docs(web): record that the OG image does not go live with the deploy

[MatheusKindrazki]

Caught while verifying the #42 deploy, and worth writing down precisely because it looks exactly like a flaky CDN and is not one.

Work-Control-ID: 01a01008-16a5-7456-afa3-819c024716a7

What happened

Origin (fastshared-web.pages.dev)	✅ new card immediately — sha256 matched local, saturation 0.157, #0f0f12 at 85.3%
Apex (fastsha.red)	❌ old card — cf-cache-status: HIT, age: 68244, old content-length

Nothing was wrong with the deploy. /og-image.png is listed in APP_PATH_PREFIXES (backend/src/index.ts), so routeRequest() does not proxy it to Pages — the Worker serves it itself from backend/src/routes/assetsPublic.ts, out of caches.default with Cache-Control: public, max-age=86400, immutable.

That cache is deliberate; the code says why: it keeps Slack/iMessage/Discord unfurlers off the Pages origin on every scrape. The consequence is that a regenerated card is invisible at the apex for up to 24 hours per edge, and immutable tells scrapers not to revalidate, so anything that unfurls during the window keeps the old card for longer still.

What this adds

The README now carries the two commands to compare origin against apex, says to purge the URL in Cloudflare and then re-scrape in the platform's own validator (the unfurlers cache separately from Cloudflare), and brand/og-image.sh prints the same warning right after it installs — which is where someone will be standing when they need it.

It also records the underlying weakness rather than just the workaround: the cache key is ${SHORT_LINK_HOST}${pathname}, with no content or version component, so every future OG change repeats this window. Three fixes are named — shorten CACHE_MAX_AGE_SECONDS for this one asset, key the cache on a build id, or add a purge step to web-deploy.yml, which already holds a CLOUDFLARE_API_TOKEN. The caveat is recorded too: whether that token carries cache-purge scope has not been checked, so nobody assumes a purge step would just work.

Docs only — no behaviour change. The purge itself needs dashboard access.

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[MatheusKindrazki]

Fechando em favor de um PR limpo (#44): esta branch já havia sido squash-mergeada como #42, então re-propunha o conteúdo do #42 sobre um main que já o tinha, e ficou CONFLICTING. Erro meu — empurrei um commit de follow-up numa branch já mergeada em vez de sair do main novo. O mesmo commit, sozinho e sem conflito, está no #44.