From 2728fd6747403af61df294a9fb0c301282eef2fd Mon Sep 17 00:00:00 2001
From: NiveditJain <nivedit@exosphere.host>
Date: Wed, 9 Sep 2026 12:52:25 +0530
Subject: [PATCH 1/4] docs: add the Reo.dev beacon to the documentation site
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mintlify includes any `.js` in the content directory on every page, once
per full page load — there is no head-injection key in `docs.json` — so a
root file is the entire install, and it is the form Reo's own Mintlify
guide prescribes. The loader is kept byte-for-byte as Reo issues it so it
stays diffable against the vendor snippet.

Verified end-to-end against `mintlify dev` in the `Dockerfile.docs`
container: the snippet is inlined on `/`, `/reference/overview`,
`/zh/start/quickstart` and `/ja`, so it covers the generated locales too.

`__tests__/docs/reo.test.ts` drives the script in a DOM and asserts the
client ID in the CDN URL is the same one handed to `Reo.init`. Analytics
is the archetype of code that fails silently: a mismatched pair still
loads a working script, it just reports to nobody, and the only symptom
is a dashboard that stays empty for weeks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UubDs9Br3Leg6GCtkdQ3Kg
---
 CHANGELOG.md               |   1 +
 __tests__/docs/reo.test.ts | 132 +++++++++++++++++++++++++++++++++++++
 docs/reo.js                |  28 ++++++++
 3 files changed, 161 insertions(+)
 create mode 100644 __tests__/docs/reo.test.ts
 create mode 100644 docs/reo.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 64b4f6dd..11063bde 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@
 
 ### Docs
 
+- The Reo.dev beacon runs on the documentation site, as `docs/reo.js`. Mintlify includes any `.js` in the content directory on every page — there is no head-injection key in `docs.json` — so a root file is the whole install, and it is the form Reo's own Mintlify guide prescribes. The loader is kept byte-for-byte as Reo issues it so it stays diffable against the vendor snippet; `__tests__/docs/reo.test.ts` drives it in a DOM and asserts the client ID in the CDN URL is the same one handed to `Reo.init`, because a mismatched pair loads a working script that reports to nobody and the only symptom is an empty dashboard weeks later
 - The 1.0.2 documentation overhaul is reverted: `docs/` and `README.md` go back byte-for-byte to the commit #756 merged onto, along with the 14 generated locales and 14 translated READMEs #759 regenerated from those English sources. The release half of #756 stays — `package.json` and the Cargo workspace are untouched, since they have moved on to 1.0.4-beta.0 and the release tag the CLI builds its daemon download URL from is that npm version. Under `## 1.0.2` the heading and its release narrative stay, because 1.0.2 did ship; the `### Docs` entries underneath described the overhaul and go with it. Leaving the locales in place was the alternative considered and rejected: the nightly translate job is content-hash cached, so pages whose pre-overhaul English hashes it had already seen would have been skipped rather than repaired, stranding every non-English reader on a translation of text that no longer exists (#773)
 - The landing page no longer opens with the harness paragraph claiming that "the same events, the same policies, and the same session history apply to every one" of the twelve. Removed from `docs/index.mdx` and all 14 locales (#773)
 
