Deploy record: the SES-readiness changes (2026-10-06) · Communication

Everything in this file ran on 2026-10-06 unless a section says it is still to do. The commands are PowerShell, run from the repo root. Set this once per window, because wrangler caches a wrong account otherwise:

$env:CLOUDFLARE_ACCOUNT_ID = "72fe41e9f39ad60cfb6937bb26ab50c3"

What was deployed

Worker	Live now	Roll back to	What it carries
comms (`logicspike-communication`, folder `communication`)	`a4171bcf-d16d-4e33-a711-d8999b7a4fe7`	`62876ebb-308f-4152-91e3-2000824c8840`; before the whole set: `9a3c7aff-bdf4-4cd8-b19a-4d917f1c913b`	the SES guard, no credentials in logs, owner alerts, sweeper armed from traffic, `vlozi.app` inbound, `founder` reserved
mailbox (`logicspike-mailbox`)	`d3019d86-26cc-4421-84b0-84c9e65e20d1`	`1d673365-94e7-46b1-ab94-7becb8359317`; before: `1d3a3dd9-4d85-4a17-90dd-a4c409977fc9`	role mailboxes on `vlozi.app`, `canReceive`, `founder` claimable
manager (`logicspike-manager`)	`8284200f-8d07-4a3a-87ac-2a458ba79554`	`3fb346bf-eba5-4358-8a8d-e7039a16d6c5`	name rule, invite and OTP limits, workspace and account deletion fixes
newsletter (`logicspike-newsletter`, folder `newsletter-service`)	`67975b1f-e8bc-4d57-ab22-1701f294b12d`	`07651f8d-d899-4c52-a615-f512ae48326d`	pauses a campaign on the new guard code
forms (`vlozi-forms-service`)	`5e7ff3ac-ccbb-4ca7-8bcb-a072f0c4a273`	`8a2a0ffd-470f-4bcf-a985-eefe78cec0c0`	one-line notification subjects, guard message
engagement (`vlozi-engagement-service`)	`11dbb2a3-ed83-4422-8564-bdaa11464257`	`702535ed-c9e3-48ee-9ecf-a02442f3055f`	one-line notification subjects

The core database migration (tenants.deleted_at and purged_at, two nullable columns; 7 workspaces, none deleted) ran before the workers. The dashboard deployed from the push to main (Vercel). The website went out as Cloudflare Pages 79cc17b9, before the operator identity and the four new policy pages existed. They went live when the owner redeployed the website on 2026-10-07 (checked: the live text matches the repository). internal-api changed only tests and was not redeployed. apps/billing-crons was pushed to main but not deployed.

To roll a worker back: cd apps\<folder>; npx wrangler rollback <version-id>, or redeploy the previous commit. To deploy one: cd apps\<folder>; npx wrangler deploy --minify, then npx wrangler deployments list (the newest version should be 100%).

What this changed in production

The SES declared-use guard is ON. Every send from a workspace on mail.vlozi.app (shared-lane newsletters, mailbox replies, form notifications, flows, API sends) is refused with 503 TENANT_SENDING_NOT_ENABLED, because Resend serves only vlozi.app. Platform mail (login codes, invitations, billing notices, owner alerts) is unaffected. Replies from a role mailbox on vlozi.app work, through Resend. To switch the guard off, set the comms secret SES_TENANT_SENDING to true (wrangler secret bulk).
Login codes, reset links and invitation links are no longer stored in the comms mail log.
Owner alerts go to the workspace owner's verified account email, at most one SLA alert per hour per workspace.
Workspace deletion now dates the deletion, revokes the workspace's API keys and repoints every member's default workspace. It does not cancel billing.
Account deletion no longer fails for owners of already-deleted workspaces or for users with linked rows.
The role addresses can be mailboxes on vlozi.app in Vlozi's own workspace.

What was checked afterwards

Read-only, through the gateway: sender identities (comms), workspace and billing balance (manager), subscriber list (newsletter), forms list (forms). Later that day the ten role mailboxes were created, and a platform-sent test to each was watched in the worker logs: nine arrived and were filed by the Mailbox. hello@ reached neither worker, probably because of an explicit Cloudflare rule (gap-log G55). The mailbox /health answers ok. Engagement and mailbox inbound were not exercised beyond that.

npx tsx scripts/check-prod-schema.ts --app core now reports only the three leftover communication.* tables (gap-log G53); anything else is new drift.

Still to do

Outside-account tests (you). Send a test from an outside address to each role address and reply once from the dashboard (contact-addresses.md §4). The platform-sent tests prove inbound works, not that an outside Gmail can reach it.

Data scripts (you). Each is a dry run until you add --apply, and each writes production data. Before running any of them, check that COMMS_DATABASE_URL and NL_DATABASE_URL are not set in your shell: the scripts prefer an environment variable over .dev.vars, so a stale one would send the write to another database.

Script	When	What it does
`node apps/communication/scripts/clear-system-mail-content.mjs`	any time (comms is deployed)	clears login-code, reset-link and invitation-link bodies already stored in the mail log
`node apps/newsletter-service/scripts/revoke-unconsented-import.mjs`	overdue: the website is already live (gap-log G61)	revokes consent on Vlozi's own ~503 un-consented contacts; nothing is deleted
`node packages/core-database/scripts/close-deleted-workspaces.mjs`	any time	revokes API keys and repoints members of workspaces deleted before the change (none were deleted on 2026-10-06, so it should report nothing to do)

The website (you). The pre-flight and the deploy command are in R8 of readiness-checklist.md. Afterwards, curl.exe -i https://vlozi.app/.well-known/security.txt should be 200.

Smoke checks after any later worker deploy.

Through the Vlozi tools: workspace_whoami and comms_get_sender_identities still answer.
Log in to the dashboard and open Mailbox.
npx wrangler tail logicspike-communication (from apps\communication) shows stale_claim_swept within minutes of traffic. The tail prints recipient addresses, so do not paste its output into evidence.