Promote develop to main: the log filter, and the negative-result rule

[ptr727]

Promotes develop to main. Four commits, each already reviewed and squash-merged to develop.

Documentation and comments only. Three files: OPERATIONS.md, TODO.md, and two comments in checks/check-live-urls.sh. No behaviour changes, so nothing here alters a build or a deploy.

What this carries

[#81] The outward log pass filters by X-Blog-Check rather than by user agent. The user-agent key was a coincidence: the CI runner's curl and the VPS host's curl are byte-identical, so only the client address separated them and the CI half rotates every run. The old method stays, scoped to the days logged before the field existed, since it is the only thing that can read them.

It also records the gap the host side measured: check-live-urls.sh sends the header on every request and a bare curl sends nothing, so an interactive probe passes -H "X-Blog-Check: proxmox/media-dev" or it lands in the visitor set.

[#82] The negative-result trap is stated as a demand for evidence. It said a query matching nothing reads as a clean result, which is true and names no action:

Before believing a negative, establish that the check could have produced a positive.

Four costumes are listed under it, each one this repository actually hit: a query that cannot see its target, a rule naming a target that does not exist, a filter whose precondition is unstated, and a tool reporting success having done nothing.

[#84] X-Blog-Check is added to the access log's keep-list, which the same file described without it. The two statements contradicted each other, and chasing it found a worse problem in the same sentence, predating today: "request headers are dropped" reads as Traefik stripping them from the request, which would mean the Pangolin token never reaches the site. It now names the three JSON keys the log carries and says the rest are omitted from the record rather than from the request.

[#85] Two counts are removed rather than corrected. The HUGO_BASEURL counterfactual said a wrong base URL would have run 1,245 requests, and check-live-urls.sh said in two comments that it runs 1,245 of them. It runs 1,253.

The distinction that came out of #85, and is worth carrying

1,245 is the URL contract, 328 render plus 917 redirect. 1,253 is the live check, which requests the contract plus eight media URLs. Both numbers are real and they mean different things, which is why three other occurrences in the repository are correct and were deliberately left alone: the migration post contrasting the contract with the sitemap's 111, the audit report quoting a 2026-08-04 run, and the parity note about a build baked with the wrong host.

Where a count was removed it was replaced by a statement that cannot go stale, rather than by a corrected number.

Two State rows re-measured

• Production carries the hard-linking result: 1,052 of 3,275 files shared with the previous release, the linked set being exactly the restored generation, all 1,048 linked media files at mode 644, and 11.4 MB incremental against 585 MB for a full copy. Staging reproduced the same 1,052 independently, against a different predecessor.
• The backup timer fired unattended on 2026-08-09 at 09:11:01 UTC, proven by both halves of the standard rather than either alone: a second journal entry and LAST moving off -.

The serving release id is no longer repeated outside the State table, since it moves with every deploy.

Merge

Plain --merge, never --delete-branch: on a develop -> main promotion that flag deletes develop.

Nothing publishes on this merge.

[Copilot]

Pull request overview

Promotes the already-reviewed develop documentation updates to main, refining operational guidance around edge-log filtering (X-Blog-Check) and codifying the “negative-result trap” as an evidence requirement, plus updating measured state entries.

Changes:

• Update the outward log-review filter guidance to use X-Blog-Check provenance (and document hand-probe tagging expectations).
• Re-state the “negative-result trap” as an explicit requirement to prove a check could have produced a positive.
• Refresh TODO “State” measurements (hard-linking counts and unattended backup-timer proof) and remove duplicated moving release IDs outside the State table.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
TODO.md	Updates State measurements and rewrites the negative-result rule section to require evidence for empty/negative checks.
OPERATIONS.md	Revises outward-pass log filtering guidance to key off X-Blog-Check rather than user-agent, with additional operational cautions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

TODO.md:34

• This bullet still says the live check runs 1,245 requests, but the State table above (and the URL-contract row) now documents the live check as 328 + 917 + 8 = 1,253. Keeping 1,245 here makes the doc internally inconsistent and could mislead someone validating a deploy.

  - **`HUGO_BASEURL` on the `production` environment is set to `https://blog.insanegenius.net/`**, done 2026-08-07. It held `https://blog.insanegenius.com/`, the live WordPress address, which is what the workflow both builds with and points the live check at, so a deploy would have baked the old platform's address into every canonical tag, feed link and `sitemap.xml` and then run 1,245 requests at the live site to verify it. **Setting it back to `.com` at M7b is the other half and is not done.**

[ptr727]

Answering the suppressed finding, which carries no thread. Fixed in #85.

This bullet still says the live check runs 1,245 requests, but the State table above now documents the live check as 328 + 917 + 8 = 1,253.

I declined this once already, earlier today, on the grounds that the sentence is a counterfactual about 2026-08-07 and the check genuinely was 1,245 that day. That reasoning is correct and it was not sufficient.

Being accurate-as-history is not the same as being useful. A reader validating a deploy meets 1,245 and 1,253 in one file with nothing connecting them, and no way to know one is a vintage. I even wrote at the time that changing it "would be the reverse error" — which is true of editing the number and not of removing it.

The number was never load-bearing. The point is that the check would have been aimed at the old platform, which the sentence makes without a count:

and then run the whole live check at the live site to verify it

1,253 now appears only where it describes the live check as it is; 1,245 appears nowhere. Same reasoning as dropping the duplicated release id in #82 — a value that has to be dated to stay true is better removed than dated.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

checks/check-live-urls.sh:118

• PR description says “OPERATIONS.md and TODO.md are the only files touched”, but this PR also changes checks/check-live-urls.sh (e.g., updated comments at lines 117 and 272). Please either update the PR description to include this file, or drop these edits if the intent is to keep the promotion strictly to those two docs.

# A resource access token opens the proxy's auth gate.
# It goes into a curl config file because bash cannot export an array to the parallel checks.
# A command line is also world-readable in ps output, and every request would carry it.
if [ -n "${PANGOLIN_ACCESS_TOKEN_ID:-}" ] && [ -n "${PANGOLIN_ACCESS_TOKEN:-}" ]; then

[ptr727]

Answering the two suppressed findings, neither of which carries a thread.

The description was stale

PR description says "OPERATIONS.md and TODO.md are the only files touched", but this PR also changes checks/check-live-urls.sh.

Correct. That was true when I wrote it and stopped being true when #85 merged into develop beneath it. A promotion's description describes a moving branch, which is a way for it to go wrong that a normal PR body cannot, and I had not accounted for it.

Rewritten against the actual diff:

OPERATIONS.md             | 12 ++++++++++--
TODO.md                   | 16 ++++++++++------
checks/check-live-urls.sh |  4 ++--

Still documentation and comments only — the check-live-urls.sh change is two comments, no behaviour.

The 1,245 finding, from an earlier round

This bullet still says the live check runs 1,245 requests.

Fixed in #85, which is now in this promotion, and it produced the distinction worth carrying: 1,245 is the URL contract (328 render + 917 redirect) and 1,253 is the live check (contract + 8 media). Both are real.

So two occurrences were genuinely stale and three were correct and deliberately left: the migration post contrasting the contract with the sitemap's 111, the audit report quoting a 2026-08-04 run, and the parity note about a build baked with the wrong host. Plus false positives worth not re-greping — the Adaptec 51245 controller in four 2009 posts, and a PaperMod SVG path.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.