@@ -51,7 +51,16 @@
   one-time seeded smoke identity and live objects were removed afterward, queue
   counts returned to zero, and a checksum-verified backup captured the migrated
   clean state. Production Compose now accepts explicit prebuilt API/verifier
-  image references so shared hosts can deploy with `--no-build`.
+  image references so shared hosts can deploy with `--no-build`. Harden the API
+  and static Registry response boundary with HSTS, anti-framing, no-sniff,
+  permissions policy, cross-domain-policy denial, and a deny-all CSP for JSON
+  surfaces. Add a reproducible website production Compose/nginx contract with
+  a read-only root filesystem, bounded temporary filesystems, health checks,
+  log rotation, `no-new-privileges`, and matching browser security headers. A
+  production recovery drill restores the post-`0002` dump into an isolated
+  Postgres 17 container, extracts the object archive into an isolated volume,
+  verifies both migrations and all seven core Registry tables, and removes the
+  temporary restore resources afterward.
 - Close the 0.23 syntax-audit consistency gaps: canonical type declarations
   now use comma-terminated fields, syntax-combination gates cover canonical and
   comma-free compatibility input, checked example mirrors use named `U64_MAX`
 
@@ -387,7 +387,7 @@ pub fn run(root: &Path) -> Result<()> {
         "website/package.json",
         &[
             r#""prepare:registry": "node scripts/generate-registry-data.mjs""#,
-            r#""build": "npm run prepare:registry && astro check && astro build && npm run check:docs && npm run check:dist""#,
+            r#""build": "npm run prepare:registry && astro check && astro build && npm run check:docs && npm run check:dist && npm run check:deploy""#,
             r#""check:docs": "node scripts/check-doc-links.mjs""#,
             r#""check:dist": "node scripts/check-dist-regressions.mjs""#,
         ],
 
@@ -30,6 +30,7 @@ work.
 | Registry operations | `api.registry.cellscript.dev` and `registry.cellscript.dev` run as an isolated self-hosted Postgres/Node/object-volume/read-only-nginx stack behind trusted TLS. |
 | Registry retry safety | Pre-admission failures release only the failed request's nonce and retry reservation; accepted metadata commits transactionally, and readiness covers the actual managed object prefixes. |
 | Registry verification | Publish transactionally queues a leased, bounded real-compiler verification job; verified evidence/status commit atomically before crash-safe static-index convergence, and default search stays hidden until the baseline passes. |
+| Production HTTP boundary | API/static JSON responses use HSTS, deny-all content policy, anti-framing, no-sniff, and restrictive browser permissions; the website ships a reproducible read-only nginx deployment with health checks and bounded logs/temp storage. |
 | Registry install policy | Explicit unverified/quarantined install acknowledgements persist per dependency, so lock refresh and subsequent builds retain the same auditable risk choice. |
 | Tooling | CLI, LSP, WASM, website bindings, examples, and package tooling use the same edition contract. |
 | Syntax audit | Canonical type fields use trailing commas, checked examples use named `u64` boundaries, and compatibility plus CKB-VM regressions cover both source and witness placement. |
@@ -316,6 +317,21 @@ four production containers remained healthy, and a checksum-verified backup
 captured the migrated, cleaned state. This proves the live worker boundary but
 still does not substitute for publisher-owned JoyID authorisation.
 
+The final production hardening pass makes the website deployment itself a
+tracked artifact instead of server-local configuration. Its nginx container
+runs read-only with bounded writable tmpfs mounts, health checks, log rotation,
+and `no-new-privileges`; the website, API, and static Registry preserve HSTS,
+anti-framing, no-sniff, cross-domain-policy, referrer, and permissions headers
+through the shared TLS proxy. JSON-only Registry responses additionally carry a
+deny-all content security policy.
+
+The post-migration backup is also restore-tested, not only checksum-tested. An
+isolated Postgres 17 container restored both numbered migrations and all seven
+core Registry tables, while an isolated object volume accepted the complete
+archive. Neither restore target shared the production database, object volume,
+network endpoint, or lifecycle; both temporary targets were removed after the
+drill.
+
 These endpoints prove the deployed service boundary, not a publisher-owned
 JoyID signature or first-package install. That interactive positive flow
 remains the explicit adoption checkpoint.
 
@@ -251,6 +251,8 @@ Production-readiness evidence currently proves:
   served rows/objects were removed afterward;
 - live health/readiness checks cover Postgres, the object volume, runtime, and
   admin configuration;
+- the website has a tracked read-only nginx/Compose deployment, and all three
+  public surfaces preserve their intended security headers through TLS;
 - the proxy admits a 2 MiB body to application validation and the Node adapter
   rejects 7 MiB + 1 byte with a structured 413;
 - unauthorised admin writes, invalid public queries, static POSTs, and traversal
@@ -260,8 +262,9 @@ Production-readiness evidence currently proves:
   object-hash drift, or source-tree drift;
 - API restart recovery preserves the database, audit log, and object volumes;
 - the daily systemd backup produces checksum-verified Postgres and object-store
-  archives, both archive formats pass non-destructive restore inspection, and
-  a post-`0002` backup captured the migrated, cleaned production state;
+  archives, and a post-`0002` backup captured the migrated, cleaned production
+  state; an isolated Postgres 17/object-volume drill restored both migrations,
+  all seven core tables, and the complete object archive;
 - the website serves the live Registry and contains no Coming Soon surface.
 - a cryptographically valid WebAuthn-shaped P-256 fixture completes capability
   registration, explicit namespace claim, signed publish, idempotent replay,
 
