import io
p='docs/RELEASE-RUNBOOK.md'
s=io.open(p,encoding='utf-8',newline='').read()
nl='\r\n' if '\r\n' in s else '\n'
old='   test assembly with no GitHub access.'+nl
assert s.count(old)==1
new=old+nl.join([
'   **The bundle\'s sha256 is not reproducible across machines.** GNU tar and',
'   Windows\' bsdtar write different archive headers for identical members',
'   (measured 213 vs 195 bytes on the same input), so a second maintainer',
'   rebuilding the bundle gets a different sha. That is expected, not',
'   tampering: the signed entry is the sha of the bytes actually uploaded.',
'   Verify a bundle by its per-member `bundle.json` shas, which ARE stable.',
''])
s=s.replace(old,new)
io.open(p,'w',encoding='utf-8',newline='').write(s)
print('ok')