caracms 0.2.0 → 0.3.1

package/src/live/editor.ts

@@ -15,6 +15,11 @@
  * **A poll asks GitHub for nothing** beyond `git.check()` (once a minute) and the
  * deployment reads while a publish is in flight (git.ts, every 10 s at most).
  *
+ * **A poll asks Redis for little** (Redis diet): its reads come from the status cache
+ * (status-cache.ts, `git.statusCache`), refreshed from Redis once 30 s old; it writes
+ * only its presence, and a heartbeat when the lock needs one. The other handlers read
+ * Redis directly (Decision 3).
+ *
  * State lives in Redis and git (two servers run during a deploy); what's held here
  * is the sweep's "am I ticking" and git.ts's caches.
  */
@@ -39,17 +44,27 @@ import type {
 } from '../editor/types.ts';
 import { Autosaves } from './autosaves.ts';
 import { lastChangeOf, liveDraftsStore, unavailable } from './drafts-store.ts';
-import { movesIn, titleOf } from './git.ts';
+import { LiveGit, movesIn, NO_REDEPLOYER_REASON, titleOf } from './git.ts';
+import { accessProblemMessage, type GitHubAccessProblem } from './github.ts';
 import { parseRedirects, type Redirect } from '../redirects.ts';
 import { Locks } from './locks.ts';
 import { displayName, type Person } from './messages.ts';
 import type { LiveSettings } from './mode.ts';
+import { Notices, type StoodNotice } from './notices.ts';
 import { RedisUnavailableError } from './redis.ts';
 import { liveRuntime, type LiveRuntime } from './runtime.ts';
 import { Sweep, type Schedule } from './sweep.ts';
 
 type Handler = (request: Request, person: Person | null) => Promise<Response>;
 
+
+/** The heading of the editor's GitHub access note (runs-anywhere Decision 5); the sentence says what to fix. */
+const ACCESS_TITLE: Record<GitHubAccessProblem['kind'], string> = {
+	refused: 'GitHub refused this site',
+	permission: 'GitHub refused a change',
+	expiring: "This site's GitHub token expires soon",
+};
+
 export interface LiveEditor {
 	readonly runtime: Pick<LiveRuntime, 'site' | 'settings' | 'git' | 'redis' | 'timings' | 'now'>;
 	readonly autosaves: Autosaves;
@@ -84,15 +99,6 @@ const sameEmail = (a: Person, b: Person) => a.email.toLowerCase() === b.email.to
 const NOTICE_ID = /^(kept|stood):[^\s\p{C}]+$/u;
 const NOTICE_ID_MAX = 512;
 
-interface StoodNotice {
-	id: string;
-	for: string;
-	file: string;
-	title: string;
-	by: Person;
-	at: string;
-}
-
 /** Map a site file to its document (collection and path), or nulls. */
 /** Site Settings' redirects, from its text (none when it's missing or unreadable). */
 function redirectsIn(text: string | null): Redirect[] {
@@ -120,8 +126,11 @@ export async function createLiveEditor(
 	const sleep = options.sleep ?? ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
 	const prefix = options.prefix ?? 'caracms:';
 	const log = options.log ?? ((line: string) => console.log(`[caracms] ${line}`));
-	const autosaves = new Autosaves(redis, timings, now, prefix);
-	const locks = new Locks(redis, timings, now, async (file) => (await autosaves.get(file)) !== null, prefix);
+	// Redis diet Decision 2: every module that writes what the status poll reads tells its cache.
+	const cache = git.statusCache;
+	const autosaves = new Autosaves(redis, timings, now, prefix, cache);
+	const locks = new Locks(redis, timings, now, async (file) => (await autosaves.get(file)) !== null, prefix, cache);
+	const noticeStore = new Notices(redis, timings, prefix, cache);
 	const sweep = new Sweep({ redis, git, autosaves, locks, timings, now, schedule: options.schedule, sleep: options.sleep, log, prefix });
 	const store = liveDraftsStore({ site, git, autosaves, locks, sweep, now });
 	// Publish's step 1 and Decision 8's "commit every pending autosave first".
@@ -139,12 +148,6 @@ export async function createLiveEditor(
 	// hook above in place, so a merge from main commits every pending autosave first.
 	await git.check({ force: true }).catch((error: unknown) => log(`check at startup: ${error instanceof Error ? error.message : String(error)}`));
 
