## The Agent Behaviour Policy becomes a page, and Lisbon gets a landing page

Three new pages, and the plumbing they needed. The site had been arguing the Agent
Behaviour Policy's contents for months without the artefact having a name; it has one
now, with a published model behind it.

- **[The Agent Behaviour Policy](abp.html) is a page.** The four objects and how each
  is obtained, the four barriers and the enforcer test, the confirmations-on/off pair
  where one barrier moved and not a single number did, the rule that a behaviour policy
  carries no score and where the score does live, the label/record/prescription ladder,
  and the business case a control can be sold on. Every figure links to the published
  data it came from rather than restating it.
- **[Lisbon](summit.html) has a landing page** for the Startup Summit on 17–18
  September: what we are showing, in order; four conversations with one ask each; press
  boilerplate at three lengths with an accurate/not-accurate table beside it; and every
  brand asset, free to take. It carries the not-affiliated notice and sends anybody
  asking about the event to the organiser.
- **An exhibitor operations page**, which is the first page on this site that is
  deliberately not published: unlisted, `noindex`, kept out of the sitemap and
  `llms.txt`, and disallowed in `robots.txt`. It holds the organiser's booth guide and
  our own action list. `site/` is a public web root, so that makes it unadvertised
  rather than protected, and the page says so on itself.

**The page list has one home.** It used to be inlined in all 24 pages with nothing
keeping them in step — a test could see them disagree but nothing could fix it, and
adding a page meant editing every page. `site/pages.json` is now the source and the
inlined copy is injected from it. A page can be marked `unlisted` (no menu entry) or
`private` (also no twin, no sitemap, no `llms.txt`, `noindex`, robots-disallowed).

**Two defects fixed on the way, both older than this release.**

- **The header bar overflowed its own 1100px cap by 33px**, before these pages existed,
  and by 137px with them. Library, Partners, Give feedback and Brand collapse into a
  *More* group, which brings six top-level entries back inside the cap, and the mobile
  drawer's breakpoint moves from 880px to 980px to close a band where the bar overflowed
  with no drawer to fall back on. No page scrolls sideways at any width now, which was
  not true of any release before this one.
- **The lockup SVGs clipped their own wordmark.** `riskmandate-lockup-light.svg` and
  its dark twin set the wordmark as an SVG `<text>` element inside a 260-unit viewBox,
  so the final letter was cut off in any font wider than the one it was drawn against —
  including whatever a printer would have used. The viewBox is 320 now, and the print
  deliverables are laid out as real type rather than as a fixed-width drawing, so there
  is nothing left to clip.

**Two new tools, neither of them a build step.** `scripts/site/new-page.mjs` scaffolds a
page with the chrome lifted from a page already in `site/`, so a new page cannot ship an
older copy of the header, the drawer or the shared modules.
`scripts/site/render-brand-exports.mjs` renders the brand exports at the sizes an
exhibitor portal and a LinkedIn page actually ask for.

**Tests: 19, from 17.** Internal links now also check that a `#fragment` resolves to an
id in the page it points at, which caught a wrong anchor before it shipped; private
pages are asserted `noindex`, twin-less and robots-disallowed; and `pages.json` has to
account for every page in `site/` and vice versa.