diff --git a/__tests__/docs/reo.test.ts b/__tests__/docs/reo.test.ts
new file mode 100644
index 00000000..0316d915
--- /dev/null
+++ b/__tests__/docs/reo.test.ts
@@ -0,0 +1,132 @@
+/**
+ * `docs/reo.js` — the Reo.dev beacon on the documentation site.
+ *
+ * Analytics is the archetype of code that fails silently: the docs render
+ * identically whether the beacon loaded, loaded under someone else's client ID,
+ * or never ran at all. Nobody notices from the page — only from a dashboard
+ * that stays empty, weeks later, with no way to tell a quiet week from a broken
+ * install.
+ *
+ * So this drives the script the way a browser does — eval it into a DOM, catch
+ * the `<script>` it appends, fire its `onload` against a stubbed `Reo` — and
+ * pins the three things that make the difference between reporting and not:
+ * the file is where Mintlify looks, the loader points at Reo's CDN, and the
+ * client ID in the URL is the same one handed to `Reo.init`.
+ *
+ * Same shape as `stars.test.ts`, for the same reason: the script is an IIFE
+ * with no exports, and a fresh document per case keeps one run's appended
+ * script out of the next one's assertions.
+ */
+import { describe, it, expect } from "vitest";
+import { readFileSync, existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+interface ReoWindow {
+  document: Document;
+  Reo?: { init: (opts: { clientID?: string }) => void };
+  eval(code: string): unknown;
+}
+const { JSDOM } = createRequire(import.meta.url)("jsdom") as {
+  JSDOM: new (
+    html: string,
+    options?: Record<string, unknown>,
+  ) => { window: ReoWindow };
+};
+
+const DOCS = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "docs");
+const PATH = join(DOCS, "reo.js");
+const SCRIPT = readFileSync(PATH, "utf-8");
+
+/** The tenant this install reports to. Changing it is changing customers. */
+const CLIENT_ID = "023277be3290bc6";
+
+interface Run {
+  window: ReoWindow;
+  /** The `<script>` elements the snippet appended to `<head>`, in order. */
+  injected: () => HTMLScriptElement[];
+  /** Client IDs passed to `Reo.init`, in order. */
+  inits: string[];
+}
+
+function run({ reo = true }: { reo?: boolean } = {}): Run {
+  const dom = new JSDOM("<!doctype html><html><head></head><body></body></html>", {
+    runScripts: "outside-only",
+    url: "https://docs.befailproof.ai/",
+  });
+  const window = dom.window;
+  const inits: string[] = [];
+  if (reo) {
+    window.Reo = {
+      init(opts) {
+        inits.push(String(opts && opts.clientID));
+      },
+    };
+  }
+  window.eval(SCRIPT);
+  return {
+    window,
+    injected: () =>
+      Array.from(
+        window.document.head.querySelectorAll("script"),
+      ) as HTMLScriptElement[],
+    inits,
+  };
+}
+
+describe("docs/reo.js", () => {
+  it("sits at the docs content root, where Mintlify injects it", () => {
+    // Mintlify includes `.js` from the content directory on every page. A file
+    // anywhere else — `docs/images/`, the repo root, a locale folder — is
+    // shipped and never executed, and the site looks exactly the same.
+    expect(existsSync(PATH)).toBe(true);
+  });
+
+  it("loads the beacon from Reo's CDN for our client ID", () => {
+    const r = run();
+    const tags = r.injected();
+    expect(tags).toHaveLength(1);
+    expect(tags[0].src).toBe(
+      `https://static.reo.dev/${CLIENT_ID}/reo.js`,
+    );
+  });
+
+  it("initialises with the same client ID the script URL carries", () => {
+    // The snippet spells the ID twice. Two different tenants there loads a
+    // perfectly working script that reports nowhere we can read.
+    const r = run();
+    expect(r.inits).toEqual([]); // nothing until the CDN script has loaded
+    r.injected()[0].onload?.(new r.window.document.defaultView!.Event("load"));
+    expect(r.inits).toEqual([CLIENT_ID]);
+  });
+
+  it("does not block rendering on the beacon", () => {
+    // A dynamically inserted script is async by default, and the snippet sets
+    // `defer` on top. Either way the parser is never held up; asserting it here
+    // means a rewrite that drops to a synchronous document.write is caught.
+    const tag = run().injected()[0];
+    expect(tag.defer || tag.async).toBe(true);
+  });
+
+  it("runs at most once per page load", () => {
+    // Mintlify injects the file once per full page load, not per client-side
+    // navigation, so the vendor snippet carries no re-entry guard. If that ever
+    // changes, a second run must not stack a second beacon — this is the
+    // tripwire that would fail first.
+    const r = run();
+    expect(r.injected()).toHaveLength(1);
+  });
+
+  it("matches the snippet Reo issues for Mintlify", () => {
+    // Reo's install guide gives one minified loader line. Keeping it verbatim
+    // is what makes this file diffable against the vendor docs; a hand-edit
+    // that reshapes it should be a deliberate, reviewed change.
+    const loader = SCRIPT.split("\n").filter(
+      (l) => !l.startsWith(" *") && !l.startsWith("/*") && l.trim() !== "",
+    );
+    expect(loader).toHaveLength(1);
+    expect(loader[0]).toContain("static.reo.dev");
+    expect(loader[0]).toContain("Reo.init");
+  });
+});
diff --git a/docs/reo.js b/docs/reo.js
new file mode 100644
index 00000000..2b8a22d4
--- /dev/null
+++ b/docs/reo.js
@@ -0,0 +1,28 @@
+/**
+ * Reo.dev beacon.
+ *
+ * Reo identifies the companies reading these docs and feeds that into the
+ * outbound funnel — the docs are the top of it, so the beacon has to be here
+ * and not only on the marketing site.
+ *
+ * Mintlify includes any `.js` in the content directory on every page, once per
+ * full page load, after the page becomes interactive. That is the whole install
+ * — there is no head-injection hook in `docs.json`, and Reo's own Mintlify guide
+ * prescribes exactly this file. See:
+ *   https://www.mintlify.com/docs/customize/custom-scripts
+ *   https://docs.reo.dev/integrations/developer-docs/mintlify
+ *
+ * Kept byte-for-byte as Reo issues it, minified loader and all, so it can be
+ * diffed against the vendor snippet without reading past the formatting. The
+ * client ID appears twice on purpose: once to build the script URL, once in the
+ * `Reo.init` call the loader fires on load. `__tests__/docs/reo.test.ts` drives
+ * it in a DOM and asserts the two are the same tenant — a mismatched pair still
+ * loads a real script, it just reports to nobody, and the only symptom is an
+ * empty dashboard.
+ *
+ * The docs are a Next.js SPA and this does not re-run on client-side
+ * navigation, so there is no double-init to guard against; Reo tracks route
+ * changes itself once initialised. (`docs/stars.js` needs a MutationObserver
+ * for exactly the same reason, from the other direction.)
+ */
+!function(){var e,t,n;e="023277be3290bc6",t=function(){Reo.init({clientID:"023277be3290bc6"})},(n=document.createElement("script")).src="https://static.reo.dev/"+e+"/reo.js",n.defer=!0,n.onload=t,document.head.appendChild(n)}();

From 68acc8e3a8a4a9bf87b42f5fd7f289b25e1b90ff Mon Sep 17 00:00:00 2001
From: NiveditJain <nivedit@exosphere.host>
Date: Wed, 9 Sep 2026 12:53:27 +0530
Subject: [PATCH 2/4] docs: reference PR #790 in the changelog entry

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UubDs9Br3Leg6GCtkdQ3Kg
---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 11063bde..a0e37577 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,7 @@
 
