Three findings, one real

Investigation of the open items after #3688. All figures measured against live production and the repo at 224130ff1 on 2026-08-23. Two of the three dissolved on inspection, including one that was entirely my error. The sections say so rather than quietly dropping them.

1. The HTML-side Vary cannot work and my fix for it is inert

Pick what produces the response. The winner of the Vary header is not the layer you configure, it is the layer that builds the response.

Response produced by

URL probed	App-rendered?	Vary observed in prod
`/favicon.svg`	no	Accept, Accept-Encoding, User-Agent
`/robots.txt`	no	Accept, Accept-Encoding, User-Agent
`/llms.txt`	route handler	rsc, next-router-...
`/openapi.json`	route handler	rsc, next-router-...
`/docs/getting-started`	page	rsc, next-router-...
`/api/md` (bot on /docs/*)	handler sets its own	Accept, Accept-Encoding, User-Agent

The decisive probe is /llms.txt. Middleware sets rate-limit headers on it, and they arrive:

ratelimit-limit: 120
ratelimit-policy: 120;w=60
ratelimit-remaining: 118
vary: rsc, next-router-state-tree, next-router-prefetch, ...

So middleware headers are not being dropped. Vary specifically is overwritten, because Next owns it on any app-rendered response (base-server.js setVaryHeader). That makes the middleware branch I added for the HTML side dead code: it runs, sets the header, and the value never reaches a client.

2. Analytics writers I called 3 dead; none is

Correction. I read the peer-compare rule out of the doctor skill text and applied it to the raw file mtimes. The hook that implements that rule already classifies two of the three, and the third was fixed on main a day earlier. Reading the implementation before reporting would have caught all of it.

File	Idle	Repo's own classification	Verdict
`dx-signals.jsonl`	139d	`RETIRED_WRITERS`: no code has ever written it, the file is a leftover	not a defect
`secret-audit.jsonl`	103d	`EVENT_DRIVEN_WRITERS`: writes only when a secret is handled, silence is correct	not a defect
`cache-breaks.jsonl`	140d	writer restored in #3678 (`f6180dd75`, on main). The running plugin is alpha.49, whose bundle carries 0 references to it; alpha.50 does.	already fixed

All three collapse to zero defects. The last row in cache-breaks.jsonl is dated 2026-04-05, and the writer that fills it was restored on main in #3678. This session runs alpha.49, whose bundle contains no reference to that file at all, so the staleness is an install-version artifact and not a dead hook. The detector's own header warns against exactly the inference I nearly made: it is dispatched by prompt/unified-dispatcher and has no direct entry in hooks.json or the entries map BY DESIGN, so the two-surface check reports a false positive on it. session-start-perf.jsonl, named dead at 136d in the same history, now writes every 2h.

3. Two advertised pages answer agents with markup the mdTarget gap

llms.txt points agents at five .md twins. Pick a page to see what a crawler actually receives on the bare URL.

Page an agent asks for

Page	Advertised in llms.txt	`.md` twin	Bot on bare URL	In mdTarget()
`/developers`	yes	HTTP 200	text/markdown	yes
`/yonyon`	yes	HTTP 200	text/markdown	yes
`/pricing`	yes	HTTP 200	text/html	no branch
`/api-policy`	yes	HTTP 200	text/html	no branch
`/auth`	yes (`/auth.md`)	HTTP 200	no HTML page exists	n/a

The twins exist, return 200, and carry frontmatter. Only the routing is missing: MARKDOWN_TWIN_SLUGS lists developers and yonyon and stops there, so an agent following our own advertised convention gets markup on two of the four.

What each finding implies

Vary. Revert the middleware HTML branch, it provably does nothing. Keep the handler-set values, which are what closed the damaging direction. Document that the mild direction is not fixable while Next owns vary on app-rendered responses.
Analytics. Nothing. All three are explained; the finding is retracted.
mdTarget. NOT by adding the slugs to MARKDOWN_TWIN_SLUGS: that list drives /api/page-md/<slug>, and neither page has a renderer there, so it would rewrite to a 404. The twins are standalone routes (app/pricing.md/route.ts), so mdTarget() needs its own branch mapping /pricing to /pricing.md and /api-policy to /api-policy.md.

Measured against live prod and repo 224130ff1 before any of it was fixed. Findings 1 and 3 landed in #3690 (the inert HTML-side Vary removed, /pricing and /api-policy routed); finding 2 needed no code. This page is kept as the evidence that motivated them, so the measurements stay with the reasoning rather than being rewritten to match the outcome.