`web/scripts/publish.sh` writes the posts to lance.blue's repository as standard.site records. It runs at the end of a deploy, not on `git push`: a document record carries the post's address, and between a push and an address that answers sit an infra edit, an apply and an invalidation. So it refuses to publish a post the site is not already serving. It compares the live page's canonical link rather than its status code, because CloudFront answers a missing key with the app's index.html and a 200. The publication record and its `.well-known` key are made once by hand with `sequoia init`, which writes both the file and the URI in sequoia.json; a test checks the two agree.