CommutingCost Pilot — Editorial Warm + Motion + AEO/GEO

Final implementation plan

Date: 2026-07-18 Status: APPROVED FOR EXECUTION — pending the 7 open questions in Part H (only Q1 and Q2 block a stage; the rest have safe defaults) Scope: two surfaces only — / and /commute-cost/[metro] — plus root discovery artifacts (sitemap.xml, robots.txt, llms.txt, llms-full.txt, /methodology, OG image routes, favicon). Out of scope: /map, /compare, /rankings, /TLCcosts, /losing-ground, /blog, /admin, /enterprise, /pricing, /widget, /find-home, /family-budget. They inherit the kit in Phase 3. No backend, GPU, kernel, or engine changes. The only pipeline work is regenerating the SEO data spine.

Part A — Locked design decisions (do not re-litigate)

Hard constraints

• Core Web Vitals must not regress. LCP < 2.5s · CLS < 0.1 · INP < 200ms. CWV is a ranking signal.
• JSON-LD, answer content, and FAQ copy must be in server-rendered HTML. Crawlers and LLMs do not reliably execute client JS.
• Never git add -A on the app dir. Stage explicit paths. Never commit .env* or secrets.
• Do not invent data. If a number has no source, omit the field. Never zero-fill, never render — or $0.00 as a fact.

Verified stack facts

Spec correction, recorded deliberately (C-1): the design spec §7/§10 mandates /usr/bin/python3 for the data pipeline. That is wrong — it lacks pyarrow and every new script reads the network parquet files. This plan mandates venv/bin/python. The spec's risk register should be updated; do not "fix" the scripts back to system python.

Part B — What the audit found

Four independent audits covered routing/structure, the metro template, SEO, and the design/data layers. Honest summary:

Already good — do not break it

• Both pilot pages are true server components. src/app/page.tsx and src/app/commute-cost/[metro]/page.tsx have no "use client". SiteChrome is a client component but takes children as a prop from the server layout, so page HTML is fully SSR'd. The crawler/LLM constraint is structurally satisfied today.
• The metro template already emits three server-rendered JSON-LD blocks — FAQPage, Dataset, BreadcrumbList — as inline <script type="application/ld+json"> with dangerouslySetInnerHTML, and the visible FAQ is real h3/p HTML driven by the same m.seo.faq array. Schema and copy cannot drift.
• The metro route is statically generated via generateStaticParams() with revalidate = 86400, and generateMetadata already sets title, description, canonical, OpenGraph and a Twitter card.
• maplibre-gl JS is already deferred behind await import() inside effects on both surfaces — the pattern to preserve.
• The homepage map shell reserves height (.cc-maps-shell { height: clamp(560px, 78vh, 820px) } with an absolutely-positioned canvas), so it is not a CLS source.
• sitemap.ts and robots.ts exist as Next metadata routes, driven off the same listMetros() loader, with an explicit AI-crawler allow-list.
• llms.txt already exists as a route handler emitting per-metro facts — a working answer-surface precedent.
• The deploy contract already ships data/ into .next/standalone, so new data artifacts need no deploy change.
• The approved motion reference already ships in-repo at public/preview/design-directions.html — byte-identical to the scratchpad file apart from an HTML wrapper.
• data/losing_ground.json already proves the provenance pattern (generated, vintages, sources, as_of_date) that the metro spine lacks.

