docs(project-state): og-default rejection + Desktop design brief, new E9 (fonts the site never loads)

docs/project-state.md

@@ -196,13 +196,34 @@ should be edge-cached — lower TTFB and less origin traffic through the tunnel.
 
 - [ ] `scraping-bot-walled-marketplace-warm-browser-session`: OG card exists, **banner 404s** (no `banner:` in frontmatter, no PNG). Generate it or accept it as the one exception.
 - [x] ✅ `authentik-css-greater-than-bug` (the `>` bug) — **published 2026-10-16 (`2295c0f`)**: `draft: true → false` in EN + ZH, `pubDate` kept at 2026-09-20 with **`updatedDate: 2026-10-16`** so `lastmod` stays honest, OG + banner generated (og `rows=1 overflow=0`; banner `delta=2 overflow=0`), and the CTA's displayed phone corrected (`011-797 2969` → `+60 12-797 2969`). Verified live: EN/ZH/og/banner all **200**, language switch both ways, `/posts/` order still monotonic. The draft bank is now empty.
-- [x] `og-default.png` rewritten 2026-10-17 (`scripts/og-gen/generate-default.mjs` + `scripts/og-gen/template-default.html`).
-  The card it replaces had shipped since 2026-09-06 still carrying the **retired brand name `hoelee.dev`** and no face, while the
-  headshot landed on the site in B4 — i.e. the most-linked share card was the least current asset on the site. New card:
-  headshot + `Lee Teong Hoe` / `Mr Hoelee` + the JSON-LD job title, measured in the DOM (`overflow=0`, 1200×630).
-  ⏸ **Not committed yet — waiting for the owner's look.**
+- [ ] `og-default.png` — **the replacement is being designed outside the repo.** The card live today (2026-09-06) still
+  says **`hoelee.dev`** and has no face, so the most-linked share card is the least current asset on the site. My own attempt
+  (headshot + `Lee Teong Hoe` / `Mr Hoelee` + the JSON-LD job title, DOM-measured `overflow=0`, 1200×630) was **rejected on
+  sight by the owner on 2026-10-17 — do not commit it and do not re-derive it.** He is having ChatGPT design the card; the
+  hand-off package is `C:\Users\hoelee\Desktop\og-default-brief-20261017\` (paste-ready prompt, specs, palette, text
+  allow/deny list, reference cards + site screenshots, headshot assets).
+  The render harness stays in the working tree **untracked**: `scripts/og-gen/generate-default.mjs` renders
+  `scripts/og-gen/template-default.html`, probes the DOM and crops to 1200×630 — rewrite the template from whatever design
+  comes back and the measuring/rendering is identical.
+  ⚠ Acceptance before it ships: render → probe (`scrollHeight<=630`, `scrollWidth<=1200`, margins ≥64 px, headline ≥48 px,
+  no `hoelee.dev`) → **show the owner the PNG** → then commit the PNG + template, build, push both remotes, confirm the live
+  `/og-default.png` byte size actually changed.
 - **Done when:** no page references a 404 image, the draft bank is empty, and the default share card matches the A1 photo.
 
+**Step E9 — The design system names two fonts the site never loads.** ⬜
+
+`src/styles/global.css` declares `--font-sans: 'Inter', …` and `--font-mono: 'JetBrains Mono', …`, but the built head carries
+**no** webfont link, no `@font-face` and nothing under `public/fonts` (verified 2026-10-17 against `dist/index.html`: the only
+`<link>` elements are canonical/hreflang/icons/RSS/one stylesheet). So every visitor renders the **system** fallback — Segoe UI
+on Windows, SF on macOS — while the docs and the OG templates describe Inter. Neither font is even installed on the machine
+that renders the share cards. Pick one and document it:
+
+- self-host two subset `.woff2` files (sans ≈ 30–40 KB, mono only on code) + `preload` the sans, or
+- delete Inter / JetBrains Mono from the tokens and state the system stack as the brand font.
+
+⚠ Either direction changes the look of **every** page, so it needs the owner's eye before it ships — and it is the reason the
+share-card brief tells the designer not to depend on Inter. Governs: `design-guide.md`.
+
 ### Phase A — Identity (highest ROI, ~2–3 hrs total)
 
 **Step A1 — Add a real author photo (headshot).**
@@ -840,7 +861,7 @@ and a DOM probe for the regenerated card. Spot values: `/zh/posts/` 200 · `/tag
 | Check | Result |
 |---|---|
 | **Closed since the Sept audit** | A1 real photo ✅ (B4) · A3 featured strip ✅ (B3) · D1 search ✅ (B3 fixed the ES-module loader) · E4 ZH routes + nav ✅ (B2) · E5 `og:locale` ✅ (B2) · E8 draft bank ✅ (now empty) |
-| **Still open** | E1 CF Web Analytics beacon + GSC sitemap (owner) · E6 HTML caching + HSTS (**CF zone write — owner**) · E8 `og-default.png` (rewritten, awaiting the owner's look) + the one banner-less post · A2 title/hero wording (cosmetic) · E2 (recorded, deferred by the owner 2026-10-17) · E3 syndication (needs dev.to + LinkedIn accounts) |
+| **Still open** | E1 CF Web Analytics beacon + GSC sitemap (owner) · E6 HTML caching + HSTS (**CF zone write — owner**) · E8 `og-default.png` (**rejected once; being designed outside the repo — brief on the Desktop**) + the one banner-less post · E9 the design system names two fonts the site never loads · A2 title/hero wording (cosmetic) · E2 (recorded, deferred by the owner 2026-10-17) · E3 syndication (needs dev.to + LinkedIn accounts) |
 | **GitHub mirror** | was **24 commits behind** — nothing had been pushed since `d2b15d6`, so all of B1–B4 existed only on Gitea. Pushed 2026-10-17: `d2b15d6..f4b2ce9`, now **0/0** with both remotes |
 | **`/posts/zh/` redirect scheme** | the 301 came back as `Location: http://blog.hoelee.com/zh/posts/` (nginx absolutised it with the scheme the tunnel reached it on), costing an extra Cloudflare "Always Use HTTPS" 308 hop. Fixed 2026-10-17 in the host nginx conf with `absolute_redirect off` (backup `default.conf.bak-20261017` beside it), validated in a throwaway container against the real file, `nginx -t` + reload in the live container — now `Location: /zh/posts/` on both the LAN origin and the public URL |
 | **`/zh/posts/` 502 blip** | 3 short 502s inside one polling window, then **45/45 × 200** (15 each on `/`, `/posts/`, `/zh/posts/`). The nginx access log over 4 h holds **zero 5xx** (411 × 200 / 31 × 404 / 11 × 304 / 2 × 301) and the LAN origin answers in 3–20 ms ⇒ the 502s came from the tunnel/edge path, not from the page or the origin. Worth watching; not a defect in the archive |