Worker → Cloudflare Tunnel → self-hosted nginx, verified live end-to-end for both domains. DR-mirror sync, drift checks, and generated nginx Tier-3 configs now cover the fleet, with an explicit activation runbook (not auto-wired to DNS — that stays a deliberate human decision).
Cloudflare Tunnel health checks were failing with a certificate-mismatch error, not a connectivity problem — the domain's cert directory was symlinked to the wrong certificate. Root-caused via direct TLS inspection, fixed, then scanned all tunnel-fallback domains in the fleet to confirm no other domain carried the same bug.
Rotated the GitHub PAT and Cloudflare Global API Key. That rotation silently broke automated deploys on three GitHub repos (mhslp-staging, mhslp-production, mhslp-deployment) — every CI deploy job since the rotation was failing on a stale-credential auth error. Diagnosed from a real failed run, fixed by pushing the current rotated key into all three repos' secrets, and re-ran the failed jobs to confirm green.
WeylandAI doesn't need a hosted Qwen bridge to work in connection-denied environments — it has real gofaineat cascade infrastructure for exactly this. Proved the existing OCR engine (tesseract-wasm, already bundled in the live OCR worker) runs correctly outside the Cloudflare Workers runtime via a real, passing Node.js portability test — a genuine step toward true offline operation.
Built the missing link between cut-sheet discovery and the catalog: a shared Qwen-bridge module, a staging/review table with an anti-hallucination substring-verification backstop, download→OCR→extract→stage orchestration, and discover/review/affirm/promote routes — gated behind the same human-affirm pattern already used elsewhere, so nothing reaches the live catalog without a person confirming it.
Seeded cited, real pricing for components across Falcon, LCN, Schlage, Von Duprin, Ives, Camden, Adams Rite, and Hager. Fixed a bracket-tokenization bug and a finish-mismatch bug that were silently discarding a component's only valid catalogue match.
11 open PRs triaged: 1 duplicate closed (two different AI-tool sessions had independently built the same migration — resolved in favor of the correctly-structured one), 10 real PRs merged — 2 new venture migrations (salesfactorai.com, marketingium.com), 4 scoped WeylandAI bug fixes, and 5 clean new-venture scaffolds (golfcad.cc, golfdad.cc, golflink.cc, golfmind.cc, brocade.cc), each verified conflict-free before merge.
Confirmed the real R2 bucket behind the old music player survived the move off the unpaid plan. Set up real R2 S3-compatible API access from scratch, located a missing track ("Double Dare") via a Google Drive backup search, and restored it to the live bucket.