-	const keys = {
-		publishLock: `${prefix}publish:lock`,
-		dismissed: `${prefix}dismissed`,
-		notices: `${prefix}notices`,
-	};
-
 	/** Common gate: a person, the same origin for anything but GET, Redis outages as 503. */
 	const handler =
 		(methods: string[], fn: (request: Request, person: Person) => Promise<Response>): Handler =>
@@ -204,36 +207,22 @@ export async function createLiveEditor(
 		return list;
 	};
 
-	const publishView = async (): Promise<PublishView> => {
-		const running = (await redis.get(keys.publishLock)) !== null;
+	/** `read`: the Publish lock and record as the status poll's cache has them; otherwise read from Redis. */
+	const publishView = async (read?: { running: boolean; record: PublishView['record'] }): Promise<PublishView> => {
+		const running = read ? read.running : (await redis.get(git.publishLockKey)) !== null;
 		let st;
 		try {
-			st = await git.publishStatus();
+			st = await git.publishStatus(read ? { record: read.record } : {});
 		} catch (error) {
 			log(`publish status: ${error instanceof Error ? error.message : String(error)}`);
-			const record = await git.lastPublish();
+			const record = read ? read.record : await git.lastPublish();
 			st = { state: record ? ('publishing' as const) : ('none' as const), record, assumed: false, canTryAgain: false };
 		}
-		return { state: st.state, running, record: st.record, assumed: st.assumed, canTryAgain: st.canTryAgain, hasToken: settings.railway !== null };
+		return { state: st.state, running, record: st.record, assumed: st.assumed, canTryAgain: st.canTryAgain, hasRedeployer: Boolean(settings.deployHook) || settings.railway !== null };
 	};
 
-	const notices = async (person: Person): Promise<NoticeView[]> => {
-		const dismissed = new Set(await redis.smembers(keys.dismissed));
-		const out: NoticeView[] = [];
-		for (const n of git.keptDraftNotices()) {
-			const id = `kept:${n.file}:${n.commit}`;
-			if (!dismissed.has(id)) out.push({ id, kind: 'draft-kept', file: n.file, title: git.titleFor(n.file) });
-		}
-		for (const raw of Object.values(await redis.hgetall(keys.notices))) {
-			try {
-				const n = JSON.parse(raw) as StoodNotice;
-				if (n.for === person.email.toLowerCase()) out.push({ id: n.id, kind: 'published-as-it-stood', file: n.file, title: n.title, by: n.by, at: n.at });
-			} catch {
-				/* skip */
-			}
-		}
-		return out;
-	};
+	const titleFor = (file: string) => git.titleFor(file);
+	const notices = (person: Person): Promise<NoticeView[]> => noticeStore.of(person, git.keptDraftNotices(), titleFor);
 
 	// The write route: M3's handler over the live store, which answers 401 with no person.
 	const write: Handler = (request, person) => handleWrite(request, store, { person });
@@ -256,19 +245,36 @@ export async function createLiveEditor(
 		// so it lapses by itself (Take over, 2026-10-15). A tab that doesn't say is treated as active.
 		const input = Number(url.searchParams.get('input'));
 		const active = !url.searchParams.has('input') || !(input >= timings.lockIdleMs);
+		// Redis diet Contracts: `interval` is how long until the tab's next poll, which its
+		// presence holds by (Decision 9). None, or not a number: a 5-second tab (an old page).
+		const every = Number(url.searchParams.get('interval'));
+		const interval = Number.isFinite(every) && every > 0 ? Math.min(every, Math.max(timings.pollMs, timings.slowPollMs)) : timings.pollMs;
+
+		// Every read from the status cache (Decision 1): memory, or Redis once 30 s old.
+		const snap = await cache.read({
+			scans: [autosaves.keyPrefix, locks.keyPrefix],
+			hashes: [locks.presenceKey(), autosaves.movesKey(), noticeStore.noticesKey],
+			sets: [noticeStore.dismissedKey],
+			strings: [git.publishLockKey, git.publishRecordKey, ...(file ? [autosaves.changedKey(file)] : [])],
+		});
 		if (tab) {
-			await locks.present(tab, person, file);
-			if (file && active) await locks.beat(file, tab, person);
+			await locks.present(tab, person, file, interval);
+			// Decision 6: a beat only when the lock (as cached) is this tab's and needs one.
+			if (file && active) {
+				const cached = locks.allFrom(snap.scan(locks.keyPrefix)).get(file) ?? null;
+				if (locks.needsBeat(cached, tab, person)) await locks.beat(file, tab, person, cached);
+			}
 		}
 		// Decision 8's check, throttled to once a minute and shared inside git.ts. Started, not
 		// awaited: the poll answers with what's known, and never waits on GitHub.
 		void git.check().catch((error: unknown) => log(`check: ${error instanceof Error ? error.message : String(error)}`));
 
