# Reproducible verification — regenerated by scripts/verify-claims.sh
# (this file: VERIFY-OUTPUT.txt) on 2026-10-29 09:44:21 UTC
# Method (display drift): each '$ command' line is executed verbatim; stdout+stderr and
# the exit status are captured programmatically (see emit() above).
# NOTES (context, not command output): dashcaddy-api/VERSION is the
# deploy-time BUILD STAMP (the deployed commit SHA written by the
# publish pipeline), not a semver source of truth — see
# dashcaddy-api/src/docker/self-updater.js:123 which reads it as the
# commit identity, and start.sh:193-205 which treats it as deployed
# VERSION metadata. Version alignment claims refer to package.json,
# openapi.yaml, and the README badge (all 1.17.0).

$ cat dashcaddy-api/VERSION
70e252c
[exit=0]

$ grep "version" dashcaddy-api/package.json | head -1
  "version": "1.17.0",
[exit=0]

$ grep "version:" dashcaddy-api/openapi.yaml | head -1
  version: 1.17.0
[exit=0]

$ grep "version-" README.md | head -1
![Version](https://img.shields.io/badge/version-1.17.0-blue)
[exit=0]

$ node -e 'const {APP_TEMPLATES}=require("./dashcaddy-api/src/docker/app-templates"); console.log("templates:", Object.keys(APP_TEMPLATES).length)'
templates: 78
[exit=0]

$ cd dashcaddy-api && npx jest __tests__/self-updater-version.test.js __tests__/self-updater-isnewer.test.js --silent
PASS __tests__/self-updater-version.test.js
PASS __tests__/self-updater-isnewer.test.js

Test Suites: 2 passed, 2 total
Tests:       13 passed, 13 total
Snapshots:   0 total
Time:        0.427 s, estimated 1 s
[exit=0]

$ grep -n "commit = fs.readFileSync" dashcaddy-api/src/docker/self-updater.js
123:          commit = fs.readFileSync(pkgPath.replace(/package\.json$/, 'VERSION'), 'utf8').trim();
[exit=0]

$ sed -n "120,126p" dashcaddy-api/src/docker/self-updater.js
        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
        let commit = null;
        try {
          commit = fs.readFileSync(pkgPath.replace(/package\.json$/, 'VERSION'), 'utf8').trim();
        } catch { /* ignore */ }
        return { version: pkg.version, commit };
      } catch { /* try next candidate */ }
[exit=0]

$ grep -n "VERSION METADATA\|source tree.s VERSION\|SRC_VERSION=" start.sh
193:# serves — decided by VERSION METADATA, not file mtimes (mtimes are not
197:#     source tree's VERSION file, start.sh must NOT touch the live bundle.
205:  SRC_VERSION=/opt/dashcaddy/dashcaddy-api/VERSION
[exit=0]

$ python3 scripts/api-surface-extract.py --root "$(pwd)" --out "$(pwd)/API-SURFACE.md"
[ok] 443 handler rows, 59 PUBLIC_ROUTES allowlist entries
[ok] wrote /root/dashcaddy/API-SURFACE.md (54340 bytes)
[exit=0]

$ wc -c API-SURFACE.md
54340 API-SURFACE.md
[exit=0]

$ sha256sum API-SURFACE.md
6ee6b2f0da244cd6103be14f0977b95f1a9af3d453bf2401bb4c222d59b6c621  API-SURFACE.md
[exit=0]