Prove a frame property over every page the build produced, not one [#73]

[iderex]

What was wrong

The affiliation notice is in the frame so that no page can ship without it, and
the row over it is proved by a fixture page with the sentence taken out:

sed -n '92,94p' internal/invariant/invariant_test.go
		"page-carries-the-affiliation-notice": []byte(strings.Replace(cleanPage,
			"Flowfin is not affiliated with the Jellyfin project.", "", 1)),

Run 2026-08-12 at 5f797cb. That proves the sentence being edited out of a
page. It does not prove the frame being bypassed, which fails somewhere else: a
page that renders its own head leaves the row green on every page still going
through the frame, and the count is the only thing that would say so.

The run that would say so needed more than one produced page, and the fixture
tree wrote one. Removing the notice from the fixture template refused
dist/index.html and nothing else, so a run over that tree could not tell a
property of the frame from a property of that page.

What this does

The fixture tree writes a second source, so the frame renders two pages. That is
also the statement that adding a page needs no new frame: the second source is
prose and nothing else, and it brings no template.

Two runs are asserted over it. The notice removed from the frame refuses both
produced pages and names each. A tree that breaks nothing decides the head rows
over two pages rather than one.

The name behind the second page's one checked statement is read out of the rule
table rather than typed, because a page citing a check nothing answers to is
refused by another row, and a fixture holding the name as a literal would red
this whole suite the day a row is renamed.

Closes

Closes nothing. This is one of the three conditions left on #73 and the issue
stays open. The other two are the link that jumps a keyboard reader to the
content, which the issue asks to be shown by the headless run and so waits on
#63, and the footer links resolving from a page at every depth, which includes
the not-found page and so waits on #30.

What was run

At ff45a67.

go run . ci
gate: 6 legs, in order: format, vet, test, build, links, invariants
  needs-network was not asked for. Asking costs a request to the public name from whatever machine runs it, and a verdict that moves when somebody else's service does rather than when this tree changes. Ask with: go run ./harness/needs-network
  format: ok, 37 file(s)
  vet: ok
  test: ok, 18 test file(s)
  build: ok, 3 file(s)
  links: every reference that stays inside this site resolves to a file the build wrote
  invariants: ok, 25 rule(s) decided, 1 owed and not decided
6 of 6 legs ran. None was skipped.

The three tests over the frame:

go test ./internal/invariant -run 'TestRunRefusesAFrameThatDroppedTheAffiliationNoticeOnEveryPageItProduced|TestRunRefusesATemplateThatDroppedTheSchemeOnEveryPageItProduced|TestASecondPageIsRenderedThroughTheSameFrame' -count=1 -v
--- PASS: TestRunRefusesATemplateThatDroppedTheSchemeOnEveryPageItProduced (0.15s)
--- PASS: TestRunRefusesAFrameThatDroppedTheAffiliationNoticeOnEveryPageItProduced (0.12s)
--- PASS: TestASecondPageIsRenderedThroughTheSameFrame (0.12s)
ok  	github.com/Flowfin/site/internal/invariant	0.935s

What proves the new assertion is worth its bytes: the fixture pointed back at a
name the build does not read, so it produces one page again, and the test reds on
exactly the clause that makes it about the frame rather than about a page.

sed -i 's|\twr(filepath.FromSlash(site.PrivacyFile),|\twr(filepath.FromSlash("content/not-read.txt"),|' internal/invariant/invariant_test.go
go test ./internal/invariant -run 'TestRunRefusesAFrameThatDroppedTheAffiliationNoticeOnEveryPageItProduced' -count=1
--- FAIL: TestRunRefusesAFrameThatDroppedTheAffiliationNoticeOnEveryPageItProduced (0.20s)
    invariant_test.go:624: the run does not say "page-carries-the-affiliation-notice: REFUSED, 2 violation(s)"; it said:
    invariant_test.go:624: the run does not say "dist/privacy/index.html: this page carries no affiliation notice"; it said:
FAIL

and with the fixture put back, which is the state of this branch:

go test ./internal/invariant -count=1
ok  	github.com/Flowfin/site/internal/invariant	2.192s

No test was skipped, and nothing here opens a window, needs a display, binds a
socket or asks for elevation.

Paths this branch touches:

git diff --name-only origin/main...HEAD
internal/invariant/invariant_test.go

A correction

The run test that landed with the colour scheme row in #152 was named for every
produced page and asserted one, because the fixture produced one. It now asserts
both. The claim in that body was made against the real output, where both
produced pages were refused and the run printed each, so what was wrong was the
test rather than the claim. It was found while writing the assertion this branch
is about, against the same fixture.

The means

Two assertions in the Go suite that already decides these rows, and a second
prose source in the fixture tree. It fits because the property is about what a
run prints over what a build wrote, which is bytes the suite already reads, and
because the discriminating case above shows the assertion can fail rather than
being carried by the tree happening to be correct. It adds no language, no
runtime and no dependency, and the module graph still requires nothing.

Who read it

Nobody else. This carries no second reader, and the evidence above stands in
place of one.