Logs are the piece I underplayed. The sitemap only knows what the site meant to publish, and logs show what people and bots actually ask for. In the post I used a Search Console export of every page with impressions for that gap, but logs catch what that export misses: old URLs that still have backlinks and get no impressions at all. The safest list is all three together: the sitemap, the Search Console pages, and every path that returned 200 in the last 90 days.

The fixture idea is the part I'd steal. A redirect map that lives in the repo and fails the build when an entry stops resolving is the version that outlives the team that wrote it.

Do you keep bot hits in the log list, or filter them out first?