drop cdn + origin access logs · correlate cache hit vs origin 429 · direct origin bypass · stale cache · runs locally
flags cdn cache hit while origin 429 · cdn blocked but origin allowed · direct origin access absent from cdn
heuristic screener · correlates exports locally · not definitive proof