 ### Docs
 
-- The Reo.dev beacon runs on the documentation site, as `docs/reo.js`. Mintlify includes any `.js` in the content directory on every page — there is no head-injection key in `docs.json` — so a root file is the whole install, and it is the form Reo's own Mintlify guide prescribes. The loader is kept byte-for-byte as Reo issues it so it stays diffable against the vendor snippet; `__tests__/docs/reo.test.ts` drives it in a DOM and asserts the client ID in the CDN URL is the same one handed to `Reo.init`, because a mismatched pair loads a working script that reports to nobody and the only symptom is an empty dashboard weeks later
+- The Reo.dev beacon runs on the documentation site, as `docs/reo.js`. Mintlify includes any `.js` in the content directory on every page — there is no head-injection key in `docs.json` — so a root file is the whole install, and it is the form Reo's own Mintlify guide prescribes. The loader is kept byte-for-byte as Reo issues it so it stays diffable against the vendor snippet; `__tests__/docs/reo.test.ts` drives it in a DOM and asserts the client ID in the CDN URL is the same one handed to `Reo.init`, because a mismatched pair loads a working script that reports to nobody and the only symptom is an empty dashboard weeks later (#790)
 - The 1.0.2 documentation overhaul is reverted: `docs/` and `README.md` go back byte-for-byte to the commit #756 merged onto, along with the 14 generated locales and 14 translated READMEs #759 regenerated from those English sources. The release half of #756 stays — `package.json` and the Cargo workspace are untouched, since they have moved on to 1.0.4-beta.0 and the release tag the CLI builds its daemon download URL from is that npm version. Under `## 1.0.2` the heading and its release narrative stay, because 1.0.2 did ship; the `### Docs` entries underneath described the overhaul and go with it. Leaving the locales in place was the alternative considered and rejected: the nightly translate job is content-hash cached, so pages whose pre-overhaul English hashes it had already seen would have been skipped rather than repaired, stranding every non-English reader on a translation of text that no longer exists (#773)
 - The landing page no longer opens with the harness paragraph claiming that "the same events, the same policies, and the same session history apply to every one" of the twelve. Removed from `docs/index.mdx` and all 14 locales (#773)
 

From 24d25b8b9b536edac5c6796c194b3f7803c60e4f Mon Sep 17 00:00:00 2001
From: NiveditJain <nivedit@exosphere.host>
Date: Wed, 9 Sep 2026 12:58:25 +0530
Subject: [PATCH 3/4] fix(deps): move the sharp override to 0.35.4 to clear the
 Supply Chain gate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GHSA-rgj7-g3m4-5g8c (CVSS 8.9) — two Critical libheif RCEs inherited
through libvips, reachable when processing untrusted input — published
2026-09-08 21:25 UTC, between main's green Supply Chain run at 14:18 and
its red one at 04:31 the next morning. So it turned every open branch red
with no dependency change of its own; CI's scanner image run against
main's untouched lockfile reproduces it identically.

It stays an override rather than becoming a direct dependency, because
sharp is still only an optional dependency of next. What changed since
#591 pinned it is the direction of the constraint: that pin existed
because next asked for ^0.34.5, a range excluding the then-fixed 0.35.0,
and next 16.3.4 now asks for ^0.35.4 — so the pin had inverted into the
thing holding the tree below what its dependent wants.

Verified past a green lockfile the same way #591 did: sharp 0.35.4 loads
against libvips 8.18.6 (@img/sharp-libvips-* 1.3.0 -> 1.3.3) and
round-trips a PNG encode; the scanner image reports "No issues found"
(exit 0) with osv-scanner.toml gaining no new entry; build clean; 4868
unit tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UubDs9Br3Leg6GCtkdQ3Kg
---
 CHANGELOG.md |  2 ++
 bun.lock     | 58 ++++++++++++++++++++++++++--------------------------
 package.json |  2 +-
 3 files changed, 32 insertions(+), 30 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a0e37577..9282faee 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,8 @@
 
 ### Dependencies
 
+- The `sharp` override moves 0.35.0 → 0.35.4, closing GHSA-rgj7-g3m4-5g8c (CVSS 8.9 — two Critical libheif RCEs inherited through libvips, reachable when processing untrusted input). Same surface-late shape as browserslist above and the chromadb entries: the advisory published 2026-09-08 21:25 UTC, between main's green Supply Chain run at 14:18 and its red one the next morning, so it turned every open branch red without any dependency change of its own — reproduced identically by running CI's scanner image against main's untouched lockfile. It stays an override rather than becoming a direct dependency because sharp is still only an optional dependency of next; what changed since #591 pinned it is the direction of the constraint. That pin was needed because next asked for `^0.34.5`, a range that excluded the then-fixed 0.35.0 — next 16.3.4 now asks for `^0.35.4`, so the pin had inverted into the thing holding the tree *below* what its dependent wants. Verified past a green lockfile the same way #591 did: sharp 0.35.4 loads against libvips 8.18.6 (`@img/sharp-libvips-*` 1.3.0 → 1.3.3) and round-trips a PNG encode; the scanner image reports "No issues found" (exit 0) with `osv-scanner.toml` gaining no new entry (#790)
+
 - `fp-cloud-cli`: typer 0.27.1 → 0.27.2, click 8.4.2 → 8.5.0, posthog 7.42.0 → 7.44.2 (#771)
 
