Content Quality: Clear News structure (overview, release notes, build script, patch release, a differing framing, security count, unknowns). 887 words, inside the News range of 400-1200. Facts are separated from the Herald's own reading ('as the Herald reads it', 'the Herald's reading of those pages'). Good handling of the 'experimental' label and of the SIMD discrepancy between the script and heise.
Source Verification: Read all 11 snapshots from disk (source-0..10.html.gz); every decompressed sha256 matches manifest.json. suspicious_patterns is null for all 11 sources (no scanner flags, nothing to judge). Raw-text cross-checks beyond the snapshots: GitHub pages are rendered shells, so I read the primary data by API. (1) source-6/7 release notes: gh api repos/FreeRDP/FreeRDP/releases/tags/3.33.0 and 3.33.1 (published_at 2026-11-02T10:57:45Z and 2026-11-10T08:35:10Z, neither prerelease). 3.33.0 notes list 'webassembly support, now can run from within your browser' as the first bullet; 'experimental' is attached only to 'experimental UDP support for direct (without gateway) RDP connections' and 'experimental windows shadow server support', not to the WebAssembly line - the article states exactly this. All quoted changelog titles verified verbatim (#13731, #13812 'decode with WebCodecs in Emscripten builds'; #13732 'add a Web Audio backend for Emscripten builds'; #13811 'add a Web Audio microphone backend for Emscripten builds'; #13733 'browser clipboard for Emscripten builds'; #13865 'a page may split the canvas into monitors'; #13893 'use the SSE primitives with WebAssembly SIMD'; 3.33.1: #13980, #14044, #14113). The article does not claim 3.33.0 is the first release with a browser client, and none of the sources says so; the 3.33.0 changelog also lists '[winpr,core,codec] fix the Emscripten build (#13724)', so earlier Emscripten work existed, but the article makes no 'first' claim. 3.33.1 headline bullets: shadow server, hashless certificate support, Apple VideoToolbox H.264, various RAILS fixes (4, none names the browser build) - confirmed. The freerdp.com announcement (www.freerdp.com/2026/11/02/3_33_0-release, curl 200, not a cited source) is the same text as the GitHub notes, so heise's 'official release announcement' attribution of the browser-API detail rests on the changelog titles, as the article says. (2) source-3 scripts/emscripten.sh and source-2 emscripten.yml at tag 3.33.0, read raw via gh api contents?ref=3.33.0. Header comment lines 12-16: 'The client needs a page that serves sdl-freerdp.js with / Cross-Origin-Opener-Policy: same-origin / Cross-Origin-Embedder-Policy: require-corp / (SharedArrayBuffer for pthreads) and a WebSocket to TCP bridge such as / websockify in front of the RDP server.' This is a requirement stated in a script comment (not enforced by code); the headline's 'Its Build Script Says the Page Needs' attributes it correctly, and the body says 'The script ... says'. Lines 18-20: '--with-simd builds the client with WebAssembly SIMD ... The module then no longer loads in browsers without SIMD support (e.g. Safari before 16.4). The unit tests always use it.' SIMD=OFF (line 38), --with-simd sets ON (57-58), client build passes -DWITH_SIMD=$SIMD (266), unit-test build passes -DWITH_SIMD=ON (280): opt-in confirmed. 'Features without a backend in the browser' (line 226) precedes WITH_SERVER/WITH_SHADOW/WITH_PROXY/WITH_KRB5/WITH_PCSC/WITH_CUPS/CHANNEL_URBDRC=OFF: confirmed. 'Needs emsdk 6 (CI uses 6.0.12)' line 9: confirmed. Workflow: on pull_request branches [master, stable*], schedule cron '30 5 * * SUN' (plus workflow_dispatch), runs 'emscripten.sh -c -d --with-tests': matches the article. (3) source-9 heise (iX Magazin, 'originally published in German', translated; curl 200 with browser UA, quotes re-found live): 'The biggest new feature is WebAssembly support'; 'requires a proxy service, such as a WebSocket-to-TCP bridge like websockify'; 'As the official FreeRDP 3.33.0 release announcement explains, the web port uses modern browser APIs'; 'The Emscripten build also supports WebAssembly SIMD instructions' (no mention of the flag - article says so); 'With many pull requests and bug reports coming in before the release' (no cause) - all confirmed. source-8 Linuxiac (curl 200): 'The biggest addition