cursedbelt-server 4.11.0 → 4.11.1

package/dist/server/analytics/webAnalytics.d.ts

@@ -48,7 +48,29 @@ export declare const WEB_ANALYTICS_SITE_TAG = "d1bea8562544421fbd2db5f11b74d1cc"
 /** The `cursedalchemy.com` site's `data-cf-beacon` token. This is what the tag carries. */
 export declare const WEB_ANALYTICS_SITE_TOKEN = "bd88d63678b64bc89f9702f48846bc88";
 /**
- * The snippet, exactly as Cloudflare's own `site_info` endpoint spells it.
+ * 🔴 The `version` the beacon's config must carry, or NOTHING is recorded.
+ *
+ * Measured 2026-09-22, after the RUM API showed every manual-snippet shell recording ZERO
+ * pageviews from 2026-09-19 on — collections, music, roms, flix, station and desk, which had
+ * been 130–290 a day between them — while the hosts still on the edge's injection kept
+ * recording. The beacon copies this value into its payload as `versions.fl`, and
+ * `cloudflareinsights.com/cdn-cgi/rum` answers a payload without `fl` with a **404 that carries
+ * no CORS header**, which a browser prints as a CORS refusal and nobody reads as "recorded
+ * nothing". Same token, same src, driven in a real browser from a `*.cursedalchemy.com` origin:
+ * `{"token": …}` → 404 every time; `{"version": "2024.11.0", "token": …}` → 204 every time,
+ * whether the script path was pinned or not. Any value was accepted; this one is what the
+ * edge's own injection carries, so it is the value Cloudflare is known to send.
+ *
+ * Cloudflare's own `site_info` snippet OMITS it, so "exactly the vendor's text" was the
+ * defect, not the safety it looked like. `tools/check-web-analytics.ts` reds a hand copy
+ * without it.
+ */
+export declare const WEB_ANALYTICS_BEACON_VERSION = "2024.11.0";
+/** The `data-cf-beacon` value — one spelling for the tag, the bootstrap and every hand copy. */
+export declare function webAnalyticsBeaconConfig(token?: string): string;
+/**
+ * The snippet as Cloudflare's own `site_info` endpoint spells it — plus the `version` key it
+ * leaves out, without which nothing is recorded (see {@link WEB_ANALYTICS_BEACON_VERSION}).
  *
  * 🔴 The single-quoted attributes and the space after `"token":` are Cloudflare's, not a
  * style choice, and they are kept because this string is COMPARED against what an app's
@@ -104,7 +126,14 @@ export declare function webAnalyticsBootstrap(token?: string): string;
  *
  * Deliberately NOT a substring test against {@link WEB_ANALYTICS_TAG}: a shell is authored by
  * hand and a formatter is allowed to re-wrap the tag across lines or re-order its attributes.
- * What must be true is that the beacon's source is there AND that it is carrying the right
- * token — the two halves that decide whether a pageview is recorded at all.
+ * What must be true is that the beacon's source is there, that it is carrying the right
+ * token, and that its config carries a `version` — the three things that decide whether a
+ * pageview is recorded at all. The third was missed until 2026-09-22 and cost four days of
+ * every manual shell's data; see {@link WEB_ANALYTICS_BEACON_VERSION}.
  */
 export declare function htmlCarriesWebAnalytics(html: string, token?: string): boolean;
+/**
+ * Every `data-cf-beacon` config in `html` names a `version` — and there is at least one.
+ * Read up to the config's closing brace, so key order and a formatter's spacing do not matter.
+ */
+export declare function beaconConfigsCarryVersion(html: string): boolean;

