log-analysis

A loose completion gate called a half-written answer done. One audit produced four fixes: pre-answer failure patterns, an anchored heading gate, probe-copy.

TL;DR: The scraper kept cutting AI answers short because loose completion gates matched "Sources" inside citation lines. The fix narrows trust: failure patterns only count before any answer text, and the completion gate requires a contracted final heading via a strict regex. Added a --probe-copy diagnostic and evidence logging; selftest grew from 72 to 79 asserts.

An hourly wave of 504s looked like an attack. The logs pointed at a dormant rate limit and a PHP-FPM pool out of workers.

TL;DR: Hourly 504 waves looked like a DDoS but were actually PHP-FPM worker exhaustion, worsened by request_terminate_timeout killing slow requests. Nginx rate limiting never fired because Cloudflare hid real client IPs, collapsing everyone into one $binary_remote_addr bucket. Fixes: enable Cloudflare caching, tune PHP-FPM pool settings, and rotate container logs with copytruncate.