The XML is created just before the files are all mirrored, but it does happen in the same script call. But yes, the files are uploaded due to filesystem existence, not XML parsing or so.
I don't think there's a door being opened, but of course it's better to worry first rather than later, so thanks for your attention!

I would need to inspect how nginx handles files to be able to control s9y.org. I'll first check if it works on netmirror...
Regards,
Garvin