package/dist/server/analytics/webAnalytics.js

@@ -48,7 +48,31 @@ export const WEB_ANALYTICS_SITE_TAG = "d1bea8562544421fbd2db5f11b74d1cc";
 /** The `cursedalchemy.com` site's `data-cf-beacon` token. This is what the tag carries. */
 export const WEB_ANALYTICS_SITE_TOKEN = "bd88d63678b64bc89f9702f48846bc88";
 /**
- * The snippet, exactly as Cloudflare's own `site_info` endpoint spells it.
+ * 🔴 The `version` the beacon's config must carry, or NOTHING is recorded.
+ *
+ * Measured 2026-09-22, after the RUM API showed every manual-snippet shell recording ZERO
+ * pageviews from 2026-09-19 on — collections, music, roms, flix, station and desk, which had
+ * been 130–290 a day between them — while the hosts still on the edge's injection kept
+ * recording. The beacon copies this value into its payload as `versions.fl`, and
+ * `cloudflareinsights.com/cdn-cgi/rum` answers a payload without `fl` with a **404 that carries
+ * no CORS header**, which a browser prints as a CORS refusal and nobody reads as "recorded
+ * nothing". Same token, same src, driven in a real browser from a `*.cursedalchemy.com` origin:
+ * `{"token": …}` → 404 every time; `{"version": "2024.11.0", "token": …}` → 204 every time,
+ * whether the script path was pinned or not. Any value was accepted; this one is what the
+ * edge's own injection carries, so it is the value Cloudflare is known to send.
+ *
+ * Cloudflare's own `site_info` snippet OMITS it, so "exactly the vendor's text" was the
+ * defect, not the safety it looked like. `tools/check-web-analytics.ts` reds a hand copy
+ * without it.
+ */
+export const WEB_ANALYTICS_BEACON_VERSION = "2024.11.0";
+/** The `data-cf-beacon` value — one spelling for the tag, the bootstrap and every hand copy. */
+export function webAnalyticsBeaconConfig(token = WEB_ANALYTICS_SITE_TOKEN) {
+    return `{"version": "${WEB_ANALYTICS_BEACON_VERSION}", "token": "${token}"}`;
+}
+/**
+ * The snippet as Cloudflare's own `site_info` endpoint spells it — plus the `version` key it
+ * leaves out, without which nothing is recorded (see {@link WEB_ANALYTICS_BEACON_VERSION}).
  *
  * 🔴 The single-quoted attributes and the space after `"token":` are Cloudflare's, not a
  * style choice, and they are kept because this string is COMPARED against what an app's
@@ -62,7 +86,7 @@ export const WEB_ANALYTICS_SITE_TOKEN = "bd88d63678b64bc89f9702f48846bc88";
 export function webAnalyticsTag(token = WEB_ANALYTICS_SITE_TOKEN) {
     return ("<!-- Cloudflare Web Analytics -->" +
         `<script type='module' src='${WEB_ANALYTICS_BEACON_SRC}' ` +
-        `data-cf-beacon='{"token": "${token}"}'></script>` +
+        `data-cf-beacon='${webAnalyticsBeaconConfig(token)}'></script>` +
         "<!-- End Cloudflare Web Analytics -->");
 }
 /** The fleet's tag, for the one site this generation serves. */
@@ -111,7 +135,7 @@ export function webAnalyticsBootstrap(token = WEB_ANALYTICS_SITE_TOKEN) {
         `\t\tvar beacon = document.createElement("script");`,
         `\t\tbeacon.type = "module";`,
         `\t\tbeacon.src = "${WEB_ANALYTICS_BEACON_SRC}";`,
-        `\t\tbeacon.setAttribute("data-cf-beacon", '{"token": "${token}"}');`,
+        `\t\tbeacon.setAttribute("data-cf-beacon", '${webAnalyticsBeaconConfig(token)}');`,
         `\t\tdocument.head.appendChild(beacon);`,
         "\t}",
         "</script>",
@@ -122,9 +146,19 @@ export function webAnalyticsBootstrap(token = WEB_ANALYTICS_SITE_TOKEN) {
  *
  * Deliberately NOT a substring test against {@link WEB_ANALYTICS_TAG}: a shell is authored by
  * hand and a formatter is allowed to re-wrap the tag across lines or re-order its attributes.
- * What must be true is that the beacon's source is there AND that it is carrying the right
- * token — the two halves that decide whether a pageview is recorded at all.
+ * What must be true is that the beacon's source is there, that it is carrying the right
+ * token, and that its config carries a `version` — the three things that decide whether a
+ * pageview is recorded at all. The third was missed until 2026-09-22 and cost four days of
+ * every manual shell's data; see {@link WEB_ANALYTICS_BEACON_VERSION}.
  */
 export function htmlCarriesWebAnalytics(html, token = WEB_ANALYTICS_SITE_TOKEN) {
-    return html.includes(WEB_ANALYTICS_BEACON_SRC) && html.includes(token);
+    return html.includes(WEB_ANALYTICS_BEACON_SRC) && html.includes(token) && beaconConfigsCarryVersion(html);
+}
+/**
+ * Every `data-cf-beacon` config in `html` names a `version` — and there is at least one.
+ * Read up to the config's closing brace, so key order and a formatter's spacing do not matter.
+ */
+export function beaconConfigsCarryVersion(html) {
+    const configs = [...html.matchAll(/data-cf-beacon[^{]{0,24}(\{[^}]*\})/g)].map((m) => m[1] ?? "");
+    return configs.length > 0 && configs.every((c) => /"version"\s*:\s*"[^"]+"/.test(c));
 }

