A post that has been published carries an `atUri` in its frontmatter, and the layout renders it as `<link rel="site.standard.document">` beside the canonical link. A post without one renders no tag: an href with nothing behind it is a claim a verifier follows and finds missing. The tag is rendered from the post rather than injected into dist/ after the build, so it is in the HTML the build produced and does not depend on a publishing tool's local state. push.sh gives the publication key an explicit text/plain type. It has no extension, so the sync guesses a download; the key itself arrives later, when the publication record exists.