[mariojgt]

Closes ENG-3684

What changed

The connector injects two things, by two different routes. The widget tag goes into source, so it ships with the app. __PATCHSTACK_PROD__ gets stamped into built HTML — and a server-rendered root never produces a static HTML file to stamp. On those stacks the marker never arrives, the widget reads the published site as build mode, and visitors get the claim flow instead of the report form.

mark-build hid it. Finding a build directory with no HTML in it printed Nothing to mark and exited 0, which looks exactly like success.

• guide now asks for the marker whenever the root shell is code rather than HTML. React-family roots get a literal JSX snippet; the rest get the requirement described, because their head mechanism (useHead, <svelte:head>, Astro frontmatter) is not a plain script tag and a wrong snippet costs more than an accurate sentence.
• It counts as an outstanding step, so the checklist stops reporting complete while the marker is missing.
• The snippet is gated on each framework's own production expression — import.meta.env.PROD where the bundler defines it, process.env.NODE_ENV for Next/Gatsby, !import.meta.dev for Nuxt. The gate is load-bearing: an ungated marker also fires in the hosted builder's preview, which is where the owner still needs the claim flow.
• The marker stays an inline document script rather than a module-level assignment. The widget tag is defer, so only a parser-executed inline script is ordered ahead of its init for certain.
• mark-build now names the server-rendered case and points at guide.

Verification

npm test — 1307 passed, 6 skipped, 106 files. npm run typecheck clean.

Smoke-tested against a fixture mirroring the reported site (TanStack Start, widget tag already in __root.tsx), which reproduces its exact state:

 ✔ Disclosure widget installed
 ✖ Add the production marker yourself — this root is server-rendered, so mark-build cannot stamp it
     Without it the widget treats the published site as build mode and shows the claim flow to visitors.
     Edit src/routes/__root.tsx → put it in <head>, above the widget tag:
       {import.meta.env.PROD && (
         <script
           data-patchstack-build="true"
           dangerouslySetInnerHTML={{ __html: 'window.__PATCHSTACK_PROD__=true;' }}
         />
       )}
     The import.meta.env.PROD guard is required — an ungated marker also hides the claim flow in preview.

Before merging

This changes src/guide.ts checklist output, so per CLAUDE.md it needs node field-test/run.mjs --persona hostile --rounds 3. I have not run it — it needs a real agent and 30–50k tokens per round.

Worth a reviewer's opinion: this asks the developer to paste a snippet. The alternative is having the installed server middleware inject the marker into SSR responses, which is automatic but only covers deployments where protect is wired. I went with the snippet because it matches how the widget tag already gets placed on these stacks and has no runtime dependency.

🤖 Generated with Claude Code

[coderbuds]

Production marker integration is well-structured with thorough test coverage.

🎯 Quality: 100% Elite · 📦 Size: Medium

📈 This month: Your 62nd PR — above team average · Averaging Excellent

_{See how your team is trending →}

[mariojgt]

/review