On a clean exit, delete the serve tracking refs. On start, reconcile from the bucket, so a crash or a deleted bucket root repairs itself: delete the root, start again, and the site renders. Design: .local/design/serve.md, failure modes.