[logmeister] Sitemap render aborts on a soft-deleted post: channel query returns tombstones

[Seifert69]

GET /sitemap.xml aborts on any identity that has soft-deleted a post in a channel.
The sitemap query returns the deleted post's tombstone, whose header content is blank, and
the render throws on it.

Root cause — three things line up:

1. A soft delete writes a tombstone (DriveStorageServiceBase.WriteDeletedFileHeader,
   :1817-1859) that keeps FileType/UserDate but sets AppData.Content = "" and
   Payloads = null. So it still matches FileType = [PostFileType] and sorts among live
   posts.
2. FileQueryParams.FileState defaults to null and QueryBatch.cs:335 only filters on
   it when set — so batch queries return tombstones unless the caller opts out.
   FollowerService.cs:392, PeerOutgoingTransferService.cs:232 and
   V2DriveBatchFileWriteOperationsController.cs:79 all pass FileState.Active; the
   three queries in HomebaseChannelContentService (GetChannelPosts, GetChannelPostIds,
   QueryBatchFirstFile) do not.
3. DriveQueryServiceBase.cs:412-419 detects FileState.Deleted, logs
   Creating Client File Header for deleted file, and falls through — the code that
   would build a deleted header is commented out.

GetChannelPostIds (HomebaseChannelContentService.cs:158-159) then calls
Deserialize<PostContent>(""), gets JsonException, and the whole render aborts.

Evidence: every occurrence traced (2026-08-30, 2026-09-01) has the deleted-file
debug line for the same file, under the same correlation id, immediately before the
public-posts channel is processed. On bleeding-edge two more identities fail the same
way after their own deleted-file lines. Same tombstone causes #1699 via a different
throw site (Payloads == null).

Suggested fix

• Add FileState = [FileState.Active] to the three FileQueryParamsV1 in
  HomebaseChannelContentService. Fixes this and [logmeister] ParsePostFile throws on a soft-deleted post's null Payloads (channel preview, post preview, SSR channel page) #1699; also stops GetChannels /
  GetChannelDrive from picking a deleted channel-definition file.
• Optionally wrap the per-post deserialize in GetChannelPostIds in a try/catch that
  logs the FileId and skips that post.
• Withdrawn: the earlier suggestion to fall back to the default payload. A tombstone
  has Payloads = null; it would throw on the next line.
• Decide what DriveQueryServiceBase.cs:412-419 should do — restore the deleted-header
  path or remove the dead branch. Today the log claims one thing and the code does another.

Occurrences: 11 on production, 2026-08-29..09-01, one identity, caller anonymous.

---

Maintained by logmeister. This body is revised in place as evidence changes, so it does
not contradict itself — see the comments for the changelog. Identity domains redacted.

logmeister-fp: 1c83b513

[Seifert69]

Superseded — this comment's analysis has been folded into the issue body, which is now
the current version.

Two claims here were wrong and have been removed rather than left to mislead:

• "Every post in public-posts is degraded" — based on 9 of 9 posts having no slug.
  PostContent.Slug is optional and authors routinely leave it blank; the fileId
  fallback is the deliberate handling. No writer-side defect. Nothing to investigate
  on that front.
• "Skip the unparseable post" — that would silently drop legitimate posts from the
  sitemap. The correct fix (payload fallback) is in the body.

Still accurate and kept in the body: the route is GET /sitemap.xml, the failing channel
is public-posts while 781 posts in other channels parse fine, and the fileId of the bad
post is never logged because the log line runs after the parse.

[Seifert69]

Changelog — the issue body above is kept current; this records what changed.

2026-09-02 — Root cause found: the failing post is a soft-delete tombstone
(Content = "", Payloads = null) that the channel query returns because it never
filters FileState. That makes this and #1699 the same defect with one fix. The
previously suggested payload fallback is withdrawn — a tombstone has no payload, so
it would have thrown on the next line. Not one corrupt file: any identity that
soft-deletes a post in a channel loses its sitemap.

2026-09-01 — Reframed from "malformed post data" to "missing payload fallback", after
Michael pointed out the post slug is optional. Superseded by the above.

2026-08-31 — First filed. Route identified, occurrence history established.