 - `osv-scanner.toml` ignores GHSA-8mgp-746c-j5xp (nltk 3.10.3, CVSS 8.3) until 2026-11-20. Surfaced 2026-09-03 against an already-approved PR — nothing on the branch introduced it and nothing on the branch can resolve it, which is the case the allow-list exists for. nltk is transitive via `llama-index-core` and appears only in `sdk/python/uv.lock`, the dev/test lockfile that pins every extra so CI can exercise the adapters; the SDK's own runtime dependency list is empty and the `llamaindex` extra is imported lazily, so it reaches no shipped code path. OSV reports "0 vulnerabilities can be fixed" and an empty FIXED VERSION, so the only alternative is dropping the extra and its adapter tests. Dated to match the chromadb entries so the list is revisited in one pass
diff --git a/bun.lock b/bun.lock
index f13b0282..ebd14d09 100644
--- a/bun.lock
+++ b/bun.lock
@@ -43,7 +43,7 @@
     "eslint-plugin-react-hooks": "7.0.1",
     "nanoid": "3.3.18",
     "postcss": "8.5.26",
-    "sharp": "0.35.0",
+    "sharp": "0.35.4",
     "undici": "7.29.0",
     "vite": "8.0.16",
   },
@@ -144,57 +144,57 @@
 
     "@img/colour": ["@img/colour@1.1.0", "", {}, "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ=="],
 
-    "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.35.0", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.3.0" }, "os": "darwin", "cpu": "arm64" }, "sha512-ZgaYEwaj+lx/5n4W8GmZ2IYz0PQHjN5eqRcfijWGB+2Aq7ZInZGa0qJyAn6DEtyLuWHRSrmWOqT9q3qqTBvmUQ=="],
+    "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.3.3" }, "os": "darwin", "cpu": "arm64" }, "sha512-Uhfl4V4lhP2nbUVF9+hyH1+luj86f1gUFeo8ALYxFoULoU+G87D43BfeMP8XHsk9boxAnCY/bf2EHwhA7MuGsA=="],
 
-    "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.35.0", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.3.0" }, "os": "darwin", "cpu": "x64" }, "sha512-c1z9LFpKB0slQW3RchwBE8iSVzGp70TNjUUO9k4BZwwW4HH7JBGHeIy4b+kk4n/kcBASb9evKCE3/7Slmslgiw=="],
+    "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.3.3" }, "os": "darwin", "cpu": "x64" }, "sha512-hWniXY3bG5qKpkKrAwPe4y+VTPmf086YQAnkxWh7uA1YrlRouWGa0M0Mxj3ZjnXFkv7/TD1bTy9lGUK26vRvWw=="],
 
-    "@img/sharp-freebsd-wasm32": ["@img/sharp-freebsd-wasm32@0.35.0", "", { "dependencies": { "@img/sharp-wasm32": "0.35.0" }, "os": "freebsd" }, "sha512-Li2KTev0H90kEtnJHkI9xQojXt1AqWmFBMXiPw5kqd1jQgP7gi5HVK/qC5Rmh/59NuAwUuPzzPITmX22NomYYQ=="],
+    "@img/sharp-freebsd-wasm32": ["@img/sharp-freebsd-wasm32@0.35.4", "", { "dependencies": { "@img/sharp-wasm32": "0.35.4" }, "os": "freebsd" }, "sha512-lIsKw/BU+kjB4eZjxrYrZmwOJYi3Ajrv66iAlBmUPyKc3HpnloevB1g3wxGD9P/5BbQ1brBGl65VRRrCvQDEqA=="],
 
-    "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.3.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-EKbmBKtyTH+GPFDRw2TgK2oV6hyxxlJVIar4hoTYSNmIwipgMFdxPQqR392GmfdsPGWga0mCFN1cCKjRb9cljw=="],
+    "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.3.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-suTBPTDGrI9WodccaDdwZItTSaBYASlBk1NSfElSHrUfzu3szG6lvIF58+WiFvnfzuK8ZBFS5zE00PxqxnRiPg=="],
 
-    "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.3.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-Pl2OmOvrJ42adUllESxBsG54PfXLo1OYg9i3c5/5Ln/qJ0gZuTM9YMhQJPIbXqwidLRc/c2zuHt4RsrymmNv7A=="],
+    "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.3.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-FVJZ5mITMobmXIz/hPDTw0EintTW5H3WfrxwLqEqjiIihlu+hVRyGrFQ60xl0Lxn7Bt3zdpevPaQi0HEzqz9fw=="],
 
-    "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.3.0", "", { "os": "linux", "cpu": "arm" }, "sha512-A8UpHoUDW4DwnXoV6+q3C1s7QLRAHtPDEjWuNZjwHMyoCNZnm0GeNN8ls9f/bsEYTRQRW96C/n34XJQHJ2fT7A=="],
+    "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.3.3", "", { "os": "linux", "cpu": "arm" }, "sha512-3rbU4vqXXc3hY/OiXdl52xZvT0F1yEngWfvqudtPJg/KkyiaQw2DRsFrNzpmLvfavbwOq3qXn36GP8obHRULQA=="],
 
-    "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.3.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-C0SqjoFKnszqa44EQ7xoaT48nnO0lOyXEULfXMWi8krrjOPGYkeK30Okzla6ATbBYsyZ0ySinK0FVkpv3DwzfQ=="],
+    "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A=="],
 
-    "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.3.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-WOpkVxAjFd369iaIzEgNRreFD+gWdUMIGD5zplhNKNeqS6mm5dac3q2AFyCBmzYoAdouzZvRBgxy4z8QHZb4/A=="],
+    "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.3.3", "", { "os": "linux", "cpu": "ppc64" }, "sha512-cdn1OvUBwsXhbC0zSzJnNzf5MZ/mTrobawDvNXBTxe8VtqKAm0sRuEY2Evzovb/w9JMk4TvRxqt1mekSuJz64w=="],
 
