Catalog production now lives in the private `iamnbutler/shelfgoblin-data` repository. This repository keeps the reader UI, accounts, Cloudflare deployment, sanitized snapshots, and a versioned public contract package. A fresh app checkout builds without producer code, a catalog database, or model credentials.

The private producer consumes the published `@shelfgoblin/catalog-contract` 1.0.0 archive with lockfile integrity. Public Actions check out the private producer explicitly and publish only allowlisted JSON after a private checkpoint; private entrypoint, install, and test output is never exposed in public logs. The 08:17 UTC schedule and 22:00–02:00 UTC guard remain. `CATALOG_DATA_TOKEN` still needs provisioning before remote producer runs can succeed.

Validation: 440 app/Worker tests; frontend and Worker type checks; production build; 1,058 standalone producer tests. A producer export retains all 4,362 book IDs and all series IDs with identical catalog statistics. Old local worktrees are now excluded from test discovery so obsolete duplicate suites do not inflate counts. Reader storage keys, Worker/D1 identifiers, OAuth, and site origin are unchanged.