Lesson 222: Construct Custom-Domain CORP COEP Fest Receipt for HTML5 (2026)

Direct answer: Before October fest links promote a custom itch domain, file corp_coep_fest_receipt_v1.json with a pinned three-origin map, CO1–CO6 gates, and either header proof on wasm/worker URLs or an explicit split_hosting_defer_path on BUILD_RECEIPT—after Lesson 208 hosting decision and Construct CORP/COEP preflight (P-gates).

Why this matters now (October 2026 fest HTML5 traffic)

October 2026 marketing ships play.yourstudio.com in the fest capsule while Construct data.wasm still loads from itch CDN. DevTools shows COEP isolated or CORP blocked—not broken event sheets. Lesson 208 records which host is production; guide P1–P6 is the ninety-second header pass—this lesson is the H2 BUILD_RECEIPT milestone with corp_coep_fest_receipt_v1.json before public fest visibility (pairs help #6 CORS custom domain, planned guide #3 fest worker smoke).

Non-repetition: 208 = hosting decision; guide P-chapter = preflight curl; 222 = fest promotion gate wiring child receipts on one BUILD_RECEIPT row.

Beginner path (fest header pass)

Time: ~30 min split path; ~70 min with custom-domain COEP experiment.

Developer path (gates CO1–CO6)

three_origin_map_v1.json (fest pin)

{
  "schema": "three_origin_map_v1",
  "build_label": "fest-demo-2026-10-05-rc2",
  "page_origin": "https://play.brand.com",
  "wasm_origin": "https://cdn.itch.io",
  "worker_origin": "https://cdn.itch.io",
  "play_url_canonical": "https://studio.itch.io/fest-demo",
  "same_origin_for_game_assets": false,
  "header_lane": "split_defer_wasm"
}

Split-hosting defer path (recommended)

Set custom_domain_serves_wasm: false and split_hosting_defer_path: true—CO4/CO5 pass via documentation, not impossible CDN header edits.

corp_coep_fest_receipt_v1.json

{
  "schema": "corp_coep_fest_receipt_v1",
  "build_label": "fest-demo-2026-10-05-rc2",
  "three_origin_map": "release-evidence/html5/THREE_ORIGIN_MAP.json",
  "paired_receipts": {
    "cors_smoke": "release-evidence/html5/cors-smoke/CORS_SMOKE_RECEIPT.json",
    "cors_hosting_decision": "release-evidence/html5/CORS_HOSTING_DECISION_RECEIPT.json",
    "corp_coep_header_preflight": "release-evidence/html5/CORP_COEP_HEADER_RECEIPT.json",
    "corp_coep_fest_smoke": "release-evidence/html5/CORP_COEP_FEST_SMOKE_RECEIPT.json"
  },
  "header_lane": "split_defer_wasm",
  "custom_domain_serves_wasm": false,
  "play_url_canonical": "https://studio.itch.io/fest-demo",
  "corp_probe": {
    "wasm_url": "https://cdn.itch.io/.../data.wasm",
    "worker_url": "https://cdn.itch.io/.../workermain.js",
    "corp_present": false,
    "notes": "itch CDN — split pattern; wasm not loaded from page origin"
  },
  "coep_coop_page_host": {
    "coep": "not_applicable_split",
    "coop": "not_applicable_split",
    "devtools_cors_clean_on_play_url": true
  },
  "gates": {
    "CO1_cors_smoke": "pass",
    "CO2_hosting_decision": "pass",
    "CO3_three_origin_map": "pass",
    "CO4_corp_or_defer": "pass",
    "CO5_coep_or_defer": "pass",
    "CO6_fest_receipt": "pass"
  },
  "fest_promotion_allowed": true
}

Pin under release-evidence/html5/CORP_COEP_FEST_RECEIPT.json. BUILD_RECEIPT columns: corp_coep_fest, html5_play_url, split_hosting_defer_path.

curl CORP snapshot (CO4)

curl -sI "WASM_URL" | grep -i cross-origin-resource-policy
curl -sI "WORKER_URL" | grep -i cross-origin-resource-policy

Archive output in corp_probe—even no header is valid evidence when header_lane is split.

Proof table (fest promotion)

Key takeaways

1. Three origins—page, wasm, worker—never hand-wave “itch handles it.”
2. 208 + smoke are prerequisites—CO1–CO2 fail without them.
3. Split defer is a valid fest lane when CDN headers are not indie-configurable.
4. play_url_canonical must match facilitator pins—not the press landing only.
5. Guide P-gates are preflight; 222 is BUILD_RECEIPT promotion authority.
6. Help #6 fixes broken fetches—this lesson prevents promoting broken layouts.
7. Do not overwrite cors_smoke_receipt—child linkage only.
8. Phaser itch_public amendments stay separate (Lesson 221).
9. Fest worker smoke preflight adds curl + DevTools proof—file corp_coep_fest_smoke_receipt_v1.json before CO6.
10. H2 capstone 223 will require corp_coep_fest GREEN or documented defer.
11. Q3 playtest wave: after shell GREEN, run playtest analytics event schema no-PII preflight before Lesson 241.

Common mistakes

• Fest Play on custom domain while wasm only tested on subdomain.
• Filing 222 without Lesson 208 chosen_production_host.
• Treating missing CORP on itch CDN as “bug we can fix in Construct export.”
• Deleting subdomain smoke after custom domain goes live.

Troubleshooting

Mini exercise (60 minutes)

1. Verify Lesson 208 receipt on branch.
2. Author three_origin_map_v1.json with real DevTools URLs.
3. Run CORP curl; choose split defer.
4. File corp_coep_fest_receipt_v1.json.
5. Update BUILD_RECEIPT; run Thursday review.

Continuity — H2 2026 arc (218–223)

Previous: Lesson 221 — facilitator amendment
Next: Lesson 223 — H2 fest hardening capstone.

FAQ

Same as Lesson 208?
208 chooses hosting; 222 proves fest-ready headers or defer on BUILD_RECEIPT.

Same as guide P-chapter?
Guide is ninety-second preflight; 222 is course milestone with paired child receipts.

Can we skip split and force custom wasm?
Only if CO4–CO5 pass with archived curl—default indie path is split.

October only?
Hook is October 2026 fest HTML5; use whenever custom itch domains promote before playtests.

Fest traffic on a custom domain without corp_coep_fest_receipt_v1.json is marketing speed—not a shippable HTML5 proof.