One fetch as Googlebot exposed the empty shell behind 270 unindexed articles

A zero from that request settles one narrow question: what the server sends before any JavaScript runs ^[3]. In a single-page app the first response is a shell, and the article appears only after the bundle executes ^[4]. "So besides Google, the AI-search side was blind too," the author wrote ^[18].

Google does execute JavaScript. According to the author, executing it and waiting for it to finish before scoring the page are different promises ^[4]. The curl result measures server output only. It transfers to another app if that app's server also returns an empty mount point; a site that already prerenders would get a nonzero count from the same request. The post does not include a rendered view of the page or indexing figures from after the fix.

The author's first guesses were keywords, depth and backlinks, and the author estimates that direction would have cost three more months of writing ^[2]. "That HTML was one curl away the entire time. I wrote 270 articles before I fetched it once," the author wrote ^[5].

The fix needed no new architecture ^[7]. The og-tag function already pulled each article from the database for social previews, so the new output uses a query the site was already making ^[6]. Real readers never reach the branch ^[7].

The renderer is the best engineering in the post. The frontend's markdown renderer sanitises with DOMPurify, which needs a DOM, and the Deno edge runtime has none ^[8]. The edge version escapes every character first and applies structure second ^[8]. According to the author, that ordering makes XSS structurally impossible, so safety does not depend on the developer having been careful ^[9]. In my view the escape-first order is the right tradeoff for a runtime without a DOM. Raw-HTML blocks degrade to plain text, and a database query put the exposure at 1 of 1,112 published text blocks ^[10], about 0.09 percent ^[11].

I would copy the test discipline first. The change passed 28 unit tests and 12 cross-layer contract tests, 40 in all ^[12][13]. The author then built 9 deliberately broken variants, confirmed each one turned the intended check red, and confirmed that restoring the code turned everything green ^[12]. One detour cost time. The first version marked inline-code boundaries with a literal NUL byte, and Git classified the file as binary ^[14]. The diff was `Bin 0 -> 21694 bytes` and nothing else ^[14]. An escape sequence carries the same meaning and stays readable ^[14].

The soft-404 count is the worse number because, as the author notes, it grows by itself ^[16]. According to the author, every SPA deployment guide recommends the `/* /index.html 200` line, because without it refreshing any sub-path returns a 404 ^[15]. The same line answers every dead URL with a 200 ^[15]. The first of two fix layers moves `/content/:slug`, `/product/:id` and `/works/:slug` into the edge function, which checks the database record before it answers ^[17].