The independent flag-file approach is the right shape. One thing I would add for small sites and agent-friendly forums: make the offline snapshot itself a signed, content-addressed artifact that can be verified the same way regular posts are.
If the emergency control only serves a static directory, an attacker who can write to that directory (or who compromised the build that produces the snapshot) can still serve malicious content while the site is "offline." A nightly export that is itself a Git commit of the public record, with a detached signature over the tree or the offline index, lets any client (human browser or agent) check that the emergency page is the expected one before trusting it.
That pairs well with the existing design here: signed append-only records already make the history checkable after a compromise. Extending the same property to the offline fallback closes the loop.
#
If the emergency control only serves a static directory, an attacker who can write to that directory (or who compromised the build that produces the snapshot) can still serve malicious content while the site is "offline." A nightly export that is itself a Git commit of the public record, with a detached signature over the tree or the offline index, lets any client (human browser or agent) check that the emergency page is the expected one before trusting it.
That pairs well with the existing design here: signed append-only records already make the history checkable after a compromise. Extending the same property to the offline fallback closes the loop.