Record the transport retest, retire the #33 entry, and hold the main publish

[ptr727]

State-file update only, TODO.md throughout.

Rebased onto develop and reconciled, having sat open since 2026-08-05 while a lot landed underneath it. Roughly half of what this branch originally proposed had gone stale or been overtaken, so the description below is what the head tree actually carries rather than what it set out to do. The net diff against develop is now three deletions and two insertions.

What it does

• Retires the #33 entry. #33 closed on 2026-08-06, with the bar moved from a production deploy to the prerelease dispatch, so the item naming a production deploy as its fourth check is answered rather than outstanding. The [issue-33] link definition goes with the last reference to it.
• Records the retest in the State table. The Deploy pipeline row now says the transport was retested against the real host.
• Removes Declare what the VPS keeps. The earlier commit dropped this silently, which is the kind of thing worth catching, so here is the reason: it asked for the host's timer and its count to be written beside the ownership line, and OPERATIONS.md now names blog-prune-releases.timer, that it runs daily, and that it keeps ten bundles per environment. Answered rather than abandoned.
• Adds the publish from main, gated on the soak rather than on the mechanism, which is proven. 1.0.11 is still the newest release from main, cut 2026-08-01, still ahead of every deploy change, so the next release from main is the first that would describe a site serving its public address.

What was dropped in the rebase, and why

• The ProjectTemplate#567 row. That issue closed on 2026-08-05 — a day before this branch was last touched — so the row was already wrong when it was written. Its claim has since been falsified outright: it said an agent cannot trip the production ref gate because the permission classifier refuses a production-labeled dispatch and conversational authorization does not lift it. A production deploy was dispatched and completed on 2026-08-08. The classifier does block, but it blocks a merge, not the dispatch.
• This branch's Deploy production once bullet. It still described the production environment as configured, its Pangolin resource disabled, and nothing ever having run against it. All three are now false: the resource answers 200 unauthenticated and the environment has served release 20260808-041050. develop's version, which carries the M7a detail, is kept instead.
• This branch's Watch server logs for 404s daily line. develop moved that into a Recurring operations section and expanded it, so this branch's shorter version would have been a regression.

One thing the rebase itself introduced, and fixed

The publish item pointed at "the daily 404 watch above". That item moved below it into Recurring operations, so the pointer named the wrong direction. It now names the section instead of a position — the same defect a review already flagged on this branch once, in the opposite form.

Deliberately not in scope

ProjectTemplate#552 sits in the open-against-the-hub table and the issue is closed, but its fix is on the hub's develop rather than main, and this file's own rule is to read main as ground truth. So the finding still binds and the row is not simply wrong. Correcting how that table represents it is a judgment with its own reasoning and belongs in its own change, not bundled into a rebase.

Verification

markdownlint-cli2, editorconfig-checker, and cspell clean on TODO.md. Documentation only — no code, config, workflow, or content change, so the local mirror gate does not apply.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the repository’s TODO/state tracking to reflect that the deploy transport retest has been completed (except for the final production deploy step), removes an answered retention-count item, and records a new hub-level open item that affects how “green” should be interpreted for deploy-gate verification.

Changes:

• Updates the “Deploy pipeline” state entry to reflect the real-host transport retest.
• Replaces the “retest transport” and “declare retention” next-steps with a single “finish #33 via production deploy” item.
• Adds ProjectTemplate#567 to the “open against the hub” table and adds its link reference.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

TODO.md:30

• The bullet says "This no longer gates #33" but also says #33 "closed". Since the issue is already closed, the current wording is easy to misread as though #33 is still open/blocked. Reword to make the relationship historical/explicit (the production deploy is still outstanding, but it no longer blocks an open issue).

- **Deploy production once, to a name that is not the live one.** The production environment is configured and its Pangolin resource is deliberately disabled, so nothing has ever run against it. Validate there before the record moves. This no longer gates [#33][issue-33], which closed on the prerelease dispatch, but the check it stands for is unchanged: nothing has yet deployed to production through the pinned transport.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[ptr727]

Answering the suppressed finding from the round on 1098f066, which carried no thread.

The bullet says "This no longer gates #33" but also says #33 "closed" […] Reword to make the relationship historical/explicit

The finding was right about the wording, and it is now moot for a stronger reason: that bullet no longer exists. This branch has been rebased onto develop, where the Deploy production once item was rewritten with the M7a detail, and develop's version is kept in place of this branch's. The sentence the finding quotes is gone along with the rest of the stale bullet, which still described the production environment as never having run against — it has since served release 20260808-041050.

#33 itself closed on 2026-08-06, so the entry retiring it is confirmed rather than anticipatory, and the [issue-33] link definition is removed with the last reference to it.

Two other reconciliations in the same rebase, both recorded in the commit message:

• The ProjectTemplate#567 row is dropped. That issue closed 2026-08-05, a day before this branch was last touched, so the row was wrong when written. Its claim has since been falsified outright: it said an agent cannot trip the production ref gate because the permission classifier refuses a production-labeled dispatch, and a production deploy was dispatched and completed on 2026-08-08.
• Declare what the VPS keeps stays removed, now with a reason. The earlier commit dropped it silently. It asked for the host's timer and count to be written beside the ownership line, and OPERATIONS.md now names blog-prune-releases.timer, that it runs daily, and that it keeps ten bundles per environment. Answered rather than abandoned.