On juudd.com, a page that still contains an unanswered question does not ship. The build looks through its own output for the marker, deletes that output and fails with the name of the file. There is nothing left to publish by mistake.
That is the decision. The rest of this post is the case that forced it, why the check reads the finished files and not the configuration, and what the pages say that a copied template would not.
The case: a legal page that looks finished
This site had no privacy policy and no terms, and that was deliberate. The footer's own comment said a link that leads somewhere empty is a worse impression than a shorter list.
Then a plugin directory's submission required both pages as URLs, and required the privacy policy to disclose every category of personal data the platform handles. The old position stopped being available.
The pages were written from the repository, not from a template. That left a handful of facts a repository cannot hold: the legal entity, the contact address, the governing law and venue, the data protection officer, the effective dates, the fees and the liability cap. Each was written into the page source as a literal marker: the words "owner must supply", a colon and the missing fact, inside double square brackets.
A page shipped with a marker in it would deploy, serve and look completely healthy. It is the worst place in a site to be wrong quietly, and nothing would say so out loud.
The check reads the output, not the config
The build already had a guard for two values with no honest default, the site's own address and the connector's. A build left on the placeholder address succeeds and serves, and every canonical link, sitemap entry and robots.txt line names a domain that is not ours.
The markers go through the same guard, as a third entry. It is not an environment variable, and that is the point of putting it there: the fix is to edit the page, not to set anything.
The guard runs last and reads the built files, the .html, .txt, .xml, .json and .css that would ship. It does not read the configuration, for two reasons.
- The configuration is not the thing that ships. A placeholder that reached the output by a path nobody anticipated would pass a configuration check and fail this one.
- A type check runs a build too. It writes types, produces no files and cannot ship a wrong page, so a check early enough to see only the configuration would fire for it as well. Checking the output is exactly as strict as the problem.
When it finds a marker it deletes the output directory before it throws. The reason is written beside the code: a non-zero exit protects build && ship and does nothing for build; ship, and what is left behind is a complete, working, wrong site.
What the pages say that a template would not
Both documents were checked against the code and the decision records, and the privacy policy's most useful section is the list of what we do not have. There is no runtime record of what a deployed function prints. There is no record of a site's visitors. There is no stored database credential.
It also carries a section no template anticipates, about the channel. juudd is driven through an assistant, so some tool results, such as the rows apply_sql returns, flow into a conversation whose records belong to the customer's AI provider. That is the product working as designed and outside our control, and a policy that left it out would be describing a different product.
What it cost, and what was answered
The consequence was written down plainly. The next production build of the site would fail with a list of questions, not produce a site. The site already live was unaffected, because it was built before the pages existed.
On 2026-09-02 the owner supplied the entity, the address, the effective date and the contact address, and delegated the data protection officer question. Each answer carries its reasoning in a comment beside it, and none of them is legal advice. They are defaults a lawyer should review. The guard still runs, so an edit that reopens a question as a marker fails the build in the same way.
What is not decided
Both pages are in English only. A legal document is the strongest case for leaving translation to the reader, because an unreviewed translation of a text whose value is precision is worse than one language a reader can check. The decision also did not write a standalone data processing agreement, and it says plainly that neither page replaces one.
The rule, once
A page that holds a question only the owner can answer does not ship: the question is a marker, the build finds it in the finished files, deletes them and fails, and the fix is to edit the page. The tools and their refusals are listed in the docs.