Derive what the manifest declares, rather than counting it a second time [#328]

[iderex]

The issue this belongs to

Closes #328

What changed

README.md and CONTRIBUTING.md each stated how many dependencies the manifest declares, one line above the command that derives it. Both numbers are deleted. Each paragraph now says that the manifest declares dependencies, that the first build fetches them before it compiles, and sends the reader to cargo tree -e normal for what they are, which is what both files already did in the next sentence.

Each file also gains the account of what its own number said and when it stopped being true, in the tense that file already uses for its earlier corrections. What the sentences still assert is unchanged: a fresh clone needs a network, --locked is in both commands so a build which would rewrite Cargo.lock fails instead of proceeding quietly, and README.md still names the records that required a cryptographic digest and the rule that admitted the entry answering them.

What failure it prevents

A failure that has already happened, twice on these two paragraphs. README.md said one dependency and CONTRIBUTING.md said the same; the manifest declares two:

git show origin/main:Cargo.toml | grep -n '^\[dependencies\]\|^sha2\|^ureq-proto'
18:[dependencies]
53:sha2 = { version = "0.11", default-features = false }
95:ureq-proto = { version = "0.6", default-features = false, features = ["client"] }

The error ran in the direction that makes the dependency surface look smaller than it is, in the first two files anybody reads before deciding what a fresh clone pulls onto their machine. That surface is what docs/decisions/0103-what-admits-a-dependency-and-what-is-refused.md exists to hold down, so a reader who takes the number and then opens Cargo.toml finds a second admitted entry neither document accounts for.

It was found by reading the two paragraphs against Cargo.toml while working the board, not by anything reporting it.

The recurrence is the part worth more than the number. #230 closed the same defect on the same CONTRIBUTING.md paragraph on 2026-08-29 by replacing none with one, and README.md got its own number two days earlier in the change that added the first entry. Each repair kept a hand-written count and each bought until the next entry landed.

Evidence

Read at the commit being pushed, 90f9101df810276e781ebb90fb0878c30cec85ae.

When each number arrived, and when the second entry did:

git log origin/main --format='%h %ad %s' --date=short -S'manifest declares one' -- README.md
3261578 2026-08-27 Build a cache key out of five length-prefixed parts, and take the digest 0041 requires

git log origin/main --format='%h %ad %s' --date=short -S'ureq-proto = {' -- Cargo.toml
3979f8a 2026-09-04 Decide the means the core speaks HTTP with: the protocol crate, not a client (#292) (#296)

What the command each paragraph hands the reader returns. Its first line is the clone's own path, so that line reads differently on every machine and the entries below it do not:

cargo tree -e normal --depth 1
flowfin-core v0.0.0 (<the path of this clone>)
|-- sha2 v0.11.0
`-- ureq-proto v0.6.1

The two commands this repository's own documents name, and the check that reads every path a document names:

cargo build --locked --all-targets ; echo "exit=$?"
exit=0

cargo test --locked
587 + 2 + 5 + 5 + 3 + 11 + 28 + 5 + 125 + 1 = 772 passed, 0 failed

bash .github/doc-paths/doc-paths.sh check | tail -1
Every path these documents name resolves against the tracked set.

The paths this change touches, against the Scope: line #328 declares:

git diff --name-only origin/main...HEAD
CONTRIBUTING.md
README.md

The means is Markdown prose in two files that are already Markdown prose, and no artefact is built here, so the means check is answered by there being no choice to make: the change edits the text of two tracked documents in the form those documents already have, adds no language, no runtime and no dependency, and is testable by the suite that already exists in the sense that doc-paths reads every path it adds.

What this does not cover

• No mechanism. Nothing here compares a document's claim about the manifest against the manifest. That is what CONTRIBUTING.md says the manifest declares no dependencies, and it declares one #230 said on closing and it is still true. A derived sentence stops these two paragraphs going stale in this particular way; it refuses nothing, and the next document that writes a count is refused by nothing.
• The rest of both documents. I re-ran the readings in these two paragraphs and audited neither file further. A count elsewhere in either of them would have passed this change unexamined.
• The past-tense accounts already in both files of what each paragraph used to say and what corrected it. Those are records of what was read and when, they were right when they were written, and moving them would rewrite what happened rather than repair what is claimed.
• The build was run offline against an already-populated registry. cargo build --locked --all-targets and cargo test --locked above were run with --offline on this machine, so the sentence this change keeps - that a fresh clone needs a network because the first build fetches before it compiles - was not re-measured from an empty registry here. It rests on the manifest and the lockfile rather than on a run.
• No run on a target triple, and no guard added. This change adds and edits no check, no test and no guard, so there is nothing here that refuses anything and no proof of a bite is owed.

Who has read it

Nobody other than the author. There is one person on this account and no second reader was available, so the evidence above stands in place of a review rather than the question being left open.