What is settled, what is not, and where every claim came from.

No preview component dispatches the site's openCheckout event. The buy panel opens a local order summary instead. The Shopify annual-bundle flow on the live site is untouched.

The business and trainer enquiry forms have no submit handler beyond local state, and say so on submit rather than showing a false confirmation.

The Meta Pixel, its noscript pixel and the Google Analytics and Ads tags were lifted out of the root layout into a component that renders nothing under /preview. On a direct load they are not rendered and not serialised, so there is no script to run and no pixel to request. Measured across all fourteen routes scrolled to the bottom: zero requests leave localhost. The live site still serves all of it, unchanged. Review round 3 found the mirror-image bug: a first pass had replaced next/script with raw script tags, which React does not execute when it inserts them, so a client navigation OUT of /preview left the live tags inert until a reload. The fix was to put next/script back, byte for byte, and let its own loader handle the route change. Review round 4 asked the opposite question and found the remaining gap: on a client navigation INTO /preview from the live site, fbq and gtag are already defined and Meta autoConfig can still report from inside the prototype. Not rendering cannot take that back, so the component now stays mounted and uses each vendor's documented off switch on the way in, fbq consent revoke and the ga-disable-ID flag, restoring them on the way out only if it set them. Review round 5 found two holes in that restoration. It wrote ga-disable-ID back to false unconditionally, so a visitor who had already opted out of Google tracking was silently opted back in by looking at a prototype; the flags are now recorded on the way in and put back to the value they actually held, including unset. It also granted Meta consent back unconditionally; consent is now granted only when this component was the one that revoked it and no IAB TCF consent manager is on the page, and where one is the flag is left revoked for the manager to reassert. The same round raised the timing of the switch itself, which runs in a layout effect after the router has already changed history. Two route facts bound it: nothing on the live site links to /preview, so entering is always a document load with no client navigation to observe, and every link back out is now a plain anchor, so leaving is a document load too. Both switches are no-ops on the live site, where the component never enters that branch.

Clarity.init has no teardown, so a mount-only guard could not stop a recording that had already started on the live site: unmounting the provider left the session running into /preview. Review round 3 called this a P0. The provider now stays mounted, watches the pathname, and issues the global stop command on entering /preview, restarting only if it was the one that stopped it. It runs in a layout effect, so the stop lands before the first /preview paint rather than one frame after it, which is what review round 4 asked for. Proved in a headless browser with every vendor domain failed at the network layer: entering /preview by client navigation records the command stop, and a direct load never defines clarity at all.

The referral capture provider sits behind the pathname guard. The preview footer used to link to /support, whose form posts to the live /api/send-support-email and re-enables normal tracking; that link is gone.

Without hydration the demo form fell back to a native GET, putting a name, email and organisation into the address bar under a panel that says nothing was sent. The form is now hidden when scripts are off and replaced by a noscript panel. The same pass opened the FAQ answers, which were hidden behind a toggle that could not be clicked, so pricing, privacy and policy disclosures were unreachable. Measured with script execution disabled: six answers 74 to 126 pixels tall, the inert plus affordance hidden, the form at zero height.

src/lib/lead-tracker.ts posts page views, scroll depth and CTA clicks to api.penng.ai. Nothing recorded under /preview is ever queued or sent: track() refuses the event at the door and flush() refuses it again, unconditionally, so containment does not depend on how the server was launched. Review round 4 noted that the flush also threw away events queued on the LIVE site before the visitor navigated in, which is a real visitor losing real events for looking at a prototype. It now holds that queue instead, capped at 200 so an indefinite stay cannot grow it without bound, and sends it when they navigate back out. The environment switch is the second line of defence and still clears, because a launcher that sets it has no destination at all. Both branches are inert on the live site.

The footer's Company column links to /news, /privacy and /app, and the own-wearable flow links to /app a fourth time. All four are live pages outside the prototype. They are pages, not forms, so nothing is submitted by following one, but normal site analytics resume the moment you are there. Review round 4 asked for them to be labelled rather than removed, because a footer with no company links is not the footer being reviewed. Round 5 found the fourth one unlabelled and the ledger claiming there were three. All four now carry a diagonal arrow and a screen-reader phrase saying the link leaves the preview, and the footer column carries a sentence saying what resumes. Round 5 also made every one of them a plain anchor rather than a client-side route change, so leaving is a document load: the live page starts with fresh tags instead of inheriting flags this prototype is still lifting, and Next stops prefetching live routes from inside the preview. Every other link on all fourteen routes stays inside /preview.

The noscript rules only apply when scripting is off. With scripting on but before React hydrates, the demo form was visible and natively submittable, and a native submit is a GET that writes a name, email and organisation into the address bar under a panel saying nothing was sent. Its submit button is now disabled until mount, which blocks the click and the implicit Enter submission together. The three start-flow route buttons were inert in the same window and are disabled until mount for the same reason, so the affordance matches what the page can actually do.

The preview layout sets robots index:false, follow:false, nocache:true. The running server is bound to 127.0.0.1:3087 (lsof confirms 127.0.0.1, not 0.0.0.0), started by npm run preview, which carries -H 127.0.0.1 so the binding does not depend on how the command was typed. Plain npm run dev still binds every interface and is the wrong command for this prototype. No tunnel, no hosting.

/v2, /v3, /app, the checkout, the pricing hook, the middleware and the corporate dashboard are unmodified. Review round 4 was right that the earlier count of two was wrong. The full list outside the preview tree is four tracked files modified: package.json, which gains an npm run preview script; src/app/layout.tsx, which now calls three extracted components instead of inlining their markup; clarity-provider.tsx; and lead-tracker.ts. Plus three new shared components the layout calls: off-preview-only.tsx, site-instrumentation.tsx and site-structured-data.tsx. The last two carry the root layout's own markup, moved rather than rewritten. Everything else is new and lives under src/app/preview, src/components/preview, src/lib/preview and public/preview-assets. git status is the check.