-		const saves = (await autosaves.all()).map((r) => r.value);
+		// From the snapshot after this poll's own writes landed in it (its presence, its beat).
+		const saves = Autosaves.allFrom(snap.scan(autosaves.keyPrefix).values()).map((r) => r.value);
 		if (saves.length) sweep.poke(); // they may have come in on the other server during a deploy
 		const pending = new Set(saves.map((a) => a.file));
-		const presence = await locks.presence();
-		const lockViews = [...(await locks.all())]
+		const presence = await locks.presenceFrom(snap.hash(locks.presenceKey()));
+		const lockViews = [...locks.allFrom(snap.scan(locks.keyPrefix))]
 			.filter(([f, r]) => locks.holds(r.lock, pending.has(f)))
 			.map(([f, r]) => locks.view(f, r.lock, tab, person));
 
@@ -315,7 +321,7 @@ export async function createLiveEditor(
 		// Pre-M7 item 8: a moved document is one entry, on its new file, with its old address.
 		// Read from the moves as recorded, not Site Settings' redirects: removing the redirect leaves it a move.
 		const readNow = (f: string) => (textNow.has(f) ? (textNow.get(f) ?? null) : git.read(f));
-		const moves = movesIn(site, [...waiting.keys()], readNow, await autosaves.moves());
+		const moves = movesIn(site, [...waiting.keys()], readNow, new Map(snap.hash(autosaves.movesKey())));
 		const redirects = moves.from.size ? redirectsIn(readNow(SITE_SETTINGS_FILE)) : [];
 		for (const [file, from] of moves.from) {
 			const w = waiting.get(file)!;
@@ -330,12 +336,14 @@ export async function createLiveEditor(
 			const lock = lockViews.find((l) => l.file === file) ?? null;
 			// M5a Decision 12: a viewer learns the document was deleted, and by whom, on this poll.
 			let deleted: NonNullable<StatusResponse['open']>['deleted'] = null;
-			if (!(await exists(file))) {
-				const record = await autosaves.changed(file);
+			const save = saves.find((a) => a.file === file);
+			const record = Autosaves.changedFrom(snap.string(autosaves.changedKey(file)));
+			if (save ? save.gone : git.read(file) === null) {
 				deleted = record?.gone ? { by: record.by, at: record.at } : { by: null, at: null };
 			}
-			open = { file, state: Locks.state(lock), lock, lastChange: await lastChangeOf({ git, autosaves }, file), deleted };
+			open = { file, state: Locks.state(lock), lock, lastChange: await lastChangeOf({ git, autosaves }, file, record), deleted };
 		}
+		const access = git.backend.accessProblem();
 		const body: StatusResponse = {
 			mode: 'live',
 			you: person,
@@ -346,8 +354,10 @@ export async function createLiveEditor(
 			waiting: list,
 			locks: lockViews,
 			presence,
-			notices: await notices(person),
-			publish: await publishView(),
+			notices: Notices.forPerson(person, git.keptDraftNotices(), titleFor, snap.set(noticeStore.dismissedKey), snap.hash(noticeStore.noticesKey).values()),
+			publish: await publishView({ running: snap.string(git.publishLockKey) !== null, record: LiveGit.publishRecordFrom(snap.string(git.publishRecordKey)) }),
+			// Runs-anywhere Decision 5: while it holds, not dismissable.
+			githubAccess: access ? { kind: access.kind, title: ACCESS_TITLE[access.kind], message: accessProblemMessage(access) } : null,
 			// M5a Decision 10: from the committed copy, never an autosave.
 			brand: editorBrand(brandFrom(git.read(SITE_SETTINGS_FILE), site)),
 		};
@@ -395,28 +405,44 @@ export async function createLiveEditor(
 
