sitemap.mjs was a step I ran by hand, so the moment I rebuilt without it the
file vanished from dist and the deploy shipped a site with no sitemap — on a
site whose entire point is being findable. Nothing caught it because nothing
was looking.
It is now inside `pnpm build`, CI asserts the file exists, and deploy.sh
smoke-tests /sitemap.xml, /robots.txt and an OG card against the live hostname.
The 404 assertion was also a warning rather than a failure; it exits now.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019mt6sHQHEnEYrJZvoMCJSB
The snapshot path was single-quoted inside the ssh payload, so the remote shell
never expanded the command substitution: every deploy wrote into one directory
named after the un-expanded literal, and the second deploy died on 'File
exists'. It looked correct for exactly as long as there had only ever been one
deploy — which is the failure mode this repo keeps finding, and the reason
deploy.sh smoke-tests the public hostname instead of trusting an exit code.
Two real snapshots now exist on the host.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019mt6sHQHEnEYrJZvoMCJSB
The browser engine is a port of the Python one and CI proves it: all 21.2M
(guess, answer) pairs hashed on both sides to the same SHA-256. Six TS tests,
including the duplicate-letter table and the twelve pinned seed vectors that
keep ?seed= permalinks pointing at the same word the recording used.
Word lists are split by how they are used. answers.json is inlined because the
board needs it before first paint to turn a seed into a word, and a fetch there
means a visibly empty board on a cold cache. guesses.json is fetched, because it
is three times larger and only needed the first time somebody presses Enter;
until it lands, validation falls back to the answer list, which accepts strictly
fewer words. The failure mode is 'your real word was briefly rejected', not 'a
non-word was accepted' — the right way round.
The solver runs in a worker constructed from a same-origin module URL, never
Vite's ?worker&inline: that yields a blob:, and production CSP has no
worker-src, so it falls back to default-src 'self' and the worker is blocked
with no console error. It would fail in production only.
deploy.sh smoke-tests the real public hostname from the deploying machine and
fails on a body under 1 kB, because the bind bug's signature is a valid
certificate over an empty 200 and a local --resolve check passes anyway.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019mt6sHQHEnEYrJZvoMCJSB
karti-ai