Outlet Powered

Rules the build enforces

• A unit test fails the build on any claim of first-hand testing in the content and data files.
• No prices are published until a store feed supplies a price with its timestamp.
• Every store button reads "Check price at" and the links come from one data file.

Saving a change

• Every admin save is validated against the whole site, then stored with a revision and an audit row.
• A save expires only the cache tags it touched, so the affected pages rebuild on their next visit without a redeploy.
• Public pages are prerendered and served from the CDN, so a page view costs no database query.

Git and the database

• Without a database the site renders from the bundled seed. If a database read fails, the seed is shown for five minutes only.
• Deploys add new seed pages and products and refresh rows nobody has edited. A row saved in the admin is never overwritten by a deploy.
• An export command writes the database back to the seed, so Git keeps a reviewable history of admin edits.

Runtime calculator

• Rated watt-hours times an efficiency range (80 to 90% on AC, 85 to 95% on DC), divided by the load, shown as a range.
• For a chosen station it checks running watts against the continuous rating and start-up watts against the surge rating, and warns about DC-only stations.

Will it run

• 54 appliances with published wattage, each tied to its source.
• Refrigerator, freezer and CPAP pages each carry a runtime table for every model, and a size calculator works out the battery a plan needs.
• CPAP figures use ResMed's own numbers: 56.1 W typical and 73.2 W peak for the AirSense 11 with a heated humidifier.

Database explorer and comparisons

• A filterable card grid with a table view and a dialog that compares up to three models.
• 12 comparison pages, brand against brand and model against model, with spec tables that highlight the rows that differ.

Recalls

• A recall tracker built from searches of the CPSC recalls API, with the date each brand was checked.

What the check holds back

• A number that is not in the database, the tool results or the visitor's own message. Small counts pass, but a small number with a unit, such as "8 hours", needs a source like any other.
• A price, a claim of testing, wording about wiring a station into a house, or a link to another website.
• Markup, an email address, or talk about its own prompt or rules, which the model has no reason to write.
• Links are kept only when they point at an existing page on the site.

Limits

• Per visitor: 10 questions per 10 minutes and 30 a day. Site-wide: 1,000 answers a day, then the guide shows the contact form.
• 500 characters a question, 6 turns, a 15-second timeout and 3 tool rounds.
• Questions are kept for 30 days without the IP address and reviewed in the admin.

How it works

• A publishAt time in UTC on a page or a product file. The cached public readers drop anything whose time has not come.
• A release cron runs at 13, 14, 18 and 19 UTC, the 9 AM and 2 PM Eastern slots in winter and summer. When something fell due, it expires the page and product caches and sends the new URLs to IndexNow.
• The admin has a Scheduled status with a US Eastern time and refuses a time in the past.
• Saves are validated with scheduled items counted as live, so a page cannot be saved if it would break once everything scheduled is out.

Checks

• A unit test parses the seed at every scheduled instant, so no live page can point at a model that is not out yet.
• An end-to-end test schedules a page, refuses a past time and publishes.

Forms and paid calls

• The contact form, the AI guide and the finder sit behind Cloudflare Turnstile. The widget is interaction-only, and a passed check sets a signed 10-minute cookie.
• If Cloudflare cannot be reached, the contact form still takes the message, and the guide and finder fall back to the free answers, never the paid model.
• The contact form has a honeypot field and a minimum fill time.
• Messages that look like spam, such as many links, a throwaway email domain or text addressed to AI readers, are stored under a spam label. The rest are posted to a private Discord channel.

Headers

• A Content-Security-Policy that defaults to the site's own origin and adds a host only for a service that is configured.
• HSTS for two years, X-Frame-Options DENY, nosniff, a Referrer-Policy, a Permissions-Policy and a same-origin opener policy.

The gate

• npm run verify runs the contrast check, unit tests, the type check, the build, the writing check and the end-to-end suite on Chromium, plus WebKit in WSL.
• A pass is tied to the exact tree it checked, and the pre-push hook skips the checks only when the pushed tree matches.