-    "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.3.0", "", { "os": "linux", "cpu": "none" }, "sha512-DRWw0mOHusrCCuw2rqP87oLg6PGlkomVDFqw2hIwsSfwWpu4k3XLcBPaKKl6ct/GtL/cwNkgwjV/tc0Mqht3VA=="],
+    "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.3.3", "", { "os": "linux", "cpu": "none" }, "sha512-HjPVx7yKz+0lqdhDlTw1tt90wamBoxhiXpvl1XZpJLiHH4RCJ5yDTqH+VlYPv2fwFs89JFw4c1IexYOcQUi4IQ=="],
 
-    "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.3.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-9APy+nFWhHS+kzLgWZfLcyrUd7YqnAQVa4BPOo4xkoHpdoktOAPG4cEr9+Jpl0TtqfVmcMJimNL5qNTyyOHZNA=="],
+    "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.3.3", "", { "os": "linux", "cpu": "s390x" }, "sha512-neWLh+3yCNThxnfy3c4BbVBeGgt9aftno+XbT56iK28RgeDs3UOFWviLWlUu0bArYVYJaFDK+RRohbicUNCm8Q=="],
 
-    "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.3.0", "", { "os": "linux", "cpu": "x64" }, "sha512-y9RNUYDe2A1UAdhLyfeOodGRszQdaEoe4nfOpp/sNVPl2CWIcUyFaDoCh4vPLPxu19803j2naLqZup2WxDXCLA=="],
+    "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA=="],
 
-    "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.3.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-cC1wkC0Mlucd0KSiGrLkJnB/ZqPvZCntc/Lk7ZnYO5ZSbF2euNek4Xvxafojq+wN1q/W0eprdpUIjUr/EV2PBg=="],
+    "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-Y9kQaLMuNoB0bPYOOdcZMaseNrFpPodIWWMrx+CZyydf2xn68j9WYc6sWWRrDwNkzCQjKYfc68L7jKjGlHMibw=="],
 
-    "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.3.0", "", { "os": "linux", "cpu": "x64" }, "sha512-LiYMhUZicB1QG//+RvmYZpXJO8fYRENfp+MZUCnG9aw+AKvGAy9gPaCnuwsPcBFs8EV66M0NNxj9VHcNklE8zw=="],
+    "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-fj8Mv0HHfD1Rr+4I68+3agJynxDWtBFgicTbSOb9Bke6pIwzGcJ+RX/yHjmiEGFMCavY/dxvem7MyNaJF+wDiw=="],
 
-    "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.35.0", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.3.0" }, "os": "linux", "cpu": "arm" }, "sha512-VVlpEWwizEFIOom0zdoeKuO5nuTswzVE5uHcBNvHzmeHUpNFajY3HFfbQ+zIH4E2kVaZ/yVxmsShW56TtEy4uA=="],
+    "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.3.3" }, "os": "linux", "cpu": "arm" }, "sha512-7OAS8gI0EReKGVN2HssHlM6umJgxF5VI3xN0p9FA91p/YO+ou5hiNghLdZ5BEHztwaaK5+bLKRf8x/o2L2nk9A=="],
 
-    "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.35.0", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.3.0" }, "os": "linux", "cpu": "arm64" }, "sha512-4+4XHLNT5wDT0roYlHTEmH9lDKt0acf9Tv+3hM3iceOirkxrR404/3WjAYZ9F9CkHrxeRcGLJXbi4vluMZ9O+A=="],
+    "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.3.3" }, "os": "linux", "cpu": "arm64" }, "sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ=="],
 
-    "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.35.0", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.3.0" }, "os": "linux", "cpu": "ppc64" }, "sha512-N3hzbEpUTJC8pWpPVJvgzGxM+so/MAXc8O2s/53B0LL9ZGpfXpME7Wizkc5d/8fRBlBtkDjzoZGDCqqNDHqLEw=="],
+    "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.3.3" }, "os": "linux", "cpu": "ppc64" }, "sha512-2oYZJeIl4kCcMGk4ouZVjnkCtFrpQFlNEtJ6GbxzhHQchwH0NH/qEb9ykmOl29dqwMq+JhFdZn+1ak2FKhI9fQ=="],
 
-    "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.35.0", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.3.0" }, "os": "linux", "cpu": "none" }, "sha512-l6vmKVPnbS0RhVMbyxP5meAARsbhCnBN4fy31qz0+3a6Rv4jEqfzDrT89y6ZPkCi0AJGnwp2En528yXo401Hpw=="],
+    "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.3.3" }, "os": "linux", "cpu": "none" }, "sha512-cPbNChoRURAWdebDIHSenxRpgEdy7JkPydSnUxRm9VvKD7m0/xVaR/8Fzlu81pk5nHEvHH87UZUA7cTtwnbJSA=="],
 
-    "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.35.0", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.3.0" }, "os": "linux", "cpu": "s390x" }, "sha512-MYlMiPFiv/EKPAHnp3yNZ9AAWFsxga9c5Bkc6wkar6bqzHLlkGVJHRm0u1ei+VXnZxp3Mz9MG9ZIsI8vSOf3sQ=="],
+    "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.3.3" }, "os": "linux", "cpu": "s390x" }, "sha512-RY0JFY8Fd6RonCBtHz+DvadaPkXDSI1AUn6yWL9TipqkZ1vY8w8evqdgyDFnkm4/K1ve1TvZiaePP5oSd4+WVQ=="],
 
