Re-take the bundle document against what the build writes now

[iderex]

What was wrong

docs/serving-the-bundle.md is the document an operator follows to serve this
site, and six of the outputs pasted into it on 2026-08-16 no longer reproduce.
The one that costs the most is the archive listing: it names seven files, and
the build writes twenty-two.

git show origin/main:docs/serving-the-bundle.md | sed -n '/tar -tzf site-bundle.tar.gz/,/SHA256SUMS/p' | grep -c '^    dist/.*\.'
5
go run . build > /dev/null && find dist -type f | wc -l
22

Run 2026-08-28 against 2a1e214. So somebody checking their unpacked bundle
against that list finds fifteen files it does not mention - the install page,
the design system page, the icon and twelve plugin pages - and has no way to
tell a wrong download from a stale document.

The other five, each with what it said and what it says now:

go run . invariants | grep -E '^  (page-fetches-no-script|output-references-no-domain-outside-the-allowlist):'
  page-fetches-no-script: ok, 18 file(s) of every page the build produced
  output-references-no-domain-outside-the-allowlist: ok, 22 file(s) of every file the build produced

the document had 4 and 7.

go run . reproduce
reproduce: two builds of ., compared byte for byte
  22 file(s), identical in both builds

the document had 7.

sha256sum pack-1.tar.gz pack-2.tar.gz
c0c27bcd42ef373f774f0d907bd4a1787c192624ac5ead66dc770efba831442b *pack-1.tar.gz
c0c27bcd42ef373f774f0d907bd4a1787c192624ac5ead66dc770efba831442b *pack-2.tar.gz

the document had 9bc535d9... twice.

grep -o -E '(href|src)="[^"]*"' dist/404.html | wc -l
6
grep -c -o 'https://flowfin.dev' dist/sitemap.xml
17

the document had five references on the not-found page and three sitemap
entries. All run 2026-08-28.

What this does

Re-takes every one of the six, and stops two of them from drifting again.

The archive listing and the address listing were enumerations, and an
enumeration of one entry per page goes stale on the day the next page lands
while nothing turns red. Both are replaced by the command and a count, which is
the repair docs/threat-model.md already took for a hand count: the reader is
handed the command instead of the answer. The remaining four are numbers rather
than lists, so they are re-taken and carry the date they were taken on.

Three pastes in the same document still reproduce and are left untouched, so
this diff is the defect and not a sweep: the bill of materials excerpt, the
not-found file location, and the empty release listing were each re-run today
and are unmoved.

The last section now says plainly that nothing in this tree holds this document
to the output it describes. That is what let the six go stale, and a reader who
does not know it reads the figures as something a run keeps honest.

Closes

Nothing. #54 stays open: two of its three done-when clauses start from a
published archive and there is no release, which is #53. The clause this
document does meet is the one asking that it document the not-found mapping and
the verification steps, and this change is a repair to the document behind that
clause rather than movement on the other two.

gh release list --repo Flowfin/site --limit 5
gh issue view 53 --repo Flowfin/site --json state,title --jq '"\(.state) \(.title)"'
OPEN The version scheme and the release workflow

Both run 2026-08-28. The release listing returns nothing.

What was run

go run . ci
gate: 7 legs, in order: format, vet, test, build, links, sitemap, invariants
  needs-network was not asked for. Asking costs a request to the public name from whatever machine runs it, and a verdict that moves when somebody else's service does rather than when this tree changes. Ask with: go run ./harness/needs-network
  format: ok, 74 file(s)
  vet: ok
  test: ok, 37 test file(s)
  build: ok, 22 file(s)
  links: every reference that stays inside this site resolves to a file the build wrote
  sitemap: every page the build wrote is listed once, and every entry has a page behind it
  invariants: ok, 39 rule(s) decided, 1 owed and not decided
7 of 7 legs ran. None was skipped.

needs-network was not asked for and no result is claimed for it. The one rule
the invariants leg reports as owed and not decided is
image-dimensions-match-the-file, which is #85 and is unrelated to this change.

go run . hygiene -origin=internal 2a1e214da732 444c77c1f231
hygiene: 1 non-merge commit(s) in 2a1e214da732..444c77c1f231, origin internal
  444c77c1f231: subject carries its reference
1 commit(s) judged, none refused.

npx --yes prettier@3.9.6 --check --end-of-line auto docs/serving-the-bundle.md
Checking formatting...
All matched files use Prettier code style!

git diff --name-only origin/main...HEAD
docs/serving-the-bundle.md

All run 2026-08-28. No test was skipped, and nothing here needed a display or
an elevation.

The means

Markdown prose in docs/, which is what this document already is and what the
five files beside it are. It adds no language, no runtime and no dependency,
and the formatter that judges it is the one already pinned in pins.json.

The three rules cut against this means honestly and it is worth saying so. A
document carries no refusable property: nothing in this tree compares these
figures against the output, which is why they went stale and why the change
says so in the document rather than claiming a guard. What the means does carry
is the third rule - every figure above is beside the command that produced it,
run at the tree being pushed - and that is the whole of what stands behind this
file. A means that could refuse the drift would be a leg comparing the document
against a build, and that is a check to argue for on its own rather than
something to bury in a repair.

This replaces #212, which carried the same bytes without a sign-off

The first branch for this change was pushed without a Signed-off-by: trailer,
and the DCO check reds every non-merge commit that carries none:

gh api repos/Flowfin/site/commits/96e9319dde6b54ad0e6c6dcafbcb700a356b85b2/check-runs       --jq '.check_runs[] | select(.name=="DCO sign-off") | {name,conclusion}'
{"conclusion":"failure","name":"DCO sign-off"}

Run 2026-08-28. A trailer cannot be added to a commit that is already pushed
without rewriting it, so the correction is pushed under a new name and the old
branch is abandoned rather than force-pushed. The content is the same bytes,
which is not asserted but compared:

git show 96e9319 | git patch-id --stable
d604409ffac8664c5419bf0f353d5088c21d8827 96e9319dde6b54ad0e6c6dcafbcb700a356b85b2
git show 444c77c | git patch-id --stable
d604409ffac8664c5419bf0f353d5088c21d8827 444c77c1f2317ad7e3d0b0f595371d2e8dd008ef

Both run 2026-08-28. #212 is closed with the reason in its body.

Who read it

Nobody but me. This board has no second reader tonight, the ruleset requires no
approving review, and this pull request is merged by whoever opened it. The
evidence above stands in place of one.