docs: add a quick reference at the top of TOOLING.md

Two commands to get new content onto the site, what the two alarming-but-fine
messages mean, and the two that mean stop. Everything else in this file is
reference material for when something is wrong; this is the part needed when
nothing is.

Says plainly that profiles covers everything but is not a substitute for
stories, because a story posted and expired between two profiles runs is gone
regardless of how thorough the later run is.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UXfdJu7QhSJLr47K7koTDF

TOOLING.md

@@ -21,6 +21,43 @@
 > commits stayed reachable by raw SHA, and only deleting the repository
 > outright removed them.
 
+## Quick reference — getting new content onto the site
+
+Timers are **disabled**, so this is manual today. Everything runs on
+`mattellite`; it fetches, publishes to the NAS itself, and the site picks it up
+with no deploy or restart.
+
+```sh
+ssh mattellite
+
+~/gdl/gdl-cron.sh stories     # ~1 min.  DO THIS OFTEN - stories die in 24h
+~/gdl/gdl-cron.sh profiles    # ~5 min.  posts, reels, highlights, stories
+```
+
+`profiles` covers everything, so it is the one to run if you only run one — but
+it is no substitute for `stories`, because a story posted and expired between
+two `profiles` runs is simply gone. Both are safe to run back-to-back; the
+`--min-interval` floor makes a repeat a no-op rather than a re-fetch.
+
+Then check <https://instaarchive.ergosteur.com> — new posts appear without a
+redeploy. The archive index re-reads a directory when its mtime changes.
+
+**Reading the output.** These two look alarming and are fine:
+
+- `rsync error: ... (code 23)` / `done; 1 step(s) failed` — the `chown` to
+  `rslsync` failing because the ssh user is not root. Files landed.
+- `No results` for a profile — it has no active story right now.
+
+**These mean stop**, and are covered in "When a run fails":
+
+- `429` from `scontent-*.cdninstagram.com`
+- `400 Bad Request` on `/api/v1/feed/reels_media/` — the account is behind a
+  scraping-warning interstitial; check the browser before anything else.
+
+Long runs: `setsid nohup ~/gdl/gdl-cron.sh profiles >/dev/null 2>&1 &` and
+`tail -f ~/gdl/logs/$(ls -1t ~/gdl/logs | head -1)`. Nothing reaches the
+archive until a run finishes, so killing one midway is safe.
+
 ## Remotes
 
 | remote | what goes there |