Fix /site dropping links to other Telegraph accounts' pages on rebuild

read_external() decided what to carry forward across a rebuild using
"telegra.ph" in href - true for this account's own pages, but also true
for a /link entry pointing at a DIFFERENT Telegraph account's page (the
observer's status page, published under telepatch-ops). That looked like
an own page and got excluded from preservation, and it was never in this
account's own scan either, so it silently vanished on every /site rebuild.

read_external() now takes the account's own known paths and only treats a
telegra.ph href as "ours" - left for the ordinary scan to regenerate - when
its path is actually in that set. Everything else, GitHub links included,
is preserved verbatim as before.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: peers8862

bot.py

@@ -3099,16 +3099,32 @@ def keep(node):
     )
 
 
-def read_external(content):
+# Used only to decide "is this href even a candidate for being one of our
+# own pages" before comparing its path against own_paths in read_external.
+# Deliberately narrower than a general URL check - a false match here just
+# means one more href gets a (cheap) path comparison, but a false miss
+# would treat a genuine telegra.ph page as an outward link.
+TELEGRAPH_HOST_RE = re.compile(r"^https?://(www\.)?telegra\.ph/", re.IGNORECASE)
+
+
+def read_external(content, own_paths=None):
     """
-    Index entries that are not Telegraph pages, kept verbatim.
+    Index entries that point outside this account, kept verbatim.
 
     /site regenerates the list from getPageList, which only knows this
-    account's Telegraph pages. A GitHub link added by hand would be wiped
-    on the next rebuild, so it is read back first — the same read-before-
-    write the dates, masthead and footer already need.
+    account's Telegraph pages. A GitHub link added by hand, or a /link
+    entry pointing at a *different* Telegraph account's page - another
+    Telepatch publication, say - would be wiped on the next rebuild
+    otherwise, so both are read back first, the same read-before-write the
+    dates, masthead and footer already need.
+
+    A telegra.ph href only counts as "ours" - and so is left for the
+    ordinary scan to regenerate, not kept here - when its path is actually
+    in own_paths. Any other telegra.ph page is exactly as external as a
+    GitHub link; the host alone was never a safe test for that.
     """
 
+    own_paths = own_paths or set()
     kept = []
 
     for node in split_master(content)[1]:
@@ -3134,7 +3150,10 @@ def read_external(content):
 
             href = (anchor.get("attrs") or {}).get("href", "")
 
-            if not href or href.startswith("/") or "telegra.ph" in href:
+            if not href or href.startswith("/"):
+                continue
+
+            if TELEGRAPH_HOST_RE.match(href) and telegraph_path(href) in own_paths:
                 continue
 
             text = "".join(k for k in kids if isinstance(k, str))
@@ -3494,10 +3513,11 @@ async def rebuild_site(message, token, master_path=None, title=None,
 
     else:
         filed = claimed_paths(scanned)
+        own_paths = {page["path"] for page, _ in scanned}
 
         entries, content = build_index(
             scanned, master_path, known_dates, masthead, footer,
-            read_byline(old), read_external(old), filed, recorded
+            read_byline(old), read_external(old, own_paths), filed, recorded
         )
 
         # Said out loud, always. A page quietly missing from a rebuild that

tests/test_index.py

@@ -183,3 +183,58 @@ def test_entry_href(bot, curated):
     assert bot.entry_href(listing[0]) == "/Filed-07-28"
     assert bot.entry_href(listing[2]) == "https://github.com/babbworks/telepatch"
     assert bot.entry_href(p("not an entry")) is None
+
+
+def test_read_external_keeps_a_foreign_telegraph_page(bot):
+    """
+    A /link entry pointing at a DIFFERENT Telegraph account's page - the
+    observer's status page, say, published under telepatch-ops rather than
+    this account - is not one of this account's own pages. A rebuild must
+    not wipe it, exactly as it must not wipe a GitHub link.
+    """
+    content = [
+        {"tag": "ul", "children": [
+            li("https://telegra.ph/telepatch-server-performance-08-01",
+               "Server status", " — 2026-08-01"),
+        ]},
+        p("Index generated by Telepatch. byline=linked"),
+    ]
+
+    kept = bot.read_external(content, own_paths={"One-07-28", "Two-07-28"})
+
+    assert len(kept) == 1
+    assert bot.entry_href(kept[0]["node"]) == \
+        "https://telegra.ph/telepatch-server-performance-08-01"
+
+
+def test_read_external_distinguishes_own_pages_from_foreign_ones(bot, curated):
+    """
+    A real account mixes all three shapes: its own page linked with a
+    relative href, its own page linked with an absolute telegra.ph href,
+    and a plain outward link. Only the two "own page" shapes should ever
+    be dropped as "the ordinary scan already has this one" - the host
+    alone was never a safe test for that.
+    """
+    own_paths = {"Filed-07-28", "Also-Filed-07-28"}
+
+    kept = bot.read_external(curated, own_paths)
+    hrefs = {bot.entry_href(k["node"]) for k in kept}
+
+    assert hrefs == {"https://github.com/babbworks/telepatch"}
+
+
+def test_read_external_defaults_to_treating_absolute_telegraph_as_foreign(bot, curated):
+    """
+    Guards the default: calling read_external without own_paths must not
+    silently drop nothing. An empty own_paths means every *absolute*
+    telegra.ph href looks foreign - the safe failure direction - while a
+    relative href is still recognised as this account's own regardless,
+    since only this account's own pages are ever written that way.
+    """
+    kept = bot.read_external(curated)
+    hrefs = {bot.entry_href(k["node"]) for k in kept}
+
+    assert hrefs == {
+        "https://telegra.ph/Also-Filed-07-28",
+        "https://github.com/babbworks/telepatch",
+    }