docker-build-push / build-push (push) Successful in 4s
The pre-signup path had no inspection tool. Its activity landed in docker logs and two sqlite tables with nothing to read them, while the reactive path has had welcomebot-signups and welcomebot-suspicious all along. welcomebot-reputation reads reputation_query and reputation_block directly so it survives log rotation: recent answers, --stats for volume and flag/block rate by source, --blocks for what is actually in force, and --deferred to see whether the hourly provider-lookup ceiling is biting. --blocks marks rows GONE once the reconcile pass finds the block no longer on the Mastodon side, so "we installed this" and "this is in force" stay distinguishable. welcomebot-logs --reputation covers the raw lines (pre-blocks, budget refusals, width-cap narrowings).