Merged as fd1d21a and live at https://docs.bds.oncarlos.com. Two things about the deploy are worth recording, because both are the "confident wrong answer" shape AGENTS.md warns about and both would have let a broken deploy pass as a good one.
carlos deploy reported "live" while the old binary was still serving. It shipped fd1d21a, promoted it to edge, printed live, and carlos instances list then showed VERSION fd1d21a / Running. All of that was true about the adopted release and false about the running process: GET /api/version still answered 855f95b, and — the unambiguous probe — the instance still served /static/editor.15280b7eedd1868f.js (200) and 404'd the new bundle name. The route had been Asleep; adoption is not a restart. carlos restart --app docs --account bds cycled it, after which the new bundle served 200 and the old one 404'd.
The bundle name is a better probe than either the header or the version endpoint here, and it is free: the committed bundle's filename is the sha256 of its own content (fixtures/build-editor.mjs), and internal/docs/assets.go panics unless exactly one exists, so exactly one bundle name can ever be served by a given binary. Asking for the new name is asking the running process which build it is, with no cooperation from the platform's own bookkeeping.
The ship build line in the signin-and-samples plan (step 3) does not stamp the version. rastrillo.BuildVersion defaults to the literal "dev" (serve.go:45) and is exactly what /api/version prints, so a binary built with the plan's -ldflags "-s -w" answers dev and distinguishes nothing — which is precisely the check discussion #7 relied on to confirm the last deploy. The first build here did that, and after the restart the endpoint went from a real sha to dev: an observability regression, not a functional one, but it blinds the only probe that asks the process itself.
Rebuilt with -X github.com/carlosframework/rastrillo.BuildVersion=$(git rev-parse --short HEAD). Versions are immutable — carlos ship refused to redefine fd1d21a with different content, correctly — so the stamped build went out as fd1d21a-1. The release is therefore named fd1d21a-1 while the process reports fd1d21a; both name commit fd1d21a, and the stamp names the commit rather than the build iteration on purpose, since the commit is the thing anyone reading it wants.
Anyone updating that plan's step 3 should add the -X to it.
Verified from outside, signed out:
GET /api/version -> fd1d21a
GET /static/editor.98af6ed37bba8906.js -> 200, sha256 prefix 98af6ed37bba8906
GET /static/editor.15280b7eedd1868f.js -> 404 (the old bundle is gone)
GET / -> 303 to sign-inThe served bundle's sha256 equals its own filename and the committed file byte for byte, so what is live is the reviewed code and not a rebuild of it.
The in-browser behaviour was verified before the merge against scripts/run-dev.sh rather than against this instance, because the live allowlist admits real addresses only and a magic link is a credential I should not be handling.