A ground-up replacement for a licensed retailer's production website, developed on a noindexed preview surface with no write path to production. The safety model is the engineering. Production DNS, the store page and the shared backend are protected surfaces, and any operation touching them needs explicit per-action approval rather than standing access. The Content Security Policy is narrow enough to be load-bearing: inline styles prohibited, scripts and fonts same-origin, form-action none, and the single inline script — inert structured data — admitted only by a build-derived SHA-256 hash. A validator recomputes that hash on every build and rejects a stale policy, so the protection cannot quietly rot into a comment while deploys keep succeeding. Analytics is consent-gated and host-pinned, so no request reaches Google before acceptance and neither localhost nor the preview can pollute production data.