package/dist/server/master-lock/guard.d.ts

@@ -51,9 +51,14 @@ export interface MasterLockGuardOptions extends LockPageOptions {
  * loosening it: nothing loads from anywhere but this origin, the form posts nowhere (the
  * script does the POST), and the page cannot be framed.
  *
- * 🔴 **EXPORTED so that nothing has to copy it.** `apps/collections` had a hand-typed
- * duplicate of this string in a test until 2026-09-18, which is a policy that can drift
- * without anything going red. It is also what
+ * 🔴 **EXPORTED so that nothing has to copy it** — and exporting it is not the same as nothing
+ * copying it. This sentence used to read *"`apps/collections` had a hand-typed duplicate … until
+ * 2026-09-18"*, and it was false the day it was written: the export landed, and BOTH re-typed
+ * copies stayed — one in `apps/collections/scripts/injectedScripts.test.ts` and one three
+ * directories from here in `../analytics/injectedScripts.spec.ts`. They were collapsed onto this
+ * constant on 2026-09-21. A policy that is typed twice can be loosened in one place and stay
+ * green in the other, which is a wall that no longer refuses what its own test says it does.
+ * It is also what
  * `beaconNeverReachesTheWall.spec.ts` measures the beacon against: the wall refuses
  * `static.cloudflareinsights.com`, so the analytics tag and this response are mutually
  * exclusive BY CONSTRUCTION rather than by anyone remembering. The owner's reason, 2026-09-18:

package/dist/server/master-lock/guard.js

@@ -20,9 +20,14 @@ const noStore = { "cache-control": "no-store, no-cache, must-revalidate", pragma
  * loosening it: nothing loads from anywhere but this origin, the form posts nowhere (the
  * script does the POST), and the page cannot be framed.
  *
- * 🔴 **EXPORTED so that nothing has to copy it.** `apps/collections` had a hand-typed
- * duplicate of this string in a test until 2026-09-18, which is a policy that can drift
- * without anything going red. It is also what
+ * 🔴 **EXPORTED so that nothing has to copy it** — and exporting it is not the same as nothing
+ * copying it. This sentence used to read *"`apps/collections` had a hand-typed duplicate … until
+ * 2026-09-18"*, and it was false the day it was written: the export landed, and BOTH re-typed
+ * copies stayed — one in `apps/collections/scripts/injectedScripts.test.ts` and one three
+ * directories from here in `../analytics/injectedScripts.spec.ts`. They were collapsed onto this
+ * constant on 2026-09-21. A policy that is typed twice can be loosened in one place and stay
+ * green in the other, which is a wall that no longer refuses what its own test says it does.
+ * It is also what
  * `beaconNeverReachesTheWall.spec.ts` measures the beacon against: the wall refuses
  * `static.cloudflareinsights.com`, so the analytics tag and this response are mutually
  * exclusive BY CONSTRUCTION rather than by anyone remembering. The owner's reason, 2026-09-18:

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.11.0",
+	"version": "4.11.1",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split \u2014 storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",

package/src/server/analytics/injectedScripts.spec.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { foreignScriptSources, scriptsRefusedByCsp } from "./injectedScripts";
+import { MASTER_LOCK_CSP } from "../master-lock/guard";
 import { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_TAG } from "./webAnalytics";
 
 const PAGE = "https://collections.cursedalchemy.com/";
@@ -61,14 +62,17 @@ describe("scriptsRefusedByCsp", () => {
 	/**
 	 * 🔴 The failure path this whole file exists for — the owner's console line, turned into a
 	 * refusal. `script-src 'self'` with something injecting is exactly what he pasted.
+	 *
+	 * 🔴 **`MASTER_LOCK_CSP` itself, never a hand-typed copy of it.** `guard.ts:91` exports the
+	 * policy for exactly this reason and says so — *"EXPORTED so that nothing has to copy it"* —
+	 * and until 2026-09-21 the two readers that mattered both re-typed the string anyway: this
+	 * spec, and a byte-identical fork of this whole file in `apps/collections`. A policy that is
+	 * typed twice can be loosened in one place and stay green in the other, which would leave
+	 * this test passing about a CSP the wall no longer serves. Importing it means relaxing the
+	 * real policy REDS here, which is the only version of this test worth having.
 	 */
-	test("script-src 'self' refuses the injected beacon and names its origin", () => {
-		const refused = scriptsRefusedByCsp(
-			"default-src 'none'; style-src 'self'; script-src 'self'; connect-src 'self'; " +
-				"img-src data:; form-action 'none'; base-uri 'none'; frame-ancestors 'none'",
-			beacon,
-			PAGE,
-		);
+	test("the wall's own CSP refuses the injected beacon and names its origin", () => {
+		const refused = scriptsRefusedByCsp(MASTER_LOCK_CSP, beacon, PAGE);
 		expect(refused.map((s) => s.origin)).toEqual([WEB_ANALYTICS_BEACON_ORIGIN]);
 	});
 

