Despite its name, NextWeb4/Private is a public GitHub Pages runtime repository. It contains the browser-ready output for the /Private/ project site, not private application source, credentials, an administration backend, or a complete development history.

The current deployment evidence shows that this repository is generated output from website-source-v2. Its validated artifact is published by GitHub Actions to this repository's main branch, and GitHub Project Pages serves it below /Private/. The separate website-source workflow publishes the user-site runtime to NextWeb4.github.io; it does not target this repository.

The next validated deployment will contain 660 files on main:

These are audit-time counts, not product limits. Recompute them from the current tree whenever the generated artifact changes.

• index.html provides the archive entry point, module navigation, article discovery, and same-origin search.
• module/ groups the archive into three topic views without requiring a server renderer.
• Every file under article/ is pre-rendered HTML; reading does not depend on a database or an application server.
• about.html provides the author profile, a Chinese/English interface switch, and the current contact address.
• Search loads committed JSON, ranks results in the browser, and links directly to generated pages.
• The daily Bing wallpaper is optional progressive enhancement; a solid-color fallback keeps the content usable when the request or image fails.

No package installation is required. From the repository root, run:

python -m http.server 8000

Open http://localhost:8000/. Use HTTP rather than file://: search depends on same-origin fetch() requests for committed JSON.

No repository build, automated test, lint, format, package-manager, or CI command was found in this runtime tree. Do not claim runtime-only manual checks as source-level automated coverage. The current source/deployment conflict means no source command is asserted here.

This repository is a deployment destination, not an editable source tree. The safe lifecycle is:

1. Edit content, templates, or validation rules in website-source-v2 and run its actual build and test gates.
2. Export only the reviewed public allowlist.
3. Replace this runtime tree atomically and let GitHub Pages serve main.
4. Verify the deployed /Private/ URL, representative articles, search, media, and 404 behavior.

Do not add backend code, raw source data, passwords, tokens, backups, local tooling, or private maintenance documents here. A public static repository cannot protect bytes that it contains, even when UI code discourages copying or developer tools.

The runtime keeps compact Bloom-filter-style indexes separately from searchable content. Query processing and result ranking happen locally after same-origin files are downloaded; there is no search API. Published article changes therefore need synchronized HTML, module entries, compact indexes, content stores, and media references.

No generator is committed here, so bulk fixes in the runtime are unsafe. After the active source is confirmed, regenerate there and validate the exact public manifest instead of hand-editing hundreds of output files.

Article HTML, styles, scripts, media, and search data are same-origin static files. site.js may request wallpaper metadata from https://bing.biturl.top/; it omits credentials and referrer data, times out after six seconds, and accepts returned images only from HTTPS bing.com hosts. Wallpaper failures are non-blocking.

The wallpaper cache and About language selection use localStorage. No server-side privacy or authentication boundary exists in this public artifact. README badges request images from img.shields.io; this affects README rendering only and adds no site dependency.

• Preview through HTTP and open the homepage, About page, all three module pages, and representative articles.
• Test empty, Chinese, English, date, no-result, keyboard, and rapidly changing search queries.
• Check UTF-8 and percent-encoded non-ASCII paths with case-sensitive hosting behavior in mind.
• Confirm every changed media URL resolves and no unreferenced private upload entered the artifact.
• Test narrow layouts, keyboard focus, reduced motion, and the About language preference.
• Simulate search-index, wallpaper API, image, and storage failures; primary content must remain readable.
• Request an unknown path and confirm 404.html rather than an accidental single-page-app fallback.

At the 2026-07-22 audit the repository was public, unarchived, and Pages-enabled; source commit 2ca9ae2 completed deployment successfully. Its principal risks are source/runtime drift, direct edits being overwritten, large static media, generated indexes becoming inconsistent, and accidental publication of material that belongs only in the private source.

Contributions should originate only after the active source has been established and should arrive here as a validated artifact. Keep the runtime framework-free unless the source architecture and deployment contract are deliberately changed and tested together.

• Rays688888@Gmail.com

No license file was detected. Public availability does not grant permission to reuse the site code, writing, or uploaded media; individual article assets may also have separate rights or provenance.