feat(rsync): the engine decides every Content-Type

[jshvn]

A census of all four mirrors (2026-10-08, every file HEAD-read, text-labeled ones sniffed) found compressed files served under the type of what they contain: 1,440 on gnu and 293 on nongnu are labeled as something a browser draws (text/x-diff over gzip bytes and the like), plus a handful on ctan. The cause is the AWS CLI storing only the first half of Python's guess_type. Its guesses also move with the image: tlnet's .tar.xz from the August fill say application/x-xz, everything since 2026-09-22 says application/x-tar.

What changes

• label decides every upload's Content-Type and the CLI guesses none. Rules, in order: a COMPRESSED ending (.gz, .tgz, .bz2, .xz, .Z, .zst, .lz, .lzma, ftp.gnu.org's types) names the type; an ending Python reads as compressed and the table lacks is never text; otherwise the image's mime.types, unless it is a type a browser draws and the first KiB disagrees (a compression signature, a NUL, a PDF without %PDF-); a name with no type is typed from its bytes. Zip-based formats (.xpi, .jar) keep their names' types.
• publish uploads one aws s3 cp --recursive --content-type per type, from trees renamed out of staging and back (no byte copied). Same PutObject count as before; timestamp still last.
• relabel, once a bucket, in the scheduled run: one canary copy read back through the domain, then a server-side --metadata-directive REPLACE copy per COMPRESSED line, then .state/labels-v1. Directory pages whose directory is named like a tarball (gnu's librejs/librejs-5.1.tar.gz/) are excluded. Every failure is a warning, never the run's; no mark means the next run tries again. Marked ponytail: for removal once all four buckets hold the mark.
• smoke reads back one key of every type the run published and compares the served type with the label, and warns (Actions annotation + summary row) for every path upstream lists that rsync never sends: nongnu's tsp/prebuilt/windows/tsp-0.8.2-Windows.exe and its .sig fail every run with "Invalid cross-device link" upstream and nothing said so.
• fresh: with FRESH_KEY set, reads upstream's clock (Unix time or CTAN's YYYY-MM-DD-HH-MM) through the domain and fails the run past FRESH_HOURS (24), under the 28 h at which GNU's and CTAN's monitors call a mirror old.
• index uploads pages with an explicit text/html.

New verbs label, label-trees, relabel, relabel-plan, fresh are added to the reserved list in toolbox.yml. CLAUDE.md gains a verified hazard: task's shell keeps set -e inside a subshell under ||, unlike bash and dash.

Rollout

Release as v2.4.0. Each mirror relabels itself on its next scheduled run after v2 moves. Consumer PRs follow with FRESH_KEY/FRESH_HOURS (gnu, nongnu, ctan), tlnet's retry settings, and every repo's render.

Test plan

• examples/rsync: task image-build, task run -- task tools, task check, task run -- task offline all pass. Offline now covers label over 18 crafted names and byte prefixes, label-trees out and back (staging byte-identical after), relabel-plan (glob escaping, .z vs .Z, tarball-named directories), and fresh passing on 1 h and 2 h clocks and failing on 48 h.
• examples/proton: the same four steps pass.
• relabel exercised inside the image against stand-in aws/curl: success marks after 7 passes; a refused canary copy, a wrong type served back, and a failed pass each stop with a warning and no mark.
• After merge and tag: dispatch nongnu first and read its run summary (Relabel row, types row), then curl a .diff.gz on each host.