package/src/server/analytics/webAnalytics.spec.ts

@@ -2,27 +2,46 @@ import { describe, expect, test } from "bun:test";
 import {
 	WEB_ANALYTICS_BEACON_ORIGIN,
 	WEB_ANALYTICS_BEACON_SRC,
+	WEB_ANALYTICS_BEACON_VERSION,
 	WEB_ANALYTICS_SITE_TAG,
 	WEB_ANALYTICS_SITE_TOKEN,
 	WEB_ANALYTICS_TAG,
+	beaconConfigsCarryVersion,
 	htmlCarriesWebAnalytics,
+	webAnalyticsBeaconConfig,
 	webAnalyticsBootstrap,
 	webAnalyticsTag,
 } from "./webAnalytics";
 
 /**
  * 🔴 The snippet, as Cloudflare's own `GET /accounts/<acct>/rum/site_info/list` returned it on
- * 2026-09-18 for `cursedalchemy.com`, unescaped. Pinning it byte-for-byte is the point: this
- * is the thing a shell pastes, and the day it drifts from the vendor's text is a day nobody
- * would otherwise notice until a dashboard stopped filling.
+ * 2026-09-18 for `cursedalchemy.com`, unescaped — and it records NOTHING. Measured 2026-09-22:
+ * the RUM endpoint 404s every payload this config produces, and four days of every manual
+ * shell's pageviews went with it while this test pinned the vendor's text as the safe choice.
  */
 const FROM_CLOUDFLARE =
 	`<!-- Cloudflare Web Analytics --><script type='module' src='https://static.cloudflareinsights.com/beacon.min.js' ` +
 	`data-cf-beacon='{"token": "bd88d63678b64bc89f9702f48846bc88"}'></script><!-- End Cloudflare Web Analytics -->`;
 
+/** The vendor's snippet with the one key it leaves out, which is what the fleet ships. */
+const WHAT_RECORDS = FROM_CLOUDFLARE.replace(`'{"token": `, `'{"version": "2024.11.0", "token": `);
+
 describe("the fleet's beacon", () => {
-	test("is exactly the snippet Cloudflare hands out for this site", () => {
-		expect(WEB_ANALYTICS_TAG).toBe(FROM_CLOUDFLARE);
+	test("is Cloudflare's snippet plus the `version` the endpoint requires", () => {
+		expect(WHAT_RECORDS).not.toBe(FROM_CLOUDFLARE);
+		expect(WEB_ANALYTICS_TAG).toBe(WHAT_RECORDS);
+		expect(webAnalyticsBeaconConfig()).toBe(`{"version": "${WEB_ANALYTICS_BEACON_VERSION}", "token": "${WEB_ANALYTICS_SITE_TOKEN}"}`);
+	});
+
+	test("🔴 a config without `version` is refused — the vendor's own text among them", () => {
+		expect(htmlCarriesWebAnalytics(FROM_CLOUDFLARE)).toBe(false);
+		expect(beaconConfigsCarryVersion(FROM_CLOUDFLARE)).toBe(false);
+		// Two beacons on one page, one of them without it, is still a page that records nothing.
+		expect(beaconConfigsCarryVersion(WHAT_RECORDS + FROM_CLOUDFLARE)).toBe(false);
+		// The edge's own spelling — no spaces, other keys after — is accepted.
+		expect(beaconConfigsCarryVersion(`data-cf-beacon='{"version":"2024.11.0","token":"x","r":1,"spa":2}'`)).toBe(true);
+		// And a page with no config at all is not vacuously fine.
+		expect(beaconConfigsCarryVersion("<html></html>")).toBe(false);
 	});
 
 	test("carries the site TOKEN, never the site TAG", () => {
@@ -79,7 +98,7 @@ describe("the hostname guard", () => {
 		for (const host of ["cursedalchemy.com", "collections.cursedalchemy.com", "vault.cursedalchemy.com"]) {
 			const { appended, attrs } = runBootstrap(host);
 			expect(appended, `${host} should load the beacon`).toEqual([WEB_ANALYTICS_BEACON_SRC]);
-			expect(attrs["data-cf-beacon"]).toBe(`{"token": "${WEB_ANALYTICS_SITE_TOKEN}"}`);
+			expect(attrs["data-cf-beacon"]).toBe(webAnalyticsBeaconConfig());
 		}
 	});
 