 	const publish = handler(['POST'], async (_request, person) => {
 		const before = await locks.presence();
-		const result = await git.publish(person);
+		const work = git.publish(person).then(async (result) => {
+			await stoodNotices(result, before, person);
+			return result;
+		});
+		// Runs-anywhere (Watch-outs): Cloudflare gives up on an answer after 100 s, and a
+		// Publish whose GitHub calls are slow can take longer. Past `publishAnswerMs` the
+		// request answers "joined" with the status (the Publish lock shows it running) and
+		// the Publish carries on; the panel follows it on the poll.
+		let timer: ReturnType<typeof setTimeout> | undefined;
+		const late = new Promise<null>((resolve) => {
+			timer = setTimeout(() => resolve(null), timings.publishAnswerMs);
+		});
+		const result = await Promise.race([work, late]).finally(() => clearTimeout(timer));
+		if (result === null) {
+			work.catch((error: unknown) => log(`publish (answered early): ${error instanceof Error ? error.message : String(error)}`));
+			return json(200, { result: 'joined', publish: await publishView() } satisfies PublishResponse);
+		}
+		return json(200, { result: result.kind, publish: await publishView() } satisfies PublishResponse);
+	});
+
+	/** "Aoife published Home as it stood at 14:20" for whoever had a published document open (Decision 10 step 1). */
+	const stoodNotices = async (result: Awaited<ReturnType<typeof git.publish>>, before: Awaited<ReturnType<typeof locks.presence>>, person: Person) => {
 		if (result.kind === 'published') {
 			// "Aoife published Home as it stood at 14:20" for whoever had a published document open (Decision 10 step 1).
 			const { record } = result;
-			const fields: Record<string, string> = {};
+			const stood: StoodNotice[] = [];
 			for (const p of before) {
 				const i = record.files.indexOf(p.file);
 				if (i === -1) continue;
 				for (const someone of p.people) {
 					if (sameEmail(someone, person)) continue;
 					const id = `stood:${record.commit}:${p.file}:${someone.email.toLowerCase()}`;
-					const notice: StoodNotice = { id, for: someone.email.toLowerCase(), file: p.file, title: result.fileTitles[i] ?? titleOf(p.file, null), by: person, at: record.at };
-					fields[id] = JSON.stringify(notice);
+					stood.push({ id, for: someone.email.toLowerCase(), file: p.file, title: result.fileTitles[i] ?? titleOf(p.file, null), by: person, at: record.at });
 				}
 			}
-			if (Object.keys(fields).length) {
-				await redis.hset(keys.notices, fields);
-				await redis.pexpire(keys.notices, timings.autosaveTtlMs);
-			}
+			await noticeStore.addStood(stood);
 		}
-		return json(200, { result: result.kind, publish: await publishView() } satisfies PublishResponse);
-	});
+	};
 
 	const history = handler(['GET'], async () => {
 		const entries = await git.history({ refresh: true });
@@ -424,9 +450,10 @@ export async function createLiveEditor(
 	});
 
 	const tryAgain = handler(['POST'], async () => {
-		if (!settings.railway) return json(409, { ok: false, error: 'No CARACMS_RAILWAY_TOKEN: a developer can redeploy from Railway.' } satisfies TryAgainResponse);
+		if (!settings.deployHook && !settings.railway) return json(409, { ok: false, error: NO_REDEPLOYER_REASON } satisfies TryAgainResponse);
 		const st = await publishView();
-		if (st.state !== 'failed') return json(409, { ok: false, error: 'The last publish hasn\'t failed, so there\'s nothing to try again.' } satisfies TryAgainResponse);
+		// Runs-anywhere Decision 10: taking longer than usual offers it too. One click, one call (the editor's button waits for the answer).
+		if (st.state !== 'failed' && st.state !== 'slow') return json(409, { ok: false, error: 'The last publish hasn\'t failed, so there\'s nothing to try again.' } satisfies TryAgainResponse);
 		const r = await git.tryAgain();
 		return r.ok ? json(200, { ok: true } satisfies TryAgainResponse) : json(502, { ok: false, error: r.reason } satisfies TryAgainResponse);
 	});
@@ -439,10 +466,8 @@ export async function createLiveEditor(
 		if (typeof id !== 'string' || id.length > NOTICE_ID_MAX || !NOTICE_ID.test(id)) throw new WriteRefused(400, '"id" must be a notice\'s id.');
 		const shown = (await notices(person)).find((n) => n.id === id);
 		if (!shown) throw new WriteRefused(404, 'There\'s no such notice for you to dismiss.');
-		if (shown.kind === 'draft-kept') {
-			await redis.sadd(keys.dismissed, id);
-			await redis.pexpire(keys.dismissed, timings.autosaveTtlMs);
-		} else await redis.hdel(keys.notices, id);
+		if (shown.kind === 'draft-kept') await noticeStore.dismiss(id);
+		else await noticeStore.remove(id);
 		return json(200, { ok: true });
 	});
 

