From c6a86244c6112e230051d28728feae9bc8dd3e86 Mon Sep 17 00:00:00 2001
From: Stuart <sgardoll@gmail.com>
Date: Fri, 14 Aug 2026 10:11:32 +1000
Subject: [PATCH 1/2] fix: refuse to deploy a dist that names files it never
 built

The FTP mirror prunes any remote file with no local counterpart, so deploying
a dist/index.html that references a bundle nobody built is worse than a no-op:
it uploads the broken HTML and deletes the bundle currently serving
production, leaving the site down until someone rebuilds and redeploys.

Nothing caught this. ensure_dist_committed checks the opposite direction -
every local file is committed at HEAD - which passes cleanly when the file is
simply absent. And the state needs no uncommitted change to reach:
dist/index.html is tracked while dist/assets/ is gitignored, so a fresh clone
that skips `npm run build` has the HTML and none of the JS it names.

ensure_dist_self_consistent parses index.html and fails when a referenced file
is missing from disk, before any FTP connection is opened. Deliberately not
skippable with --allow-dirty: that flag exists for a dist git cannot
reproduce, never for one that is internally broken.

Reference matching skips anything carrying a URI scheme, a protocol-relative
host, or a bare anchor, and strips query strings, so external CDN scripts and
data: URIs cannot trip it. Relative and root-relative paths are both checked.

scripts/test-deploy-guard.py covers all six cases (npm run test:deploy-guard).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 DEPLOYMENT.md                                 |  10 ++
 package.json                                  |   1 +
 .../__pycache__/deploy_ftp.cpython-313.pyc    | Bin 0 -> 15644 bytes
 .../test-deploy-guard.cpython-313.pyc         | Bin 0 -> 4091 bytes
 scripts/deploy_ftp.py                         |  62 +++++++++++
 scripts/test-deploy-guard.py                  |  97 ++++++++++++++++++
 6 files changed, 170 insertions(+)
 create mode 100644 scripts/__pycache__/deploy_ftp.cpython-313.pyc
 create mode 100644 scripts/__pycache__/test-deploy-guard.cpython-313.pyc
 create mode 100644 scripts/test-deploy-guard.py

diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
index 86e6310..e78c055 100644
--- a/DEPLOYMENT.md
+++ b/DEPLOYMENT.md
@@ -29,6 +29,16 @@ sit on the server forever. It never lists or deletes a remote directory that
 has no local counterpart. Use `--dry-run` to preview without changing the
 server.
 
+Because pruning deletes remote files, `npm run build` is not optional. The
+script refuses to run when `dist/index.html` names a file that was never built:
+uploading it would replace the live page with one whose bundle 404s *and* prune
+the bundle currently serving the site, so the site would stay down until
+someone rebuilt. `dist/index.html` is tracked while `dist/assets/` is
+gitignored, so a fresh clone is already in that state until it builds. This
+check is not skippable with `--allow-dirty` — that flag covers a `dist/` git
+cannot reproduce, not one that is internally broken. `npm run test:deploy-guard`
+exercises it.
+
 ## FlutterFlow custom-class deploys
 