@@ -113,7 +132,7 @@ describe("htmlCarriesWebAnalytics", () => {
 		// A formatter is allowed to break the attributes across lines; the check must survive it.
 		const rewrapped =
 			`<script\n\ttype="module"\n\tsrc="${WEB_ANALYTICS_BEACON_SRC}"\n` +
-			`\tdata-cf-beacon='{"token": "${WEB_ANALYTICS_SITE_TOKEN}"}'\n></script>`;
+			`\tdata-cf-beacon='${webAnalyticsBeaconConfig()}'\n></script>`;
 		expect(htmlCarriesWebAnalytics(rewrapped)).toBe(true);
 	});
 

package/src/server/analytics/webAnalytics.ts

@@ -53,7 +53,33 @@ export const WEB_ANALYTICS_SITE_TAG = "d1bea8562544421fbd2db5f11b74d1cc";
 export const WEB_ANALYTICS_SITE_TOKEN = "bd88d63678b64bc89f9702f48846bc88";
 
 /**
- * The snippet, exactly as Cloudflare's own `site_info` endpoint spells it.
+ * 🔴 The `version` the beacon's config must carry, or NOTHING is recorded.
+ *
+ * Measured 2026-09-22, after the RUM API showed every manual-snippet shell recording ZERO
+ * pageviews from 2026-09-19 on — collections, music, roms, flix, station and desk, which had
+ * been 130–290 a day between them — while the hosts still on the edge's injection kept
+ * recording. The beacon copies this value into its payload as `versions.fl`, and
+ * `cloudflareinsights.com/cdn-cgi/rum` answers a payload without `fl` with a **404 that carries
+ * no CORS header**, which a browser prints as a CORS refusal and nobody reads as "recorded
+ * nothing". Same token, same src, driven in a real browser from a `*.cursedalchemy.com` origin:
+ * `{"token": …}` → 404 every time; `{"version": "2024.11.0", "token": …}` → 204 every time,
+ * whether the script path was pinned or not. Any value was accepted; this one is what the
+ * edge's own injection carries, so it is the value Cloudflare is known to send.
+ *
+ * Cloudflare's own `site_info` snippet OMITS it, so "exactly the vendor's text" was the
+ * defect, not the safety it looked like. `tools/check-web-analytics.ts` reds a hand copy
+ * without it.
+ */
+export const WEB_ANALYTICS_BEACON_VERSION = "2024.11.0";
+
+/** The `data-cf-beacon` value — one spelling for the tag, the bootstrap and every hand copy. */
+export function webAnalyticsBeaconConfig(token: string = WEB_ANALYTICS_SITE_TOKEN): string {
+	return `{"version": "${WEB_ANALYTICS_BEACON_VERSION}", "token": "${token}"}`;
+}
+
+/**
+ * The snippet as Cloudflare's own `site_info` endpoint spells it — plus the `version` key it
+ * leaves out, without which nothing is recorded (see {@link WEB_ANALYTICS_BEACON_VERSION}).
  *
  * 🔴 The single-quoted attributes and the space after `"token":` are Cloudflare's, not a
  * style choice, and they are kept because this string is COMPARED against what an app's
@@ -68,7 +94,7 @@ export function webAnalyticsTag(token: string = WEB_ANALYTICS_SITE_TOKEN): strin
 	return (
 		"<!-- Cloudflare Web Analytics -->" +
 		`<script type='module' src='${WEB_ANALYTICS_BEACON_SRC}' ` +
-		`data-cf-beacon='{"token": "${token}"}'></script>` +
+		`data-cf-beacon='${webAnalyticsBeaconConfig(token)}'></script>` +
 		"<!-- End Cloudflare Web Analytics -->"
 	);
 }
@@ -121,7 +147,7 @@ export function webAnalyticsBootstrap(token: string = WEB_ANALYTICS_SITE_TOKEN):
 		`\t\tvar beacon = document.createElement("script");`,
 		`\t\tbeacon.type = "module";`,
 		`\t\tbeacon.src = "${WEB_ANALYTICS_BEACON_SRC}";`,
-		`\t\tbeacon.setAttribute("data-cf-beacon", '{"token": "${token}"}');`,
+		`\t\tbeacon.setAttribute("data-cf-beacon", '${webAnalyticsBeaconConfig(token)}');`,
 		`\t\tdocument.head.appendChild(beacon);`,
 		"\t}",
 		"</script>",
@@ -133,12 +159,23 @@ export function webAnalyticsBootstrap(token: string = WEB_ANALYTICS_SITE_TOKEN):
  *
  * Deliberately NOT a substring test against {@link WEB_ANALYTICS_TAG}: a shell is authored by
  * hand and a formatter is allowed to re-wrap the tag across lines or re-order its attributes.
- * What must be true is that the beacon's source is there AND that it is carrying the right
- * token — the two halves that decide whether a pageview is recorded at all.
+ * What must be true is that the beacon's source is there, that it is carrying the right
+ * token, and that its config carries a `version` — the three things that decide whether a
+ * pageview is recorded at all. The third was missed until 2026-09-22 and cost four days of
+ * every manual shell's data; see {@link WEB_ANALYTICS_BEACON_VERSION}.
  */
 export function htmlCarriesWebAnalytics(
 	html: string,
 	token: string = WEB_ANALYTICS_SITE_TOKEN,
 ): boolean {
-	return html.includes(WEB_ANALYTICS_BEACON_SRC) && html.includes(token);
+	return html.includes(WEB_ANALYTICS_BEACON_SRC) && html.includes(token) && beaconConfigsCarryVersion(html);
+}
+
+/**
+ * Every `data-cf-beacon` config in `html` names a `version` — and there is at least one.
+ * Read up to the config's closing brace, so key order and a formatter's spacing do not matter.
+ */
+export function beaconConfigsCarryVersion(html: string): boolean {
+	const configs = [...html.matchAll(/data-cf-beacon[^{]{0,24}(\{[^}]*\})/g)].map((m) => m[1] ?? "");
+	return configs.length > 0 && configs.every((c) => /"version"\s*:\s*"[^"]+"/.test(c));
 }