package/src/live/git.ts

@@ -42,9 +42,11 @@ import { movesKey } from './autosaves.ts';
 import type { WaitingChange } from '../editor/types.ts';
 import { MissingBranchError, StaleHeadError, type Branch, type CommitSummary, type Comparison, type GitBackend, type Head, type Heads, type TreeChange } from './backend.ts';
 import { HttpError } from './github.ts';
+import { runningCommitFrom } from './mode.ts';
 import { mergeFile } from './merge.ts';
 import { draftMessage, mergeMessage, parseMessage, publishMessage, type Person } from './messages.ts';
 import type { RedisClient } from './redis.ts';
+import { landed, StatusCache } from './status-cache.ts';
 import { DEFAULT_TIMINGS, type LiveTimings } from './timings.ts';
 import { publishState, waitingFromCommits, type DeploymentFact, type PublishRecord, type PublishState, type WaitingFile } from './status.ts';
 
@@ -103,14 +105,20 @@ export interface HistoryEntry {
 	state: PublishState;
 }
 
-export interface RailwayConfig {
-	/** CARACMS_RAILWAY_TOKEN: a project token (Decision 12). */
-	token: string;
-	serviceId: string;
-	environmentId: string;
-	/** For tests. Default: global fetch. */
-	fetch?: typeof fetch;
-}
+/**
+ * Try again's redeployer (runs-anywhere Decision 11): Railway's API with a project token
+ * (`CARACMS_RAILWAY_TOKEN`, M4 Decision 12), or a deploy hook (`CARACMS_DEPLOY_HOOK_URL`):
+ * one bare POST, any 2xx a success. The hook's URL is a secret: never logged or sent on.
+ */
+export type Redeployer =
+	| { kind: 'railway'; token: string; serviceId: string; environmentId: string; fetch?: typeof fetch }
+	| { kind: 'hook'; url: string; fetch?: typeof fetch; timeoutMs?: number };
+
+/** A deploy hook that hasn't answered in this long has failed (it's one POST; nothing retries by itself). */
+export const DEPLOY_HOOK_TIMEOUT_MS = 20_000;
+
+/** Try again's answer when no redeployer is set: no host's name (Decision 11). */
+export const NO_REDEPLOYER_REASON = "Try again isn't set up on this site: a developer can redeploy it.";
 
 export interface LiveGitOptions {
 	backend: GitBackend;
@@ -119,12 +127,16 @@ export interface LiveGitOptions {
 	now?: () => number;
 	sleep?: (ms: number) => Promise<void>;
 	log?: (line: string) => void;
-	/** The running server's commit, read on every status (tests move it). Default: CARACMS_RUNNING_COMMIT or RAILWAY_GIT_COMMIT_SHA. */
+	/** The running server's commit, read on every status (tests move it). Default: mode.ts → `runningCommitFrom` over the environment and `bakedCommit`. */
 	runningCommit?: () => string | null;
+	/** The commit baked in at build (runs-anywhere Decision 9), for the default `runningCommit`. */
+	bakedCommit?: string | null;
 	timings?: Partial<LiveTimings>;
-	railway?: RailwayConfig | null;
+	redeployer?: Redeployer | null;
 	/** Redis key prefix. Default `caracms:`. */
 	keyPrefix?: string;
+	/** The status poll's cache (Redis diet), told of the publish lock, the publish record and the moves Publish clears. Default: one of its own. */
+	statusCache?: StatusCache;
 }
 