 FlutterFlow's VS Code extension supports editing existing standalone Custom Code
diff --git a/package.json b/package.json
index 2603fc2..55b7926 100644
--- a/package.json
+++ b/package.json
@@ -9,6 +9,7 @@
     "preview": "vite preview",
     "test": "node --test src/*.test.js",
     "test:proxies": "php scripts/test-proxy-allowlist.php",
+    "test:deploy-guard": "python3 scripts/test-deploy-guard.py",
     "test:key-storage": "npm run build && node scripts/test-key-storage.mjs",
     "verify:buildship-mcp": "node scripts/verify-buildship-mcp.mjs",
     "audit:widget": "node scripts/audit-ff-widget.mjs"
diff --git a/scripts/__pycache__/deploy_ftp.cpython-313.pyc b/scripts/__pycache__/deploy_ftp.cpython-313.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..23777c84f5a1d57c06e62397b6b1ea317bcc3640
GIT binary patch
literal 15644
zcmd6OYj7Lam1YBIyc#dQDN+*Iq9}==2+(@j79~-UC`yziQZgXevMGm#fF=nG1ek76
z6j8B5r)D;!Jrh!~y+*2L*WB92&|5PTZ8kqVRa+HXnVrehPSpY-M?~5hmuFX%TL06-
zn`D(g`<>h921wKP%;wKt5*OWl?>+bSz2|)n9(g<hhw{I!y!Ogs7svfiy3q??x_Fc_
zaojsxn3K7%DQrGxl1=Q}ESuT4MYgbSUgp`iRkpHkn{30k<(&N)hwKo!D}1O%2VMSd
z<H9^z>dH^_t3zh(N_KteNb4c2jEd|I+hkAJE_=fc*%x-oRaYEs+?8s*J+w>fS6Lq_
z-Gp{mKGm)_dnVUisS67M7iOyuyP7$<A?!xo81|sv6855Q3j0tuhpSL;4OgSy7Op|P
zJzR^rC0vKPHC&Hcys{(Q&~usNq7II`BDQh*YD8|#JZAPcM(^SEBa_K=G%m&yN~T-P
zq{Ym*Bu-0L#nYEAikYZ9CS}BEDlSgSQz=PQGSQ?Y%F;wSBZ;Glq@)A|;kg8EV(C;y
zN@W7$QDt0G#H&+@BnB#qlu^WvL@F-b2ppxh-ry^Wze`loqI6x7XIRI$n3ST|F$!}F
zld^O@k)BdS>b*x{vxrxvaljDMDYiUCk}+0HjEbpr1`T6uMFb#`35u7-6N;$B<iun~
zm`KQST2@3U8XLze%2F(o#-!TICNheY92F;`spuHS1{myUES8>1Wkflh&U9%Vqmzm5
zE`g2FUZ@*=<5E(}(A3e?Oy!1%30h-Xk&NjQ?8TxPELKdWQ)7}WNH?(C3hrXjWO61b
zo<$>VhnQr~(=rZXDn|Pl)nS(xpBV=%Y!2WF3<CBZE0*NRsEj3JXR#!0Thdb*B@w5k
zC>d;JdO9VJ;=Ly21l|z4l$1tsNLZAFV~i-+h8{sgNli|OIB)H6*po>>Os5W%_EqVQ
zOF)~Mk<rX#aB@Z*4g})zOaMb(5`>G`r0KLA$I6v-aw?NZr+NsRMlPNRho8R?IweY}
z>*Dn&J3!z^mnbE%T@%sRg|K)|nu(1^6DgsC4mlB%#J0FBMJGm+>FK`o1kNgcIxU|D
zSiJCQJPcw9ZC#>%Y?Ii;feYbF-H~vA2xx;I{-E#~QQVN<r1BS|neptCSFUy(?@{E~
zx5s5^)PF_kJcdul@ry^l)jQm_=OsT~PNHY;@HcV0m+p^!%b#uf=5RESJrQ{ErPB8k
zfx~-)ftNaavURi*pn()HERn|5L@+w_Sv{uBis?xy6-&pZkts%M-`LnK`%id9m8Ua|
zX`Dl=iK$xfc_cH|Ic&6rN=(gofQyi|@=m)Bn{?Kd;v!r}sY8@_0@u#9aKkozOb85Q
zV*yh&hb>`#m@#*14O@rZdatmp+aA{b9EbUoDPjtF^|tbNsJeWuU+GM$o!e2lf=$@^
zu))v|n(bV4KgXra!wou|&=&ow{Eam`BW5ob7Rsx}ovXZV+_?|f^?eb!R*0mO`Gk3_
z^gU`C<&IfexlxnfGo-pJ(OPvVQfx|2WM;DUqu^G7F)1a<iCAE=L=ahXK*1-9&-5j~
zMfJv_lbI=58UdM3PGwX+Bi+cTR?vOyTDH3{J(Y|Tg99CbKNDLfmaGF4N9FW{K`vrP
z_KZI$hQX{Wmn4FdMB{O=MR7Wj87Jb_*GSL5utG7Qh*@3?M8&K{3{3kysyVHwcF=1=
zPN!50gn=q3Q&%VDbWBnd)dGrFtIqYm&^K`6?9d2E?zyvl{VGqyr`nWE9B-ytl?-^X
zTGIz!C&e#nL;Hy@tJS9=LWa_r(_mn6?U6;9QB)obGJ_p*W9AY4ja3^M%2W~nCC1bV
z_ra^wdX3j_;7Mu~V?Wm=W4yc_1NP#h+(I?W-L0*Ex94WhyS+Dimx3#``)1F7Vy`Xw
zw&opM@AEFJaJPEvyDdLxDS8_7O;6lvUwwMu=k2Q(FXf+mG4CEOZf#wP-)etgwbTf6
zw)+mQs$t>P`B&F`Z3SQ3imyHIX#ee9cf*?7UvT?Z_a4o=jy>Y60P1ipINop+y~jR~
zK6w5<XYM!czqkKneqY~*2mg-$@cPfg_pN46$n+Zv?-U+zsD5|ff^m<PMlAY29zW5^
zebm`}@=42WzT@OR%k6zuT*pcp3VLuHX;h3YJfX1#qfIBQ6f~=Srj$9tg{a?#5;p6|
zU&{^1ASp}4vKjM;aC*OxeFF&G8gua&?fmj~gXz?Q>6k*$dp4E`ug@cLgU_IsCFI%I
zr#znyFAgR)7)5XM*TT$joQo5=%QXkh?VR6|eI_J<C{xf{WGNZVB(7_U4hSzZu5^JI
zOAjHCwP%p{vE)>obb+=uzX(i*3?lU*sB)^Q({EQTkaDV39!sXLsxBSCNG7d1qRPl*
zT1nhc?FnUs^eNQ>x>Rkr1AM<#<q42#WvUj*02#zVD*@?2Y7$ci35cS+4OeO%QwJCv
zWdxFvU?_3`O}+Ri-$FIZ-E;fi?4Ru~y1jD;XHONY>fRM@3b_OS(l^H!y)|pzmV&n>
zms#<)uXzInZ(zmSJ!dJpd<#eCk1q7i_ZHpN3uougF2=q;RP<CY49^cQy!7TvMR(Q0
z!2G~s`1^woTwJwy-_5zJ=Z@t0hDVr`i&Y{Tp$kLM0fwLvlYVGXyw2sCBWRAIWsDF4
z-y2JX)Upg4aEA@~7P06EqkjXDLqKF04x6EB#1iHreArCe#2ZMRvR)3cl@KEB;2;e_
zE}I~7#4ry;ZrDKIuq9&kat91j5(yDEk#&`$2QO)eIL1Nl8FF+psR>z!_a@mi)MZE`
zen>TSe@6S2b&BG|H9}9(?*#XqOeP5XqR>25OHxXy{441Mm^u2WR;CK7HfS%&#8p)Q
ziyqOqt4tP)-=<p7q}qXOgiI<w5sgb21x-^?O$nK?Q&JOvgD4srR!b>`#F}O%&^Y-x
zx}3vDc?;Dn_lc`!aqO*h(cvw+YZnIR2Xi}D+%2>HcRe+4A6T4vtLKiVWzJOe)hyhY
zzmc=%#+FP=C;p8!=Uwsb0h+peZyx=nyY9Z3cUBkOzJ)XMXBJQW(coQo_2SuFJoj9_
zrhV1D>%NV1dKMh>j>Wp~dmq+v-qzoK?ggJ-^N9tY_=qz(tAFXPx^KbvV};a<kLp`b