Missing or broken — the actual work

Design system - The Editorial Warm palette does not exist. Current tokens are the Losing Ground scheme: --bg #f7f3ec, --fg #1a1714, --accent #b23a1e, --accent-mid #c98a2b, --hero-bg #15110d. Grep for any locked hex returns zero hits. - There is no motion of any kind. Zero @keyframes, zero animation:, zero prefers-reduced-motion anywhere in src/. Only 26 hover/color transition declarations. - The homepage hero is a dark band (--hero-bg #15110d) — the inverse of the cream direction — with two decorative radial-gradient washes that will collide with the new scene. .cc-hero is shared with /losing-ground, so it must not be mutated in place. - The metro page has no hero at all — breadcrumb straight into <article>. - Display font is Fraunces via a render-blocking @import to fonts.googleapis.com at globals.css:14. next/font is used nowhere. - Tailwind carries almost no tokens — 5 CSS-var bridges and a borderColor override. No fonts, no keyframes, no animation config. - .btn-primary binds to var(--accent) = #b23a1e, and its :hover binds to --accent-dim = #8f2c14. 18 files use .btn-primary. - The metro page renders the CBSA eyebrow at text-xs in var(--accent) — a small-text AA failure under the locked palette.

Data spine - No GTFS dominant-mode field exists. No route_type, dominant_mode, or mode_share anywhere in metros_seo.json or src/lib/metros.ts. Hard blocker for L8. - No freshness field anywhere — no generated, dateModified, as_of, or vintage in metros_seo.json or any of the three *_50.json ranking files. Only file mtime. - 51 records, not 62. Copy hardcodes "50" in three places. - No slug↔network bridge. 6 SEO slugs have no matching network dir (new-york, los-angeles, san-francisco, san-jose, philadelphia, washington-dc); 9 network dirs have no page. The only partial bridge is public/transit/_index.json, covering 31 of 51. - notes[] (32 of 51 metros) and data_coverage (all 51) are generated and rendered nowhere. These are ready-made provenance copy explaining exactly why each block is missing. - Sparse coverage: 20/51 have no priced transit fare, 14 no bike-share, 7 no tolls, 5 no parking, 6 no affordability. ottawa additionally lacks cheapest_mode — it loses its two highest-value sections and renders nearly empty. - Only affordability has a graceful-degradation fallback (:500-507); fares, bike-share, tolls and parking just vanish. - json_ld_facts (11 structured keys) is JSON.stringify'd into a single opaque PropertyValue — machine-hostile. - buildVariablesMeasured emits only 5 of ~15 available measures, and reads m.data while the blob reads json_ld_facts — two paths that can disagree. - Silent truncations: only the first 8 toll facilities (21 metros have more), only the first priced bike-share system (NYC has 5). - All 51 seo.title values are 68–87 chars — every one truncates in SERP. meta_description is only 83–133 chars, wasting snippet room. - The generator lives outside the web repo at /home/krish/gpu-pilot/content/build_metros_seo.py with a manual copy step. No validation, no schema test, no npm task. - Three .bak.newcities.20260712 files in data/ and src/components/SiteHeader.tsx.bak-lg-20260629 are copied into the standalone bundle by postbuild.

SEO / AEO / GEO - Homepage has no metadata export and zero JSON-LD. No canonical for /, no page OG, no Twitter card, no Organization, no WebSite. - No metadataBase anywhere — relative OG image paths cannot resolve and Next 14 will warn. - No OG image route, no favicon, no icon of any kind. Metro pages declare twitter.card: "summary_large_image" and supply no image. - No sitewide identity JSON-LD. Organization appears only nested as a creator inside Dataset nodes. - No /methodology route. The Dataset schema asserts citable numbers with nothing to back them; Source: {aff.source} is unlinked plain text. - No llms-full.txt. - llms.txt combines dynamic = "force-dynamic" with revalidate = 3600 — force-dynamic wins, so a 442 KB JSON re-parse happens on every bot hit. Its content is also stale: it describes the product as OpenTripPlanner-2.6-backed and US-only. - robots.ts bug: the seven AI-crawler groups declare allow: "/" with no disallow. robots.txt groups match exclusively, so GPTBot/ClaudeBot/PerplexityBot etc. are explicitly permitted into /admin/ and /api/ that the * group blocks. - robots.ts bug: host: SITE_ORIGIN emits Host: https://commutingcost.com; the directive takes a bare hostname. - Sitemap omits /losing-ground and /api-landing, and metro entries carry no lastModified (blog entries do). - SITE_ORIGIN is declared four separate times. - The reusable src/components/JsonLd.tsx exists but neither pilot surface uses it. - FAQ visible-render guard is not null-safe (:535 m.seo.faq.length vs the schema guard's m.seo.faq && …). Latent crash. - The bottom metro CTA links to a bare /route with no prefilled destination — the largest conversion leak on the template. - MetroAccessMap's wrapper has no reserved height — a latent CLS source that a new animated hero would be blamed for. - No tests, no lint config, no CWV harness in the repo.

