post(devops): it reported success, nothing had changed (EN+ZH) + og/banner

Three silent failures on a network-mounted share: a 403 MB upload that wrote 12.5 MB and returned OK
(the timeout toast arrived minutes later, asynchronously), an os.replace() that never landed while
getsize()/mtime served cached metadata (the destination was still the original H.264 file), and a
byte-count source check that agreed with a length-preserving bad copy. Adds read-back hashing at all
three boundaries (source copy, upload, install) and records the metric traps that hid them: a clean
decode test on wrong pictures, SSIM on near-flat frames, input-seek decoding of open-GOP sources,
stream-copy slices dropping frames, and fixed-name scratch files colliding across concurrent runs.
Audit after the fix: reported=30 landed=29 not-landed=0.

scripts/banner-gen/generate.mjs

@@ -1167,6 +1167,24 @@ BANNERS['every-player-stuttered-the-file-was-fine'] = {
   ],
 };
 
+BANNERS['it-reported-success-nothing-had-changed'] = {
+  titlebar: "root@nas - reported success",
+  lines: [
+    { t: 'prompt', text: "$" }, { t: 'cmd', text: "convert-batch --tier x265" },
+    { t: 'dim', text: "stage: 403,448,100 bytes written" }, { t: 'err', text: "remote: 12,582,912 bytes - reported OK" },
+    { t: 'prompt', text: "$" }, { t: 'cmd', text: "read-back hash -> mismatch, re-upload" },
+    { t: 'ok', text: "hash match - replacing" }, { t: 'hl', text: "verify at every boundary" },
+    { t: 'dim', text: "reported=30 landed=29 not-landed=0" }, { t: 'dim', text: "one writer, zero silent failures" },
+  ],
+  flow: [
+    { n: '1', label: "stage" },
+    { n: '2', label: "upload" },
+    { n: '3', label: "re-read" },
+    { n: '4', label: "hash" },
+    { n: '5', label: "replace" },
+  ],
+};
+
 // ---------- read frontmatter ----------
 const postPath = join(ROOT, 'src', 'content', 'posts', `${slug}.md`);
 let category = 'devops';