diff --git a/site/api/checkpoint.mjs b/site/api/checkpoint.mjs
index a0a73787a..3a28a8ab7 100644
--- a/site/api/checkpoint.mjs
+++ b/site/api/checkpoint.mjs
@@ -121,7 +121,8 @@ export default async function handler(req, res) {
       res.setHeader('Cache-Control', 'no-store');
       return res.status(404).json({ ok: false, error: 'no certified checkpoint stored yet' });
     }
-    return res.status(200).json({ ok: true, now: new Date().toISOString(), ...cp });
+    // the hand merge of 12:22 BST (a0b62cf7) returned `...cp` with no cp bound: every caller read "cp is not defined" (8 Oct 2026, build-server lane)
+    return res.status(200).json({ ok: true, now: new Date().toISOString(), ...shape(row, source) });
   } catch (e) {
     res.setHeader('Cache-Control', 'no-store');
     return res.status(500).json({ ok: false, error: String(e.message || e) });