Part C — Decisions resolved before any code

These are places where inputs conflicted. Each is settled here; the stages assume the decision.

C1 — Metro count: 53 pages, 54 routing regions

Plan of record: ship 53 metro pages (51 existing + salt-lake-city + edmonton). Every count in code derives from metroCount() / listMetros().length — zero literals. The hero stat line becomes 53 metro guides · 9 modes · 151,781 destinations precomputed.

This is a reduction against a number the spec states five times, and against an explicitly in-scope deliverable ("regenerating metros_seo.json to full 62-metro coverage"). It is therefore Open Question Q1, not a closed decision. The arithmetic supports 53; the authority to reduce the deliverable is Krishna's. Stage 1 cannot start until Q1 is answered.

C2 — Dominant mode field shape: hero_vehicle

The mode computation resolves the Amtrak exclusion, ferry fallthrough, and extended-route-type collapse before it emits anything. The app therefore consumes m.data.transit_mode_mix.hero_vehicle ∈ {subway, train, tram, bus} — a vehicle key, not a raw route type.

• sceneForMetro(heroVehicle) is keyed on the four vehicle names.
• Fallback is bus, never car — a metro with a built transit network always has transit; a car would be a lie.
• The mode-share sentence uses dominant_mode + dominant_share and is suppressed when confidence === "low".

C3 — Token naming: --accent / --accent-deep, with tint aliases

One pair of names. Defined in :root with a globally safe default, and in [data-theme='dark'], so the 18 files using .btn-primary are safe outside any [data-tint] scope. Each [data-tint="x"] block sets both --accent/--accent-deep and the aliases --tint-body/--tint-deep so motion CSS ported verbatim from the reference keeps working.

C4 — llms.txt / llms-full.txt: pre-built artifacts, served by static file readers

Kills the force-dynamic bug, removes the per-hit 442 KB re-parse, and lets the corpus be validated on geocoder before it ships. Content assertions (no OpenTripPlanner, 53 ## blocks, zero $0.00) run in the geocoder build and post-deploy against the live URL.

C5 — Freshness metadata: generated sidecar, id-keyed

data/metros_seo.meta.json is emitted by the generator, never hand-authored (a hand-authored sidecar is a lie waiting to go stale). sourcesForMetro(coverage) maps data_coverage flags → sources[].id and must be total — every coverage flag, including the new transit_mode_mix, has a matching source entry or the function is a bug.

C6 — Homepage primary CTA target: #plan

<SearchForm /> is already mounted ~200px below the hero. Sending a user to /route is a wasted navigation and a second LCP. The mid-page repeat CTA points at /route.

C7 — Copy ownership: src/lib/copy.ts owns prose, src/lib/seo.ts owns shaping

seo.ts imports from copy.ts and only shapes (metroSerpTitle ≤60, metroDescription ≤155). One string, one home.

C8 — Fabricated numbers: deleted, not shipped

• The illustrative "$9,400/year" hero line is deleted. The only sourced figure of that genre is the attributed $12,682 on the Piscataway case-study card; it stays where it is.
• The six homepage Stat literals (1,210 / 49,806 / 932,057 / 6,935 / 3,183 / 400,706) each require a verify: command whose output is pasted into the PR. Prior audits already contradict two (tolls: 139 priced facilities vs 6,935 shown; parking: 1,515 garages vs 3,183). Any stat whose verify output does not match is deleted from the grid in this PR. Expect to ship four, not six.
• ENGINE_STATS is held to the same rule. 9 modes and 151,781 destinations each get a verify: command. 151,781 currently traces to a session log, not a live query — it is verified against Postgres or it is dropped.

