feat(whoareyou): build the page at deploy, fetch its values as an island

[oddharsh]

What changes

/whoareyou stops rendering per request. build.ts step 5b bakes it once, like /security. The per-request rows arrive after load from /whoareyou/values.html, a no-store HTML fragment the Worker renders for that request alone.

	before	after
document on the wire	8,293 B (edge q4 brotli)	6,288 B (q11 twin)
return visit with the family dictionary	same 8,293 B	4,492 B (dcz delta)
script-src	'self' 'unsafe-inline'	three sha256 hashes
ETag, 304	no	yes

The fragment adds one request of its own, preloaded from <head>, so it starts while the document is still parsing. In a real browser against the built tree, performance recorded exactly one fetch of it, with initiator link, so the preload was consumed rather than duplicated.

lib/island.ts: the convention, written down once

This is the homepage's shape (/photos/grid.html, /rn/tracks.html) turned into four exports, so the next page imports it instead of copying a hydrator out of index.html:

• islandPreload(url): the <head> preload, with crossorigin, which is required even same-origin or the fragment is fetched twice.
• islandMount(id, url, placeholder, noscript): the mount carries its own URL in data-island.
• islandScript(): takes no arguments. It finds every mount by attribute, so the script text is identical on every page that uses it (one CSP hash site-wide), and nothing caller-supplied is ever interpolated into it. It requires an x-island: 1 marker before injecting, because an edge 5xx is also text/html. On failure it leaves the placeholder and sets data-state="failed".
• islandResponse(body): no-store, noindex, and the marker.

The placeholder is drawn by the same renderer as the live fragment, fed a placeholder model. bun run cls reads /whoareyou clean on desktop and phone, with its control passing, and a contract test pins the placeholder and a typical browser visitor's live fragment to the same row count.

What moved, stated on the page

The values now describe the fragment request. That is normally the same connection, IP and TLS session as the page, with a later clock and its own ray id. The referrer is the one field that would be wrong, since the fragment's Referer is the page, so that row is filled in the browser from document.referrer. The callout and the Markdown twin both say so.

Also

• Bug fix: on HTTP/2 the page showed "QUIC round-trip 0 ms" beside the real TCP row. Measured over curl today: cf.clientQuicRtt is 0 rather than absent on TCP, which is the mirror of the TCP fix from 2026-09-21. The transport now decides both rows.
• run_worker_first: /whoareyou and /whoareyou.json fold into /whoareyou*. This covers the fragment and frees a row.
• link-integrity now treats /cdn-cgi/* as Cloudflare's namespace. /whoareyou became the first built page to link /cdn-cgi/trace, and the build caught it.

Verification

• bun run build, bun run lint, bun run typecheck: clean.
• bun run routes:check: 178 routes, 0 failures. New rows cover the island mount (fullPage), the fragment (fragment), and Markdown negotiation.
• New contract-whoareyou-is-a-built-document: passes under bun and node.
• Full bun run test: 907/910. The one twin failure was a stale .build (fixed by a rebuild). The two remaining failures are in contract-photo-pipeline-failures, and they also flake on a clean origin/main checkout on this machine: a different test failed on each of four runs, and one run passed 24/24.
• Browser, against the built Worker: the island goes live, the failure note shows only in data-state="failed", there are no CSP violations, and /cdn-cgi/trace 404s locally as expected (it is edge-only).

Not in this PR

This is the first of a series moving the site's per-request pages onto one pattern. Next: /ledger, the bare terminal frames (fixed bytes, so no island needed), /coffee (cal cannot import from the site tree, gotcha 16), and a /garage page measuring the before and after.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	aadhar-sh	01af2c0	Sep 25 2026, 05:43 PM

[github-actions]

Wire-size diff vs merge base

34fd4043ad05f1c21b341c06798a4592d63d1067 → 66a191f71995856a04527e673f682a1c9a5d6522

Brotli q11, the quality the edge serves. Every number here is deterministic:
an unchanged file produces no row. Advisory — this check fails on nothing.

Client assets

No change. 27 files, 91.44 KiB Brotli total.

Pages

Total Brotli: 589.76 KiB → 595.90 KiB (+6.14 KiB, +1.0%) across 58 files, 1 changed.

file	base	head	Δ
whoareyou.html	—	6.14 KiB	new

Worker bundle

254.08 KiB → 255.37 KiB gzip (+1.29 KiB, +0.5%)

Largest module deltas (raw bytes in bundle):

file	base	head	Δ
.build/src/worker/whoareyou.ts	22.17 KiB	24.41 KiB	+2.24 KiB (+10.1%)
.build/src/worker/lib/island.ts	—	0.92 KiB	new
.build/src/worker/index.ts	12.24 KiB	12.60 KiB	+0.36 KiB (+3.0%)
.build/src/worker/lib/csp-hashes.ts	6.48 KiB	6.63 KiB	+0.15 KiB (+2.4%)

Dictionary transport

Family dictionary acquisition: no change, 14.41 KiB q11.

pd/: 168 → 169 deltas, 520.38 KiB → 524.77 KiB (+4.39 KiB).