docs(project-state): B2o — the four surviving posts written and dated; the other topics dropped with the user's instruction recorded

docs/project-state.md

@@ -604,12 +604,61 @@ start, so publishing added no pages. The number in that message is wrong; the de
   asserted locally (language switch both ways, content, date 2025-02-20, sitemap hreflang pair). Not committed, not
   pushed — the working tree also carries the two generator entries for this slug (additive: 5 / 17 lines, deletions 0).
 
+**Step B2o — (unplanned) The four surviving candidates, written and dated.** 🔵 held for the read
+
+| Slug | Category | `pubDate` | Source |
+|---|---|---|---|
+| `my-backup-was-using-someone-elses-api-quota` | `notes` | 2026-10-15 | Hermes `20261015_170438_0e4312` |
+| `space-reclamation-wasnt-stuck-it-was-waiting` | `devops` | 2026-10-14 | Hermes `20261014_203035_c6b198` |
+| `adding-a-domain-to-someone-elses-mail-server` | `notes` | **2025-05-06** | Hermes `20261014_092537_4759b3` |
+| `embedding-fonts-so-a-pdf-looks-the-same-everywhere` | `engineering` | **2025-01-22** | `numerology-report` `docs/v2/FONTS.md` + Hermes `20261011_085128_453ab1` |
+
+- **What each argues.** (1) A 1 TB restic seed stalled at zero bytes because rclone's **shared** OAuth client was
+  rate-limited (`consumer: projects/202264815644`, `quota_limit_value: 840000`) — own the client, Desktop-app type,
+  Publish the app or the refresh token dies every 7 days, and the callback accepts exactly one request; the old side
+  gave back 1.012 TiB → 3.800 GiB while rclone reported `itemNotFound` *after* finishing. (2) The DSM Storage Manager
+  card reads `running` 24×7 by design (`run_all_time`, `schedule_table` 168×1) — free space actually came back
+  +69.0 / +46.8 GiB at the 09:29/09:34 snapshot rotations while the recycle bin held 5 GiB and the afternoon wrote
+  −47.2 GiB; retention 1 means a delete frees only at tomorrow's rotation. (3) Inbound needs four records and worked
+  first try; outbound hit `554 5.7.1` (no PTR, 4 RBLs clean) and the relay hit `550-From header sender domain not
+  verified`; **PTR is one per IP, not per domain**, forwarding needs Sieve and still cannot leave the box, so the
+  design that survives is a receiving-side POP pull — verified now: forward `mail.hoelee.com → 41.216.187.102`
+  resolves, the reverse lookup for that IP still returns nothing. (4) Four families / eight static faces embedded:
+  static only because the PDF engine's parser reads `glyf`/`loca` and ignores `fvar` (variable fonts resolve to
+  Thin 100 / ExtraLight 200), `font-weight: 600` rewritten to `bold` for the PDF side only, GB2312 ∪ Big5 subsetting
+  silently cut real name characters (犇 骉 頔 祎 廸 玧 祾 赟 堃), and a glyph lint that fails the build.
+- **Dates and their justification.** The two 2026 posts are pinned by their own evidence (the seed's quota errors and
+  today's samples) and ship on their real work dates; 2026-10-14 now carries two posts (this one and the QSV
+  calibration) — within the E7 limit of ~3–5. The two 2025 dates are **backdating**: both have no calendar date, no
+  quoted log timestamp and no checkable version pin in the prose (verified: the mail post's only month reference was
+  removed, the fonts post cites no engine version). They fill 2025-05 (between 2025-03-19 and 2025-06-11) and
+  2025-01 (between 2024-12-10 and 2025-02-20) — both confirmed in the built feed, monotonic, at positions 64 and 67.
+  `updatedDate` = 2026-10-16 on all four, so every `lastmod` is the real day.
+- **State:** EN + ZH written (`rewrap_post.py` → `wrap_lists.py` on EN only, ZH one paragraph per line); og + banner
+  generated and **measured** for all four (`rows=1 overflow=0`, banner 8 rows `delta=2 overflow=0`); build clean at
+  **163 pages**; 8 `dist/` pages asserted (language switch both ways, dates, content, sitemap hreflang, images).
+  ⚠ Not committed and not pushed — `draft: false` locally, untracked in the working tree, alongside the generators'
+  four new `TERMINALS`/`BANNERS` entry sets (+20 / +68 lines, deletions 0).
+- **Internal links:** the two recent posts link backwards (to `running-production-infrastructure-solo`, 10-06;
+  `it-reported-success-nothing-had-changed`, 10-08; `your-disk-full-alert-is-lying`, 06-24). The two backdated posts
+  carry **no prose links** — every post they would naturally cite is dated later, and a backdated post may only link
+  backwards. Their "related posts" rows are the theme's automatic ones, which every backdated post already has.
+
 **Step B2m — The next-session topic queue (user decision 2026-10-16).** ⬜
 
 From the same sweep, **explicitly not to be written**: the Photoshop "closes every five minutes" post (#6 in the
 sweep) and the Shopee abnormal-status / voucher-card post (#12). Everything below is queued, in the user's requested
 order of interest, each with its source session:
 
+> ⛔ **Dropped by the user on 2026-10-16 — do not write these, do not publish them.** Of the seven candidates below,
+> only #2 (rclone/Drive), #4 (NAS space reclamation), #6 (mail domain/PTR) and #7 (embedded fonts) survive; they are
+> written and dated in **Step B2o**. The other three are dead: **#1 The Packaged App 404'd Its Own CSS**, **#3 The UI
+> Said "Idle" / the savings ledger** and **#5 The Scan Failed Because an HTML Error Page Was Parsed as JSON**. The
+> same instruction killed the four candidates that surfaced later the same day and were never entered here — the
+> pause-button hole (`pause_now` only killing when `self.running and self.pid`), the ten rows that passed a gate that
+> did not exist yet, one-file-one-worker, and the empty-path 400. **Do not resurrect any of them without a fresh
+> request from the user.**
+
 > **Which of these can carry a deep historical date (the user's 2026-10-16 question).** Deep backdating needs a post
 > whose *facts are undated* — no calendar date, no quoted log timestamp, and no version whose release date is
 > checkable. In this queue that is **only two**: the mail-server/PTR post (concepts, no events) and the PDF