C9 — Next metadata is shallow-merged. Never inherit openGraph/twitter.

Next 14 replaces nested metadata objects rather than merging them. A page-level openGraph wipes the layout's entire openGraph, silently dropping siteName, locale, and twitter.site — while looking correct in review because "the layout has them."

Every surface composes through helpers in src/lib/seo.ts:

const OG_BASE = { siteName: SITE_NAME, locale: "en_US" as const, type: "website" as const };
export const og = (o: Partial<OpenGraph>) => ({ ...OG_BASE, ...o });
export const tw = (t: Partial<Twitter>) => ({ card: "summary_large_image" as const, ...t });

scripts/seo-check.mjs asserts og:site_name is present on / and on 3 metros.

C10 — Verification never touches :3035

npm start binds 3035 and pm2 commutingcost-web owns it in production. Every pre-deploy checkpoint runs against VERIFY_PORT=3055:

PORT=3055 npx next start -p 3055 &
BASE=http://localhost:3055

:3035 is used only for post-deploy checks, and only after the health poll returns 200.

C11 — robots.txt is a crawl directive, not a security control

Stage 8 is sequenced after 7.1 for tidiness, but the real protections on the two /api/ routes are the honeypot, the timing guard, the in-process rate limit, and the closed EventName union. Do not under-invest in 8.5's validation because "robots blocks it."

C12 — Fonts: move the @import to a parallel <link>; do not delete it

Deleting globals.css:14 re-renders every out-of-scope page in Georgia, because h1,h2,h3 bind globally to --serif ("Fraunces", "Spectral", Georgia, …). That is a Phase-3 change. Plan of record: move the Google Fonts request out of the CSS @import chain into a plain <link rel="stylesheet"> in layout.tsx (removes the import-chain serialisation, keeps the typeface, keeps display=swap), and give the pilot surfaces Georgia via fontFamily.editorial. Do not ship the media="print" + string onLoad hack — React will not serialise a string event handler in an RSC <link>. Dropping Fraunces entirely is Q3.

C13 — Reference-port fidelity notes

• .rider.back { transform: scale(.6) } is already restated outside the cancelled keyframe at design-directions.html:134. Do not drop it during the port; no new work, but T12 tests for it.
• The reference has 10 @keyframes, including rise (which Reveal's reduced-motion cancel depends on). Port all 10.
• The reference's sentence conflating the two contrast ratios (design-directions.html:214) is not ported. The brief's 6.1:1 (white-on-tint) and the reference's ≈5.6:1 (tint-on-cream) are both correct measurements of different things. Neither number appears in shipped copy. Say "AA-compliant" or say nothing.
• The reference's drive scene uses car/car, which collapses the two-depth illusion and violates L5. SCENE_DRIVE.back = 'bus'.

Part D — Implementation stages

Nine stages. Each ends in a checkpoint that must pass before the next begins. De-risking first.

STAGE 0 — Preflight & baseline (30 min)

Goal: you cannot prove CWV didn't regress without a before, and you cannot verify safely without a non-prod target.

CHECKPOINT 0 - node scratchpad/contrast.js → #cc7a5c FAIL on white (3.20:1) and on cream (3.02:1); #9c4a2c PASS on both (6.12:1 / 5.73:1); all four deep variants PASS. - curl -s -o /dev/null -w '%{http_code}' $BASE/ → 200 (verification server is up on 3055, prod on 3035 untouched). - Baseline JSON files exist; numbers recorded in the PR description.

STAGE 1 — Data pipeline (geocoder) ⛔ HARD BLOCKER, gated on Q1

Goal: produce a 53-metro spine carrying hero_vehicle, a slug↔network bridge, and freshness stamps. Everything downstream depends on this.

