docs(project-state): B2l + B2m — the drei posts held for review, and the next-session topic queue

docs/project-state.md

@@ -156,7 +156,7 @@ should be edge-cached — lower TTFB and less origin traffic through the tunnel.
 **Step E8 — Small hygiene backlog.** ⬜
 
 - [ ] `scraping-bot-walled-marketplace-warm-browser-session`: OG card exists, **banner 404s** (no `banner:` in frontmatter, no PNG). Generate it or accept it as the one exception.
-- [ ] `authentik-css-greater-than-bug` (the `>` bug) is complete in EN + ZH but still `draft: true` since 2026-09-20 — the last item in the draft bank; publish it with images.
+- [x] ✅ `authentik-css-greater-than-bug` (the `>` bug) — **published 2026-10-16 (`2295c0f`)**: `draft: true → false` in EN + ZH, `pubDate` kept at 2026-09-20 with **`updatedDate: 2026-10-16`** so `lastmod` stays honest, OG + banner generated (og `rows=1 overflow=0`; banner `delta=2 overflow=0`), and the CTA's displayed phone corrected (`011-797 2969` → `+60 12-797 2969`). Verified live: EN/ZH/og/banner all **200**, language switch both ways, `/posts/` order still monotonic. The draft bank is now empty.
 - [ ] `og-default.png` has **no face**; the homepage and category pages share it. Regenerate after Step A1 (same source asset).
 - **Done when:** no page references a 404 image, the draft bank is empty, and the default share card matches the A1 photo.
 
@@ -538,6 +538,46 @@ from a normal Chrome UA — so "0 pageviews after a headless test" is not a bug.
 - ⚠ **Reminder for the next session:** the assertion method matters — hrefs must be checked against **raw** HTML, not the
   tag-stripped text (a first pass reported the CTA and cross-links "missing" because tag-stripping removes `href`).
 
+**Step B2l — (unplanned) Three posts written from the 2026-10-09 → 10-16 sessions, held for the user's read.** 🔵
+
+Per the user's instruction of 2026-10-16 ("先写出来，我看了过后，确认后再发"), these three are **written, built and
+image-complete but deliberately not committed and not pushed** — they are untracked files in the working tree while
+they wait for a read. **A parallel session's `git add -A` would sweep them in — never stage blindly in this tree.**
+
+| Slug | Category | Proposed `pubDate` | Source session (Hermes id) | What it argues |
+|---|---|---|---|---|
+| `calibrating-intel-quick-sync-hevc-quality` | `tutorials` | 2026-10-14 | `20261014_132458_102ffe` | The full QSV calibration: ICQ 18–22 inflate thin sources (size gate 176.8/141.8/107.6%), the usable range starts at 24, the quality cliff sits **between 28 and 30**, excerpts rank quality but **never** speed (fast == medium byte-for-byte, 168,435,266 B), the four traps (`/lib` mount, `rgb24` rate control, `SKIP already HEVC hvc1`, one QSV job at a time) |
+| `docker-reported-exit-0-the-oom-killer-disagreed` | `devops` | 2026-10-16 | `20261016_034103_770729` | "Container stopped unexpectedly" while `docker inspect` reports `ExitCode 0` / `OOMKilled=false` — the truth was 6 cgroup OOM kills in dmesg (uptime stamps matching `FinishedAt`), driven by a crawler flood (25,976 IPs / 50k lines, 33,636×403 + 16,082×429); fix = 512M → 2g + `memswap_limit: 2g`, labelled a stopgap; plus the "my own bare curl got 403" verification trap |
+| `the-dialog-opened-in-7-seconds-my-script-waited-5` | `ai` | 2026-10-15 | `20261014_203311_1682fa` | The LinkedIn cron's "composer dialog did not open" was a race: dialog +1.8 s, buttons +2.8 s, editor **+7.2 s**, script slept 5 s and looked once; the swallowed-click defect (identical click ignored 75 s, then accepted in 2 s); and the silent failure underneath — a 72 h approval TTL against a 12-day queue |
+
+- **State of each:** EN + ZH written; `rewrap_post.py` → `wrap_lists.py` applied to the EN files (ZH untouched, one
+  paragraph per line); OG + banner generated and **measured** (`measure_og_banner.py` → PASS on all four pairs);
+  `npm run build` clean (155 pages, no duplicate-id warning); all 8 `dist/` pages verified locally (language switch
+  both ways, content assertions from whitespace-normalised tag-stripped text, listing order monotonic on `/posts/`,
+  `/` and `/zh/`).
+- ⚠ **The generators already carry all four `TERMINALS`/`BANNERS` entry sets** — the three for these posts rode into
+  `2295c0f` together with the authentik entry (git stages whole files). They are inert until a slug is actually
+  generated, so publishing each post needs only its two `.md` files plus its two PNGs.
+- **To publish one:** confirm the real `pubDate` (`date`, and the newest `<time>` on the live `/posts/`), then
+  `git add` the four explicit paths (post EN/ZH + og + banner) and push `origin main`; verify the four URLs 200.
+
+**Step B2m — The next-session topic queue (user decision 2026-10-16).** ⬜
+
+From the same sweep, **explicitly not to be written**: the Photoshop "closes every five minutes" post (#6 in the
+sweep) and the Shopee abnormal-status / voucher-card post (#12). Everything below is queued, in the user's requested
+order of interest, each with its source session:
+
+| Topic | Category | Source | The hook |
+|---|---|---|---|
+| Moving a 1.5 TB cloud backup OneDrive → Google with rclone | `notes` | `20261015_170438_0e4312` | seed stalled at 0 bytes/90 s with 159 `rateLimitExceeded`; `gcloud` holds only a TTS service account so the console is the critical path; the credential must be a **Desktop app** client for rclone's redirect |
+| The UI said "idle", the memory guard had refused 83 times | `devops` | `20261015_232854_2d9fc2` | lanes blocked 83× (34-minute waits) reported as idle; and the "savings" ledger lying — `SUM(size − out_size)` with rounded estimates, 632 of 688 rows `size ≈ out_size`, lifetime total fell 37.0 → 12.46 GB while the row count grew 591 → 670 |
+| Your NAS didn't hang — 121 GiB came back while you weren't looking | `devops` | `20261014_203035_c6b198` | 5-minute free-space samples: two snapshot rotations +69.0 / +46.8 GiB, recycle bin held only 5 GiB, then −47 GiB of new writes; regrowth + snapshot retention ≠ a stuck job |
+| The scan failed because an HTML error page was parsed as JSON | `devops` | `20261015_200429_37ec35` | `SyntaxError: Unexpected token '<'`; the real cause was a CJK path printed to a GBK console → `UnicodeEncodeError` killed 3 jobs at their own first log line |
+| Adding a domain to someone else's mail server | `notes` | `20261014_092537_4759b3` | PTR is **per IP, not per domain**; forward-confirmed rDNS uses postfix's own HELO name; a new domain still needs MX/SPF/DKIM/DMARC + a verified SMTP2GO sender; forwarding still dies on `p=reject` |
+| The router that 401s `/v1/models` and serves chat completions with no key | `ai` | `20261015_210913_47cca4` | two Google-login connections (7 + 11 live models), `REQUIRE_API_KEY=false` with an empty key table, a dead `gemini-3.1-pro` alias |
+| Embedding fonts so a PDF looks the same on any machine | `engineering` | `20261011_085128_453ab1` | four families + weights fixed in-repo instead of trusting the server or the reader's machine ⚠ pull the final implementation detail from the session/docs first — the session moved on mid-topic |
+| Housekeeping (not posts): E1 CF Web Analytics + GSC sitemap, E3 syndicate 2–3 flagships, A1 author photo, E8 `og-default.png` face + the one banner-less post | — | — | these still outrank writing anything new, per the 2026-09-29 audit |
+
 ### Phase C — Discovery & structure (Tier 2)
 
 **Step C1 — Per-post custom OG images.** ✅ Done (verified live 2026-09-29)