Declare the licence by parts, because the boundary runs inside two files (#1)

[iderex]

Scope: decisions/, README.md, CONTRIBUTING.md

This lands the answer given in entry 1 of #1 on 2026-08-24. That answer has two
halves: the code carries AGPL-3.0-or-later, and the CC-BY-4.0 split for the
design system and the page prose is implemented as one declaration by parts
rather than a header in each file, because the boundary does not run between
files. It also asks that README and CONTRIBUTING drop their entry-1-is-open
pointers.

What is here

decisions/licensing.md is the declaration. It names, part by part, which bytes
are under which licence, what a reader who copies a whole file takes, what the
tree does not carry, and what the entry still does not settle.

The reason a table of paths cannot carry this is measurable, and the declaration
carries the measurement. Both served pages hold the page's own stylesheet, its
markup and its script in the same bytes as the words a reader reads. At 2a8f88a:

grep -n '<style>\|</style>\|<script>\|</script>' docs/index.html docs/design-system.html
docs/index.html:5:<style>
docs/index.html:22:</style>
docs/design-system.html:4:<style>
docs/design-system.html:149:</style>
docs/design-system.html:411:<script>
docs/design-system.html:447:</script>

Run 2026-08-25. So a row saying docs/ is under one licence is wrong about part
of every file it names, which is what the README table said until this change.

The three pointers the answer asked for are gone, and the search that found them
comes back empty on this branch at 195faa5:

git grep -n 'entry 1 of #1' -- README.md CONTRIBUTING.md ; echo "exit=$?"
exit=1

Before the change the same command returned three lines: README.md:219,
CONTRIBUTING.md:189 and CONTRIBUTING.md:255.

What I did not do, said as what it is

The CC-BY-4.0 text is not in this tree. Only one licence text is carried:

git ls-files | grep -i -E '^(LICENSE|COPYING|LICENSES)'
LICENSE

Run 2026-08-25 at 195faa5. The declaration states that in its own words rather
than glossing it, and #140 is where the gap is held. Reproducing a third party's
legal text from recollection is how a licence file ends up subtly wrong, so it
belongs in a change whose whole subject is a verbatim fetch.

The repository detector still reports one licence for a tree that now grants
under two, and nothing on the platform side can be made to state both:

gh api repos/Flowfin/hub --jq '.license.spdx_id'
AGPL-3.0

Run 2026-08-25. That is why the declaration is a file in the tree and not a
setting.

The means

Markdown in decisions/, which is the form every other answer out of #1 already
took, and the same two root documents the answer named. Nothing here is a
program, so the means adds no language, no runtime and no dependency, and it is
testable by the suites that already exist: site-links-resolve reads the links
this change adds and format and editorconfig read its bytes.

The gate

go run . gate

green at 195faa5, 14 of 14 legs examined and passed: build, test, format,
editorconfig, tests-reach-nothing, no-hardcoded-names, site-fetches-nothing-outside,
site-links-resolve, coverage, site-declares-its-language, install-address-is-answered,
colour-stands-off-every-surface, page-matches-the-token-file, pr-hygiene.

The harness did not run and none of its three requirements was asked for:
needs-network, needs-browser, needs-jellyfin. No leg above depends on any of
them, which the run's own last lines say, so this verdict is complete for what
the gate covers and is evidence of nothing the harness would have measured.

Guards

This change adds none. Every sentence it lands is prose, the declaration says so
in its own "What refuses a departure" section, and no leg of this gate has a
licence as its subject.

The reader

There is no second reader on this board tonight. The evidence above stands in
place of one: every claim in this body carries the command that produced it, and
each of those commands is re-runnable at 195faa5 by anybody who opens it.

This replaces an earlier request, and why it is a new branch

The first attempt at this landing is #141. Its commit carried a good signature
and no DCO sign-off, so the DCO sign-off check refused it:

FAIL  6ff711c751e72d3cab6ed9922469790b54a5cfd8 is missing: Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>

Read from that run's log on 2026-08-25. The repair is a new branch rather than a
rewrite of the pushed one, because whether anybody has fetched a ref is not
knowable from here. The content is the same bytes, and that is checked rather
than asserted:

git diff-tree -p 6ff711c | git patch-id --stable
de7155da8a1343f1ebae9d8c98fc08c55f11c538
git diff-tree -p 195faa5 | git patch-id --stable
de7155da8a1343f1ebae9d8c98fc08c55f11c538

git diff --stat 6ff711c 195faa5 ; echo "exit=$?"
exit=0

Run 2026-08-25. #141 is closed with this reason in its body and its branch is
left where it is.

Entry 1 and the issue it sits in

Recording this answer is the last of the five entries in #1 to be recorded. I am
deliberately not letting the merge act on that issue's state: the state change is
worth making explicitly, with the evidence for all five entries beside it, rather
than as a side effect of a keyword in this body. #1 was once closed by exactly
that accident and had to be reopened.