Limit homepage devlogs and add refresh trigger

README.md

@@ -72,6 +72,7 @@ assets/static/            CSS, filtering JavaScript, favicon, and static assets
 configs/project-sources.ini  Approved public remote-project registry
 scripts/project_sources.py  Remote-content validator and importer
 scripts/build_with_projects.py  Isolated build/preview entry point
+scripts/trigger_project_refresh.py  Authenticated remote-project refresh client
 ops/deploy-labyricorn     Versioned copy of the production deployment command
 tests/                    Importer validation tests
 .gitea/workflows/         Push, schedule, and manual deployment automation
@@ -199,12 +200,13 @@ The public routes are `/projects/thinkloom/`,
 `/projects/thinkloom/devlog/`, and
 `/projects/thinkloom/devlog/<entry-slug>/`. The project repository owns the
 native Lektor records and approved images. This site owns their models,
-templates, layout, repository-information card, and import policy. Imported
-devlog entries also join the homepage Recent Activity feed, ordered with
-projects, articles, and blog entries by publication date. The feed initially
-shows six items and reveals up to six more per button activation. This is a
-progressive enhancement implemented by `assets/static/activity.js`; without
-JavaScript, the complete semantic feed remains visible.
+templates, layout, repository-information card, and import policy. The latest
+imported devlog entry from each project also joins the homepage Recent Activity
+feed, ordered with projects, articles, and blog entries by publication date.
+Older devlog entries remain available on each project's complete devlog. The
+feed initially shows six items and reveals up to six more per button activation.
+This is a progressive enhancement implemented by `assets/static/activity.js`;
+without JavaScript, the complete semantic feed remains visible.
 
 `configs/project-sources.ini` is the allowlist. Each source declares a stable
 project ID, credential-free HTTPS Git URL, public web/API URL, and branch. Add
@@ -865,19 +867,20 @@ From Gitea, open **Labyricorn/labyricorn-site → Actions → Deploy production*
 and choose **Run workflow** for `main`.
 
 Automation and coding assistants may dispatch the same workflow through
-Gitea's authenticated API after pushing project publishing content:
+Gitea's authenticated API after pushing project publishing content. With
+`LABYRICORN_REFRESH_TOKEN` supplied by an approved credential store or
+ephemeral environment, run:
 
 ```bash
-export LABYRICORN_REFRESH_TOKEN='set this outside Git and shell history'
-curl --fail --silent --show-error \
-  -X POST \
-  -H "Authorization: token $LABYRICORN_REFRESH_TOKEN" \
-  -H 'Content-Type: application/json' \
-  --data '{"ref":"main"}' \
-  https://git.labyricorn.com/api/v1/repos/Labyricorn/labyricorn-site/actions/workflows/deploy.yml/dispatches
-unset LABYRICORN_REFRESH_TOKEN
+python scripts/trigger_project_refresh.py
 ```
 
+Use `python scripts/trigger_project_refresh.py --dry-run` to inspect the fixed
+site workflow target without reading the token or making a network request.
+The script sends only `{"ref":"main"}`, keeps the credential out of the URL
+and request body, and reports whether Gitea accepted the dispatch. It does not
+wait for or claim a successful deployment.
+
 The token must be supplied through an approved credential store or ephemeral
 environment and must have permission to dispatch Actions for the site
 repository. Never put it in the URL, a project repository, `AGENTS.md`, logs,