notes: the sweeps ran — all four gone, and what the live run settled

[JulienMartel]

What

A notes-only follow-up to #375. The handoff and §5.3 both said "until both have run, two of the four are still public" — both have run, so that line is now false in the plan of record.

Why

Both preview-sweep copies merged and ran 2026-08-15 11:16 UTC, dry-run first then for real. All four leaked Workers deleted. Re-enumerating the account leaves nebelhaus, hausfold and hausfold-pr-49, and the two hostnames that were serving /init.sh?ref=<sha> now 404 — so the ?ref= hole is gone from the code's last hiding place, not just from the zone.

Three things the live run settled that construction alone could not, and they're why this is worth a commit rather than a mental note:

• The keep arm is real, not just anchored. hausfold.co's run had an open PR's preview (hausfold-pr-49) in front of it and left it alone, in both passes. That's the safety property that most needed demonstrating before anyone trusts this on a cron.
• The CI token can list. The header called Workers Scripts:Read "inference until the first run". It isn't any more, in either repo.
• preview-web.yml's fast path is fine when it fires. ci, web: enumerate the account, reap leaked previews, and fix three 301s onto a 404 #375's own preview was already gone before the sweep looked — backstop, not replacement, and the account listing is what shows the difference.

Verify

workshop      DELETED nebelhaus-pr-321 / nebelhaus-pr-341
hausfold.co   DELETED hausfold-pr-16 / hausfold-pr-22, keep hausfold-pr-49 (PR #49 is open)

Then, against the account and the live URLs:

# the two that served the hole
curl -s -o /dev/null -w '%{http_code}\n' \
  "https://nebelhaus-pr-341.<sub>.workers.dev/init.sh?ref=<a resolvable sha>"   # 404

# untouched
curl -sI https://hausfold.co/                      # 200
curl -sI https://nebelhaus.com/guides/pounce       # 301 → /docs/haus/rooms/launcher/

Watch out

• Branched fresh from main rather than rebased: ci, web: enumerate the account, reap leaked previews, and fix three 301s onto a 404 #375 landed as a squash, so replaying the original commits conflicts with the merged copy of itself.
• 👤 api.hausfold.co is still there — account-side, in no config, dormant only because that subdomain has no DNS record. Its box in §5.3 is unchanged.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PkTBtapKcZTCeTqfhRZEJ7