z3g+8F-N_x++oB2eI=m$vh~aGtIPnfQY~ZHB>@3~DGJLFMyo?w+7O?O`V4<x7Q!Diw
zg1(__%DQYiRs+vV*bmGz@Fij+<1uBA*h9Vz;Bc$2G*tD)wv;1cHYl;4<A%YKwGuW(
zY|x9$5l7hKgDHKW0_O*lj5h2cjM!MhMn5x`a)N$Hgl#Bc8^JzcjyQEwT!f}Yf93m%
zmDs<0B@sT<v;jD7BgTF~eB3Uv`hH^dJGd@G=Z)hmN6kc0BL0RBYZ@Ntuvv!~A_lvm
zfDVJ$YoTI&4z@mLM8G>$2(F0r>(<8fOyPuZ#x#hXgwBcU3SCne%KAicnyG}E6(MHL
zVuxz#%G$-NGZ{(ot7iFX)*8NaAtVw9(0h4B@$`wa=k@!?<{r`SlXu`%prEDYj1*_Y
zDH8@Ua#rmi*i>{vQu$M7!<SSZHh)I7E13}`k(K19Xe3W24KzU*(^nIzs63<EqLX+O
zm!Bpuhf(=mau0QNRmdcOmS;vtXLJ%DVd6=3Xe*T<^+uzRfN{Bt#%ZQ4lsCvao@Q2U
z;}B^{N#2TPg;*_doKn#kkD!4X0T+|OO*t}&lzN;kl)b9jx2&^gi@xgFfuhGZd-|TQ
ze(~BJU)!AJuA?cp^H1dWrhhp7-gkcZon>XE^}wwcRvpLh);Hz)ZoW7t6n#w#-<ki;
zicehgbrgIZbNsJdHN<T$EcGoNS~f2qyk%PMxV0x=)3fS6LY#@WJ6ns;A6sv>F4e78
z?_S<rtg3z2d(*pAzoaZlxmTA*SE~;F#=_O?xyQIxEEid7Te`HoV`*UdOupves{2sU
zUAJ&y{z9(rj$3@Nm8;r$znyc}<y~9z{MO%8W8~jg@BZEAq<QKb&FpNYRShj2SlYED
zFYj7z%-8H&b?+~_YcwXi=57I>{T)<HXX|6-32e`8dv)J_^X)ASec*Y)E?oa?htSvU
z{MlYRUGJ|ub<p}(wzgB<*1zhu;yMQ2XB0z{lbn8s1Lrg2V_~uqPd1kIk{(>eM3jF4
z?mj4Wm2gV~%N!tL0rz~KWH_jN6Ddq~sNNggmym;%vV09&d%)t!wjG3Ei&(=vDGVua
zpRmo4^9Pv1SmLTB5bW!+6t+|U%~a2@L+8i`E9Cv)3mUJ9FitZ}N;xYb!=~1sa2)su
zfRm1(m|J0a8#3LQJ*O+9!yQDDU2xhE)xd!k3<h6<Ge?F`tn6x<=^~47_$6|U!RCvn
zB_*{dBQkeWFl#*zdKOilzJ@*{f%6&drQfWYf?0DgDAO6JrZ_ZKrz~aUWFjRgGKuXn
zS<CzB_8@fx`I8zzhNa)mh+U?gBy$l4pQNZ(20-QMOFl+TJiUZMXtR!PedPA4R2QP?
zF@=xv=cs16PrX&MXP~go_TM*Ktc^w3P@Z|uUpz&cLGFb@!=4XpA6oy${gHdsG5E;A
zRX0FKDCxBam#SB)cFtMvy1a8!Z}#L&Z}x&di@v(WXXkG)RbuhTimQd5IeZJ=d2fzi
zI`PBtwU&K_mVLK&uCzRvZ+z;G<LL)JfW2SCxoc;Ke*1Y7=dM|EZ7aC8L5;wId<}1S
zp-5O8A1kEg{fmy19`3fM;pA@1?Oi6+G2{HvN_)=q2vw&VO=mDDCSu?bu>J>xrDc8M
zvQ5Wxw9R6daAuP?A`U}x6Nban60sRiu-!~5nId-3o8<z&Q_jmb4XodVc8k%w4Q!K8
zofS}~6O!L@z|g6IrTnH^v{R=7$l0N<(3dOvRm{WxKh5)9jm8GwUN6_nzMT+BwG9Q-
z22~$YyZn|`HoI*TsZFT5p+Hk9ofPv9*-26l{taX{yQ+}cj_kiZMNVRPaVs6>%%uY-
zw*oTJJ;3nV#voGR<w>t|8<WpZDEX&@;t3rNI6%pfO~j}9mElRQ^aGQ3x9n1u;^Y?=
zz!Hqdnu9qWlt~Jdl?&$9mc(q0*kQP<HD|t`v<kgh*D6Z)avy*UfeW0%w@lQ_^aRE`
zRGZeR%tK15fqWkQbUBY#QshB;09#`seI07RMFK-uD!)wC9;!$+_zDG}nnfu_Sd>CD
zgXK|-cmp5hGgPx2JT*`O&S)w?ZBwrEPVKHa``vAOm;3H)J3N1W?$jr~`d?OU`NaRk
z;`6X3p3P-)qlKDXx8iesut!#WJJ9$mU&Gz1`kZgsvNV<N>diMCU#<E^v8s^-d`?-d
z+KE2*d7Eb^34LZ=zwM&|&ZV78_4(aT=Nk^MR`nPI?o{o3)XHt|d0^q{cHi#=kC{83
z=bL}~xs$7FUaM^{)V4q3%$}VD!b|GI^8RIM`T2aqq1CD<i&YKpdTx4hv9+qUUsSb`
zZ1?PZtdR5bqrkqCe*U(<uCLR6`&e7wF8j}RS#iD2T|^kpxDmMsVAY`3%4QN7{!>%8
zDZ)JqnH@HlrCQi>n1}NOHmGGRk%4bhCMGA7XIQnwrsH@()`(1Ihw2RVU%W69x^UqV
zIph&xQWPSnlJUro0D_#vgZJ@Kz>aWgcU|=hy>Ijuo!&X`V%?l~DRZm+znpzwF}rPW
zp;>J*^l)z7Ymt~`uSNAcmF{iKHD)RsZ{09#o;8d#=BPGf?1mDy^h`s22!S~otb8+3
zPLW2qEl9R*D4Q8`he~~p87`1G3=XhZ(`Jn8t00gfRc1^7{P70+hx`0%-_S7Y#0n!A
z`)I4!M>8BAzu!LE0pa)ENAvHukHdxujkRndN;Y%p=x3^*M#@q)56b}yy_JdY{s<3Y
z?k7PXW(MQ|bIN{MIRZ>&eoU<5YtO_<!aXch3hKeVnphk&`CU{00AL|$bP9nsk})iL
zCq}jSCW|e|(qvkUMN?Y90S^B7RE(m6mr8L5Es`ouPO<RrG-8k}U<rAGpe*FnH5PfK
zD1`<b!VKDBVl*1dh!ayvM!YH^?1{VNj7Xy~`6z_oxX8jCh!d2oTM8V<5yYLwYA6t*
zP|zYkGHwb%w26rX0)KHdkvj_kW5lcFXzUsuF&Amc`$}@Nn~l?g%+!Xr#H`baWD-j$
znZp=X3dN#np#Q|Fpa||GCdN`}tPKDl@d#8Y?5hP=Ay=o@hr8pDkYt+DM#@r2?keNy
zX$AAZJ<I^n)=Z}582rZw5tC7k821bUHkwthWN2l|cw$n7^pjbv=YPz;t!)DNmbDQK
z6pPr>VL`W7B#ENl!jPY*hzmi@x&i@XrpM+$;IWmx1=H`d`^$l)>(OK)j)P<`O=G1a
zP%(fcG@pScK_S|tW6!#Vo-f~f#HZmm-|WOFmw>h+Nse`eG6zc7ftfX|OI*cHvgj7h
zA}CPQ7iU6a7;fO8Wrc#q!LcCW1|1m1xB{akY~H<_J=2gy3`~e^Y+Mf}&;Zb8v<Vkr
zI$@(_ijR{W6-|lKgoJ#DRBVQ!ISZMIF9!l}C#0tX&`>fnFOyo70VIMBe}@$J2mQ9J
zJ*fmTvLqq0C)4henG;B-k~1n#SS6>y=;cXN+1~Q*OQ|W$N84Y<Yg(Fy$(x@91M;|z
zQSyefh&JPpn0|)^mLYD2*k45IO;H+zC~Bd}5=xVgCyHzemg4Y5Y(7$&cH>$7|8Yt#
zrc|f`EL((kC>}49KT;-5iNz{`3vwMjA;%~4kZHy)1qS5PsQeDq#c+X4@XU;y!ZX!g
z;y<d>*mF&>HH~PFEC&#jxv><IW+l6~r0mp}JmqxkBjxc~bo>!M%F{T~S?<>joTC=L
z@_U}@U)1!hc#h1TF4{e7_ALebmfVRI`*uC3=sr>O)vpUfuKA8F+kWJE-?P?nq|k9>
zrQ=xM+Y3w8^9|GI7K>AWI_&U%@732|U9&eA?9FTTZ3X+b5;(ZmJ(tnV<`h1!;(WEg
zsC{O|dk(s@-MeOQD%hKH&#u^8jJXG41uwid|Js^wXTi5~#kXtCcYL|=M=kHStoe@>
z{Kr=O$MfEA(A+1rx#7C1u3J3w?$FJlwYrW%UB^mY=StPy*|YcR{eRZJQs4dh(CoR7
