post: four posts — rclone/Drive quota, DSM space reclamation, mail domain/PTR, embedded fonts (EN+ZH) + og/banner

- my-backup-was-using-someone-elses-api-quota        (notes,       2026-10-15, pinned by its own evidence)
- space-reclamation-wasnt-stuck-it-was-waiting       (devops,      2026-10-14, pinned by its own samples)
- adding-a-domain-to-someone-elses-mail-server       (notes,       2025-05-06, backdated: no date/version pins)
- embedding-fonts-so-a-pdf-looks-the-same-everywhere (engineering, 2025-01-22, backdated: no date/version pins)
All four updatedDate 2026-10-16 so every lastmod stays honest; the two backdated posts carry no prose links
(a backdated post may only link backwards). og measured rows=1/overflow=0, banners 8 rows/delta=2/overflow=0.

scripts/banner-gen/generate.mjs

@@ -1288,6 +1288,74 @@ BANNERS['two-ways-a-javascript-file-stops-working-and-looks-fine'] = {
   ],
 };
 
+BANNERS['my-backup-was-using-someone-elses-api-quota'] = {
+  titlebar: "root@dsm - 1 TB seed, 0.27%",
+  lines: [
+    { t: 'prompt', text: "$" }, { t: 'cmd', text: "rclone about gdrive-restic" },
+    { t: 'dim', text: "2.88 GB of ~1075 GB uploaded - 0 snapshots" }, { t: 'err', text: "403 Quota exceeded - consumer projects/202264815644" },
+    { t: 'prompt', text: "$" }, { t: 'cmd', text: "own OAuth client - Desktop app - Publish app" },
+    { t: 'ok', text: "the seed spends my quota now" }, { t: 'hl', text: "the callback accepts ONE request: no reload, no second tab" },
+    { t: 'dim', text: "old side: 1.012 TiB -> 3.800 GiB reclaimed" }, { t: 'dim', text: "guid = sha256(id): repointing a plan cannot fork history" },
+  ],
+  flow: [
+    { n: '1', label: "find what writes it" },
+    { n: '2', label: "repoint the repo" },
+    { n: '3', label: "own the client" },
+    { n: '4', label: "seed" },
+  ],
+};
+
+BANNERS['space-reclamation-wasnt-stuck-it-was-waiting'] = {
+  titlebar: "root@nas - volume1, 09:29",
+  lines: [
+    { t: 'prompt', text: "$" }, { t: 'cmd', text: "df -h /volume1  (every 5 min)" },
+    { t: 'dim', text: "08:59-09:24 flat at 1134.1 GiB" }, { t: 'ok', text: "09:29 +69.0 GiB - Class snapshot rotated" },
+    { t: 'ok', text: "09:34 +46.8 GiB - Video snapshot rotated" }, { t: 'err', text: "15:34 +5.0 GiB - the recycle bin held almost nothing" },
+    { t: 'hl', text: "retention 1: a delete frees at tomorrow's rotation" }, { t: 'dim', text: "the afternoon wrote -47.2 GiB: reclaim was a rounding error" },
+    { t: 'dim', text: "volume1 98% used - volume2 100%" },
+  ],
+  flow: [
+    { n: '1', label: "sample the number" },
+    { n: '2', label: "read the schedule" },
+    { n: '3', label: "know retention" },
+    { n: '4', label: "alert on the trend" },
+  ],
+};
+
+BANNERS['adding-a-domain-to-someone-elses-mail-server'] = {
+  titlebar: "mail.hoelee.com - one more domain",
+  lines: [
+    { t: 'prompt', text: "$" }, { t: 'cmd', text: "add domain + MX/SPF/DKIM/DMARC" },
+    { t: 'ok', text: "inbound works first try - RCPT_MAILCOW_DOMAIN" }, { t: 'err', text: "outbound: 554 antispam policy (4 RBLs clean, no rDNS)" },
+    { t: 'err', text: "via relay: 550 From header sender domain not verified" }, { t: 'hl', text: "PTR is per IP - every domain shares one reverse record" },
+    { t: 'dim', text: "forwarding needs Sieve, and still cannot leave the box" }, { t: 'dim', text: "a relay needs a verified sender per domain, forever" },
+    { t: 'prompt', text: "$" }, { t: 'cmd', text: "POP pull on the receiving side" },
+  ],
+  flow: [
+    { n: '1', label: "four records" },
+    { n: '2', label: "test from outside" },
+    { n: '3', label: "check the reverse" },
+    { n: '4', label: "pull, don't forward" },
+  ],
+};
+
+BANNERS['embedding-fonts-so-a-pdf-looks-the-same-everywhere'] = {
+  titlebar: "report.pdf - what is really inside",
+  lines: [
+    { t: 'prompt', text: "$" }, { t: 'cmd', text: "pdffonts report.pdf" },
+    { t: 'err', text: "before: one CJK face + Roboto, bold was synthetic" }, { t: 'dim', text: "variable font: parser reads glyf only, ignores fvar -> Thin 100" },
+    { t: 'ok', text: "after: 8 static faces, 4 families, embedded" }, { t: 'hl', text: "font-weight 600 -> rewritten to bold for the PDF engine" },
+    { t: 'dim', text: "GB2312 subsetting cut real name characters: 犇 骉 頔 祎 堃" }, { t: 'dim', text: "glyph lint fails the build instead of printing a box" },
+    { t: 'prompt', text: "$" }, { t: 'cmd', text: "page counts: zh 23/23, en 28/29, bm 30/30" },
+  ],
+  flow: [
+    { n: '1', label: "files in the repo" },
+    { n: '2', label: "static cuts only" },
+    { n: '3', label: "map two weights" },
+    { n: '4', label: "lint every glyph" },
+  ],
+};
+
 // ---------- read frontmatter ----------
 const postPath = join(ROOT, 'src', 'content', 'posts', `${slug}.md`);
 let category = 'devops';