docs(website): record production publication

tasks/vitepress-documentation-site/implementation-plan.md

@@ -1,8 +1,7 @@
 # VitePress Documentation Site Implementation Plan
 
-Status: local website implemented and verified on 2026-07-28; production deployment is
-authorized and in progress. English owns the public root and future Chinese content will use
-`/zh/`.
+Status: website implemented, published, and verified on 2026-07-28. English owns the public root
+and future Chinese content will use `/zh/`.
 
 ## Impact Handshake
 
@@ -219,7 +218,8 @@ External state in scope:
   `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_API_TOKEN`;
 - set repository variable `CLOUDFLARE_PAGES_PROJECT=inkcre-website`;
 - create or reconcile the `inkcre-website` Pages project with production branch `main`;
-- attach `inkcre.dev`, allowing Cloudflare to create the apex DNS record and certificate;
+- attach `inkcre.dev`, bootstrap its proxied apex CNAME to `inkcre-website.pages.dev`, and allow
+  Cloudflare to issue the certificate;
 - create a GitHub `production` deployment environment through the workflow.
 
 GitHub preparation completed on 2026-07-28: the selected organization secrets now also allow
@@ -232,6 +232,19 @@ request completion can start the delivery controller even when its identity job
 Keep production concurrency on the deploy job, after trusted-main identity resolution, so an
 ineligible controller run cannot cancel an active production deployment.
 
+## Publication Result
+
+Publication completed on 2026-07-28. The Pages API associated `inkcre.dev` but left it in
+`Verifying` until the Cloudflare-managed zone received the one-time proxied apex CNAME
+`inkcre.dev CNAME inkcre-website.pages.dev`. After that bootstrap, Cloudflare reported the custom
+domain active with SSL enabled.
+
+Production run `30369725430` consumed the exact artifact from successful current-main check
+`30368276959` and passed the complete immutable and canonical-origin smoke contract. Independent
+verification confirmed root `200`, English markup and canonical URL, canonical sitemap and
+robots, missing-route `404`, `noindex` on the immutable Pages origin, and no `noindex` header on
+the official origin.
+
 When the first published route moves, add its direct permanent redirect under
 `website/content/public/_redirects` and verify both old and new URLs. Do not add custom global
 cache rules until measured behavior requires them.

tasks/vitepress-documentation-site/packet.md

@@ -35,9 +35,13 @@
   The website is an editorial projection and no canonical Hub document changed. The repository
   can consume the existing organization Cloudflare account and API-token secrets, owns
   `CLOUDFLARE_PAGES_PROJECT=inkcre-website`, and has a GitHub `production` environment restricted
-  to the `main` branch.
-- **Next Step**: publish through the normal branch, pull-request, and main-branch workflow path;
-  monitor the Pages deployment and verify `inkcre.dev`.
+  to the `main` branch. `inkcre.dev` now has a proxied apex CNAME to
+  `inkcre-website.pages.dev`, and the Pages custom domain reports active with SSL enabled.
+- **Result**: publication completed through the normal pull-request and main-branch artifact
+  path. Production run `30369725430` verified immutable deployment
+  `3e61826e-b55f-45f0-8480-027421c40092` and `https://inkcre.dev`: HTTPS root, English locale,
+  canonical metadata, sitemap, robots, real `404`, production indexing behavior, and Pages-origin
+  `noindex` all passed.
 
 ## Supporting Material
 

website/README.md

@@ -78,5 +78,7 @@ repository variable:
   CLOUDFLARE_PAGES_PROJECT=inkcre-website
 ```
 
-The Cloudflare token requires Pages Write access. The application at `app.inkcre.dev` remains an
-independent deployment.
+The Cloudflare token requires Pages Write access. The one-time domain bootstrap also requires the
+proxied apex DNS record `inkcre.dev CNAME inkcre-website.pages.dev`; it is zone state rather than
+part of each content deployment. The application at `app.inkcre.dev` remains an independent
+deployment.