Take the catalogue reading again, now that the address answers

[iderex]

What was wrong

The catalogue address is the one path an operator pastes into a server, and this
board rests on what it answers in three places: the state #67 has to keep apart,
entry 4 of #7, and the address the install page in #27 prints. All three were
written against a 404.

The only reading this tree holds for that address was taken on 2026-08-11, and it
recorded the host's own not-found page rather than a catalogue:

gh api repos/Flowfin/site/contents/harness/needs-network/record/2026-08-11T17-49-13Z.md \
  --jq '.content' | base64 -d | grep -A 7 '^### the catalogue address'
### the catalogue address

    GET https://flowfin.dev/manifest.json
    status 404 Not Found
    content-type text/html; charset=utf-8
    server GitHub.com
    9379 byte(s), sha256 b620507312c5e97566a3c6cfaf99144fefc18a0da7d941401dfa0f5f58fb0368
    title Page not found · GitHub Pages

Run 2026-08-23 at 51a1f10. That is no longer what answers.

What this change does

It runs the harness that already exists for readings of this kind and lands the
record it wrote. Nothing else is touched:

git diff --name-only origin/main...HEAD
harness/needs-network/record/2026-08-23T03-23-54Z.md

The address now returns a catalogue, and the digest is what separates that from
an origin serving a default page:

grep -A 6 '^### the catalogue address' harness/needs-network/record/2026-08-23T03-23-54Z.md
### the catalogue address

    GET https://flowfin.dev/manifest.json
    status 200 OK
    content-type application/json; charset=utf-8
    server GitHub.com
    1247 byte(s), sha256 b111962a5c8db99ccf6da3813cb8af7ef5dad4683ca3c82a5e23a0fe4ad413a6

Read beside the path in the same record that is asked for so that nothing can
match it, the two are different responses rather than one served twice:

grep -c 'b620507312c5e97566a3c6cfaf99144fefc18a0da7d941401dfa0f5f58fb0368' \
  harness/needs-network/record/2026-08-23T03-23-54Z.md
1

Both run 2026-08-23 at 377e98f. One occurrence, against the unmatched path, and
none against the catalogue address. In the 2026-08-11 record that digest appears
twice.

What it carries is a catalogue with one entry in it:

curl -sS https://flowfin.dev/manifest.json | grep -oE '"(name|version|targetAbi)": "[^"]*"'
"name": "Requests"
"version": "0.1.0.0"
"targetAbi": "10.11.0.0"

Run 2026-08-23.

Nothing else in the record moved. The name still redirects from plain http and
still carries no strict-transport-security header, the certificate is inside its
window with 74 days left, and the three readings this set does not ask for are
written as not asked for rather than as results.

The means

The harness in harness/needs-network is what this repository already uses for a
reading of a public name, and this is a run of it as documented rather than
anything new. A reading of somebody else's service is not a property of this
tree, so it stays outside the gate, and the gate goes on saying on every run that
the set was not asked for:

go run . ci | sed -n '2p'
  needs-network was not asked for. Asking costs a request to the public name from whatever machine runs it, and a verdict that moves when somebody else's service does rather than when this tree changes. Ask with: go run ./harness/needs-network

Run 2026-08-23 at 377e98f.

What this does not do

#67 stays open. The publish side of that issue is untouched, and a
run of the harness is not evidence about it. What it removes is the board resting
on a pasted 404 that no longer reproduces.

It edits no decision record. decisions/0006-what-answers-at-the-catalogue-address.md
quotes the same 404 and says the question is cheap to settle while the address
does not answer. Under the rule in decisions/README.md a change there is not a
correction, because it changes what a reader would decide after reading it, and
that needs a new record rather than an edit. That is left where it belongs.

The gate

go run . ci
gate: 7 legs, in order: format, vet, test, build, links, sitemap, invariants
  format: ok, 54 file(s)
  vet: ok
  test: ok, 26 test file(s)
  build: ok, 8 file(s)
  links: every reference that stays inside this site resolves to a file the build wrote
  sitemap: every page the build wrote is listed once, and every entry has a page behind it
  invariants: ok, 38 rule(s) decided, 1 owed and not decided
7 of 7 legs ran. None was skipped.

go run . hygiene origin/main HEAD
hygiene: 1 non-merge commit(s) in origin/main..HEAD, origin internal
  377e98ff8355: subject carries its reference
1 commit(s) judged, none refused.

Both run 2026-08-23 at 377e98f.

No second reader

This change carries no second reader. The commands above are what stands in place
of one.