package/src/server/incidents/incidents.spec.ts

@@ -30,7 +30,11 @@ const stuckIngest = (failed = 42): IncidentReport => ({
 	title: "collections: every queued upload is failing",
 	whatBroke: "The scheduled ingest ran and every one of its items failed.",
 	whatItBlocks: "Nothing new reaches the collections app, and the queue keeps growing.",
-	whatToDo: "cd ~/code/local/binary-server && bun run storage-drift",
+	// 🔴 Not a `cd ~/…`. This is a PUBLISHED library: a fixture here is read by whoever
+	// installs it, and the string that stood until 2026-09-22 named a directory on one
+	// machine that had not existed for days. `check-paths`'s `deadCd` rule is what found
+	// it, and a fixture is the one kind of violation that can simply be reworded.
+	whatToDo: "Run the storage-drift sweep for this tenant and clear the failed uploads.",
 	facts: { failed, pending: failed },
 });
 

package/src/server/master-lock/guard.ts

@@ -80,9 +80,14 @@ const noStore = { "cache-control": "no-store, no-cache, must-revalidate", pragma
  * loosening it: nothing loads from anywhere but this origin, the form posts nowhere (the
  * script does the POST), and the page cannot be framed.
  *
- * 🔴 **EXPORTED so that nothing has to copy it.** `apps/collections` had a hand-typed
- * duplicate of this string in a test until 2026-09-18, which is a policy that can drift
- * without anything going red. It is also what
+ * 🔴 **EXPORTED so that nothing has to copy it** — and exporting it is not the same as nothing
+ * copying it. This sentence used to read *"`apps/collections` had a hand-typed duplicate … until
+ * 2026-09-18"*, and it was false the day it was written: the export landed, and BOTH re-typed
+ * copies stayed — one in `apps/collections/scripts/injectedScripts.test.ts` and one three
+ * directories from here in `../analytics/injectedScripts.spec.ts`. They were collapsed onto this
+ * constant on 2026-09-21. A policy that is typed twice can be loosened in one place and stay
+ * green in the other, which is a wall that no longer refuses what its own test says it does.
+ * It is also what
  * `beaconNeverReachesTheWall.spec.ts` measures the beacon against: the wall refuses
  * `static.cloudflareinsights.com`, so the analytics tag and this response are mutually
  * exclusive BY CONSTRUCTION rather than by anyone remembering. The owner's reason, 2026-09-18: