Distillation

Date: Aug 5, 2026

• 🔴 (13:43) User reported a validation fetch failure for site.standard.document record rkey=3ddlziywd523h: context deadline exceeded (Client.Timeout exceeded while awaiting headers) from https://meadow.us-east.host.bsky.network/xrpc/com.atproto.repo.getRecord.
• 🟡 (13:44) Public API checks returned HTTP 400 for public.api.bsky.app and bsky.social; the displayed URLs encoded the query separators as %26 inside the repo parameter rather than sending separate repo, collection, and rkey parameters.
• 🟡 (13:44) DID resolution for did:plc:kl3s4yablm3fgnxfkn47uy5r identified the handle byk.im and PDS endpoint https://meadow.us-east.host.bsky.network.
• 🔴 (13:44) User’s deployment requirement is that a transient standard.site/PDS publishing problem never fails deploy.
• 🔴 (13:44) User’s deployment requirement is that a mid-run publishing failure never strands the blog without its live records.
• 🔴 (13:44) User’s safety requirement is that an empty or broken manifest must never be able to wipe the whole site.standard.document collection.
• 🟡 (13:44) .github/workflows/deploy.yml uses BSKY_APP_PASSWORD: ${{ secrets.BSKY_APP_PASSWORD }} at the job level; the publish step runs only when the secret is nonempty via if: ${{ env.BSKY_APP_PASSWORD != '' }}, uses continue-on-error: true, and executes node scripts/publish-standard-site.mjs after withastro/action@v6.
• 🟡 (13:44) .github/workflows/deploy.yml deploys GitHub Pages in a separate deploy job with needs: build, using actions/deploy-pages@v5; the publish step’s continue-on-error: true allows the Pages deployment to proceed after a publisher failure.
• 🟡 (13:44) scripts/publish-standard-site.mjs resolves the handle through https://public.api.bsky.app, resolves the DID’s PDS, authenticates with com.atproto.server.createSession, and refuses publication if the authenticated DID differs from the DID embedded in the manifest AT-URI.
• 🟡 (13:44) scripts/publish-standard-site.mjs publishes/upserts the publication and all current document records with com.atproto.repo.putRecord, passing validate: false because the PDS does not host the site.standard.* lexicons.
• 🟡 (13:44) scripts/publish-standard-site.mjs uploads image blobs before putRecord; unchanged content-addressed blobs make reruns no-ops, while missing or oversized images are published without the image rather than failing.
• 🟡 (13:44) scripts/publish-standard-site.mjs performs orphan cleanup only after all current records have been upserted, so a failure during publication occurs before deletion of existing records.
• 🟡 (13:44) scripts/publish-standard-site.mjs skips orphan cleanup when manifest.documents.length === 0 and warns manifest has no documents — skipping orphan cleanup to avoid deleting every record; otherwise it lists existing records, computes orphan rkeys against the manifest keep-set, and deletes them.
• 🟡 (13:44) The observed repository state was master...origin/master with only the intentionally preserved untracked src/content/posts/teaching-my-agent-to-wait.mdx; commits shown were 5400235 fix: use TIDs for standard.site documents and its parent 915acea Modernize CI actions and drop unused page collection.
• 🟡 (13:44) Diagnosis distinguished the current problem from TID validation: the validator accepted the TID format, while the record was either not published or unreachable because the PDS request timed out; the code push itself did not publish records automatically.