feat(web): serve recovery UI under /recovery

[SuPuHe]

Summary

Serve the existing operator frontend at the domain root and the recovery fixture viewer at /recovery/ from one Cloudflare assets tree.

Scope and acceptance criteria

• The change is limited to frontend deployment composition.
• The existing root app remains at /.
• The recovery UI builds to apps/web/dist/recovery and uses the /recovery/ asset base.
• Wrangler continues serving apps/web/dist as the single assets directory.
• Deployment documentation matches the combined build and route.
• No unrelated cleanup is included.

Product and security invariants

No payment, intent, settlement, authorization, or recovery decision logic changed. The recovery viewer remains a synthetic, read-only fixture UI with no settlement submission capability. No secrets or credentials are included.

Validation

pnpm build:frontend - PASS; root and recovery bundles emitted into the combined asset tree.
pnpm --filter @oneshot/web test - PASS; 27 tests.
pnpm --filter @oneshot/recovery-ui test - PASS; 51 tests.
Both package typechecks and linters - PASS.
pnpm exec wrangler deploy --dry-run - PASS; Wrangler read the combined asset tree and exited without uploading.

Independent review evidence

Gate A - exact candidate tree before push

• Base commit SHA: 710614a

• Candidate tree SHA: c50e1fd7f2b2dc73b4eec1e0277e85d110c6328b

• Candidate commit SHA: 9364515

• Reviewer tool: free-pi-cli

• Reviewer model: glm-5.3-flash

• Verdict: VERDICT: PASS

• Findings: None blocking. Residual risks are build-order coupling and root SPA fallback for unknown recovery paths.

• The reviewed tree equals the committed tree.

Gate B - exact remote PR head

• Pull request URL/number: pending creation.

• Remote head commit SHA: 9364515

• Remote head tree SHA: c50e1fd7f2b2dc73b4eec1e0277e85d110c6328b

• Reviewer tool: free-pi-cli

• Reviewer model: pending.

• Verdict: pending.

• Findings or residual risks: pending.

• Gate B reviewed the current remote head and matches Gate A's approved tree.

• Required CI checks pass.

Risk and rollback

• Residual risks: Reordering the combined build scripts could remove the nested recovery output; unknown /recovery/* paths use the existing root SPA fallback.
• Rollback: revert commit 9364515 or deploy the prior develop revision.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	9364515	Sep 08 2026, 06:49 PM