diff --git a/AGENTS.md b/AGENTS.md
index fd8bf5bc..b8ed1423 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -263,7 +263,7 @@ filing, and before pushing docs run the audit:
 grep -rohE 'improvise-[a-z0-9]{3,8}\b' \
      context README.md AGENTS.md CLAUDE.md crates src tests examples web harness docs \
   | sort -u \
-  | grep -vE '^improvise-(core|formula|io|protocol|command|gp|ws|worker|wasm|harness|registry|side)$' \
+  | grep -vE '^improvise-(core|formula|io|protocol|command|gp|ws|worker|wasm|harness|registry|side|web)$' \
   > /tmp/bd-audit-ids.txt
 bd show $(cat /tmp/bd-audit-ids.txt) 2>&1 \
   | grep -iE 'not found|no such issue' || echo "all resolve"
@@ -291,6 +291,14 @@ real defect through:
   exclusion list is a filter, and a filter that over-matches fails in the
   direction that looks like success. (Anchoring it is also what caught the
   example id this very paragraph originally spelled out — see the note below.)
+- **A release artifact's name is ID-shaped, and `improvise-installer.sh`
+  escaped only by being ten characters long.** `improvise-web.tar.gz`
+  (improvise-oujb) is three, so it matches `{3,8}` and resolves to nothing;
+  `web` is therefore excluded above. The general point is that the length
+  bound, not any rule, is what has been keeping `dist`'s artifact names out of
+  this audit — so **a new artifact whose name is a short lowercase word must be
+  added to the exclusion list in the same commit**, or it arrives as a dead id
+  that no amount of `bd` archaeology explains.
 
 Note the recipe's own prose deliberately spells no live or dead id: a document
 that lists ids as examples makes itself a source of audit noise.
diff --git a/RELEASING.md b/RELEASING.md
index f96814c3..68998d08 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -48,7 +48,19 @@ moved. Every step below exists to put that check before the irreversible one.
 
 5. **Watch the run.** A green release takes about three minutes and publishes
    tarballs for all four targets with their `.sha256` files, `sha256.sum`,
-   `dist-manifest.json`, `source.tar.gz` and `improvise-installer.sh`.
+   `dist-manifest.json`, `source.tar.gz`, `improvise-installer.sh` and
+   `improvise-web.tar.gz` — the assembled landing page and browser app, stamped
+   with the tag, which the page then shows in its header (improvise-oujb).
+
+   **`improvise-web.tar.gz` is a self-hostable copy and a rollback target, not
+   what the published site is serving.** GitHub Pages tracks `main` and a tag
+   does not deploy it, so the site and the release are deliberately different
+   code. Two things follow when the web half goes wrong. `release.yml` is
+   autogenerated, so never hand-edit it: change `dist-workspace.toml` and re-run
+   `dist generate`, which should leave the workflow byte-identical. And a
+   **pull-request** run of the Release workflow skips `build-global-artifacts`,
+   so a green PR says nothing about the web capture — to exercise it without
+   cutting a tag, run `dist build --artifacts=global` locally.
 
    The failure signature is unmistakable once you know it: **`plan` fails in
    about twenty seconds and the four jobs behind it skip.** That is the tag not
diff --git a/web/index.html b/web/index.html
index 2461a7d7..5ed8239a 100644
--- a/web/index.html
+++ b/web/index.html
@@ -34,17 +34,18 @@
     -->
     <header>
       <h1>improvise</h1>
+      <!--
+        What this page IS: web/assemble.sh rewrites the text below to the tag
+        or commit it assembled from (improvise-oujb). It sits with the name
+        because the bar's order starts at "what this is", and a tree served
+        straight out of web/ was never assembled and honestly says so.
+      -->
+      <span title="Build this page was assembled from" id="build-version">unstamped</span>
       <span id="doc-name"></span>
       <span id="view-name"></span>
       <span id="mode"></span>
       <span id="hint"></span>
       <span id="status" role="status"></span>
-      <!--
-        What this page IS: web/assemble.sh rewrites the text below to the tag
-        or commit it assembled from (improvise-oujb). A page served straight
-        out of web/ was never assembled and honestly says so.
-      -->
-      <span title="Build this page was assembled from" id="build-version">unstamped</span>
     </header>
 
     <!--
diff --git a/web/style.css b/web/style.css
index ce0e8b9d..e6aab1c5 100644
--- a/web/style.css
+++ b/web/style.css
@@ -87,6 +87,20 @@ header h1 {
   flex: none;
 }
 
+/* Which build this is (improvise-oujb). Quietest thing on the bar -- it is
+   reference, never state -- but it must stay legible enough to quote. */
+#build-version {
+  flex: none;
+  /* A tag fits whole; a 40-char commit SHA truncates to a prefix long enough
+     to name a build, and selecting the text still copies the whole thing. */
+  max-width: 14ch;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  color: var(--dim);
+  font-size: 0.72rem;
+}
+
 #doc-name {
   flex: none;
   /* Wide enough for the shipped document's whole title, `name (stored_as)`,