 /** The site file that holds Site Settings, relative to the site (Decision 15). Defined in config.ts (M5a: the reserved `settings` collection). */
@@ -153,6 +165,12 @@ export class LiveGit {
 	readonly redis: RedisClient;
 	readonly timings: LiveTimings;
 	readonly now: () => number;
+	/**
+	 * The status poll's write-through cache (status-cache.ts, Redis diet Decisions 1–5),
+	 * one per process: kept here because this module writes some of what it holds; the
+	 * live editor's autosaves, locks and notices write through the same one.
+	 */
+	readonly statusCache: StatusCache;
 	/** Phase 2 fills this: commit every pending autosave (Decision 10 step 1; Decision 8 before a merge). */
 	commitPending: () => Promise<void> = async () => {};
 	/**
@@ -168,7 +186,7 @@ export class LiveGit {
 	private readonly sleep: (ms: number) => Promise<void>;
 	private readonly log: (line: string) => void;
 	private readonly runningCommit: () => string | null;
-	private readonly railway: RailwayConfig | null;
+	private readonly redeployer: Redeployer | null;
 	private readonly keyPrefix: string;
 
 	private copyHead: Head | null = null;
@@ -194,9 +212,11 @@ export class LiveGit {
 		this.now = options.now ?? Date.now;
 		this.sleep = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
 		this.log = options.log ?? ((line) => console.log(`[caracms] ${line}`));
-		this.runningCommit = options.runningCommit ?? (() => process.env.CARACMS_RUNNING_COMMIT || process.env.RAILWAY_GIT_COMMIT_SHA || null);
-		this.railway = options.railway ?? null;
+		const baked = options.bakedCommit ?? null;
+		this.runningCommit = options.runningCommit ?? (() => runningCommitFrom(process.env, baked));
+		this.redeployer = options.redeployer ?? null;
 		this.keyPrefix = options.keyPrefix ?? 'caracms:';
+		this.statusCache = options.statusCache ?? new StatusCache({ redis: this.redis, maxAgeMs: this.timings.statusCacheMs, now: this.now });
 		this.prefix = repoPrefix(options.site);
 		// Every collection's folder, shared blocks' included (M5a Decision 8); Site Settings is its one file (inScope).
 		this.folders = Object.values(options.site.collections)
@@ -241,6 +261,20 @@ export class LiveGit {
 		return `${this.keyPrefix}${name}`;
 	}
 
+	/** The Publish lock's key (one Publish at a time) and the newest publish's record's (Decision 10, 12). */
+	get publishLockKey(): string {
+		return this.key('publish:lock');
+	}
+	get publishRecordKey(): string {
+		return this.key('publish:last');
+	}
+
+	private async setPublishRecord(record: PublishRecord): Promise<void> {
+		const raw = JSON.stringify(record);
+		await landed(this.statusCache, this.publishRecordKey, () => this.redis.set(this.publishRecordKey, raw));
+		this.statusCache.string(this.publishRecordKey, raw);
+	}
+
 	/** Run `fn` alone among this server's git operations, so the copy is never changed by two at once. */
 	private exclusive<T>(fn: () => Promise<T>): Promise<T> {
 		const run = this.queue.then(fn, fn);
@@ -642,9 +676,11 @@ export class LiveGit {
 	 * Redis lock); a second press while one runs joins it.
 	 */
 	async publish(by: Person): Promise<PublishResult> {
-		const lock = this.key('publish:lock');
+		const lock = this.publishLockKey;
 		const token = randomBytes(12).toString('base64url');
-		if (!(await this.redis.set(lock, token, { nx: true, px: this.timings.publishLockMs }))) {
+		const taken = await landed(this.statusCache, lock, () => this.redis.set(lock, token, { nx: true, px: this.timings.publishLockMs }));
+		if (taken) this.statusCache.string(lock, token);
+		else {
 			const until = this.now() + this.timings.publishLockMs;
 			while (this.now() < until && (await this.redis.get(lock)) !== null) await this.sleep(500);
 			return { kind: 'joined', record: await this.lastPublish() };
@@ -659,7 +695,10 @@ export class LiveGit {
 				throw new Error(`caracms: publish gave up after ${MAX_ATTEMPTS} tries (main or drafts kept moving).`);
 			});
 		} finally {
-			await this.redis.compareAndDelete(lock, token).catch(() => {});
+			// Let go: gone when it was still ours; otherwise (it expired and someone else took it, or the call failed) not known here.
+			const gone = await this.redis.compareAndDelete(lock, token).catch(() => false);
+			if (gone) this.statusCache.string(lock, null);
+			else this.statusCache.drop(lock);
 		}
 	}
 
