PASS: regional sitemap index, single URL, empty sitemap, query string, HTTPS off, XML escaping, audited snapshot after regeneration, shared set domain substitution, membership/main isolation