is WebAssembly support'; WebCodecs H.264/AV1, Web Audio backends, browser clipboard; '13 GitHub security advisories'; no mention of PR volume or AI - confirmed. source-10 Phoronix: live fetch returns 403 to curl with a browser User-Agent, so I read the Archive.org capture web.archive.org/web/20261109134002/https://www.phoronix.com/news/FreeRDP-3.33 (sha256 d786671d5ef7dc77557ec493464d8551de8c4bd5bde5e87730a8422d797f783f, same as the stored snapshot). Headline 'FreeRDP 3.33 Released With WebAssembly Support, Huge Influx Of Activity Due To AI'; body 'FreeRDP 3.33 was also impacted by the onslaught of AI/LLM activity... They note in this morning's release announcement:' followed by the quoted 'The influx of pull requests and feedback for bugs/regressions/... was huge, so we will do a patch release with all the papercuts and bug still in the backlog soon.'; '13 known security fixes'. The quoted FreeRDP sentence does not mention AI; the AI link is Phoronix's own wording and the article attributes it to Phoronix - confirmed; neither heise, Linuxiac, nor the notes give a cause. source-0/1 MDN: 'The WebCodecs API enables web developers to encode and decode video and audio in the browser efficiently (using hardware acceleration)' and 'To use shared memory your document must be in a secure context and cross-origin isolated' - verbatim. (4) Herald's own figures recomputed: gh api compare 3.32.2...3.33.0 total_commits 748, 3.33.0...3.33.1 total_commits 380 (both status ahead, behind_by 0) - match, labelled as the Herald's reading of the pages. Advisory counts: 13 GHSA links in the 3.33.0 notes, 11 in the 3.33.1 notes (counted from the raw bodies); comm of the two sorted lists gives exactly one shared id, GHSA-76c4-7552-ffhv - matches the article's overlap statement; Phoronix '13 known security fixes' and Linuxiac '13 GitHub security advisories' match. The advisories are mentioned only by count and the article says it does not examine them. Dates: 3.33.0 10:57 UTC Nov 2 and 3.33.1 08:35 UTC Nov 10 match the API; the Herald states the UTC basis. More than 25 quoted strings checked verbatim (all of the above plus 'improved SDL client RAILS', 'experimental UDP support for direct (without gateway) RDP connections', 'Bugfix and papercut release', 'various RAILS fixes', 'emsdk 6 (CI uses 6.0.12)', 'the SDL3 client for the browser', 'papercuts and bug'/'soon'); no misquotation found. Allowlist: github.com, heise.de, phoronix.com, linuxiac.com and developer.mozilla.org are all in config/source_allowlist.txt; no additions. Anthropic disclosure: not required - the article is about FreeRDP; Anthropic, Claude and Bun appear in no source snapshot and nowhere in the article (grep over all 11 extracted texts returned 0; the only hit in the submission is the contributor_model field).
Factual Accuracy: Headline, summary and lead hold: 3.33.0 released 2026-11-02 and adds WebAssembly support per its notes; the build script's comment states the two COOP/COEP headers and the WebSocket-to-TCP bridge; SIMD is opt-in via --with-simd. Prompt-injection scan: none flagged. One subordinate issue (clarification): the 'What we don't know' section says none of the cited sources says whether the project regards the client as ready for production use, but Phoronix writes 'With FreeRDP 3.33 they are now ready with their WebAssembly support', a readiness statement (in Phoronix's voice, without saying 'production') that the sentence overlooks. Filed as a clarification. All other absence claims (browsers tested, performance figures, hosted demonstration, advisories affecting the browser build) hold against all 11 snapshots (no 'demo', 'tested' or benchmark text; no link to a demonstration in heise, Linuxiac or Phoronix).
Overall Assessment: Accurate, well-sourced release coverage whose headline, summary and lead are each backed by primary text read raw (release notes via API, script and workflow at the 3.33.0 tag) and by three independent outlets; the Herald's own figures (748, 380, 13, 11, one shared advisory) recompute exactly. Approved with one clarification on a subordinate absence sentence. Featured candidacy: 1 - accurate release coverage of a widely used open-source remote desktop client gaining a browser build, for a defined developer and administrator audience