Run every script with /home/krish/gpu-pilot/venv/bin/python. System python3 has no pyarrow. Each new script opens with a hard import pyarrow guard emitting "run this with venv/bin/python".

CHECKPOINT 1 (on geocoder)

cd /home/krish/gpu-pilot
venv/bin/python content/build_dominant_mode.py && \
venv/bin/python content/build_metros_seo.py && \
venv/bin/python content/validate_metros_seo.py && \
venv/bin/python content/build_llms_txt.py && echo "STAGE 1 GREEN"

Plus: - metro_mode_mix.json has 53 metros, no corridor slugs - san-antonio.mix == {"bus": 1.0} (Amtrak exclusion works) - new-york.hero_vehicle == "subway"; seattle == "tram" (ferry correctly fell through); san-jose.shared_network == true - grep -ci opentripplanner content/llms/*.txt → 0 - grep -c '^- ' content/llms/llms.txt → 53 - grep -c '^## Attribution' content/llms/llms-full.txt → 1 - DB vocabulary check: psql -h 172.26.1.152 -p 5433 -U krish -d commute -c "SELECT route_type, route_type_name, count(*) FROM public.transit_routes GROUP BY 1,2 ORDER BY 1" — any route_type not explicitly handled by canon() must be added before this checkpoint is accepted. - Montréal→train and Boston/Philadelphia→tram are recorded in the run log, not hand-edited (see Q7).

STAGE 2 — Shared modules in the web repo (no visual change)

Goal: land all plumbing independently verifiable, before anything user-visible moves.

CHECKPOINT 2 - npx tsc --noEmit clean · npm run build succeeds - grep -rn '"https://commutingcost.com"' src/ | grep -v src/lib/site.ts → only the two out-of-scope page files - node -e assertions: sceneForMetro('subway').mode === 'subway' · sceneForMetro('tram').wire === true · sceneForMetro(undefined).mode === 'bus' · SCENE_DRIVE.back !== SCENE_DRIVE.mode - node -e assertion: sourcesForMetro({transit_mode_mix:true}).length > 0 (totality, D-6)

STAGE 3 — Token layer ⛔ 3.5 gated on Q3

Goal: one coordinated CSS/Tailwind pass. Fixes the AA defect site-wide and de-blocks the font request.

CHECKPOINT 3 - node scratchpad/contrast.js → all deep variants PASS light and dark; both #cc7a5c rows FAIL (expected) - grep -c "fonts.googleapis.com" src/app/globals.css → 0; grep -c "fonts.googleapis.com" src/app/layout.tsx → 1 - grep -c "prefers-reduced-motion" src/styles/motion.css → 1 - grep -c "@keyframes" src/styles/motion.css → 10 - grep -c "accent-deep-hover" src/app/globals.css → ≥ 3 (root, dark, hover rule) - Compositor-property proof: grep -nE "animation:|transition:" src/styles/motion.css | grep -vE "transform|opacity|filter|animation-play-state|animation:\s*none" → empty - Out-of-scope regression sweep: /rankings, /blog, /compare, /losing-ground render unchanged apart from darker buttons, in both themes

STAGE 4 — Motion + data components (new files only, no page edits)

Goal: build and verify the whole motion system in isolation, proving zero client JS before it touches a page.

CHECKPOINT 4

npm run build
grep -rl "cc-bobber" .next/static/chunks/    # must print NOTHING — proves zero client JS for the scene
grep -rl "cc-modebar" .next/static/chunks/   # must print NOTHING
npx tsc --noEmit

Plus the M6 measurement gate (the grep in Checkpoint 3 proves the properties are compositor-friendly; it does not prove the animations are composited): - DevTools Performance, 5 s idle with the hero in view on /commute-cost/new-york: record main-thread raster/paint. Accept only if there is no recurring main-thread paint task ≥ 2 ms/frame. If it fails, reduce animated sub-parts to 1 per vehicle and re-measure before proceeding.

