Render every page into one shared frame

[iderex]

Depends on the landing page issue.

Five issues in this plan already say that something appears on every page. #51
puts the affiliation notice in the template so that a new page cannot ship
without it. #69 references the icon from the head of every page. #72 puts the
policy element in every page. #14 refuses a page with no lang attribute and no
title. #48 has to be reachable from wherever a reader is standing. Nothing in
the plan lands the thing all five of them write into.

The site as served has no frame at all, because it has one page and one file:

curl -sS https://flowfin.dev/ | grep -o -E 'href="[^"]*"' | sort -u
href="design-system.html"

Run 2026-08-08. One relative link on the landing page is the whole of the
navigation, and the second page links nothing back.

This issue lands one template that every page is rendered into, and it owns the
positions rather than the contents. What goes in each position is the issue that
already asks for it, so this one closes without deciding what the notice says or
what the policy permits.

The positions.

The head, which carries the character encoding, the viewport, the title and the
description for that page, the icon reference and the policy element. Every one
of those is a thing a page cannot be correct without and none of them is
something a page author should be able to forget.

A link that jumps a keyboard reader past the navigation to the content. On a
page with a navigation this is the difference between reaching the text with one
key and reaching it with as many keys as there are links, and it costs one
element.

The navigation itself, listing the pages a reader can reach. A set of pages with
no way between them is a set of files rather than a site, and the plugin pages in
particular are reached today by nothing at all.

The footer, which carries the affiliation notice, the privacy page and the legal
notice, and which is the reason those three are one link away from everywhere
instead of one link away from the landing page.

The frame is one file. A page that renders its own head is a page that will
carry a different one, and the whole value here is that the answer to "does
every page have this" is a property of one file rather than a search.

Every reference the frame writes is absolute from the site root, which is #68's
rule, and it is the frame that makes the rule cheap to hold: the plugin pages
sit one level down and the not-found page is served in response to a URL of any
depth.

Done when

Every produced page is rendered through one frame file and no page renders its
own head; a test that removes the affiliation notice from the frame reds the
invariant gate on every produced page rather than on one; every produced page
carries a link to the content that is the first focusable element, shown by the
headless run; the footer links resolve from a page at every depth the site
produces, including the not-found page; and adding a page to the build requires
no new frame.

[iderex]

Two of the five conditions here hold on main already, and one of the remaining three
is not the row it looks like.

templates/ holds one file:

gh api repos/Flowfin/site/contents/templates --jq '[.[].name]'
["page.html.tmpl"]

and both pages the build produces go through the same parsed template rather than
through one each:

gh api repos/Flowfin/site/contents/internal/site/site.go --jq '.content' \
  | base64 -d | grep -n 'ParseFiles\|tmpl.Execute\|writePrivacy('
82:	tmpl, err := template.ParseFiles(tmplPath)
114:	if err := tmpl.Execute(&rendered, p); err != nil {
124:	privacy, err := writePrivacy(root, out, label, tmpl, log)
gh api repos/Flowfin/site/contents/internal/site/privacy.go --jq '.content' \
  | base64 -d | grep -n 'func writePrivacy\|Execute'
78:func writePrivacy(root, out, label string, tmpl *template.Template, log io.Writer) ([]string, error) {
89:	if err := tmpl.Execute(&rendered, p); err != nil {

Both run 2026-08-12. The template is parsed once and handed to the second page, so no
page renders its own head. That is the first condition. The second page is also the
evidence for the last one: it was added through the frame rather than beside it, and it
brought no frame of its own.

The condition about the affiliation notice is not met, and the bite proof that exists is
a different statement. What it edits is a fixture page:

gh api repos/Flowfin/site/contents/internal/invariant/invariant_test.go \
  --jq '.content' | base64 -d | sed -n '87,88p'
		"page-carries-the-affiliation-notice": []byte(strings.Replace(cleanPage,
			"Flowfin is not affiliated with the Jellyfin project.", "", 1)),

Run 2026-08-12. That proves the row refuses a page that is missing the sentence. This
condition asks for the other one, that removing the sentence from the one frame reds
every produced page rather than one of them, and nothing in the tree makes that
statement today. It is the condition that catches the frame being bypassed, where the
row above catches the sentence being dropped, and the two fail in different places.

So what is left here is that proof, the link that jumps a keyboard reader to the content,
and the footer links resolving from a page at every depth. The frame itself is not part
of it.