zea#3z)i>u3<aR9{n{yOhwSVtwzYC}Tz#9X_n%zq`mR`Bf@%yfrP*-0u{n}#lcpuui
zs;ytt3CZANI^nOdt;}6zs!(^SWkV^)I3b^Z2Kh`{jbS#HJBJPZaWm6c*9cf7mGt5b
zC2VMJx)w%SV1*Iu*)RaN<sg?nhPk%j^n@$T&|1plDjj5DE4{*|y=-MSTB+A2L94Kl
z9zpIneSW5?zz`pXn@uYbo<b3u1qSpT(Z{m2{}^jGZ5AR}7XkjSnocupxcY~;8uJ;a
zpleq!NgUaabr%{*5Q?S-^a!jGzD06ca6B`SgnUL~6q2q;+@Ole5{cN7f&*pf0$BP6
z7?78c`6;ABP<KsSL#+rvu|S4W3RZa}bRKbI$hJ&6mQEV83rG^npaB9n+JjDK0RXZw
zkwU)6n1t)tIAyL8P$fMfT}{VlSfUj2xBv?>av~@&hduf4c4p1p-Ky!hybrs<<h=ZC
zx+3G=?^S)syz0L+66!zQAL<`MhK7R@R3Ln1)jB4przSPVcLlvw0ZSPP_YL$9_N&&3
zXeKt!*q~}lvOEsP3FTb`oOuRM(bW!`#;OV|&u@gbQngPc6w)K)?-Ec%t4A3-+!(TM
zDs_YRue6Wx5l!2YzlVYUh>!9SDp>ArX1U+37T2o%g=+tD=bh?9bJn7_cH!FmwcPF%
z?~XO^o`QGJiq}79LGTYe0`cnH-Zj_mf@}Amb*^>x6gqo8IIz}vywG`^JbvElg~WU!
zX8|Mgwl0|p-nKPwN5R{%T)P}y@jh{@y5K#q=ItqXF>1woe9rQTuLk4pR@E&kHwBH+
zt@(C=*HIXAXnrVn;EucXK|NRV<mU}=5x%_>QO>RvS8JYc)z}f<#3+V|x`nZ$GAjz3
zSPYNbJV9e4@i1obbw(+YJvRFBh7DGPc|fQeOPCK^4;v&!hOt4e@RNsaoBG1-%^>1h
zBhIK3BJ#4nZiR?GVuj9117=JZ6a22|hp;1=!n2v_GR;yg8QyIqVa*_@BxF+mpiwfL
zMz?1WjUv+Bki_|=el^VmNNJd^&8TB8>0{BdB>?_0O-Y)}Oky*Wa)!i6GQnWJpl>Q2
zNKf{VTTTmHu>@H0s+_(irNn_tgXhIgu!PQ%*G+2$fNL~U$>Ko58MqIODuLxoqCr!l
zDeJO}rPVSu5v-5t+Hpz&MY3oDrUsY_#SThZF(vX|BBsae09q>2&R}MdGETce78>o+
z7j=3{h9x7Z;t&#wpqpjW<79iW4kas!U_&R;j4bAu#8#ASK}to{c&~CTF{ubIuggSz
znWeoFA7`6G>@r0I(xXh}d?rjm4;Eqwil-zbG%)oVEE_tzKmaG%>s*}?*D3X|W9Y?4
zlhH9+8yN$d4Xd3f)5*!o(5z!9klGd_8lxSq9))30001(Caehp!on=tSRv?TlgVY}H
zWziX0St&dthLCW(@qL-CgUHQPW;F0L++_}yNs4u;CSjew%L14nOYRYQNOy7~^qU9=
ztpzSP<a>cA$wPFVd&dg*JUkgL^cXWeWkDLF8G&SR=zR(UnS)PgOqx75dNzmiDCIHU
zn3Q|fV5PcBxzo^DQwq)=7#KXt0=-Ia(C9CKuPKy|`5D-EzWMNv8<%(HLQ9t1)W7Qa
zapV6{h$Vctrp}Z-%gCD{s_vWU`2tSqWCm(oPuXk_8G-c(+1G>!OS09l9*3b>*U==>
zqO}xu&5&f~x<Nd!qLFM&MsJBwx{&(L$gE6FIIrncPz;rfNOm%0*{s7*@`017pb1FB
zzF@M9f@;zD2qk&S#Khqg{R8Uyho~T3X&d7Tog-`nEuOvgEB0G{3q600k1~g9miv4g
zSJRMl7pmK5pDDWP*Ie5RuI+2C)`F|Gq@w3*_bdxb-_9TSX1;o4)$#H@FYebmjutwO
zemIuzIGXPmTJc_(J@bj(Tdb~sx9Mh6q51HCYFuePyi$F5&SqEzCQsw1zWTZG`<$h*
z<-XPGY5Ct4J4^{H=kR?|${`k|Dc#@4aeuvkxhyBbro$%6OWsVS)-sPFpDb{eZr;NN
zmDg_cFk~H8Q!2U~O_{!0)z<sz(l3rQ(qVclRyNC|X{%7)A=4a{uGz9PP=_mW!}U5e
zD8NSkvi=NNJD?*f=vh{K$+ymm-pX8wJIgsd|Lk=-*R9h~tMzrJ_+cXlCe)(OUj8os
zyd-5szRQksi+(lSW?Z%FS79OSVy9>gQGjPd8P+!)QAa)QiCutWQ!8P2876kxQ|=FT
zM~-;nh8v0wl8lb97ug3sGVt|XTnD|X;%T=I=5lCrxOz4gJBP7~H5xw<0&G&xS-Bj#
zyl=DB9Rih5VNm9=kHpkB6#Ybyv^qm;PYIi^Xx*FE;7w~&u75($I`phhxhvkFA>zXB
zHV*3(S7cS;`Id-#L#vSyf#*#XqXd0FaXQ8|C|EF7dXTF;-RAJt&{G>;9=8!=?1q#3
z8mbI$)8~iq!=HaU{UpQ{m$U?OXiQnB@k16ZyGa_!$Wv0bFAQg{=C;=4Nu>vw)DSJi
z88<W~=ASkM3j4Vd<f{$tZ_J|d<5F@m>shCSWS=}iZpKQ@gETe6DWu86FS;M)dF)7b
zOX&wex@gqJXz;TeXvSOGGYP1BQ<<!%^y?GYsPOP2*&jM;RuDUonMFVO@yo3Q&m#l^
zddgTJkljMJmA?SfBrsasl{snh1sYp=q-_aOzE})AF29L3)pSfXiCKrJWqKXUI<$)(
zWV0c)nyACS4O!9h7&1&1N%fwP$KWJQWiHaKtlCFL;_2APi0X#NcLd#7qbji8bgyXA
zm&J<9(w9V~Oind<iYmey_G17Rl2$GF#e`}vZ3`T>`1KHeCv+in2?;Feu|!HHkA@b{
z9;7QcSvVF}R{3vDAyx^T<urlrQEhA`vV4u6ou?{}N_FVJVbIcKXq!||DOs(Q^d`|W
zw-&!HJ-SGbc=)K1n5#9=wc^2Js0ihvDGNx=#ae%a#(L7b{u&hmr=I#XPx~)C?LTQO
zcn-sF$O~(HV}VBwO>ORc(G!Bywr+XAS*-LM2CGYNY+P~|J^kw%^^6x}%gmm-hlKDW
z^G6nr%^xf21#h2Pd@|p3Dqr2d>NtImZ(Zeg+~u2c?Q6}Qh33vxe($}O{XaRl((-hH
z-#UBl6Ia8!ar^Ss`&S(Y?)h2~VV@niCsZwTzR~$+*KA*rw}0>4>*wC)-;OW!&7Ldp
z9rWbv>u3KczBsVTZ@<es=LY|zJ=c)S{JT?2Pv(Wr58^*f{xtc1GJi2t5W=hcrF*<H
zFEp?6Tkp2OwEy7XPmliP(Uq0~TF3xv+qKH?zPl~39Q#oC@8|#a{K~c$3VhS-nNKm%
z!0Q8l@XV*4=7PtM-P^w7y({lsneScBB6EJ{o<BYMr$=wL+<Ia58Cu23xy;<?;)%Co
zxsJCc7Dtv&EWNUH<yQ4i4&0jl&qr?sKXm+E?a!b4Z(D!v$qUb|^3VUu?z!vm%)OF3
z_}<|k9$tEGWouW#+qLQlls0Cu`j1_tQ+b(Ar8-7N=zvE?{B80Q4q5)!R6R`<^mz{1
zpOO}1C$v}Xls5?jNG5%fkb7d1eq11&Ju`G6)Zcd^+%LaILtm%r-&6G;sA8B-E<c)%
zXdI-5d<^`I?>h1?f!iQO`4#HPlwA5jjYdtB->nfwl&(gpN>atBjyyR`UuEb?u*pap
z8Ik{(8iG`jYN0xgP9W@<lzQdA#4Qk*Q|_RG&)8&o!23-6Bat&zeav}2=A7)m`eRP`
z2W|^c7r*7{{6S}tKT+gu-y3{=@R8M0Yo7I?#ap%T;u|mKw;WvY9GVqAwQry0i*_ef
zepIzj<+-YVbXP5Id2?vZ-Bxh7t+?CQ+<Ob|y=(6M1^510XVG4@_$1ujv;0F_l}UKG
zTQD^~Z1$iM8%^6D9;`9dKJ46P+WN59VzNDScbmKq<E9#uNDqaFy<Mid``<Kiyn8OY
UVrlv%@A$*h_bnXX%-;L|0?%sskN^Mx

