v20.4 Release Audit Results

Important flaws found and corrected during the audit

• Cloudflare Pages layout: Command and Iridesceux previously used the project root as the static output while also keeping functions/ there. The package now uses a separate public/ output for both, with functions/ at the Pages project root.
• HVN profile auth race: the profile page could redirect before asynchronous account initialization completed. Protected pages now wait for the real account result and fail closed when auth initialization is unavailable.
• Viewer account persistence: profile edits now merge the full server response; Clear All Data persists to the backend; sign-out redirects correctly; password guidance matches the backend minimum.
• Password-reset privacy: a mail-provider failure no longer creates an account-existence side channel, and an unsent reset token is destroyed.
• Site Studio URL safety: editor overrides can no longer publish javascript:, other executable schemes, protocol-relative URLs, or unknown site IDs. Public runtimes defensively enforce the same rule.
• Public API method safety: the Iridesceux read API explicitly rejects mutations.
• Media seeking: HVN byte-range handling now correctly supports suffix ranges used by video players.
• Live viewer/status data: the HVN player now uses first-party Command-backed audience and broadcast-status endpoints instead of unrelated placeholder lifecycle/view-count calls.
• Forms: every Iridesceux form type is now integration-tested, including attachments, age gates, email delivery payloads and Command mirroring.

Automated suite coverage

Known launch dependencies — not code failures

• The HVN frontend still depends on external font/image/avatar services in several places. Self-host/licensing review is recommended before launch so a third-party outage does not change the public presentation.
• editlocation.html still contains prototype watchlist artwork from via.placeholder.com. Replace it with approved HVN artwork/content before that page is considered final public content.
• The Cloudflare Stream customer/input identifiers in the live page must be verified against the actual Stream account during staging.
• Public forms and HVN account endpoints need Cloudflare WAF/rate-limit rules before launch. Application logic alone is not a substitute for edge abuse controls.
• Safety/weather automation uses representative market coordinates; it is not an authoritative full-DMA emergency-alert replacement. Keep operator review and official sources central.
• The basic Command browser uploader is intentionally for smaller operational assets. Large program masters should use a resumable/multipart R2 ingest workflow.

Mandatory real staging tests

Complete Production Readiness Tests after deployment. At minimum prove Cloudflare Access/JWT, D1/R2 bindings, real uploads, both public sites, all seven market states, Stream playback, realtime cues, Resend delivery, viewer accounts, the physical OBS agent, Primary → Backup → Primary, Emergency Stop, and a full commercial-break rehearsal.