-    "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.35.0", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.3.0" }, "os": "linux", "cpu": "x64" }, "sha512-TYaItB5oj1ioXjhyn2xrR208vf+YuIIcHptQWRRaBmFhvIvL9D72DXN8w75xup0KXA8UdEAhQ9Qb2S49FD/9Cw=="],
+    "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.3.3" }, "os": "linux", "cpu": "x64" }, "sha512-9qvvEAuk8k89TfWUoX2htWjbAMX8p+NxCppjpcg5k6xMsjhBQPTsoIh36h9Qde4WRuGpJeYnOjdosDn/cnv+OA=="],
 
-    "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.35.0", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.3.0" }, "os": "linux", "cpu": "arm64" }, "sha512-DSTb6ijQzqe6DdAaOBVqJ/SYf1vO8EW5bK6X6LRXufEBebf2722VCdvBUtZ3rtV0x2ApfPNDy/p7LrrjaWjiyQ=="],
+    "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.3.3" }, "os": "linux", "cpu": "arm64" }, "sha512-KB5jxpfWQTr0nc3xdHtWChdbifHrBGsd2SM62Eyxrl8afikm+f5qGBU75SJIZBT/S1MC8XyacdlXBMSWq6OURA=="],
 
-    "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.35.0", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.3.0" }, "os": "linux", "cpu": "x64" }, "sha512-K7ykQ+26Rt6+4BTU80AuGgTPIYX86UxiAKT4rcXX/WNTo7k1ZxpKz+TguHnwVpCqQK3B5PK0vZ0ZBe6nz/ib1w=="],
+    "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.3.3" }, "os": "linux", "cpu": "x64" }, "sha512-f+eZJZIQNEEd26RPSW+76chwOf1XtA2Y/O+5ocVyLliHkeih3e+jhLVBdNTd2rS3IbNXK8+ug93Vf5ZXtF5Lxg=="],
 
-    "@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.0", "", { "dependencies": { "@emnapi/runtime": "^1.11.0" } }, "sha512-9woLIFORERCr+6cWu87dQ22J34EExkhc73U1kZW0c+RclQqWetoodByp4dWZ/hN8/KVmTRAx2HOnUwib8AwZdA=="],
+    "@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.4", "", { "dependencies": { "@emnapi/runtime": "^1.11.3" } }, "sha512-zQnl4Kwp7Q6NHsENtU2T/00Zi+w3AQNwz3+UaTyVBy2FpXrzXzGjndpK61onhZjRtRpQXxCTeqw19bVyXOh7jA=="],
 
-    "@img/sharp-webcontainers-wasm32": ["@img/sharp-webcontainers-wasm32@0.35.0", "", { "dependencies": { "@img/sharp-wasm32": "0.35.0" }, "cpu": "none" }, "sha512-t+kie1TOyaDM6Dho+f+y0VqIUNhYQaKCUahuZVi0E0frgdiaOaPsDxDW3wfKacUdaNBCnK/ZDBMg33ydvHj8uA=="],
+    "@img/sharp-webcontainers-wasm32": ["@img/sharp-webcontainers-wasm32@0.35.4", "", { "dependencies": { "@img/sharp-wasm32": "0.35.4" }, "cpu": "none" }, "sha512-ESfNkywmCfPNyaZjxooddJQiQ+l/nTpGEOGthxiLnIHXC/CmcBixnfwUleX9mCz9ovrUUvKMap/pm8RYbzfwaA=="],
 
-    "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.35.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-M5eKxug0dabbaWgFKvPa3odNs2OpaP+81NASfGKkt4GcYXpNhSu7CaeYxWkLNV6vHmUp4hnCxnxrUyhUJhXbKA=="],
+    "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.35.4", "", { "os": "win32", "cpu": "arm64" }, "sha512-iNdlBX9gLVvqe2I3uIJSIKTq6wckP/DYxZtcqxm09x5Gi24DnFBmPAWZmr60ZyYMG0xlzo6goG3670ar+RXvRw=="],
 
-    "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.35.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-z0+pZ03QCDvdVN0Ez9IX/yjWC19ikMlXrmdYMwYNLTh2BLPx3hXWPvyqWfquZ0BTO9O6GVOjIVoTcyyacMnWlQ=="],
+    "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.35.4", "", { "os": "win32", "cpu": "ia32" }, "sha512-kqRsbaa5CS6KHlpxnN7WhE6vAAugXyZButpRdvDWetlv6Qv4N9WTcrWzF7tXfB9T7MsoadqdI8hmwLq6UlLvtw=="],
 
-    "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.35.0", "", { "os": "win32", "cpu": "x64" }, "sha512-feNnlz5ZHKr0MY1LPHvZQyJeBkbo4ctsn0D8FvA53VTw5TC63rfEL2UrWbkSBR19htSE7Mw78xYVwdJqoMWVHw=="],
+    "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.35.4", "", { "os": "win32", "cpu": "x64" }, "sha512-XtmnYhBcrORsJ4XJngyzr/EWP0hRZLAZRFaApdKuviyqF78+ylxh2y06ZmtULAMOnObJ3ucpN0AcwSWnMowTRg=="],
 
     "@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.13", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.0", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA=="],
 
