diff --git a/docs/plans/footer-preferences-and-page-readiness.md b/docs/plans/footer-preferences-and-page-readiness.md index ec20b89..4c5428d 100644 --- a/docs/plans/footer-preferences-and-page-readiness.md +++ b/docs/plans/footer-preferences-and-page-readiness.md @@ -1,6 +1,6 @@ # Public page readiness and Cloudflare analytics -Status: in progress. Date: 2026-10-23. +Status: complete. Date: 2026-10-23. ## Outcome @@ -19,8 +19,9 @@ Cloudflare's [metrics](https://developers.cloudflare.com/web-analytics/data-metr - [x] Inspect current public surfaces, design, analytics and renderer readiness. - [x] Remove Google configuration and implement actual readiness feedback. - [x] Verify no Google/consent UI, slow/failed assets, route changes, cancellation, reduced motion, desktop/mobile and no-JavaScript behavior. -- [ ] Run required checks, review and merge through CI. -- [ ] Verify production source, collection and separate hostname/country reports. +- [x] Run required checks, review and merge through CI. +- [x] Verify production source, public routes and actual collection on both public hostnames. +- [x] Confirm processed analytics with separate hostname and country reports. ## Recovery @@ -29,3 +30,9 @@ Revert the public source/build to restore the prior presentation. The readiness ## Local verification The full repository check passed with 636 tests and 57 conditional skips, builds, isolated application smoke and release checks. After the final readiness refinements, the focused suite passed 10 tests on Node 22 and 24; the standalone browser suite passed 10 checks, including actual shadow-frame decoding, Back/Forward, anchors and native Privacy navigation. All 80 public HTML pages exclude Google and consent assets. Existing public-site QA passed 23 routes at desktop/mobile sizes; cold-load layout shifts remained below 0.1 at all three tested widths. These are local checks; CI, deployed source and Cloudflare collection remain separate gates. + +## Integration and live verification + +[PR #246](https://github.com/Softinator-TechLabs/feedbacks-oss/pull/246) merged as `81b905c925d895324fd1550261ed99ac53b016fe`. Exact-main [CI run 39895951640](https://github.com/Softinator-TechLabs/feedbacks-oss/actions/runs/39895951640) passed all six jobs on attempt 2 after retrying only two Node jobs that timed out during Ubuntu package downloads before tests. The normal [public-site deployment 39898125644](https://github.com/Softinator-TechLabs/feedbacks-oss/actions/runs/39898125644) succeeded. Live deployment metadata matches that source; landing, docs, privacy and comparison routes return HTTP 200, and served readiness JavaScript/CSS match the built artifact byte for byte. + +The hostname-scoped Cloudflare Configuration Rule retains Rocket Loader off. Its legacy Disable RUM setting was removed so automatic analytics can run; Configuration Rules take precedence over Web Analytics rules. Fresh browser checks on both public hostnames confirmed one automatic beacon script loading with HTTP 200 and an actual vendor collection request to `/cdn-cgi/rum` returning HTTP 204. Google tags and consent controls are absent, and the loading signal was verified during controlled slow loading. Separate hostname-filtered dashboards and country breakdowns were also verified; the newly observed Feedbacks visits came from QA, including the slow reload. Operational receipts and screenshots remain private. diff --git a/docs/self-hosting.md b/docs/self-hosting.md index ecb2bb1..4cadafb 100644 --- a/docs/self-hosting.md +++ b/docs/self-hosting.md @@ -100,7 +100,7 @@ Run `npm run build:site`, then `npm run preview:site:cloudflare` for a loopback [`site/public/_headers`](../site/public/_headers) preserves separate website/docs content security policies, allows Markdown readback, and gives fingerprinted assets a long browser cache lifetime. Unversioned HTML and walkthrough files retain the platform's revalidation policy. Static asset serving has no application-server dependency; dynamic Worker code and optional paid services have separate limits and pricing. See [static assets](https://developers.cloudflare.com/workers/static-assets/) and [pricing](https://developers.cloudflare.com/workers/platform/pricing/). -Documentation page chunks load when navigating rather than prefetching every visible sidebar link: [Speed Brain rejects prefetches on Worker routes](https://developers.cloudflare.com/speed/optimization/content/speed-brain/#caveats). If automatic Web Analytics injection conflicts with the site's CSP, use a hostname-scoped [configuration rule](https://developers.cloudflare.com/rules/configuration-rules/settings/#disable-real-user-monitoring-rum) to disable RUM injection for this static host. Keep other hosts' settings and the site's CSP intact. +Documentation page chunks load when navigating rather than prefetching every visible sidebar link: [Speed Brain rejects prefetches on Worker routes](https://developers.cloudflare.com/speed/optimization/content/speed-brain/#caveats). Keep [Rocket Loader off](https://developers.cloudflare.com/rules/configuration-rules/settings/#rocket-loader) for this hostname so scripts retain their normal execution. When using automatic Web Analytics, remove **Disable Real User Monitoring (RUM)** from matching Configuration Rules: [these rules take precedence over Web Analytics rules](https://developers.cloudflare.com/rules/configuration-rules/settings/#disable-real-user-monitoring-rum), even when analytics is enabled in its dashboard. Keep other hosts' settings and the site's CSP intact. Before changing a production hostname, save its current DNS/route configuration privately, verify the `workers.dev` deployment, and test landing/comparison/privacy pages, documentation search and deep links, walkthroughs, Markdown exports, response headers and 404 behavior. Attach the exact hostname only after these checks pass. Preserve the previous host so routing can be restored without rebuilding or touching application data. Deploy reviewed revisions after required CI passes; automatic deployments must retain that gate. @@ -112,7 +112,7 @@ For independent forks, replace the official canonical URL, sitemap, repository a Public builds contain no Google Analytics integration or cookie controls. The hosted public website uses Cloudflare Web Analytics through the existing zone's automatic injection, excluding EU visitors. Its aggregate visits, pageviews and country breakdown do not require analytics cookies, local storage or fingerprinting. Visits are not unique people; browser blockers and excluded regions limit counts. -For a separate installation, configure analytics with your hosting provider and keep your public privacy policy consistent with that deployment. Do not inject a second beacon if automatic injection is enabled. The public CSP permits only Cloudflare's beacon script origin and same-origin collection; the team application and extension are unchanged. The [page-readiness plan](plans/footer-preferences-and-page-readiness.md) records the removal of the former opt-in Google integration and the public loading signal. +For a separate installation, configure analytics with your hosting provider and keep your public privacy policy consistent with that deployment. Do not inject a second beacon if automatic injection is enabled. The [public CSP](../site/public/_headers) permits Cloudflare's `https://static.cloudflareinsights.com` script origin and same-origin `/cdn-cgi/rum` collection; the team application and extension are unchanged. Keep the hostname's Rocket Loader setting separate from RUM, and verify actual beacon loading and collection after changing rules. The [page-readiness plan](plans/footer-preferences-and-page-readiness.md) records the removal of the former opt-in Google integration and the public loading signal. Cloudflare's rule precedence was checked on 2026-10-23. ## Multiple GitHub Apps