diff --git a/plan/21-generators.md b/plan/21-generators.md
index 35dd3cf..baea469 100644
--- a/plan/21-generators.md
+++ b/plan/21-generators.md
@@ -147,6 +147,17 @@ whose failure mode is a healthy-looking shell over dead data.
 
 - `curl /mcmeta/1.21.1-summary/registries/data.min.json` — proves the mirror is
   actually mounted. An Uptime Kuma monitor should probe **this**, not `/`.
+- **A status code is not enough — assert the BODY.** Observed on 2026-07-21,
+  with the nginx vhost installed but the container not yet deployed: caddy
+  answers an unmatched `Host` with an **empty `200`**, so *both* `/` and the
+  mirror path above returned `HTTP 200, 0 bytes` while literally nothing was
+  running. Any check that looks only at the status code reports green on a
+  completely absent service. Match on content (or a minimum body size):
+
+  ```
+  curl -s https://generators.${BASE_DOMAIN}/mcmeta/1.21.1-summary/registries/data.min.json \
+    | head -c 40   # must be JSON, ~536 KB total — not empty
+  ```
 - **Offline acceptance test**: a real browser with every non-origin request
   blocked, walking the generators you intend to use. `tooling/`-adjacent harness
   lives in the scratchpad; the check is: zero off-origin attempts, zero