Summary

• Add uselesskey bundle --profile --explain as a read-only profile explanation path.
• Keep bundle explanation aligned with uselesskey profile --explain and prevent accidental bundle materialization.
• Update README/start-here/contract-pack docs plus first-run UX closeout records.
• Refresh the generated ripr+ endpoint for the new CLI regression test.

Files added/changed

• crates/uselesskey-cli/src/main.rs
• crates/uselesskey-cli/tests/cli.rs
• README.md
• docs/how-to/start-here.md
• docs/contract-packs/README.md
• plans/first-run-ux/closeout.md
• docs/learnings/2026-05-first-run-ux.md
• badges/ripr-plus.json

Validation

• cargo xtask fmt --fix
• cargo run -p uselesskey-cli -- bundle --profile webhook --explain
• cargo test -p uselesskey-cli --all-features bundle_explain
• cargo test -p uselesskey-cli --all-features profile
• cargo test -p uselesskey-cli --all-features
• cargo clippy -p uselesskey-cli --all-targets --all-features -- -D warnings
• cargo xtask docs-sync --check
• cargo xtask typos
• cargo xtask user-path-smoke
• cargo +nightly xtask pr-lite
• cargo xtask badges --check
• cargo xtask doctor --format json
• cargo +nightly xtask pr
• git diff --check

Note: plain cargo xtask pr-lite was attempted first and failed at fuzz-build because stable rustc rejects cargo-fuzz sanitizer -Z flags. The same gate passed under cargo +nightly xtask pr-lite, and doctor reports nightly is installed while warning that the Windows ASAN runtime DLL is not on PATH.

Non-goals

• No new fixture profile or public claim.
• No provider compatibility or production-security claim.
• No executable CLI proof wrapper.
• No generated fixture payloads committed.

What this enables next

• Users can ask for the boundary at the exact bundle command they were about to run, before any files are written.