[Madraka]

From #117. Status: Accepted (2026-11-08). Every open question decided as recommended; the design notes of 2026-11-08 are worked in. Implementation starts with rollout PR 1 (status pages in the renderer), which ships on its own.

Status pages (the renderer serves them before Astro, from a pure statusPage(state, input) → Response)

State	Code	Retry-After	noindex
not-published	503	3600	yes
maintenance	503	until the end (≥ 60 s)	no (Google's pause guidance)
unavailable	503	300	no
error	500	–	no; shows only cf-ray
preview-expired	410	–	yes

• All no-store on browser and edge, Vary: Host on top: Workers Cache keys on the path, not the host (the cloudhal.com www-redirect lesson), so a cached status page would be shared across hosts; a workerd test asserts two hosts of one Worker never share one. A self-contained page of at most 8 KB with its own CSP, no admin link.
• Language: host or path-prefix locale, then the site default, then en (no Accept-Language); RTL from the registry, Western digits for Arabic and Persian. The renderer's catalog covers every registered Studio language through pnpm i18n:export/import (a second source of the exchange script); messages use simple ICU arguments only, so no compiler ships in the site Worker.
• Look: maintenance and preview-expired may use the published snapshot's theme tokens (brand, surface, text colors, the font pairing); the other states stay neutral.
• Theme hook: an optional statusPage in theme.ts returns HTML only. It falls back on throw, > 50 ms or > 64 KB, and is never used for error. Old themes get the built-in page unchanged; the starter's routes use statusPage/statusPlain as their own fallback.
• Health: GET /__cloudhal/health answers { "ok": true, "state": "published" | "not-published" | "maintenance" }, the admin's /api/health shape plus state, so Docker, Caddy and cloudhal.com's post-deploy check read both with one rule.
• Static builds: cloudhal build --published writes the status page as the whole output of an unpublished or hidden site (index.html, 404.html, robots.txt, _headers, a .cloudhal-status marker); the Docker site-build passes the flag and the Caddyfile serves it with 503. The self-host static path never serves an empty directory.

Maintenance mode

• Storage: a per-site D1 record (SiteMaintenance, a new root contract) outside snapshots, bundles and push/pull, so a rollback never toggles it.
• Modes: off, on (optional end) and window (start and end). Wording is maintenance or coming-soon, with a plain-text message per locale of at most 280 characters. It ends per request; no scheduler is involved.
• Who: people with site:settings. Agents use set_maintenance only with approval from a person holding site:settings, in every mode (turning it off too). Every change is audited. get_site gains a status field so an agent learns the state before it acts; RFC-0044 tokens carry the same key scopes and never site:settings.
• Owner bypass: a signed link to the published site, never a cookie, because Workers Cache doesn't key on cookies. Responses are private, no-store; links last 1 hour by default, 24 hours at most.
• Still served during maintenance: robots.txt (a 503 there would pause Google crawling), media, static assets and /.well-known. Feeds, sitemap and llms.txt answer a plain 503.
• Caching: turning it on purges the site tag with takedown priority (a tag, never a URL, because the edge key is the path), plus a second purge after 15 s. A window expires cached pages at its start, like RFC-0008's gates.
• Guard: features report {gates: 2, status: 1}; until then, writes get status_unsupported (409).
• Surfaces: REST, MCP (get_maintenance, set_maintenance), CLI (cloudhal maintenance …) and Studio (a card and a banner). The playground blocks all of it.

Decisions (2026-11-08): the 14 recommended defaults, listed one line each at the end of the RFC, plus the seven design notes and where each went. Rollout: 7 PRs; PR 1 status pages in the renderer (self-contained), PR 2 static builds, PR 3 maintenance in the renderer (with the contract and its ADR), PR 4 writers, PR 5 MCP, PR 6 Studio, PR 7 ops and docs.

Schema check: the new site-maintenance.schema.json, with 4 valid and 12 invalid fixtures, passed pnpm gen, the core-contracts tests and cargo test on the draft branch, then was reverted; it lands with PR 3.

🤖 Generated with Claude Code