Give five restated facts one owner each

[max-sixty]

Five small concepts had a second copy beside their owner. Each copy now reads the owner, and the copy is deleted.

• The Worker's frame-ancestors header. structure.FRAME_ANCESTORS_CSP owns the policy. The Worker spelled it again in staticAssetResponse; the site manifest now carries it (frame_ancestors), the Worker validates it at its edge with the rest of the manifest, and adds what it says.
• A document's version number. lf-version, which delivery_identity writes on every delivery of a stamped revision, owns it. document-identity.js also parsed it out of /versions/vN.html when the marker was absent, which no delivery reached; the fallback and VERSION_PATH are deleted. The version comparison fetched versionUrl(base), a second derivation of the address the state's version entry already carries at the page root (the one the version menu's travel reads); it now fetches that url, so it also resolves from a revisions/ address. The MCP app snapshot now stamps the active version like every other delivery.
• The stream-activity writers. leaf.codex owns set_stream_activity and clear_stream_activity, but codex_adapter and the website host bound them by name, so two test files each kept a helper that patched both bindings. Both callers now call through codex, and one helper in interact_support patches that one binding.
• The page-directory inventory. test_interact_layer held its own copy of PAGE_STATE_FILES and PAGE_OWNED_DIRS under a test named for the storage contract. It now reads page-storage.md's "Files" and holds the product to it. That found interactions.jsonl documented as Leaf's but missing from the inventory: an initialized page now owns it, so a package path aliased to it is refused. INTERACTIONS_FILE moves to schema so the inventory can name it.
• The layer's sheet order. The face test ordered every bundled package alphabetically while claiming composed_sheets' order; it now walks a composed example's layer (SHIPPED_PACKAGES) by layer.ROOT_SHEETS, the per-root order composed_sheets itself reads.

interact_support.wait_for takes a callable failure, for a poll whose message needs state read at the timeout, and four hand-rolled polls in test_interact_session and test_render_export use it.

Deleted: VERSION_PATH, versionUrl, the URL fallback in document-identity.js, the Worker's policy literal, both take_stream_activity copies, EXPECTED_PAGE_STATE_FILES, EXPECTED_PAGE_DIRECTORIES, and two inventory tests folded into one.

Not in this change: verify_site._stamped still splits the served reading on its last .. The reading's files.presence form is composed in served_state/service.py page_state and page_snapshot.capture_page_snapshot as well as the news stream, and a live branch (status-state-machine) is rewriting those exact lines, so the owner for that form waits for it.

🤖 Generated with Claude Code