9. Testing methodology that actually catches these bugs

Every one of the failures above produced the exact same surface symptom — "it doesn't work" — despite having completely different root causes. Isolating layers one at a time is what actually finds them:

1. Query the database directly. Confirm the update site's location and extra_query columns hold what you expect before assuming any UI layer is lying to you.
2. Fetch your live update feed directly and read the raw XML. Check <element>, <version>, and the download URL by eye before trusting Joomla's interpretation of it.
3. Test the raw item download URL by hand, with and without a dlid query parameter appended, before ever touching Joomla's Update page. This isolates the ARS/Access-Level layer completely from the Joomla-detection layer.
4. Always run the "no dlid" test in a private/incognito window. Any active session — a logged-in backend admin, or a logged-in front-end customer account — will satisfy the Access Level check on its own and give you a false pass.
5. Don't trust a silent catch block. If a sync or hook "should" be running and nothing changes, assume it's throwing and log to find out, rather than re-reading the same fifteen lines of surrounding logic for the fifth time.