literal 0
HcmV?d00001

diff --git a/scripts/__pycache__/test-deploy-guard.cpython-313.pyc b/scripts/__pycache__/test-deploy-guard.cpython-313.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..5e09ddd7e580556ac421d0ff804b83cf7538853d
GIT binary patch
literal 4091
zcmai1U2NOd6~2^ciIOPCvK>3Nv-HMJlgPHD#QAF-+ntlxb$*?SR?#9^RhpzE#uUkt
zRALLo<_#$7ti_UG3*uqJ=Dm4udF;~=V9y(@Ih#~A!!m3yd2{Pxz}|K)Ny$o<wigh2
zdGGl@=icvVI~olm7{MR>@P@=9^e^&JAAWDLy#|x}h(iYAD9(40GJMY4Z}{Quzerzb
zF<LOX-qMe*2To8fS9+Jn-Sj%)&C_j7i{G+lggCkv8DXvko{{S;7Z`m9A)Z0#dZZuK
zrD2r!<$duW|3^@Lwjc=$CbkL^7A0NLmT<nr8zL<57G97f-NZaD@JcQ*Uy>CIi?V5@
zu$IeV-O$96V9A=A42S1{e|qjJF3N_X8L(GUCE!$-upt#SOTsx>k?<|qDqvN^iYD+1
z7POLTNruiF)-X0TPrt0@F&}o+$f_tUCJR<kam`WrA`yz`OR5OcRBc`pm*9)oRRY_2
z(RF0r&=w>W&&*xEga>(591M$+B3Zyo-1NAGl3_@yr7U4nGHw#BWYd%_Dd{@dq+JG1
zgBKPg5#K6+Bd&S8X-bxv!myi{Ejh1hh9o+k@Hl5kW&sO|rb-Y2UMM)qA*80oLo{xb
zObgF1h0O(7*NN`;RlSHIXpT4H`w-D|Ngc)dl2y>uW7rf7SqEL<gOzaelyLHt)R)4~
zNJU(UQ#O5-w+cdYskFccsmkp?!{a`>*4Rt?8q>xkO{iZO9Ca;FU*dd;2tu5nJWqK1
z>UYTu)wy@x8C0)%mCB&BbDnl~$t)dx{+oPds5%#h`2iHCuh@`RQnJ~crQ1O-M&;<v
zB19)1v_o=H*9=RM=WV)V$%@@=>XMMn8Co$*$}&sJk<_srN>5##&8BB(=j^s3R5$E7
zRD|9RkOGqoJ0dLtx4Rwp*|fXqew!pL7~6ZlEn#*$k(Bk!bQz5pFm}MtOv7UtJ&APQ
znYcYsjU25+j@FpYU&w3mO4rc3R_Pkw_WRht^0}`AsI~jfd$-@KMu#iW;q|%A=*aSP
zjb=W+_~VOJy01d_txi9t2WpYn^5t!iik>SCxD?#dNJ4=?X?WKVq?VAvP!S~OC1t`<
zqyS!8EI!WvI;Bz^ouN|bxSwmuQ0bs6t@+6XxM012I6}v8A%{N9MVvRwMY+}#1v|UA
zHZDeHsetOc)+i>fz4x1}>u{_C3tt>uXT5+r8a{G6h3wDxg)W4y!KLnwbZdRK^X^C7
z?z$9=Qb?sUz78~VAE6RNQGZ(vW&$tuxGUqYd#nZ^t|Z+rj7$RxR3;M?2Ei6m5YEUj
zb*)_Y=nO*R)M0Oj?}UOw8HU?KPH%d*x7_rCSbMouL$mZd9}|8xbgjEik_k0rLAJS`
zS&HjzMO<H|r4=3X*Lgw5b99$Kgd<6(d+Jhl-h_|an+d}6dl?2~wCu>Z`~aZ{v6pV>
zJO+L?Y~l8C`_g?ovg)%8U6+x7rTQFycec8lXq&V&Mb=lR0DE8ghIQQRLmtKVUnz%o
z;Gx`7vT}*n-~whORnSDZ&&$UMm<U?2C|eew27xocft&=8BLEa=D&P*edk7=}DoBe!
zP#$bRTY(4ksH3F|a1MY1)ChbjU$Dwi4}Ban66Mb4KKXeQpe<1zmlgqFRbCk;Xl-eN
zrX&nWfy?fuG>k>w;sK&X_z497ZLkl})sV0UW#vDN0rbP_c>jQ<>HQO9DSl$iz1gs7
z2;=<)%hJu!R7w!lq{Yk1EwDx~%_KNZs9n;DF-2AvJVB{cPE##2nI||X3xqPYm;@f6
zmy3B<EHP|UF7kOPrK|bV^SmjYJU%=*2{d(silEKXMoq0K0mOb^TI7qmBDspm9x=6?
z;_(M1$pD163<9#E2Ju!k3m0Tj!T{2wC)tU=Sx!CYUCN8;)k~9Sr)Fj^otsL(adUj6
z$+PkR4^eaDxszVf5CGsi?SiFg<-~JRJ)x>}Q!?D1DtUu=UyoLK_e&|t2TX85krE%2
zpq+x8S>V%ri8M7NWuCtBk!D?o>K-&HON@ZJLrv<s|6iR$BQyX3P8@*&IH+j*HFylb
z0lp8{FI;@kmufMBSTBy7=st9~m)qUro=2zrIVw&$O$zDa05^TfBQ~XbfN78h*A9*4
zB~@C~jS0IOlBg!foJP@{NH#X!1UeJ0JoF4ea)X)rOV7ExlXtp))&-OQnlx<uWKS<;
z2VAGTQ<@kApUbDOXkM@Ab%3(!HhNwFk{DX97aK9C5yP~ScBH8Yo{`8HBqY#rO>&$~
zPfwn|RQ6$9j*P-lhGv0es2mu^c_=oU3fokw9K<?NB*t4EthecN=eapM1kItCwcwoE
zK?9l@UXW}WVqn>HUeV@lzqw@EG+Yms-BXlJQUlq>JtAgZ(`~;ZsdgBSlwq0V*05W2
zD0mCPpzD$<+Vl-gR^wqi;PxDL*tt@&q_ehL1UO!%9RWj>tQ#4d$-xmSK?`dDA|jg+
zHKA058wD;n&pQw;SS4PuecFOaIyl@IZZ2t(K!cRaUig`Rf|x;96Mbbfx*wX9_B{`V
z?hUQ6mG<Fk>{KOo>QVPb?9@i={PKk@21U<MHMXn9wr&OKP<V?)(bwU-%I>SM`&NIn
zab$XveY3{4HFhsiTRu8EwiQOvU0b^tVCh8Bi5ffJEMla_o~}g?Y_P93_>R@siCXmF
z27Aa|8Xt%TmZ!eHM4^uE&zY&!gTEd6<<L4)={-{IIa%pB`S8QXJ?A!=sYe#HU>$+w
zi(3K2bX0=9PngIZ=BLa??8;+i_UW$J^2`?p;uQw3(5p<Xqp#XAQ0W+0yZrF<X2%;V
zOfA-3jUBDTjy^oR89TiacpB-bMEah@I`6*y^S(8z65C&mrPp%nZ~acL9vrP49Njqm
z*5<+V?K4kf-IdtD%9(#N(cg^R>smXx(Kfi=zdpA<z0rE?F?0MMyJ9OwjqSWMdwX`(
zTFtFpe8{YqKkIrF_-t`w@66xW^IvwOR|o&oi<q`2Oms!OJNMw-d+)9;Ztgx@X+8Xy
ziF=ORjeQz<LWfq)d}`i3@kx0_S>6BZvuiECy0AL7c55S?`YV0JfTInSk<F4kXS4CB
z9n5B-PO@3Mwb5@UNxN;34$wG6$b&lkL4iKpfM&^IcG~YODScB@Zc26l{tQB$8Kk0|
zW8zd0QA2KxZ1(ra(d(8NGv@Zr6UG@JCx_DH;IZYWDC$c(MA6%wi0b+Rh5wHB{F80F
zyXTWDRkpvv_HVKWs_amO9jdY;6?SAf^i?20wSUz<Nl{0)W_*ZdSIV3Ip3iCKqv<U_
JqI(^s{{!&25>WsE

