max / makenotwork

Describe the custom-pages host, strip and all quasicoherent 48a6e9e5. u.makenot.work was the last host assembled entirely by Askama, and the reason it was last is that a description could say neither half of it: the creator's markup is opaque and the stylesheet that goes with it is per request. quasi 0.92.0 added Node::Canvas and Document::style, and this is their first consumer. The strip is content, not Chrome. A Chrome is built once beside the router and every link here is per request, so the header and footer are Band regions on the screen. They stay siblings of the canvas, which is the whole isolation guarantee: css_sanitizer nests every creator rule inside .user-canvas#uc-{owner}, so a creator selector naming anything in the strip is emitted under the canvas and matches nothing. The published class names survive. site-docs tells creators the buy block is .mnw-buy, the file list .mnw-files and the item block .mnw-item, with worked CSS, so those are a contract with people outside this codebase and they ride on Canvas scopes. The one visible change is the call to action, which was an <a class="mnw-buy-cta"> and is now that class on the element around the link; the guide's own example sets color on it, and a color on an ancestor does not reach an anchor, so the sheet says color: inherit for a link inside one. Without that line the documented example would quietly stop working. Shell::without_scripts rather than thirteen refusals, under a CSP of default-src 'none'. Embeds take it too, where the list had grown to nine and gained one every time quasi added a script. templates/custom/ is gone, chrome partials included. The 16 custom-pages workflow tests pass unchanged, which is the check that matters: they assert the scoping, the CSP, the locked-owner fallback and the item canvas.