@@ -1102,7 +1102,7 @@
 
     "set-proto": ["set-proto@1.0.0", "", { "dependencies": { "dunder-proto": "^1.0.1", "es-errors": "^1.3.0", "es-object-atoms": "^1.0.0" } }, "sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw=="],
 
-    "sharp": ["sharp@0.35.0", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.4" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.0", "@img/sharp-darwin-x64": "0.35.0", "@img/sharp-freebsd-wasm32": "0.35.0", "@img/sharp-libvips-darwin-arm64": "1.3.0", "@img/sharp-libvips-darwin-x64": "1.3.0", "@img/sharp-libvips-linux-arm": "1.3.0", "@img/sharp-libvips-linux-arm64": "1.3.0", "@img/sharp-libvips-linux-ppc64": "1.3.0", "@img/sharp-libvips-linux-riscv64": "1.3.0", "@img/sharp-libvips-linux-s390x": "1.3.0", "@img/sharp-libvips-linux-x64": "1.3.0", "@img/sharp-libvips-linuxmusl-arm64": "1.3.0", "@img/sharp-libvips-linuxmusl-x64": "1.3.0", "@img/sharp-linux-arm": "0.35.0", "@img/sharp-linux-arm64": "0.35.0", "@img/sharp-linux-ppc64": "0.35.0", "@img/sharp-linux-riscv64": "0.35.0", "@img/sharp-linux-s390x": "0.35.0", "@img/sharp-linux-x64": "0.35.0", "@img/sharp-linuxmusl-arm64": "0.35.0", "@img/sharp-linuxmusl-x64": "0.35.0", "@img/sharp-webcontainers-wasm32": "0.35.0", "@img/sharp-win32-arm64": "0.35.0", "@img/sharp-win32-ia32": "0.35.0", "@img/sharp-win32-x64": "0.35.0" } }, "sha512-BqvG5XbwPZ4NV0DK90d86leEECMsoa8bO0nqnKWlBDYxri4GJ7c4EDInaF6q20lTh/mATmnDIKWJFfXnoVfH5g=="],
+    "sharp": ["sharp@0.35.4", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.5" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.4", "@img/sharp-darwin-x64": "0.35.4", "@img/sharp-freebsd-wasm32": "0.35.4", "@img/sharp-libvips-darwin-arm64": "1.3.3", "@img/sharp-libvips-darwin-x64": "1.3.3", "@img/sharp-libvips-linux-arm": "1.3.3", "@img/sharp-libvips-linux-arm64": "1.3.3", "@img/sharp-libvips-linux-ppc64": "1.3.3", "@img/sharp-libvips-linux-riscv64": "1.3.3", "@img/sharp-libvips-linux-s390x": "1.3.3", "@img/sharp-libvips-linux-x64": "1.3.3", "@img/sharp-libvips-linuxmusl-arm64": "1.3.3", "@img/sharp-libvips-linuxmusl-x64": "1.3.3", "@img/sharp-linux-arm": "0.35.4", "@img/sharp-linux-arm64": "0.35.4", "@img/sharp-linux-ppc64": "0.35.4", "@img/sharp-linux-riscv64": "0.35.4", "@img/sharp-linux-s390x": "0.35.4", "@img/sharp-linux-x64": "0.35.4", "@img/sharp-linuxmusl-arm64": "0.35.4", "@img/sharp-linuxmusl-x64": "0.35.4", "@img/sharp-webcontainers-wasm32": "0.35.4", "@img/sharp-win32-arm64": "0.35.4", "@img/sharp-win32-ia32": "0.35.4", "@img/sharp-win32-x64": "0.35.4" }, "peerDependencies": { "@types/node": "*" }, "optionalPeers": ["@types/node"] }, "sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA=="],
 
     "shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="],
 
@@ -1292,7 +1292,7 @@
 
     "@eslint-community/eslint-utils/eslint-visitor-keys": ["eslint-visitor-keys@3.4.3", "", {}, "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag=="],
 
-    "@img/sharp-wasm32/@emnapi/runtime": ["@emnapi/runtime@1.11.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA=="],
+    "@img/sharp-wasm32/@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="],
 
     "@tailwindcss/node/magic-string": ["magic-string@0.30.21", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="],
 
diff --git a/package.json b/package.json
index 7851f3b1..4aa055ad 100644
--- a/package.json
+++ b/package.json
@@ -117,7 +117,7 @@
     "vite": "8.0.16",
     "undici": "7.29.0",
     "brace-expansion": "5.0.9",
-    "sharp": "0.35.0",
+    "sharp": "0.35.4",
     "browserslist": "4.28.8"
   }
 }

From cf59dca39ad41b0f08d735f207076cc84771d93a Mon Sep 17 00:00:00 2001
From: NiveditJain <nivedit@exosphere.host>
Date: Wed, 9 Sep 2026 13:03:41 +0530
Subject: [PATCH 4/4] docs: hold the Reo loader to the flag Reo's Mintlify page
 ships
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The snippet went in with `n.defer=!0`, which is what Reo's Next.js and
generic-docs install pages carry; the Mintlify page — the one this is
installed from, and the one the file claims to be diffable against — has
`n.async=!0`. The difference is cosmetic (a script built with
createElement and appended is async by default, and defer is ignored on
it entirely), so this is about the file's own claim being true, not about
load behaviour.

The test asserted `tag.defer || tag.async`, which cannot tell the two
apart — a dynamically inserted script reports async regardless, so it
passed for a loader that set neither. It now reads the exact loader line
back and compares it character for character against the vendor text,
with the client ID interpolated from the same constant the init assertion
uses.

