mirror second-pass close-out: retention diagram precision, evidence taxonomy, sourced Talos reboot claim, qualified failure matrix, Hub pull terminology, referrer completeness split, storage semantics, secret-rotation truth, table captions + scope + keyboard regions, all-lazy plates, en-AU, editorial reduction, extended gates

Dockerfile

@@ -1,11 +1,11 @@
 # syntax=docker/dockerfile:1
-# Static teaching site: bash assembles dist/ from the split source, then a pinned
-# nginx-unprivileged serves it. No Node build — build.sh is plain bash + coreutils.
+# Static teaching site: build.sh runs the node assembler (pilot/assemble-arc.mjs) to
+# produce dist/, then a pinned nginx-unprivileged serves it. No package installs - the
+# assembler is dependency-free node.
 
 # ---- build stage ----------------------------------------------------------
-# Reusing the digest the site image already pins: it's a bookworm-slim base that is
-# verified and cached in the zot pull-through mirror, so this layer costs nothing
-# extra. Only bash/sed/find/install are used here — node itself is incidental.
+# A bookworm-slim node base, digest-pinned and typically served from the zot
+# pull-through mirror; node runs the assembler.
 FROM node:22-bookworm-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS build
 ARG BUILD_REV=dev
 ENV BUILD_REV=$BUILD_REV