sources: spin v20261025.01 4534f65212, brand main 31d07eb9b7

src/content/docs/reference/security/known-gaps.md

@@ -9,7 +9,7 @@ sidebar:
 
 <!-- Generated by tools/refgen from spin:docs/security/README.md. Edit the source, not this file. -->
 
-The open items of Spinbox's security model, from spin's [`docs/security/README.md`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/docs/security/README.md) at `b3598142d`. The numbers are [its rules](/reference/security/rules/).
+The open items of Spinbox's security model, from spin's [`docs/security/README.md`](https://github.com/spin-stack/spin/blob/4534f652122fbb0bb2ba8e434f6e4cd73212fa18/docs/security/README.md) at `4534f6521`. The numbers are [its rules](/reference/security/rules/).
 
 What no line keeps yet. Each is a design change, not a patch, which is why it is here.
 

src/content/docs/reference/security/rules.md

@@ -9,7 +9,7 @@ sidebar:
 
 <!-- Generated by tools/refgen from spin:docs/security/README.md. Edit the source, not this file. -->
 
-The rules every entry point must keep, from spin's [`docs/security/README.md`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/docs/security/README.md) at `b3598142d`. Code cites a rule's number at the line that keeps it. **Gate** is what fails a build when the rule is broken; *none* marks a rule kept only by each place remembering it. What is still open is on [Known gaps](/reference/security/known-gaps/).
+The rules every entry point must keep, from spin's [`docs/security/README.md`](https://github.com/spin-stack/spin/blob/4534f652122fbb0bb2ba8e434f6e4cd73212fa18/docs/security/README.md) at `4534f6521`. Code cites a rule's number at the line that keeps it. **Gate** is what fails a build when the rule is broken; *none* marks a rule kept only by each place remembering it. What is still open is on [Known gaps](/reference/security/known-gaps/).
 
 | # | Rule | Gate |
 |---|---|---|

src/content/docs/use/dashboard.md

@@ -7,7 +7,7 @@ editUrl: false
 
 <!-- Generated by tools/refgen from spin's dashboard/e2e/site.spec.ts. Edit the source, not this file. -->
 
-The dashboard is at `https://app.<domain>`. These screenshots are of spin v20261024.01, taken by spin's dashboard suite on its end-to-end stack - real workspaces on a real runner - each by a test that first checks the screen shows what its title says. Everything here is also in the [CLI](/reference/cli/) and the [API](/reference/api/).
+The dashboard is at `https://app.<domain>`. These screenshots are of spin v20261025.01, taken by spin's dashboard suite on its end-to-end stack - real workspaces on a real runner - each by a test that first checks the screen shows what its title says. Everything here is also in the [CLI](/reference/cli/) and the [API](/reference/api/).
 
 ## A person's workspaces
 

src/data/figures.json

@@ -1,6 +1,6 @@
 {
 	"datapath": {
-		"source": "https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/docs/network/datapath",
+		"source": "https://github.com/spin-stack/spin/blob/4534f652122fbb0bb2ba8e434f6e4cd73212fa18/docs/network/datapath",
 		"width": 552,
 		"words": [
 			"How a packet leaves a workspace",
@@ -56,7 +56,7 @@
 		]
 	},
 	"egress-policy": {
-		"source": "https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/docs/network/egress-policy",
+		"source": "https://github.com/spin-stack/spin/blob/4534f652122fbb0bb2ba8e434f6e4cd73212fa18/docs/network/egress-policy",
 		"width": 854,
 		"words": [
 			"What the forward chain decides, in order",
@@ -157,7 +157,7 @@
 		]
 	},
 	"isolation": {
-		"source": "https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/docs/network/isolation",
+		"source": "https://github.com/spin-stack/spin/blob/4534f652122fbb0bb2ba8e434f6e4cd73212fa18/docs/network/isolation",
 		"width": 499,
 		"words": [
 			"Same address, different segment",
@@ -204,7 +204,7 @@
 		]
 	},
 	"traffic": {
-		"source": "https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/docs/security/traffic",
+		"source": "https://github.com/spin-stack/spin/blob/4534f652122fbb0bb2ba8e434f6e4cd73212fa18/docs/security/traffic",
 		"width": 1889,
 		"words": [
 			"Traffic: every arrow is a connection opened in its direction, and nothing else is let in",

src/data/reference.json

@@ -1,16 +1,16 @@
 {
 	"spin": {
 		"installs": "v20261019.02",
-		"commit": "b3598142dbcd6ef24135066332441a400dd35980",
-		"tag": "v20261024.01",
+		"commit": "4534f652122fbb0bb2ba8e434f6e4cd73212fa18",
+		"tag": "v20261025.01",
 		"machine": "v20261014.01"
 	},
 	"terraform": {
 		"commit": "3df623f0ca2b7f91650e0ac857ba0bde295e0481",
 		"release": "v20261024.01"
 	},
 	"brand": {
-		"commit": "c882b6f0f3901787525ef16ef29058c9c1418cbe"
+		"commit": "31d07eb9b76596695a138ff96403d881f358e80d"
 	},
 	"counts": {
 		"built": 75,
@@ -20,5 +20,5 @@
 		"endToEnd": 65,
 		"gap": 10
 	},
-	"openapiSha256": "f600ebac2a39e1b1e59bcb3b08ebfd80692432d8d98b29111b55991729f924d2"
+	"openapiSha256": "55f225492362049f6ed1501104de85e6345aa55a6163f0aa0bf96950aff45322"
 }

src/data/shots.json

@@ -1,6 +1,6 @@
 {
-	"release": "v20261024.01",
-	"commit": "b3598142dbcd6ef24135066332441a400dd35980",
+	"release": "v20261025.01",
+	"commit": "4534f652122fbb0bb2ba8e434f6e4cd73212fa18",
 	"shots": [
 		{
 			"name": "workspaces",

versions.yaml

@@ -7,8 +7,8 @@
 - name: spin
   kind: git
   source: https://github.com/spin-stack/spin
-  version: v20261024.01
-  pin: b3598142dbcd6ef24135066332441a400dd35980
+  version: v20261025.01
+  pin: 4534f652122fbb0bb2ba8e434f6e4cd73212fa18
   track: github-release
   note: >-
     The release the site documents (D2: the newest, exactly). The daily sync moves it to the next
@@ -29,7 +29,7 @@
   kind: git
   source: https://github.com/spin-stack/brand
   version: main
-  pin: c882b6f0f3901787525ef16ef29058c9c1418cbe
+  pin: 31d07eb9b76596695a138ff96403d881f358e80d
   track: branch
   note: >-
     The palette and the logos. brand cuts no releases, so its main is what it has to say. The