docs(evidence): re-verify sitemap finding (round-5 candidate) against current main and live

docs/evidence/sitemap-2026-08-09.md

@@ -133,3 +133,47 @@ deployed sitemap lists all five human-facing pages at their clean URLs plus
 the two machine-readable mirrors — including the four pages that were
 invisible to crawlers before the fix. The receipt now records the closeout on
 the current head so the finding cannot be re-opened by tracker drift.
+
+### Closeout re-verification (added 2026-08-11)
+
+Re-verified against the current origin/main head (2eed3d2, "docs(evidence):
+re-verify heading-hierarchy finding e6e153bdadd0 against current main and
+live", merged 2026-08-11) after the commits that landed since the 2026-08-09
+closeout — 95d2248 (preferred source pages: llms.txt/offer.md only), c5e2f2b
+(de-index the retired Agent Desk), ac05bec (tap targets: CSS padding only),
+d74225e/1295f9c/536b3c9 (CI-runner commits, no public assets), 2e04225
+(render-blocking re-verify receipt), 11864a7 (Website Appraisal contract
+doc), f9f0b0f (footer link), 1cc7a4e (appraisal-page canonicals and JSON-LD
+@ids on /audit — page content, not the page set), ce02df9 (CI allowlist for
+the Web Analytics beacon tag), 6a914b6 (social share image closeout),
+8b42e0a (apple touch icon closeout), 16efd20 (internal-links re-verify),
+6f24bff (broken external links closeout), and 2eed3d2 (heading-hierarchy
+re-verify). None of them touched `public/sitemap.xml`, `public/robots.txt`,
+or the HTML page set — the public surface is still the same seven files
+(five human-facing pages, the noindex `/brief-requested`, and the legacy
+`/agent-desk`), so no loc belongs in the sitemap that is not already there.
+Two fresh checks:
+
+1. Source checks on this head: `npm run test:sitemap` passes (7/7 subtests,
+   including the "known bad shape" fixtures that prove the checker rejects
+   every regression it guards) and `npm run check` passes (the "Sitemap
+   should expose the root Agent Desk URL" guard and every other site check).
+
+2. Fresh live measurement of the deployed site (2026-08-11):
+   `https://tinystudio.io/sitemap.xml` returns 200 and is **byte-identical**
+   to `public/sitemap.xml` on this head (clean `diff`); every loc probed over
+   HTTPS returns 200 — `https://tinystudio.io/`, `/audit`, `/agents`,
+   `/pricing`, `/specimen` (the five human-facing pages at their clean
+   extensionless URLs), plus `/offer.md` and `/llms.txt`. `robots.txt` (live)
+   still carries `Sitemap: https://tinystudio.io/sitemap.xml`, and
+   `/brief-requested` still serves `<meta name="robots" content="noindex,
+   nofollow">` while remaining absent from the sitemap, as does legacy
+   `/agent-desk`.
+
+Same result as the 2026-08-09 closeout: the sitemap covers the complete
+indexable surface (five human-facing pages plus the two machine-readable
+mirrors), the regression suite and site checks pass on the current head, and
+the deployed bytes match the committed file. The round-5 candidate ("Publish
+a complete sitemap covering the five human-facing pages") remains fully
+delivered — code side (PR #36), CI (`test:sitemap`), and live — and this lane
+(2026-08-11) re-confirmed all three and found nothing further to change.