STAGE 5 — The two page rewrites ⛔ the big one

Goal: one coordinated edit per file. Both stay server components.

5A · src/app/page.tsx

5B · src/app/commute-cost/[metro]/page.tsx

CHECKPOINT 5 (against $BASE = :3055)

npm run build      # must prerender 53 metro slugs
curl -s $BASE/ | grep -o '<h1[^>]*>'                                   # h1 present in server HTML
curl -s $BASE/ | grep -c 'og:site_name'                                # 1  (C9)
curl -s $BASE/commute-cost/ottawa | grep -c 'cc-eh-scene'              # 1  (fallback scene renders)
curl -s $BASE/commute-cost/dallas | grep -c 'No priced GTFS fares'     # >=1 (notes rendered)
curl -s $BASE/commute-cost/new-york | grep -o 'See all [0-9]* metros'  # "See all 53 metros"
curl -s $BASE/commute-cost/new-york | grep -c 'data-reveal'            # 0  (Reveal idle on SSR)
curl -s $BASE/commute-cost/new-york | grep -c '<summary'               # >=2 (accordion is real HTML)
curl -s $BASE/commute-cost/new-york | grep -c 'Data updated'           # 1  (freshness stamp)
curl -s $BASE/commute-cost/new-york | grep -oE 'href="/route\?[^"]*"'  # 2 hits, both with dlat= and metro=

STAGE 6 — Metadata root, JSON-LD graph, OG images

Goal: site-wide identity and social cards, with the OG route proven on one metro before 53 are written.

CHECKPOINT 6 - 6.4 probe, before writing 6.5: bash ls .next/server/app/opengraph-image* # prerendered body present ls .next/standalone/node_modules/next/dist/compiled/@vercel/og/ # wasm traced If either fails: ship one static public/og/default.png wired via metadataBase + explicit images, and defer per-metro cards to a follow-up. Do not let 53 runtime PNG renders land on geo3. - After 6.5: ls .next/server/app/commute-cost/*/opengraph-image* → 53 bodies - node scripts/seo-check.mjs --base=$BASE --all-metros → PASS, exit 0 - npm run build 2>&1 | grep -c metadataBase → 0 warnings - OG PNGs return 200 image/png at 1200×630; ottawa's card renders with no empty chips - Record the build-time delta (53 pages + 53 PNGs) — this feeds the deploy-window decision in Part F

STAGE 7 — Root artifacts

CHECKPOINT 7

curl -s $BASE/robots.txt > /tmp/robots.txt
grep -A3 'User-Agent: ClaudeBot' /tmp/robots.txt | grep -c 'Disallow: /admin/'   # 1
grep -c '^Host: commutingcost.com$' /tmp/robots.txt                              # 1
curl -s $BASE/sitemap.xml | grep -c '<lastmod>'                                  # >= 53 + blog + static
curl -s $BASE/sitemap.xml | grep -cE '/admin|/api/'                              # 0
curl -s $BASE/llms-full.txt > /tmp/llms-full.txt
grep -c '^## ' /tmp/llms-full.txt                                                # 53 metro blocks + sections
grep -cE '\$0\.00|: —|: null' /tmp/llms-full.txt                                 # 0
grep -c '^## Attribution' /tmp/llms-full.txt                                     # 1
grep -A6 '^## Dallas' /tmp/llms-full.txt | grep -c 'Median transit fare'         # 0 (no priced fares)
grep -A6 '^## Toronto' /tmp/llms-full.txt | grep -c 'Housing + Transportation'   # 0 (CNT is US-only)
curl -o /dev/null -w '%{http_code}' $BASE/methodology                            # 200

STAGE 8 — Conversion plumbing

Goal: make the CTAs actually convert. Sequenced after 7.1 for tidiness, but per C11 the real protections live in the endpoints themselves.

