deploy: guard prod-only runtime data from rsync --delete

dac2f03dc146e33a1e1c8548e312cd8afe37fa45 · 2026-09-04 08:25:09 -0700 · Steve Abrams

deploy.sh runs 'rsync -az --delete' with no data/ exclude, so a deploy
overwrote the box's runtime file with the local copy and destroyed
everything written since the last deploy. Added a surgical
RSYNC_EXTRA_EXCLUDES for this project's runtime path(s) only, so genuine
build artifacts under data/ keep syncing.

Verified by itemized rsync --dry-run against prod: the runtime file is
listed for transfer WITHOUT the exclude and absent WITH it.

Fleet sweep, TK-11227. Same bug class as the July 2026 artmura/quadrille
mis-target fix and the abramsagency lead-ledger fix (TK-10536).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013mq9RQtVZZEWvreDqqTgv2

Files touched

M .deploy.conf

Diff

commit dac2f03dc146e33a1e1c8548e312cd8afe37fa45
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Sep 4 08:25:09 2026 -0700

    deploy: guard prod-only runtime data from rsync --delete
    
    deploy.sh runs 'rsync -az --delete' with no data/ exclude, so a deploy
    overwrote the box's runtime file with the local copy and destroyed
    everything written since the last deploy. Added a surgical
    RSYNC_EXTRA_EXCLUDES for this project's runtime path(s) only, so genuine
    build artifacts under data/ keep syncing.
    
    Verified by itemized rsync --dry-run against prod: the runtime file is
    listed for transfer WITHOUT the exclude and absent WITH it.
    
    Fleet sweep, TK-11227. Same bug class as the July 2026 artmura/quadrille
    mis-target fix and the abramsagency lead-ledger fix (TK-10536).
    
    Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_013mq9RQtVZZEWvreDqqTgv2
---
 .deploy.conf | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.deploy.conf b/.deploy.conf
index fe793d8..9b0cf2f 100644
--- a/.deploy.conf
+++ b/.deploy.conf
@@ -3,3 +3,9 @@ PROJECT_NAME=robet-site
 DEPLOY_PATH=/root/Projects/robet-site
 HEALTH_URL=http://127.0.0.1:9788/
 # Public domain (gated): appointments.designerwallcoverings.com → Cloudflare → Kamatera 45.61.58.125
+
+# Runtime state written by the LIVE server. deploy.sh runs `rsync -az --delete`, so
+# without this exclude a deploy overwrites the prod file with the local copy and
+# destroys everything submitted since the last deploy. Kept surgical so genuine
+# build artifacts under data/ keep syncing.
+RSYNC_EXTRA_EXCLUDES="/data/contacts.jsonl /data/keys.json"

← c318a29 creds-safe fetch guard: resolve relative fetch vs credential · back to Robet Site · (newest)