literal 0
HcmV?d00001

diff --git a/scripts/deploy_ftp.py b/scripts/deploy_ftp.py
index ff9dc18..0eb2105 100755
--- a/scripts/deploy_ftp.py
+++ b/scripts/deploy_ftp.py
@@ -18,10 +18,19 @@
 import argparse
 import ftplib
 import os
+import re
 import subprocess
 import sys
 from pathlib import Path
 
+# src=/href= on any tag, single or double quoted. Only used to find the built
+# assets index.html depends on, so attribute order and tag name don't matter.
+ASSET_REFERENCE = re.compile(
+    r"""\b(?:src|href)\s*=\s*(?P<q>["'])(?P<path>[^"']+)(?P=q)""",
+    re.IGNORECASE,
+)
+URI_SCHEME = re.compile(r"^[a-zA-Z][a-zA-Z0-9+.-]*:")
+
 HOST = "ftp.connectio.com.au"
 PORT = 21
 USER = "opencode_upload@connectio.com.au"
@@ -213,6 +222,58 @@ def ensure_dist_committed(allow_dirty):
             )
 
 
+def missing_referenced_assets(index_html):
+    """Returns the root-relative paths index.html points at that aren't on disk.
+
+    Only root-relative references are checked - external URLs, protocol-relative
+    hosts, data: URIs and in-page anchors are somebody else's problem.
+    """
+    missing = []
+    for match in ASSET_REFERENCE.finditer(index_html):
+        ref = match.group("path").strip()
+        # Anything carrying a scheme (http:, data:, mailto:), a protocol-relative
+        # host, or a bare in-page anchor is not a file this deploy ships.
+        if ref.startswith(("#", "//")) or URI_SCHEME.match(ref):
+            continue
+        rel = ref.split("?", 1)[0].split("#", 1)[0].lstrip("/")
+        if not rel:
+            continue
+        if not (DIST / rel).is_file():
+            missing.append(rel)
+    return sorted(set(missing))
+
+
+def ensure_dist_self_consistent():
+    """Refuse to deploy a dist/ whose index.html points at files that aren't built.
+
+    The mirror prunes any remote file with no local counterpart, so an
+    index.html referencing a bundle that was never built is worse than a no-op:
+    it uploads the broken HTML *and* deletes the working bundle currently
+    serving production, leaving the site down until someone rebuilds.
+
+    That state is reachable without any uncommitted change - dist/index.html is
+    tracked while dist/assets/ is gitignored, so a fresh clone that skips
+    `npm run build` has the HTML and none of the JS it names. Deliberately not
+    skippable by --allow-dirty: that flag is for deploying a dist git cannot
+    reproduce, never for one that is internally broken.
+    """
+    index_html = DIST / "index.html"
+    if not index_html.is_file():
+        sys.exit(f"Refusing to deploy: {index_html} does not exist. Run `npm run build` first.")
+
+    missing = missing_referenced_assets(index_html.read_text(encoding="utf-8"))
+    if missing:
+        listed = "\n".join(f"  {rel}" for rel in missing)
+        sys.exit(
+            "Refusing to deploy: dist/index.html references files that are not "
+            "built:\n"
+            f"{listed}\n"
+            "Uploading this would also prune the bundle currently serving the "
+            "site, taking production down. Rebuild first:\n"
+            "  npm run build"
+        )
+
+
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument(
@@ -228,6 +289,7 @@ def main():
     if not DIST.is_dir():
         sys.exit(f"{DIST} does not exist. Run `npm run build` first.")
 
+    ensure_dist_self_consistent()
     ensure_dist_committed(args.allow_dirty)
 
     local_files, local_dirs = local_files_and_dirs(DIST)
diff --git a/scripts/test-deploy-guard.py b/scripts/test-deploy-guard.py
new file mode 100644
index 0000000..ab5bd15
--- /dev/null
+++ b/scripts/test-deploy-guard.py
@@ -0,0 +1,97 @@
+#!/usr/bin/env python3
+"""Checks the deploy guard that keeps a half-built dist/ off production.
+
+The FTP mirror prunes any remote file with no local counterpart, so deploying a
+dist/index.html that names a bundle nobody built uploads the broken HTML *and*
+deletes the bundle currently serving the site. dist/index.html is tracked while
+dist/assets/ is gitignored, so a fresh clone reaches that state just by
+skipping `npm run build`.
+
+Run: python3 scripts/test-deploy-guard.py
+"""
+import importlib.util
+import sys
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+
+
+def load_deploy_module():
+    spec = importlib.util.spec_from_file_location(
+        "deploy_ftp", REPO_ROOT / "scripts" / "deploy_ftp.py",
+    )
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def main():
+    deploy = load_deploy_module()
+    built_html = (deploy.DIST / "index.html").read_text(encoding="utf-8")
+
+    cases = [
+        (
+            "the committed dist references only files that exist",
+            built_html,
+            [],
+        ),
+        (
+            "a bundle hash with no built file is caught",
+            built_html.replace("assets/index-", "assets/index-absent-"),
+            None,  # asserted below - the real hash is not known here
+        ),
+        (
+            "external, protocol-relative, data and anchor refs are ignored",
+            '<a href="#top"></a>'
+            '<script src="https://cdn.tailwindcss.com"></script>'
+            '<link href="//fonts.gstatic.com/x.css">'
+            '<img src="data:image/png;base64,AA">'
+            '<a href="mailto:someone@example.com">mail</a>',
+            [],
+        ),
+        (
+            "a query string does not hide a file that exists",
+            '<script src="/assets/PLACEHOLDER?v=2"></script>',
+            [],
+        ),
+        (
+            "a relative reference is checked too",
+            '<script src="assets/never-built.js"></script>',
+            ["assets/never-built.js"],
+        ),
+        (
+            "single-quoted attributes are checked",
+            "<script src='/assets/never-built-2.js'></script>",
+            ["assets/never-built-2.js"],
+        ),
+    ]
+
+    # Resolve the real bundle name for the query-string case.
+    real_bundle = next(
+        (p.name for p in (deploy.DIST / "assets").glob("index-*.js")), None,
+    )
+    if real_bundle is None:
+        sys.exit("No built bundle in dist/assets/. Run `npm run build` first.")
+
+    failures = []
+    for name, document, expected in cases:
+        document = document.replace("PLACEHOLDER", real_bundle)
+        actual = deploy.missing_referenced_assets(document)
+
+        if expected is None:
+            ok = len(actual) == 1 and actual[0].startswith("assets/index-absent-")
+        else:
+            ok = actual == expected
+
+        print(f"{'PASS' if ok else 'FAIL'}  {name}")
+        if not ok:
+            failures.append(f"{name}: expected {expected}, got {actual}")
+
+    if failures:
+        print("\n" + "\n".join(failures))
+        sys.exit(1)
+    print(f"\n{len(cases)}/{len(cases)} passed")
+
+
+if __name__ == "__main__":
+    main()