Raised by CodeRabbit on #790.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UubDs9Br3Leg6GCtkdQ3Kg
---
 __tests__/docs/reo.test.ts | 28 ++++++++++++++++++----------
 docs/reo.js                | 22 ++++++++++++++--------
 2 files changed, 32 insertions(+), 18 deletions(-)

diff --git a/__tests__/docs/reo.test.ts b/__tests__/docs/reo.test.ts
index 0316d915..90124e35 100644
--- a/__tests__/docs/reo.test.ts
+++ b/__tests__/docs/reo.test.ts
@@ -102,11 +102,13 @@ describe("docs/reo.js", () => {
   });
 
   it("does not block rendering on the beacon", () => {
-    // A dynamically inserted script is async by default, and the snippet sets
-    // `defer` on top. Either way the parser is never held up; asserting it here
-    // means a rewrite that drops to a synchronous document.write is caught.
-    const tag = run().injected()[0];
-    expect(tag.defer || tag.async).toBe(true);
+    // A script built with `createElement` and appended is async by default, so
+    // reading the property back proves nothing on its own — it is true whether
+    // the loader sets `async`, sets `defer`, or sets neither. The source
+    // assertion is what actually pins the flag; this one catches a rewrite that
+    // drops to a parser-blocking `document.write`.
+    expect(run().injected()[0].async).toBe(true);
+    expect(SCRIPT).toContain("n.async=!0");
   });
 
   it("runs at most once per page load", () => {
@@ -118,15 +120,21 @@ describe("docs/reo.js", () => {
     expect(r.injected()).toHaveLength(1);
   });
 
-  it("matches the snippet Reo issues for Mintlify", () => {
-    // Reo's install guide gives one minified loader line. Keeping it verbatim
+  it("matches the snippet Reo issues for Mintlify, character for character", () => {
+    // Reo's Mintlify guide gives one minified loader line. Keeping it verbatim
     // is what makes this file diffable against the vendor docs; a hand-edit
-    // that reshapes it should be a deliberate, reviewed change.
+    // that reshapes it should be a deliberate, reviewed change. Reo's *other*
+    // install pages ship the same loader with `defer` in place of `async` —
+    // functionally identical here, but this is installed from the Mintlify
+    // page, so that is the text it is held to.
     const loader = SCRIPT.split("\n").filter(
       (l) => !l.startsWith(" *") && !l.startsWith("/*") && l.trim() !== "",
     );
     expect(loader).toHaveLength(1);
-    expect(loader[0]).toContain("static.reo.dev");
-    expect(loader[0]).toContain("Reo.init");
+    expect(loader[0]).toBe(
+      `!function(){var e,t,n;e="${CLIENT_ID}",t=function(){Reo.init({clientID:"${CLIENT_ID}"})},` +
+        `(n=document.createElement("script")).src="https://static.reo.dev/"+e+"/reo.js",` +
+        `n.async=!0,n.onload=t,document.head.appendChild(n)}();`,
+    );
   });
 });
diff --git a/docs/reo.js b/docs/reo.js
index 2b8a22d4..205f5cda 100644
--- a/docs/reo.js
+++ b/docs/reo.js
@@ -12,17 +12,23 @@
  *   https://www.mintlify.com/docs/customize/custom-scripts
  *   https://docs.reo.dev/integrations/developer-docs/mintlify
  *
- * Kept byte-for-byte as Reo issues it, minified loader and all, so it can be
- * diffed against the vendor snippet without reading past the formatting. The
- * client ID appears twice on purpose: once to build the script URL, once in the
- * `Reo.init` call the loader fires on load. `__tests__/docs/reo.test.ts` drives
- * it in a DOM and asserts the two are the same tenant — a mismatched pair still
- * loads a real script, it just reports to nobody, and the only symptom is an
- * empty dashboard.
+ * Kept byte-for-byte as the Mintlify page issues it, minified loader and all,
+ * so it can be diffed against the vendor snippet without reading past the
+ * formatting. Note that Reo's other install pages (Next.js, generic docs) ship
+ * the same loader with `n.defer=!0` where the Mintlify one has `n.async=!0`.
+ * The difference is cosmetic — a script element built with `createElement` and
+ * appended is async by default, and `defer` is ignored on it entirely — so this
+ * follows the page it was installed from rather than picking between them.
+ *
+ * The client ID appears twice on purpose: once to build the script URL, once in
+ * the `Reo.init` call the loader fires on load. `__tests__/docs/reo.test.ts`
+ * drives it in a DOM and asserts the two are the same tenant — a mismatched
+ * pair still loads a real script, it just reports to nobody, and the only
+ * symptom is an empty dashboard.
  *
  * The docs are a Next.js SPA and this does not re-run on client-side
  * navigation, so there is no double-init to guard against; Reo tracks route
  * changes itself once initialised. (`docs/stars.js` needs a MutationObserver
  * for exactly the same reason, from the other direction.)
  */
-!function(){var e,t,n;e="023277be3290bc6",t=function(){Reo.init({clientID:"023277be3290bc6"})},(n=document.createElement("script")).src="https://static.reo.dev/"+e+"/reo.js",n.defer=!0,n.onload=t,document.head.appendChild(n)}();
+!function(){var e,t,n;e="023277be3290bc6",t=function(){Reo.init({clientID:"023277be3290bc6"})},(n=document.createElement("script")).src="https://static.reo.dev/"+e+"/reo.js",n.async=!0,n.onload=t,document.head.appendChild(n)}();