diff --git a/docs/BUILD_CLI.md b/docs/BUILD_CLI.md
index 19234cf..6c90393 100644
--- a/docs/BUILD_CLI.md
+++ b/docs/BUILD_CLI.md
@@ -27,14 +27,14 @@ npx fastedge-build --version
 
 ## Options
 
-| Flag          | Alias | Type       | Description                      |
-| ------------- | ----- | ---------- | -------------------------------- |
-| `--input`     | `-i`  | `String`   | Input JavaScript/TypeScript file |
-| `--output`    | `-o`  | `String`   | Output WebAssembly file path     |
-| `--tsconfig`  | `-t`  | `String`   | Path to tsconfig.json            |
-| `--config`    | `-c`  | `String[]` | Path(s) to build config files    |
-| `--help`      | `-h`  | `Boolean`  | Show help                        |
-| `--version`   | `-v`  | `Boolean`  | Show version                     |
+| Flag         | Alias | Type       | Description                      |
+| ------------ | ----- | ---------- | -------------------------------- |
+| `--input`    | `-i`  | `String`   | Input JavaScript/TypeScript file |
+| `--output`   | `-o`  | `String`   | Output WebAssembly file path     |
+| `--tsconfig` | `-t`  | `String`   | Path to tsconfig.json            |
+| `--config`   | `-c`  | `String[]` | Path(s) to build config files    |
+| `--help`     | `-h`  | `Boolean`  | Show help                        |
+| `--version`  | `-v`  | `Boolean`  | Show version                     |
 
 ## Build Modes
 
@@ -123,12 +123,12 @@ export { config };
 
 ### BuildConfig Fields
 
-| Field          | Type                  | Required | Description                                        |
-| -------------- | --------------------- | -------- | -------------------------------------------------- |
-| `type`         | `'http' \| 'static'`  | No       | Build type; must be `http` or `static` if provided |
-| `entryPoint`   | `string`              | Yes      | Input JavaScript/TypeScript file                   |
-| `wasmOutput`   | `string`              | Yes      | Output WASM file path                              |
-| `tsConfigPath` | `string`              | No       | Path to tsconfig.json                              |
+| Field          | Type                 | Required | Description                                        |
+| -------------- | -------------------- | -------- | -------------------------------------------------- |
+| `type`         | `'http' \| 'static'` | No       | Build type; must be `http` or `static` if provided |
+| `entryPoint`   | `string`             | Yes      | Input JavaScript/TypeScript file                   |
+| `wasmOutput`   | `string`             | Yes      | Output WASM file path                              |
+| `tsConfigPath` | `string`             | No       | Path to tsconfig.json                              |
 
 ### Static-Only Fields
 
diff --git a/docs/SDK_API.md b/docs/SDK_API.md
index 2c82d65..bf96403 100644
--- a/docs/SDK_API.md
+++ b/docs/SDK_API.md
@@ -1068,9 +1068,10 @@ Available as `crypto.subtle`. Supported operations:
 
 | Operation                                      | Supported Algorithms                  |
 | ---------------------------------------------- | ------------------------------------- |
-| `digest()`                                     | SHA-1, SHA-256, SHA-384, SHA-512      |
+| `digest()`                                     | SHA-1, SHA-256, SHA-384, SHA-512, MD5 |
 | `sign()` / `verify()`                          | RSASSA-PKCS1-v1_5, ECDSA, HMAC        |
 | `importKey()`                                  | JWK, PKCS#8, SPKI, raw (HMAC)         |
+| `getRandomValues()`                            | ✓                                     |
 | `encrypt()` / `decrypt()`                      | **Not implemented**                   |
 | `generateKey()`, `deriveKey()`, `deriveBits()` | **Not implemented**                   |
 | `exportKey()`                                  | **Not implemented**                   |
diff --git a/docs/STATIC_SITES.md b/docs/STATIC_SITES.md
index 7a1e3ef..6110208 100644
--- a/docs/STATIC_SITES.md
+++ b/docs/STATIC_SITES.md
@@ -131,9 +131,9 @@ All fields are optional. Pass only the fields you need.
 | `extendedCache`   | `Array<string \| RegExp>` | `[]`    | Paths or patterns that receive a `Cache-Control: max-age=31536000` response header                        |
 | `compression`     | `string[]`                | `[]`    | Content encodings to serve (e.g. `['br', 'gzip']`); matched against the request `Accept-Encoding` header |
 | `notFoundPage`    | `string \| null`          | `null`  | Asset path to serve when no match is found (e.g. `'/404.html'`); only served for HTML-accepting requests  |
-| `autoExt`         | `string[]`                | `[]`    | Extensions to append when no exact path match is found (e.g. `['.html']`)                                |
-| `autoIndex`       | `string[]`                | `[]`    | Index file names to try for directory requests (e.g. `['index.html']`)                                   |
-| `spaEntrypoint`   | `string \| null`          | `null`  | Asset path served as the SPA fallback for unmatched routes; only served for HTML-accepting requests       |
+| `autoExt`         | `string[]`                | `[]`    | Extensions to append when no exact path match is found (e.g. `['.html']`)                                 |
+| `autoIndex`       | `string[]`                | `[]`    | Index file names to try for directory requests (e.g. `['index.html']`)                                    |
+| `spaEntrypoint`   | `string \| null`          | `null`  | Asset path served as the SPA fallback for unmatched routes; only served for HTML-accepting requests        |
 