From 67fcb515b0031ef25769a7dbf6067fe78abe81cf Mon Sep 17 00:00:00 2001
From: Stuart <sgardoll@gmail.com>
Date: Fri, 14 Aug 2026 10:17:50 +1000
Subject: [PATCH 2/2] fix: check CSS url() references, not just src=/href=

The page carries its stylesheet inline, so the built font is reachable only
through `src: url('/assets/Delight-VF-<hash>.ttf')` - a colon, not an `=`, and
therefore invisible to the attribute pattern. A dist missing the font passed
the guard, and the mirror then pruned the font off production while the guard
stayed silent. Same prune mechanism as the bundle, quieter symptom: the site
renders in a fallback face rather than not at all.

Matching url() reuses the existing skip rules, which already cover the two
other forms in the page: url(#gem-grad) SVG fragments are caught by the anchor
rule, and url("data:image/svg+xml,...") by the scheme rule. Quotes are
optional in CSS url(), so both spellings are matched.

Guard test now 9/9, including a missing font, an unquoted url(), and the
fragment/data: forms staying ignored. Verified against the real dist: clean as
built, and both the font and the bundle reported when either is absent.

Caught by review of #57.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../__pycache__/deploy_ftp.cpython-313.pyc    | Bin 15644 -> 16012 bytes
 .../test-deploy-guard.cpython-313.pyc         | Bin 4091 -> 4584 bytes
 scripts/deploy_ftp.py                         |  24 ++++++++++++++----
 scripts/test-deploy-guard.py                  |  19 ++++++++++++++
 4 files changed, 38 insertions(+), 5 deletions(-)

diff --git a/scripts/__pycache__/deploy_ftp.cpython-313.pyc b/scripts/__pycache__/deploy_ftp.cpython-313.pyc
index 23777c84f5a1d57c06e62397b6b1ea317bcc3640..5062db562670cd5cc1923801c5a52c9019de49f4 100644
GIT binary patch
delta 1125
zcmZuxU2NM_6u#GSQaeqXCQX(!bm2A?iJh$rEsS+EX+d3RRTk97jWj9lGN*A9qtsom
zoza#7g=(A7_*r|Y_|ZTWFP+2-$buK(2~9%cg=r6)BE%C&h^IgiNRyDb9z^hfAI|yw
zo$q|dK3Dejjn`i2KIrOl1A1LK`{J{$W82+fcw;;9?)K#eogSIZ`-$&p@QCX;v?T!G
zE~x`|OC0t}JnoU)*e7!_Ap6_(e1gnIBg1*&Z~1@Y|8Y1d2c^!TPC&-sL|i%)0eC=;
zNukHj0HAOH$OAEO{2vnps!Wv;!`6H7VaLdbTyEgHEXYPun3zqkju&Hzg$dEd=M}Ry
zUOXF1hzmz-BC{$|m27>@-gLkb>kaOA24<~Gom&jdTYUE_3(MB?{x2NxqBVMGhK1YK
zR^(F%KekTx|H;A6tP>9vp(o4$unST^hbcg=#|3r{7FqH^Jl-=0b*8}dg6XdS&>aN_
zQAUDf*2C|(`&peWu;f}aKu{vYd)nI|=Mw?)gy0Uex1><>+&lmUHt!>Ifhf6_=pbKG
z(MJhC?4?X^s-wMO-C1z9`zm(dTL2UTZR>)QE)(QKJHim`Bj0$Uf!s|1IspR32iltA
zVRBB0dX*`9rg_zDVBJ7wjl3f~^3vqW1r-~pykgeS^nC6#QcM$T<%X#mNHFkXCRM}g
zQbt6IUO|(Rgy<OvBGPnfpwd*=bk%K`>vh$rsj7*F?(^k_RyWboif$s!Kr4EE9br{j
ztSRNXN(FeOQLWt<`s#F^ijSe}8cn)VckhTHh)7tBM+Hq^tT!r}UUl0;2aOBWp(<7?
znyQ<kNHXH7l(*@9Qj)UsrF{0OY(D$UWVXpIX?jJYW=$V`+)^Qb`rjgXUwryeSJO=u
z>RPF0F4vnK%bH=(5fmuqVof#h7TsFYL0=jlrO0s6fQUaCpMI61pKR(!8a6?z2Y7v(
zQ!U2fb$!Q&@9+b+_<_CTZGNcbpwth1<PJZ0iyz#Zxy`3qPD*V~9dN+kN91G#a^$(>
zhATvGe+yfGBpD|RTlZ3Kc-WrO<mt95B~x89vHdZK4t$9we3=XkKjzw{kcHO5Fyn$(
z$+;8z@O8qCZopl#HTtvj6Iva#@X7BXH;6y9yY|SLu~R*pHhjen`*yfN_Q#45dl<I;
zu-(?=N+n%cR!b%PCh1Ry-Jes^{tXzvkn!|Hq#Fc7Z_n(^++{O&S=W`^%ee!mBglLU
SeB@$!-Ps4xucPE%I`$V)*&*%#

delta 799
zcmY*XZAep57(VCT-R<t~!}g`NRBl7}>Clv!iXTORv5;bGAZ##(yXkCR@obh23i~4Z
zg4SC<f(ZZk5hNCuegp-TM9{w|3|2(`i3$SK@Rvd7l7l*Mp7%ZPd7t+@=jFY6>Q2GD
zZZZjouCIyHBi9>?=4vb#J-1;`9q%H>sFs+bI%1CUq#~*(+Y-DBB`hJV5)g_sz+u73
zMBK2#*<9|w!GDq16ZWVOG$2GAQG*l4aIcuy8LjLbKq$o{ln`Agv_%ln5HrO1s+4!Q
znN`}kB^C#iO@4#HJ<7V_9D@%kC(Pp-99O<spRjmBnXL?K@MYzv^AX1Pl)0MUJYH00
z8sb>^LiOE3O-ROI^mqjuI<SP0%)}UI7VPlUD8R#3J4}1@92;XJdMMIUoxsCuj|tXV
zYinX``G?*uaVZ9&{v!y*SorL*L%r7qD;^t!som|hH|fgxvL>b}bJ8m3CPHy*xg{};
z+KPw+roBO21$(P)upk(1FA*{z5yiKc^Wr;h`0AX64-qLpLFAm6AC^QiHkJ<(DVxe?
zjziGb8agCrPyQFBInq&yNb;bR6H`PI2ZyD>V^UfSiqd3WB62D#!m6(d3&8u`(C^=e
z%~15$z%zf?&y|FXoR%h&!}-x{NjI9w<udXRIZGv#SX!4fQZL6*fS!Q6{vvf&)W~xR
zQ)tzQDlAidA1&g0i|>uaH}7Azgy4R_iM8-5P|!M%we44>($~mvSWv>d1YE0DDCvom
zN+<JF9#O}@$CC5ZkP9&0(xwIKZXji$h0)?m@SuGTUx9&+0tR^7@ts?ww+`h+=O;|(
zbXsNIh54@ihBK-=qrxm~cEz3QJ47u-R7QzUCgs$qluVLqFy37)Jf=ZRcWxP=yBB_R
OPjXf)uK8i4$MpyECD0uJ