@@ -710,16 +749,28 @@ export class LiveGit {
 		this.historyCache = null;
 		// The moves this publish took live are done with (a move made since stays waiting).
 		const published = [...records].filter(([old]) => files.includes(old)).map(([old]) => old);
-		if (published.length) await this.redis.hdel(movesKey(this.keyPrefix), ...published).catch(() => 0);
+		if (published.length) {
+			const moves = movesKey(this.keyPrefix);
+			const cleared = await this.redis.hdel(moves, ...published).then(
+				() => true,
+				() => false,
+			);
+			if (cleared) this.statusCache.hash(moves, {}, published);
+			else this.statusCache.drop(moves);
+		}
 		const record: PublishRecord = { commit, by, at: new Date(this.now()).toISOString(), files, titles, tryAgainAt: null };
-		await this.redis.set(this.key('publish:last'), JSON.stringify(record));
+		await this.setPublishRecord(record);
 		this.log(`published ${commit.slice(0, 7)} (attempt ${attempt}): ${titles.join(', ')}`);
 		return { kind: 'published', record, attempts: attempt, fileTitles };
 	}
 
 	/** The newest publish, from Redis. */
 	async lastPublish(): Promise<PublishRecord | null> {
-		const raw = await this.redis.get(this.key('publish:last'));
+		return LiveGit.publishRecordFrom(await this.redis.get(this.publishRecordKey));
+	}
+
+	/** A publish record from its text as read (the status cache's, on a poll). */
+	static publishRecordFrom(raw: string | null): PublishRecord | null {
 		if (!raw) return null;
 		try {
 			return JSON.parse(raw) as PublishRecord;
@@ -842,14 +893,15 @@ export class LiveGit {
 	// ── Publish status (Decision 12) ────────────────────────────────────────────
 
 	/** The newest publish's state. Asks GitHub at most every `deploymentReadMs`, and only while it isn't live. */
-	async publishStatus(): Promise<PublishStatus> {
-		const record = await this.lastPublish();
+	async publishStatus(options: { record?: PublishRecord | null } = {}): Promise<PublishStatus> {
+		// `record`: the newest publish as the caller read it (the status poll's cache); otherwise read here.
+		const record = options.record !== undefined ? options.record : await this.lastPublish();
 		if (!record) return { state: 'none', record: null, assumed: false, canTryAgain: false };
 		const running = this.runningCommit();
 		if (running === null) {
 			if (!this.assumedLogged) {
 				this.assumedLogged = true;
-				this.log('no RAILWAY_GIT_COMMIT_SHA or CARACMS_RUNNING_COMMIT: no deploy pipeline, so a publish reads as live once its refs moved');
+				this.log('no running commit known (CARACMS_RUNNING_COMMIT, a host\'s commit variable, or one baked in at build): a publish reads as live once its refs moved');
 			}
 			return { state: 'live', record, assumed: true, canTryAgain: false };
 		}
@@ -858,8 +910,8 @@ export class LiveGit {
 			let facts: DeploymentFact[] = [];
 			let later = new Set<string>();
 			if (!includes) ({ facts, later } = await this.deploymentFacts(record));
-			const { state } = publishState({ record, running, runningIncludesPublish: includes, laterOnMain: later, deployments: facts });
-			return { state, record, assumed: false, canTryAgain: state === 'failed' && this.railway !== null };
+			const { state } = publishState({ record, running, runningIncludesPublish: includes, laterOnMain: later, deployments: facts, now: this.now(), slowAfterMs: this.timings.publishSlowMs });
+			return { state, record, assumed: false, canTryAgain: (state === 'failed' || state === 'slow') && this.redeployer !== null };
 		});
 	}
 
@@ -904,7 +956,7 @@ export class LiveGit {
 		} catch (error) {
 			if (error instanceof HttpError && (error.status === 403 || error.status === 404)) {
 				this.deploymentsDenied = true;
-				this.log(`can't read GitHub Deployments (${error.status}): the App needs "Deployments: read". A publish will show as publishing until the server runs it.`);
+				this.log(`can't read GitHub Deployments (${error.status}): the site's GitHub token or App needs "Deployments: read" to tell a failed publish. Without it, a publish shows as publishing until the server runs it, then as taking longer than usual.`);
 				return { facts: [], later: new Set() };
 			}
 			throw error;
@@ -930,7 +982,7 @@ export class LiveGit {
 				const parsed = parseMessage(c.message);
 				if (parsed.kind !== 'publish') return;
 				const live = running === null || (runningAt !== -1 && i >= runningAt) || (status.record?.commit === c.sha && status.state === 'live');
-				const pending: PublishState = status.state === 'failed' ? 'failed' : 'publishing';
+				const pending: PublishState = status.state === 'failed' || status.state === 'slow' ? status.state : 'publishing';
 				entries.push({ commit: c.sha, by: parsed.publishedBy, at: c.date, titles: parsed.titles, files: parsed.publishedFiles, state: live ? 'live' : pending });
 			});
 			this.historyCache = { at: this.now(), entries };
@@ -940,13 +992,26 @@ export class LiveGit {
 