 #### routePrefix
 
diff --git a/fastedge-plugin-source/generate-docs.sh b/fastedge-plugin-source/generate-docs.sh
index aa3cfae..6b5be7d 100755
--- a/fastedge-plugin-source/generate-docs.sh
+++ b/fastedge-plugin-source/generate-docs.sh
@@ -217,6 +217,11 @@ $existing_doc
 "
   fi
 
+  # Build prompt with sandwich output constraint:
+  # The OUTPUT CONSTRAINT appears at both the start and end of the prompt.
+  # This is critical for large prompts where the model may lose track of
+  # the instruction to output only raw markdown. Without it, the model
+  # sometimes produces conversational preamble or asks for permission.
   local prompt
   prompt="$(cat <<PROMPT
 OUTPUT CONSTRAINT: Your output is piped directly to a file. Output ONLY raw markdown. No conversational text. No preamble. No "here is" or "I'll generate". No "the existing content is accurate", "no changes needed", "outputting verbatim", or any similar acknowledgement — this applies equally when the existing content needs no changes. No questions. No explanation. No permission requests. Start your very first character with # (the level-1 heading). End with the last line of markdown.
@@ -244,7 +249,8 @@ PROMPT
   tmpfile=$(mktemp "$DOCS_DIR/.${target}.XXXXXX")
   # Note: we do NOT trap-rm the tmpfile on RETURN. Failed-validation output is
   # preserved under $DOCS_DIR/.failures/ for prompt-debugging (see below) —
-  # the success path mv's the tmpfile out, the interrupt path rm's it explicitly,
+  # the success path writes stripped content directly to docs/$target and deletes
+  # the tmpfile, the interrupt path rm's it explicitly,
   # and after max_attempts we explicitly rm the working tmpfile.
 
   # Failure-preservation directory. Accumulates across runs so you can compare
@@ -276,14 +282,22 @@ PROMPT
     # the doc. The original is still saved to .failures/ so the prompt can
     # be tuned later.
     local stripped
-    stripped=$(awk '/^#/ { found=1 } found' "$tmpfile")
-
-    if [ -n "$stripped" ]; then
-      # Detect preamble: anything before the first line starting with '#' is preamble.
-      # Matches the prompt's constraint ("first character is #") rather than requiring
-      # '# ' (hash + space), so a model that emits '#Title' still salvages.
+    # Fence-aware level-1-only salvage: track ``` fences so that #-prefixed
+    # lines inside a fence (shell comments, #include, etc.) don't trigger the
+    # heading-detection scan. Fence delimiter lines are NOT skipped — they fall
+    # through to `found { print }` so fenced code blocks are preserved intact
+    # in the output. Only a bare `# ` heading outside a fence sets found=1.
+    stripped=$(awk '/^```/ { in_fence = !in_fence } !in_fence && /^# / { found=1 } found' "$tmpfile")
+
+    # Post-strip validation: confirm the salvaged output actually starts with a
+    # level-1 heading (# followed by a space). Belt-and-suspenders against any
+    # remaining edge case; reject and retry rather than silently writing junk.
+    local first_nonempty
+    first_nonempty=$(printf '%s\n' "$stripped" | grep -m1 '.')
+    if [ -n "$stripped" ] && [[ "$first_nonempty" =~ ^"# " ]]; then
+      # Detect preamble: anything before the first level-1 heading is preamble.
       local first_heading_line
-      first_heading_line=$(grep -n -m1 '^#' "$tmpfile" | cut -d: -f1)
+      first_heading_line=$(grep -n -m1 '^# ' "$tmpfile" | cut -d: -f1)
       if [ "${first_heading_line:-1}" -gt 1 ]; then
         local preamble_copy="$failure_dir/${target}.preamble.attempt-${attempt}.$(date +%s).md"
         cp "$tmpfile" "$preamble_copy"
@@ -295,10 +309,10 @@ PROMPT
       return 0
     fi
 
-    # No level-1 heading anywhere — genuine failure. Save and retry.
+    # No valid level-1 heading found — genuine failure. Save and retry.
     local failed_copy="$failure_dir/${target}.attempt-${attempt}.$(date +%s).md"
     cp "$tmpfile" "$failed_copy"
-    echo "  Attempt $attempt/$max_attempts failed for $target (no '# ' heading found in output) — saved to $failed_copy, retrying..."
+    echo "  Attempt $attempt/$max_attempts failed for $target (no level-1 heading found in output) — saved to $failed_copy, retrying..."
     attempt=$((attempt + 1))
   done