CHECKPOINT 8 - The four subscribe curls: happy → 200 + one JSONL line · honeypot filled → 200 + no line · invalid email → 400 · 11th request in a minute → 429 - POST /api/e valid → 204; {"e":"evil"} → 400 - DNT=1 → no beacon fires - grep -cE '"ip":"[0-9]' $CC_LEADS_FILE $CC_EVENTS_FILE → 0 (no raw PII) - grep -c 'dlabel' $CC_EVENTS_FILE → 0 - Manual: a metro deep link fills To, focuses the empty From, and produces zero geocode XHR on load

Part E — Files touched

Create (49)

Modify (18)

Move out of the ship path

data/best_commute_50.json.bak.newcities.20260712, data/best_transit_50.json.bak.newcities.20260712, data/most_walkable_50.json.bak.newcities.20260712, src/components/SiteHeader.tsx.bak-lg-20260629 → .data-archive/. postbuild currently copies these into .next/standalone.

Part F — Deploy

Web work happens on geo3 (172.26.1.70), reached with nested ssh through geo (-J presents the origin key and is denied).

F1 — Acknowledge the deploy window

postbuild runs rm -rf .next/standalone/.next/static .next/standalone/public && cp -r …. For the duration of that rm+cp, every live user's JS/CSS chunk request 404s against the still-running server. This is pre-existing, but the pilot adds 53 prerendered pages and 53 ImageResponse PNGs, materially lengthening it.

Choose one before deploying (do not pretend the in-place build is zero-downtime): - Preferred: build in a staging checkout and swap the standalone directory atomically, then pm2 restart. - Acceptable: pm2 stop commutingcost-web → build → pm2 start, deliberately off-peak, with the Stage-0 rollback snapshot in hand.

F2 — Steps

# 1. Ship data artifacts geocoder -> geo3 (validator runs as a gate inside the script)
bash /home/krish/gpu-pilot/content/sync_to_web.sh /path/to/checkout

# 2. Confirm ONLY expected paths are staged — NEVER git add -A
ssh krish@geo.tlcengine.com "ssh krish@172.26.1.70 'cd /home/krish/commutingcost-web && git status --porcelain'"

# 3. Snapshot the current build tree OUTSIDE the repo
ssh krish@geo.tlcengine.com "ssh krish@172.26.1.70 'mkdir -p /home/krish/cc-web-rollback && \
  cp -r /home/krish/commutingcost-web/.next/standalone /home/krish/cc-web-rollback/standalone-\$(date +%s)'"

# 4. Build (node 20 required)
ssh krish@geo.tlcengine.com "ssh krish@172.26.1.70 'cd /home/krish/commutingcost-web && \
  source ~/.nvm/nvm.sh && nvm use 20 && npm run build'"

# 5. Confirm the new data artifacts landed in the standalone tree
ssh krish@geo.tlcengine.com "ssh krish@172.26.1.70 'ls /home/krish/commutingcost-web/.next/standalone/data/llms/ \
  /home/krish/commutingcost-web/.next/standalone/data/metros_seo.meta.json'"

# 6. Restart by REGISTRY NAME (check ~/.claude/service-registry.json first — never guess)
ssh krish@geo.tlcengine.com "ssh krish@172.26.1.70 'pm2 restart commutingcost-web'"

postbuild already copies content|data|.env.local|.next/static|public → .next/standalone, so data/llms/, data/metros_seo.meta.json, data/home_faq.json and src/app/icon.svg ship with no deploy change.

F3 — Health poll before any verification

The restart briefly 502s: nginx proxies to :3035 and the standalone server takes several seconds to bind.

for i in $(seq 1 30); do
  c=$(curl -s -o /dev/null -w '%{http_code}' https://commutingcost.com/)
  [ "$c" = "200" ] && { echo "up after ${i}s"; break; }; sleep 1
done

A 502 in the first ~10s is normal boot, not a failure. Only after a 200 do the post-deploy tests mean anything.

