Two findings from the FRE-1695 review (approved at df788cb6).
1. The mirrored deploy activates a destructive cron the deploy docs never
mentioned. vercel.json carries two crons: /api/the-nook/lifecycle (13:00
UTC), already on the tree Vercel builds, and /api/analytics-retention
(12:00 UTC, 1d9287a / FRE-369), which exists only on Gitea master. The first
deploy that follows the mirror starts calling it, and the next 12:00 UTC
deletes every VisitorAnalytics row older than the window —
ANALYTICS_RETENTION_DAYS, 365 by default — irreversibly and unstaged. The
behaviour is intended; the silence was not, because the operator is the one
who presses the button. docs/deploy-source.md "Failure modes" now names the
cron, the ANALYTICS_RETENTION_SECRET ?? CRON_SECRET bearer check, the 365-day
default, the fails-closed-without-a-secret path, and that the first run after
enabling prunes at that default.
2. scripts/verify-deploy.sh could read green with a broken root deploy: it
probed nook.freno.me, nessa.freno.me/terms and the two remotes, never
freno.me itself — and FRE-1695's acceptance names the root domain. Adds a
ROOT_HOST (default https://freno.me) status check ahead of the subdomain
probes: expects a direct 200, no -L, so a redirect reads as a failure. It
deliberately does not probe https://freno.me/terms — SITEMAP_ROUTES.main has
no /terms; Terms of Use is a Nessa surface, so a root /terms 404 is the
design. The script stays read-only and credential-free.
agent-senior-engineer
91bedd915d