docs: record what landing pull request 4 found

docs/landing-pull-request-4.md

@@ -0,0 +1,160 @@
+# Landing pull request 4
+
+https://github.com/atlantic-blue/transcript/pull/4
+
+Title: fix: report what the platform actually answered instead of a missing video
+Branch: `diagnose-the-boundary-and-report-the-real-cause`
+Head before: `84d9fe3`
+Head after: `84d9fe3`
+
+I read this repository on 1 September 2026. I fetched first, then I read.
+
+## What I resolved
+
+Nothing. There was no conflict.
+
+`origin/main` is at `3b5f6cc`. That commit is already the base of the branch. `git merge origin/main`
+answered "Already up to date". The merge wrote no commit. The merge changed no file. I did not
+rebase. I did not force push.
+
+I pushed the branch. Git answered "Everything up-to-date". GitHub reports the pull request as
+`mergeable=true` and `mergeable_state=clean`.
+
+## What I fixed
+
+Nothing in the code. I changed no file on the branch.
+
+Every gate that can run here passes. I ran each gate as one command. I read each result before I ran
+the next command. I sent no gate into `tail` or `grep`, so each exit code is the exit code of the
+gate.
+
+    npm ci                                    exit 0
+    npm run typecheck                         exit 0
+    npm run lint                              exit 0
+    npm run test:count                        exit 0   tests: 114 total, 114 passed, 0 failed
+    npm run build                             exit 0   bundle 7.13 MB, worker 1641 bytes
+    TABLE_NAME=unused npm run verify:package  exit 0   GET / answered 200 with 4697 bytes
+    terraform fmt -check -recursive           exit 0
+    terraform init -backend=false             exit 0
+    terraform validate                        exit 0   Success
+
+## The check that stays red
+
+The failing check is `plan and apply`. It belongs to the `deploy` workflow. That workflow starts on
+a push to `main`. It also starts on a manual start. It does not start on a pull request. So
+`gh pr checks 4` prints two checks and exits 0. It does not print this one. Read the commit instead:
+
+    gh api repos/atlantic-blue/transcript/commits/84d9fe37/check-runs \
+      --jq '.check_runs[] | "\(.name) \(.conclusion)"'
+
+    plan and apply   failure
+    infrastructure   success
+    code             success
+
+The failing job is here:
+
+https://github.com/atlantic-blue/transcript/actions/runs/33387270234/job/99472620061
+
+`gh run view --log-failed` answered with an empty file. I read the log through the interface
+instead, with `gh api repos/atlantic-blue/transcript/actions/jobs/99472620061/logs`.
+
+## What the log says
+
+The deploy worked. Terraform planned. Terraform applied. The function url answered 200. The front
+page answered 200.
+
+The job failed on its last step. That step asks the deployed page for a transcript. The page
+answered 502 eight times over four minutes:
+
+    attempt 1 answered 502, the distribution may still be spreading
+    ... eight attempts, thirty seconds apart ...
+    the page answered 502 with 4777 bytes, and said:
+      The platform refused this page, not your video
+
+## I confirmed the cause against the running system
+
+I took three readings on 1 September 2026. I did not take them from the code.
+
+1. The deployed page. `https://dm60tfc2fh2e6.cloudfront.net/videos?id=gyN9lV9QgyA` answered 502 with
+   4777 bytes. Its title is "The platform refused this page, not your video".
+
+2. The function log. Log group `/aws/lambda/transcript-handler` in eu-west-1, at
+   2026-09-01T07:55:53.207Z, one second after my own request:
+
+       {"event":"watch_page_unreadable","video_id":"gyN9lV9QgyA","cause":"bot_check",
+        "status":200,"bytes":1381407,"has_video_details":true,"has_caption_tracks":false,
+        "has_player_response":true,"playability":"LOGIN_REQUIRED",
+        "playability_reason":"Sign in to confirm you are not a bot",
+        "markers":["not a bot","consent","sign in"]}
+
+   The platform answers 200. It sends a bot check. It sends no caption tracks.
+
+3. The same code, run from this sandbox. `npm run test:live` exited 0. It read 560 caption segments
+   and 18861 characters from video `gyN9lV9QgyA`.
+
+Reading 3 against reading 2 is the diagnosis. One code base. Two addresses. Two answers. The code is
+not the fault. The address the function calls from is the fault.
+
+## The failure comes from `main`
+
+Every `deploy` run in this repository failed. The runs on `main` failed too.
+
+    33387270234  diagnose-the-boundary-and-report-the-real-cause  84d9fe37  failure
+    33386170462  diagnose-the-boundary-and-report-the-real-cause  9f98ba0c  failure
+    33313972826  main                                             3b5f6cc2  failure
+    33313802106  fix-the-function-url-answers-instead-of-403      19004078  failure
+    33312928308  main                                             75b62fb2  failure
+    33312819570  main                                             75b62fb2  failure
+    33311209287  main                                             e61e38df  failure
+
+I read the log of run 33313972826, which is `main` at `3b5f6cc`. It failed on the same step. It
+answered 404 eight times. Before this pull request the page called a refusal a missing video. After
+this pull request the page answers 502 and names the refusal. The check is still red. It is now red
+about the right thing.
+
+So pull request 4 does not cause this failure. It inherits it.
+
+## Why I changed nothing
+
+- The failing step is a correct gate. It asks the deployed page for a transcript. It fails when it
+  does not get one. To make it pass I must weaken it, and the product stays broken.
+- To pass the bot check, the function needs a different address to call from. Each way to get one
+  bills money while nobody visits: a network address translation gateway, an always on proxy, or a
+  paid proxy service. The project context refuses the first two by name. It says what to do instead:
+  do not build it, say so in the answer, and let a person decide.
+- I cannot test a fix from here. This sandbox is not refused, so a change made here passes for the
+  wrong reason. The only place to test it is a real deploy, and a deploy from a sandbox is not
+  allowed.
+- A new way to fetch is a second intention. This pull request reports the real cause. How the
+  function reaches the platform belongs in its own pull request, with its own evidence.
+
+## What a person decides next
+
+The product cannot read a transcript from AWS Lambda in eu-west-1. The platform refuses that
+address. Somebody must choose one of these. Each one costs money while nobody visits:
+
+- a network address translation gateway, so the function calls from an accepted address;
+- a paid proxy service;
+- an always on host outside AWS.
+
+The project context refuses the first by name. It refuses always on hosts by name. So this is a
+decision, not a task to build.
+
+## The run this report started
+
+The push to pull request 4 started no run. The merge moved nothing, and the `deploy` workflow does
+not start on a pull request.
+
+This file ships in its own pull request, cut from `origin/main` at `3b5f6cc`:
+
+https://github.com/atlantic-blue/transcript/pull/12
+
+The push to that branch started this run, and it passed:
+
+https://github.com/atlantic-blue/transcript/actions/runs/33484742957
+
+I read the log, not the colour. The `code` job printed "tests: 75 total, 75 passed, 0 failed", it
+built a 7.13 MB bundle, and it printed "the package starts and serves". The count is 75 because this
+branch comes from `main`. The 114 tests are on the branch of pull request 4. The `infrastructure`
+job checked the format and validated the configuration. Both check runs on the head commit report
+success. GitHub reports the head commit as verified.