F4 — Post-deploy, in order

1. curl -sI https://commutingcost.com/llms-full.txt → text/plain, cache headers correct
2. curl -s https://commutingcost.com/robots.txt → Disallow: /admin/ under every group; Host: commutingcost.com
3. curl -s https://commutingcost.com/sitemap.xml | grep -c '<lastmod>' ≥ 53 + blog + static
4. node scripts/seo-check.mjs --base=https://commutingcost.com --all-metros
5. T3, T5, T6, T7, T22 against the live origin
6. Submit the updated sitemap in Search Console; request indexing for / and 3 metros
7. Env: create /home/krish/commutingcost-web-data/ mode 700 owned by krish; add CC_LEADS_FILE, CC_EVENTS_FILE, CC_SALT to geo3 .env.local — never commit it
8. If any pm2 service was added or removed, regenerate ~/.claude/service-registry.json per the standing rule

Part G — Rollback

Three levels, fastest first.

L1 — instant revert (≤2 min). Restore the Stage-0 / F2-step-3 snapshot, which lives outside the repo:

rm -rf /home/krish/commutingcost-web/.next/standalone
cp -r /home/krish/cc-web-rollback/standalone-<ts> /home/krish/commutingcost-web/.next/standalone
pm2 restart commutingcost-web    # then run the F3 health poll

L2 — git revert + rebuild (≈10 min, longer than before because of 53 OG PNGs).

git checkout main && git reset --hard ce2c3a6
cp .data-archive/* data/         # only if the moved .bak files are actually needed
npm run build && pm2 restart commutingcost-web

L3 — data-only rollback. If the pages are fine but the spine is wrong (bad mode mix, bad counts):

cp /home/krish/gpu-pilot/content/metros_seo.json.pre-pilot /home/krish/gpu-pilot/content/metros_seo.json
# re-sync, rebuild, restart.

This returns 51 metros, so metroCount() reports 51 and the two new pages 404 — acceptable and self-consistent, because every count is derived. No copy edit needed.

Partial rollback is safe by design: - data/metros_seo.meta.json absent → getDataMeta() catches and returns null → dateModified / lastModified / the visible "Data updated" line are omitted, not zero-filled. Pages render. - transit_mode_mix absent → sceneForMetro(undefined) → bus scene. Every metro page still renders. - home_faq.json absent → faqPageNode returns null, no FAQ section, no schema. Valid. - JS never runs → the scene animates, all content is visible, all JSON-LD is present. The whole motion system is CSS over server HTML.

Coupled — cannot be partially rolled back: the robots.ts fix and the two /api/ routes. If robots is reverted, revert the API routes with it.

Do not roll back by editing files on geo3 in place. Revert in git, rebuild, restart — the standalone tree is generated, not authored.

Part H — Testing & validation matrix

Run in full before deploy; starred rows again after.

Part I — Open questions for Krishna

Only genuine decisions. Q1 and Q2 block a stage; the rest have safe defaults that will be taken if no answer arrives.

Appendix — Rules that must survive review

1. Never git add -A. Stage explicit paths; sync_to_web.sh prints the exact line.
2. :3035 is production. All pre-deploy verification runs on :3055.
3. Every count derives from metroCount() / a manifest scan. No literal 50, 51, 53, 54, or 62 in shipped code or copy.
4. Never inherit openGraph/twitter across the layout/page boundary. Compose through og() / tw().
5. Omit, never zero-fill. No $0.00, no —, no null rendered as a fact, in HTML, JSON-LD, llms.txt, or an OG card.
6. Both contrast numbers (6.1:1 and ≈5.6:1) are correct measurements of different pairs. Neither appears in shipped copy. Say "AA-compliant."
7. --accent-deep must exist in :root and in [data-theme='dark']. Eighteen files depend on it outside any tint scope.
8. Never put an inline animation shorthand on a motion element — it out-specifies the stylesheet and defeats prefers-reduced-motion.
9. jsonld.ts and metros.ts are server-only. They reach node:fs; a client import breaks the build in a confusing way.
10. Rollback snapshots live outside the repo. next build owns .next/.