# Production pageview privacy contract

`static/privacy-pageview.js` loads the current Umami script only on HTTPS,
exact hostname `player.nenasets.com`, default port, and known application document routes.
It never loads on loopback, desktop protocol, DEV, previous, rollback, API,
admin, download, or unknown routes. Website: `dc1b14a6-d1ba-4802-b895-553b3c81c677`.

Automatic Umami tracking is disabled, including history and click hooks. One
manual pageview is sent per loaded document. The before-send hook reconstructs
a strict projection: website, hostname, static title `Alta Export Player`, static path
`/`, empty referrer, validated ordinary browser screen/language. It drops
identity, unknown/custom events, tags, arbitrary properties, user title, URL,
query/fragment, filenames, upload contents, forms and application state.
Only fixed download controls emit fixed event names/properties: `#releaseAction` → `download_desktop_app` (`tool: alta-export-player`, `format: desktop`). Native desktop/update modes are excluded.
These are click intents, not successful-download reports. A capture listener does
not read the link URL or filename, cancel navigation, or await analytics. Unknown events and
caller-provided event data are discarded; whitelisted event data is reconstructed.

The hook is installed before creating/loading the external script, auto tracking
is disabled, and an unavailable bootstrap produces no tracker GET/POST. The script
uses anonymous CORS and no-referrer; collection fetch credentials are omit.
No application data is read. Both script requests and collection requests must
have no Cookie, Authorization or Referer headers. Tracker credentials are omit.

The only CSP additions are the exact script and endpoint paths:
`https://umami.nenasets.com/script.js` in script-src and
`https://umami.nenasets.com/api/send` in connect-src. Existing restrictions stay.
No gateway/auth/deployment/registry configuration is changed by this commit.

## Repeatable gates

- `node --test tests/analytics.test.js`: hostname/path/protocol/port allowlist,
  single pageview, automatic tracking off, reconstruction and identity/event denial.
- `node scripts/check.js`: native utility/server checks plus analytics suite.
- Root is the only native application document route. No synthetic media fixture
  is provided; local acceptance exercised shell/layout controls, not footage playback.

Built-image Chromium desktop/mobile acceptance and request evidence live outside
this source checkout in the rollout project worker reports. The audited real
tracker was served locally and its POSTs intercepted with a204 sink, not sent to
production Umami. This does not prove organic ingestion. ONVIF acceptance uses
unchanged documented real bundled catalogue records, independent local signing
secrets and a test-only employee verifier; it does not prove a Google login.

No push or deployment is part of this commit. Inspect CI and deployment bindings
before publishing; the coordinator owns exact-image promotion and rollback.