 	// ── Try again (Decision 12) ─────────────────────────────────────────────────
 
-	/** Redeploy through Railway's API with the project token. Never publishes again. */
+	/**
+	 * Redeploy through the redeployer (runs-anywhere Decision 11): Railway's API with the
+	 * project token, or the deploy hook's one POST. Never publishes again, and never
+	 * retries by itself. A success restarts the "taking longer than usual" clock.
+	 */
 	async tryAgain(): Promise<{ ok: true } | { ok: false; reason: string }> {
-		if (!this.railway) return { ok: false, reason: 'No CARACMS_RAILWAY_TOKEN: a developer can redeploy from Railway.' };
+		if (!this.redeployer) return { ok: false, reason: NO_REDEPLOYER_REASON };
 		const record = await this.lastPublish();
 		if (!record) return { ok: false, reason: 'Nothing has been published.' };
-		const { token, serviceId, environmentId } = this.railway;
-		const res = await (this.railway.fetch ?? fetch)(RAILWAY_API, {
+		const r = this.redeployer.kind === 'hook' ? await this.callHook(this.redeployer) : await this.redeployOnRailway(this.redeployer);
+		if (!r.ok) return r;
+		await this.setPublishRecord({ ...record, tryAgainAt: new Date(this.now()).toISOString() });
+		this.deploymentsCache = null;
+		this.log(`try again: ${this.redeployer.kind === 'hook' ? 'the deploy hook took it' : 'Railway is redeploying'} (publish ${record.commit.slice(0, 7)})`);
+		return { ok: true };
+	}
+
+	private async redeployOnRailway(railway: Extract<Redeployer, { kind: 'railway' }>): Promise<{ ok: true } | { ok: false; reason: string }> {
+		const { token, serviceId, environmentId } = railway;
+		const res = await (railway.fetch ?? fetch)(RAILWAY_API, {
 			method: 'POST',
 			headers: { 'content-type': 'application/json', 'project-access-token': token },
 			body: JSON.stringify({
@@ -956,15 +1021,28 @@ export class LiveGit {
 		});
 		const body = (await res.json().catch(() => ({}))) as { data?: { serviceInstanceRedeploy?: boolean }; errors?: { message: string }[] };
 		if (!res.ok || body.errors?.length || !body.data?.serviceInstanceRedeploy) {
-			const reason = body.errors?.map((e) => e.message).join('; ') || `Railway answered ${res.status}`;
+			const reason = body.errors?.map((e) => e.message).join('; ') || `the host answered ${res.status}`;
 			this.log(`try again: Railway refused the redeploy (${reason})`);
 			return { ok: false, reason };
 		}
-		await this.redis.set(this.key('publish:last'), JSON.stringify({ ...record, tryAgainAt: new Date(this.now()).toISOString() }));
-		this.deploymentsCache = null;
-		this.log(`try again: Railway is redeploying (publish ${record.commit.slice(0, 7)})`);
 		return { ok: true };
 	}
+
+	/** The deploy hook: one POST, no body, no extra headers; any 2xx is success. The URL is never logged or returned. */
+	private async callHook(hook: Extract<Redeployer, { kind: 'hook' }>): Promise<{ ok: true } | { ok: false; reason: string }> {
+		let reason: string;
+		try {
+			const res = await (hook.fetch ?? fetch)(hook.url, { method: 'POST', redirect: 'manual', signal: AbortSignal.timeout(hook.timeoutMs ?? DEPLOY_HOOK_TIMEOUT_MS) });
+			await res.body?.cancel().catch(() => {});
+			if (res.status >= 200 && res.status < 300) return { ok: true };
+			reason = `the deploy hook answered ${res.status}`;
+		} catch (error) {
+			const name = error instanceof Error ? error.name : '';
+			reason = name === 'TimeoutError' || name === 'AbortError' ? "the deploy hook didn't answer in time" : "the deploy hook couldn't be reached";
+		}
+		this.log(`try again: ${reason}`);
+		return { ok: false, reason };
+	}
 }
 
 export interface Moves {