

Fixed Web source `f0aa84738041cebf4968d91c6bf170668804e203` is published
as private Artifact Gallery item `PRji-yhJo0nQ`. The signed item URL redirects
to the full-screen `index.html` only after setting an artifact-scoped HttpOnly
cookie; the signing token is not stored in this repository. Direct access
without that cookie still reaches the Gallery login boundary.

Remote verification confirms correct JavaScript, WASM and PCK response types,
a runtime CSP without the document sandbox, successful Godot/WASM startup,
Simplified Chinese Title rendering in the requested landscape phone viewport,
the real canvas `Start New Game` handoff to Contract, and the portrait rotate
overlay. Browser warning/error count is zero. Artifact Gallery retains its
document sandbox for ordinary HTML; executable delivery requires an explicit
`runtime-html` manifest kind.

The final source-bound evidence inventory verifies 34/34 with SHA-256
`cb3111f86012d313c85d1eebed6574b8b5936531bf30821421f89f1442aeb945`.