agent-senior-engineer
91bedd915d
Two findings from the FRE-1695 review (approved atdf788cb6). 1. The mirrored deploy activates a destructive cron the deploy docs never mentioned. vercel.json carries two crons: /api/the-nook/lifecycle (13:00 UTC), already on the tree Vercel builds, and /api/analytics-retention (12:00 UTC,1d9287a/ FRE-369), which exists only on Gitea master. The first deploy that follows the mirror starts calling it, and the next 12:00 UTC deletes every VisitorAnalytics row older than the window — ANALYTICS_RETENTION_DAYS, 365 by default — irreversibly and unstaged. The behaviour is intended; the silence was not, because the operator is the one who presses the button. docs/deploy-source.md "Failure modes" now names the cron, the ANALYTICS_RETENTION_SECRET ?? CRON_SECRET bearer check, the 365-day default, the fails-closed-without-a-secret path, and that the first run after enabling prunes at that default. 2. scripts/verify-deploy.sh could read green with a broken root deploy: it probed nook.freno.me, nessa.freno.me/terms and the two remotes, never freno.me itself — and FRE-1695's acceptance names the root domain. Adds a ROOT_HOST (default https://freno.me) status check ahead of the subdomain probes: expects a direct 200, no -L, so a redirect reads as a failure. It deliberately does not probe https://freno.me/terms — SITEMAP_ROUTES.main has no /terms; Terms of Use is a Nessa surface, so a root /terms 404 is the design. The script stays read-only and credential-free.