@@ -106,6 +106,9 @@ https://registry.cellscript.dev/health
 - Token-gated audit-event read path for review, incident response, and
   production debugging.
 - Token-gated verification queue metrics and audited dead-letter requeue.
+- Consistent API and static-object response hardening: HSTS, anti-framing,
+  no-sniff, no-referrer, restrictive browser permissions, and a deny-all CSP
+  for JSON-only surfaces.
 - Audit/event log records for capability, namespace, auth failure, rate-limit,
   and publish transitions, including admin review/quarantine/yank overrides.
 - Successful capability use updates `last_used_at` and writes a
@@ -173,6 +176,11 @@ filesystems, health checks, log rotation, and `no-new-privileges`. Production
 API readiness requires a fresh verifier heartbeat, so a missing or wedged
 consumer cannot present the write path as ready.
 
+The API and read-only static service emit the same conservative transport and
+browser security boundary on success and error responses. The JSON-only CSP
+allows no executable or embedded content; CORS remains explicit for public
+CLI/browser reads and signed write requests.
+
 Production validation performed at deployment includes trusted TLS for both
 domains, dependency-aware readiness, a 2 MiB request reaching application JSON
 validation, a structured application 413 at 7 MiB + 1 byte, rejection of
@@ -233,6 +241,13 @@ systemctl enable --now cellscript-registry-backup.timer
 systemctl start cellscript-registry-backup.service
 ```
 
+The 2026-08-01 production recovery drill restored the post-`0002` custom dump
+into an isolated Postgres 17 container and extracted the object archive into an
+isolated Docker volume. Both migrations and all seven core Registry tables were
+present; the disposable container and volume were removed after verification.
+This exercise did not attach to or mutate the production database/object
+volume.
+
 Verify a backup before treating it as recoverable:
 
 ```bash
 
@@ -6,6 +6,14 @@ server {
     server_tokens off;
     charset utf-8;
 
+    add_header Content-Security-Policy "default-src 'none'; base-uri 'none'; frame-ancestors 'none'" always;
+    add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
+    add_header Referrer-Policy "no-referrer" always;
+    add_header Strict-Transport-Security "max-age=31536000" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header X-Permitted-Cross-Domain-Policies "none" always;
+
     location = /health {
         default_type application/json;
         return 200 '{"status":"ok"}\n';
@@ -17,8 +25,13 @@ server {
         default_type application/json;
         add_header Access-Control-Allow-Origin "*" always;
         add_header Cache-Control "public, max-age=60, stale-while-revalidate=300" always;
+        add_header Content-Security-Policy "default-src 'none'; base-uri 'none'; frame-ancestors 'none'" always;
+        add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
         add_header Referrer-Policy "no-referrer" always;
+        add_header Strict-Transport-Security "max-age=31536000" always;
         add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "DENY" always;
+        add_header X-Permitted-Cross-Domain-Policies "none" always;
     }
 
     location /source-snapshots/ {
@@ -32,8 +45,13 @@ server {
         }
         add_header Access-Control-Allow-Origin "*" always;
         add_header Cache-Control "public, max-age=31536000, immutable" always;
+        add_header Content-Security-Policy "default-src 'none'; base-uri 'none'; frame-ancestors 'none'" always;
+        add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
         add_header Referrer-Policy "no-referrer" always;
+        add_header Strict-Transport-Security "max-age=31536000" always;
         add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "DENY" always;
+        add_header X-Permitted-Cross-Domain-Policies "none" always;
     }
 
     location / {
 
@@ -1798,8 +1798,13 @@ function corsHeaders(requestId: string): Headers {
     "access-control-allow-headers": "content-type,authorization,idempotency-key,x-registry-admin-token,x-registry-admin-actor",
     "access-control-expose-headers": "x-request-id,x-idempotency-status",
     "cache-control": "no-store",
+    "content-security-policy": "default-src 'none'; base-uri 'none'; frame-ancestors 'none'",
+    "permissions-policy": "camera=(), geolocation=(), microphone=()",
     "referrer-policy": "no-referrer",
+    "strict-transport-security": "max-age=31536000",
     "x-content-type-options": "nosniff",
+    "x-frame-options": "DENY",
+    "x-permitted-cross-domain-policies": "none",
     "x-request-id": requestId,
   });
 }
 
@@ -211,6 +211,12 @@ describe("registry api", () => {
     });
     const ready = await get(readyApp, "/ready", { REGISTRY_ADMIN_TOKEN: "secret" });
     expect(ready.status).toBe(200);
+    expect(ready.headers.get("content-security-policy"))
+      .toBe("default-src 'none'; base-uri 'none'; frame-ancestors 'none'");
+    expect(ready.headers.get("permissions-policy")).toBe("camera=(), geolocation=(), microphone=()");
+    expect(ready.headers.get("strict-transport-security")).toBe("max-age=31536000");
+    expect(ready.headers.get("x-frame-options")).toBe("DENY");
+    expect(ready.headers.get("x-permitted-cross-domain-policies")).toBe("none");
     expect(await ready.json()).toMatchObject({
       status: "ready",
       checks: {