The header ships with the package, so the check is not optional any more

vendor/raylib/web/ is gitignored, so the header a build-web.sh tree happens
to have never appears in a git worktree. Every parallel lane that touched
bindings was checking against nothing and was not told. One went looking and
used a copy out of ~/.local/share/Trash, which happened to be byte-identical.
A check that silently does not run is worse than no check.

raylib.h is 128K and now sits beside the package it describes. The argument
for ?${FLAN_RAYLIB_H} was that requiring a header would make a build need
raylib-devel, and that dissolves when the header is committed here. There is
no variable to export any more; to check against a different header, edit
the line or replace the file.

Measured, because always-on has to be paid by every build: a warm build of
raylib-font.flan is 0.10-0.11s against a 0.10s baseline. The header read is
cached and keyed like the object cache, so this is under the noise. Verified
it fires by putting f64 where raylib says int and watching an ordinary build
refuse, naming the tracked header.

vendor/raylib/headers

@@ -24,13 +24,19 @@
 #      agrees with it by construction. That is also why the hand-written lines
 #      were kept rather than replaced by generated ones.
 #
-# Why it is still optional. A build needs libraylib linkable and *not*
-# raylib-devel installed, which is a property worth keeping; requiring a header
-# would take it from everyone to give the check to whoever has one. Before the
-# bindings were committed this marker also decided how many bindings a build
-# got, which was the real cost of it being opt-in; it no longer decides that,
-# and all it now withholds is a check that regeneration has already run once.
-# Same shape as ${FLAN_RAYLIB_WEB} in `link`, and for the same reason.
+# Why it is no longer optional. It used to be `?${FLAN_RAYLIB_H}`, and the
+# argument was that a build needs libraylib linkable and *not* raylib-devel
+# installed, so requiring a header would take that property from everyone to
+# give the check to whoever had one. **That argument dissolved when the header
+# was committed here**: nobody needs raylib-devel to have it, because it ships
+# with the repository.
+#
+# What being optional actually cost was found the hard way. `vendor/raylib/web/`
+# is gitignored, so the header a `build-web.sh` tree happens to have never
+# appears in a git worktree — and every parallel lane that touched bindings was
+# therefore checking against nothing and not being told. One of them went
+# looking and used a copy out of `~/.local/share/Trash`, which happened to be
+# byte-identical. A check that silently does not run is worse than no check.
 #
 # The version must match the shared library `link` names — 5.5, libraylib.so.550.
 # Reading one version's header while linking another's library is exactly the
@@ -38,11 +44,10 @@
 # described: against a 5.1-dev header, regeneration reports ten differences
 # that are all real and writes nothing.
 #
-#   export FLAN_RAYLIB_H=/path/to/raylib-5.5/src/raylib.h
-#
-# vendor/raylib/build-web.sh already clones that exact tag to build the browser
-# archive, so a tree that has built for web has the matching header at
-# vendor/raylib/web/raylib-5.5/src/raylib.h.
+# To check against a different header — a newer raylib, or a system one — edit
+# this line or replace the file. There is no environment variable for it any
+# more: the point of committing the header is that every tree checks against
+# the same one without anybody exporting anything.
 #
 # To see what regeneration would produce without writing anything:
 #
@@ -52,4 +57,4 @@
 # are called — is `bindings` beside this file. See its comments for why a
 # committed generated file needs a config at all.
 #
-?${FLAN_RAYLIB_H}
+raylib-5.5.h