docs: fix stale 2-tier scope claims, Release-Checklist command drift (v1.9.2 freshness pass)
Cross-checked every wiki page against current main (through #1209) and
docs/tools.md, docs/mcp-contract.md, docs/operator-guide.md. Found and
fixed real drift, not just cosmetic staleness:
- Client-Compatibility.md, Smoke-Tests-and-Live-Verification.md: both
claimed "write scope sees the full write/build/admin tool set" — the
admin tier (#1039/#1050) narrowed that; write no longer includes the
four managed Hugo lifecycle tools. Fixed both, matching the model
OAuth-Clients-and-Scopes.md and Pitfall-Anonymous-vs-Authenticated-Server.md
already correctly describe.
- Managed-Hugo-Upgrades.md: said "all five [Hugo upgrade] tools require
a write bearer" — verified against internal/tools/admin/image.go's
Defs(): only get_hugo_update requires write; the other four require
admin. This was a real security-relevant inaccuracy, not just stale
wording.
- Installation-Guide.md: scope table still said "read/write scopes",
missing admin.
- Documentation-Source-of-Truth.md: self-contradicted — described the
current 3-scope model, then immediately said "do not reintroduce a
third canonical scope," leftover text from before #1039/#1050 shipped
the admin tier it was warning against. Reworded to be accurate and
forward-looking (warn against a fourth scope instead).
- Release-Checklist.md: explicitly claims "docs/release-checklist.md
remains the source of truth for the exact command list" and then
presented its own diverged copy (had a standalone `gofmt -w` step the
repo doc doesn't have; missing check-readme-release/check-agent-ready.sh
the repo doc does have). Synced to match, noted gofmt is CI-enforced
rather than a manual step, and added a note about the new v1.9.2
diff-coverage gate (#1207).
- Pitfall-Claude-auth_callback-vs-oauth_callback.md: added a
terminology note on its historical `scope: site.admin` example
(still valid as a compatibility alias, but now resolves to the
narrower `admin` tier, not `write`) — same pattern the sibling
invalid-scope-disguised-as-302 pitfall page already uses.
- Pitfall-openid-configuration-404.md: added a "reconfirmed live
2026-08-20" note — re-observed the same 404-then-success pattern in
production logs today while diagnosing an unrelated ChatGPT connector
issue; still expected, still no fix needed.
Read every other page (Home, AgentReady-Pitfalls, Live-Deployment-Runbook,
Discovery-and-RFC-Map, Webhook-Plugins-Configuration, Security-Redaction-Checklist,
Pitfalls-Index, Scope-and-Tool-Matrix, remaining Pitfall-* pages,
Client-Compatibility, OAuth-Clients-and-Scopes) — all already current
against v1.9.2 main, no changes needed. Config field names
(cloudflare/indexnow/google_indexing) spot-checked directly against
internal/config/config.go and match exactly. docs/tools.md and
docs/mcp-contract.md already document the three chunked-upload tools
from #1204/#1205 — repo docs were already in sync.
docs: add 5 pitfall pages + update Home index
- Pitfall: Claude auth_callback vs oauth_callback (redirect URI path mismatch)
- Pitfall: Redirect URI exact matching (rules, wildcards, common mistakes)
- Pitfall: OAuth client max scope (scope clamping, RFC 6749 §3.3, log output)
- Pitfall: Anonymous vs authenticated server (tool boundary, test, Claude UI label)
- Pitfall: openid-configuration 404 (ChatGPT OIDC probe, expected, no fix needed)