diff --git a/scripts/__pycache__/test-deploy-guard.cpython-313.pyc b/scripts/__pycache__/test-deploy-guard.cpython-313.pyc
index 5e09ddd7e580556ac421d0ff804b83cf7538853d..9584bcf26f1f337db06221d11516f422934a945f 100644
GIT binary patch
delta 761
zcmZuv%WD%s7@tWt*(TkM^qr*Ij*WSt=~9yVNFRu`R;3_xjE4%sB)i$J-E43lq1{rW
z2f?chc=0G+g_468{T~W?h$jURL_I|6LGa>k9>v!OGyLY8-}n7~^D#dsKgB`^JRby3
zJi2xF_VXiqp_fds-#L1nb#RrwVV-61ARfZQ0?c{w2p+{_Z4|~40pz?wK=a%Txb<$}
zXq0|s!t8j)X|dK%zcEAbD1GHyhR3MaKMN=5IscW&Wd1S$3ozBG0c02e1PXl^(I@_u
z!0~GkPlW)E(J%f5_C$eoaGVP4j4y!`YvXi)9im(8SvX1e*b$hZ@7OVzboYT&);9|~
zO%aemI^AIVK6vVOoS=$g7>XvNa#b^tqM;>>k)^AtG*S#yB9^>i+N<-1xvffz=Uq~!
zOiI#D7gZE>JAZM`&`Wu@C@B!bkW53+q?)8>ik709)23NYrssC&g-#QDw8yFcNwN{q
zkfq(Rs-`6V<zquCZAzlO_^*+k^na8ySy%ga>2OcFtz2*W>#*z;zOjPJI*}`qGYF!I
zNF*l7cV|I#2`REx)g2SXu8C=~Q&v>9{qUG9RWh<p#PsfTai>U1o3dWDG_id-)$XKJ
zh%5<4O+L9*QBTFQOGdON$Fs{0a<dMaN*@l1ehxl{>y7*UFQA9@&^-V2!XV&tO>Vu(
z$M?BJi)8}A76*8t$*nf|<UW@=Or2?YAYXv*xlk+Mb65nP=Kc4Uzw3>U{0}&B9m1KG
a<^c@%(0=WWyk+_xTxxj%6V(TuAMy)^sN#bF

delta 276
zcmaE%{9B&yGcPX}0}!ys)@7ygY~<U+!o>mPG6V5vy~$TtmI~^#<uOHbg4BROu#nW`
zH!Kp2!jt#2N-~N}zRBv!C^}i5&6H7WawwZ8qxj_cY~t(^tU#qfqLV+e2v5GirpGDi
z&loJl#}F(%nVsF1T_%(r$d;Y#&2Gpn7c4iqp4~TG+>{Y)K7#^7v^azXv`j8q7{(4|
zf~f%NmB%5jV9W|rrNEHRpsBc7nd33j<heZ47~MCU@NQ>hI?FiuE#G1eTV-Ch2G=h>
Vn=kSIU}SS-WHkKXG5La^1OPo!G`j!*

diff --git a/scripts/deploy_ftp.py b/scripts/deploy_ftp.py
index 0eb2105..ed659fe 100755
--- a/scripts/deploy_ftp.py
+++ b/scripts/deploy_ftp.py
@@ -29,6 +29,13 @@
     r"""\b(?:src|href)\s*=\s*(?P<q>["'])(?P<path>[^"']+)(?P=q)""",
     re.IGNORECASE,
 )
+# The page carries its stylesheet inline, so the built font arrives as a CSS
+# `src: url(...)` - a colon, not an `=`, and therefore invisible to the
+# attribute pattern above. Quotes are optional in CSS url().
+CSS_URL_REFERENCE = re.compile(
+    r"""\burl\(\s*(?P<q>["']?)(?P<path>[^"')]+)(?P=q)\s*\)""",
+    re.IGNORECASE,
+)
 URI_SCHEME = re.compile(r"^[a-zA-Z][a-zA-Z0-9+.-]*:")
 
 HOST = "ftp.connectio.com.au"
@@ -223,16 +230,23 @@ def ensure_dist_committed(allow_dirty):
 
 
 def missing_referenced_assets(index_html):
-    """Returns the root-relative paths index.html points at that aren't on disk.
+    """Returns the paths index.html points at that aren't on disk.
 
-    Only root-relative references are checked - external URLs, protocol-relative
-    hosts, data: URIs and in-page anchors are somebody else's problem.
+    Covers both HTML attributes (src=/href=) and CSS url() in the inline
+    stylesheet - the built font is only reachable through the latter. External
+    URLs, protocol-relative hosts, data: URIs and in-page anchors (including
+    url(#svg-gradient)) are somebody else's problem.
     """
     missing = []
-    for match in ASSET_REFERENCE.finditer(index_html):
+    matches = [
+        *ASSET_REFERENCE.finditer(index_html),
+        *CSS_URL_REFERENCE.finditer(index_html),
+    ]
+    for match in matches:
         ref = match.group("path").strip()
         # Anything carrying a scheme (http:, data:, mailto:), a protocol-relative
-        # host, or a bare in-page anchor is not a file this deploy ships.
+        # host, or a bare in-page anchor is not a file this deploy ships. The
+        # anchor case also covers CSS's url(#gradient-id) SVG fragments.
         if ref.startswith(("#", "//")) or URI_SCHEME.match(ref):
             continue
         rel = ref.split("?", 1)[0].split("#", 1)[0].lstrip("/")
diff --git a/scripts/test-deploy-guard.py b/scripts/test-deploy-guard.py
index ab5bd15..495e3b8 100644
--- a/scripts/test-deploy-guard.py
+++ b/scripts/test-deploy-guard.py
@@ -64,6 +64,25 @@ def main():
             "<script src='/assets/never-built-2.js'></script>",
             ["assets/never-built-2.js"],
         ),
+        # The stylesheet is inline, so the built font is reachable only through
+        # CSS url() - a colon, not an `=`. Missing it would let the mirror prune
+        # the production font while the guard stayed silent.
+        (
+            "a missing font in CSS url() is caught",
+            "<style>@font-face{font-family:D;src:url('/assets/never-built.ttf');}</style>",
+            ["assets/never-built.ttf"],
+        ),
+        (
+            "an unquoted CSS url() is checked",
+            "<style>@font-face{src:url(/assets/never-built-3.ttf);}</style>",
+            ["assets/never-built-3.ttf"],
+        ),
+        (
+            "SVG fragment and data: url() are ignored",
+            "<style>.a{fill:url(#gem-grad)}"
+            ".b{background:url(\"data:image/svg+xml,%3Csvg%3E%3C/svg%3E\")}</style>",
+            [],
+        ),
     ]
 
     # Resolve the real bundle name for the query-string case.