[HugoXK]

Fixes #2455

Owner: Dev-1
Written-by: Dev-1
Claim-Id: ec77e1fbeedc470289e30804a6afb098
Branch: dev/1-doc-compose-publish (head repo HugoXK/FlyBot)
Base: 334960bbdb43a9e69e7a1fab7a15200b6f42eea7 (live main)
Tier: T0 — one file under docs/; the gate's own computation over this patch is T0, why []
Diff: 1 file +1/−1
Tip: 6d97baee7c3fbb5018de306b054627bd9a1502d0 — verified commit 59d4435136f72f1cfab6682e5a3ecdd9ca3cb936 (tree 38e5f94b4abc05bcae95b2199c132d31b2de6697, single parent 334960bbdb43a9e69e7a1fab7a15200b6f42eea7); the pushed head was generated from that same tree by the push path

What changed

docs/subsystems/install.md invariant 4 said compose.yaml "publishes the port on the host's 127.0.0.1 only". The shipped compose.yaml has network_mode: host and no ports: key, so nothing is published — the web server binds 127.0.0.1 itself through docker/web.patch.yml. The same page's table row and docs/docker.md already describe host networking, so the invariant was the only place contradicting the file it describes. The sentence now says the container shares the host's network and the server's own loopback bind is the only exposure; no port is published.

Red first

No unit test is added (docs-only). The red is the contradiction and it is reproducible before the edit with a two-file check:

$ python3 tmp/doc-compose-check.py
doc claims "compose.yaml publishes the port": True
compose.yaml has a ports: key: False
compose.yaml has network_mode: host: True
RED: the invariant says compose publishes a port, but compose.yaml publishes none (host networking)
$ echo $?
1

After the edit the same check prints GREEN: the invariant and compose.yaml agree and exits 0.

Ran at the tip

Verified commit 59d4435136f72f1cfab6682e5a3ecdd9ca3cb936 (tree 38e5f94b4abc05bcae95b2199c132d31b2de6697, single parent 334960bbdb43a9e69e7a1fab7a15200b6f42eea7):

• TZ=UTC ARCH_DOCS_BASE=334960bbdb43a9e69e7a1fab7a15200b6f42eea7 npm run verify — exit 0, 4843/4843 tests, fail 0 / cancelled 0: core 2851, social 574, tree 132, timeline 141, workflow 411, root .github+policy 671, interop 37, live-e2e 26. Lint: core 77 warnings / 0 errors, plugin lint 36/9/2/16 warnings / 0 errors, interop 1 warning / 0 errors, live-e2e 0 warnings / 0 errors.
• ARCH_DOCS_BASE=334960bbdb43a9e69e7a1fab7a15200b6f42eea7 npm --prefix core run arch-docs on the committed tree — arch-docs: OK (1 changed file(s)).
• node scripts/ds-bot-patches.mjs check / canonical (inside verify) — 10 patches apply cleanly in order, patches/ds-bot/ is what generate writes (generate is a no-op); core/ and patches/ untouched.
• node core/scripts/build-client.mjs --check (inside verify) — exit 0; client.js untouched.
• The doc/compose check above — GREEN, exit 0.

Not run

• No smoke test, no bench, no DSH run: one docs sentence, no code path or bundle changed.
• No changelog fragment: no user-visible product behaviour changes; the deploy guide (docs/docker.md) already said what this sentence now says.
• No re-generation of patches/ds-bot/: no file under core/ changed.

Duplicate check

GitHub search on repo:ThinkFlowLab/FlyBot for "compose publishes the port", "network_mode host docs" and "docker port published compose" returns only closed #482, #1594 and #352; none describes this doc/code contradiction.

Checkpoint

{
"pr": 2456,
"claim": "Dev-1",
"issue": 2455,
"summary": "The install page's invariant said compose.yaml publishes a port on 127.0.0.1, but the file has network_mode: host and no ports key, so nothing is published and the web server binds loopback itself. The invariant now says what compose.yaml and the Docker guide already say: host networking, the server's own loopback bind, no published port. One docs sentence; no code, patches or changelog fragment.",
"files": [
"docs/subsystems/install.md"
],
"checks": {
"ran": "TZ=UTC ARCH_DOCS_BASE=334960bb npm run verify",
"result": "green",
"at": "59d4435136f72f1cfab6682e5a3ecdd9ca3cb936"
},
"next": "none — ready for review"
}

[HugoXK]

@Birfy review request for this exact tip: 6d97baee7c3fbb5018de306b054627bd9a1502d0

Tier T0, one file: the docs/ compose.yaml network sentence (+1/−1), Fixes #2455. Checks at this head: 15 success, enqueue-guard green (T0 needs no Verdict per the gate rules), agent-audience cancelled and non-blocking. Non-draft, base 43b2cb17a39a177517b5b7e67c8216859c88b4a5.

Nothing else rides along — the diff is the one sentence and nothing in core/, plugins/ or patches/ moves.