Merge branch 'fix/deploy-local-changes'

A setup wizard run on one server added files to backend/src that the
backend build picked up, so the deploy failed part-way and rolled back.
deploy.sh now lists files git reports as changed or added (ignored files
and the PM2 config don't count) and stops before backing up or checking
out. --check runs only that; ALLOW_LOCAL_CHANGES=1 deploys anyway; the
script also runs from a copy outside the install (the folder you're in).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,19 @@ and this project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.52.2] - 2026-11-02
+
+### Changed
+
+- **`scripts/deploy.sh` stops before touching anything when files in the install folder were
+  changed or added by hand**, and lists them. A setup wizard run on one server had added files to
+  `backend/src` that the backend build picked up, so the deploy failed halfway and rolled back.
+  Ignored files (`.env`, uploads, backups, `ecosystem.config.js`) never count.
+  `ALLOW_LOCAL_CHANGES=1` deploys anyway.
+- `bash scripts/deploy.sh --check` runs only that check (no backup, fetch, build or reload). The
+  script can also be run from a copy outside the install (e.g. `/tmp/deploy.sh`, from the folder
+  you're in), so an older install can check before updating — see DEPLOYMENT.md, "Updating".
+
 ## [1.52.1] - 2026-11-02
 
 ### Changed

DEPLOYMENT.md

@@ -311,6 +311,24 @@ and goes back to the previous version if anything fails first. `backend/.env`,
 `frontend/.env.production`, `ecosystem.config.js` and the nginx/frpc configs are not in git, so
 updates keep your changes from this guide.
 
+Since 1.52.2 it first checks for files in the install folder that were changed or added by hand
+(e.g. by a setup wizard run on the server) and stops, listing them, before it backs anything up
+or checks anything out: they would be built into the release, or block the checkout. Move added
+files out of the folder and put changed ones back with `git checkout -- <file>`, or deploy anyway
+with `ALLOW_LOCAL_CHANGES=1`. To check without deploying:
+
+```bash
+sudo -u hopeevents -H bash scripts/deploy.sh --check
+```
+
+An install still on an older release can run the new check without updating anything — fetch the
+script on its own and run it from the install folder:
+
+```bash
+git fetch -q origin && git show origin/main:scripts/deploy.sh > /tmp/deploy.sh
+bash /tmp/deploy.sh --check
+```
+
 ### Upgrading Node
 
 Node 20 stopped getting security fixes in April 2026; Cross Events runs on Node 24 LTS (supported

WHATS-NEW.md

@@ -12,6 +12,11 @@ Write for church admins, not developers: no environment variables, endpoints or
 developer log is CHANGELOG.md. A tagged version without a section here shows "No details given".
 -->
 
+## 1.52.2
+
+- **Safer updates.** If files on your server were changed by hand, an update now stops straight
+  away and says which files, instead of failing part-way. Nothing else changes.
+
 ## 1.52.1
 
 - **Better documentation for developers.** If someone builds on your Cross Events site (for example

backend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "event-management-backend",
-  "version": "1.52.1",
+  "version": "1.52.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "event-management-backend",
-      "version": "1.52.1",
+      "version": "1.52.2",
       "hasInstallScript": true,
       "dependencies": {
         "@cj-tech-master/excelts": "^10.2.0",

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "event-management-backend",
-  "version": "1.52.1",
+  "version": "1.52.2",
   "description": "Event Management System Backend",
   "main": "src/index.js",
   "scripts": {

docs/HANDOVER.md

@@ -1,6 +1,6 @@
 # Handover — where things stand and how to carry on
 
-Last updated: 2026-11-02, after **1.52.1** (and Hub 1.5.0). The plan itself is in
+Last updated: 2026-11-02, after **1.52.2** (and Hub 1.5.0). The plan itself is in
 [ROADMAP-v2.md](./ROADMAP-v2.md) (decisions table at the end); the previous round of
 features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).
 
@@ -14,6 +14,7 @@ encrypted settings unreadable or break existing installs.
 
 | Version | What |
 |---------|------|
+| 1.52.2 | `scripts/deploy.sh` stops first (listing them) when files in the install were changed or added by hand; `--check` runs only that; runs from a copy outside the install too; `ALLOW_LOCAL_CHANGES=1` overrides |
 | 1.52.1 | **API documentation complete:** every v2 route documents its body, answer and parameters — the ~300 answered by v1 handlers through `documented` shapes (`src/v2/docs.ts`), shown but not enforced, logged outside production when they don't fit; empty bodies say "No body needed". Test `tests/v2Docs.test.ts` |
 | 1.52.0 | **Urgent fix + Corrections:** required attendee forms no longer leave paid door/manual registrations without tickets — popup with "Fill in later" (`Registration.formWaivedAt`, `POST /api/v2/registrations/{id}/form-later`); one form per person on picked sessions; forms with no questions don't hold tickets; kiosk asks for the forms the server says are missing. Admin **Corrections** page (`src/services/corrections.ts`, `/api/v2/corrections/…`): issue missing tickets, pay later (`ticketsReleasedAt`), make it free (`complimentaryDiscount`), check in after the event. Migration `20261102120000_corrections`. e2e `e2e/corrections.spec.ts` |
 | 1.51.17 | **Security:** forgot-password and sign-in don't reveal whether an account exists (same answer, status and timing); forgot-password rate-limited |
@@ -128,7 +129,7 @@ Languages (Afrikaans, §10) and Wallet passes (§7) are removed from scope (2026
   The backend declares `engines.node >= 22`. pg-boss 11 (1.51.7) runs in its own schema,
   `pgboss_v11` — it can't migrate pg-boss 10's `pgboss` schema; there's no `archive` table any more
   (finished runs stay in `job` until they expire).
-- **Deploying:** `bash scripts/deploy.sh [tag]` on the server (no tag = latest main). Each install
+- **Deploying:** `bash scripts/deploy.sh [tag]` on the server (no tag = latest main). It stops first if files in the install were changed or added by hand (`--check` to only check; `ALLOW_LOCAL_CHANGES=1` to go ahead anyway). Each install
   keeps its own `ecosystem.config.js` (PM2 app names, port), which is not in git. The script
   runs from a temp copy of itself and rolls back on failure before the PM2 reload. It was
   tested by running it against a throwaway clone with npm/pm2 stubbed: across the tracked →

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.52.1",
+  "version": "1.52.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events-frontend",
-      "version": "1.52.1",
+      "version": "1.52.2",
       "dependencies": {
         "@dnd-kit/core": "^6.3.1",
         "@hookform/resolvers": "^5.2.1",

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.52.1",
+  "version": "1.52.2",
   "private": true,
   "scripts": {
     "dev": "next dev",

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events",
-  "version": "1.52.1",
+  "version": "1.52.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events",
-      "version": "1.52.1",
+      "version": "1.52.2",
       "license": "ISC",
       "devDependencies": {
         "@axe-core/playwright": "^4.14.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events",
-  "version": "1.52.1",
+  "version": "1.52.2",
   "main": "index.js",
   "scripts": {
     "dev:backend": "cd backend && npm run dev",

scripts/deploy.sh

@@ -6,20 +6,34 @@
 # Usage (on the server, from the repo folder):
 #   bash scripts/deploy.sh            # the latest main
 #   bash scripts/deploy.sh v1.37.3    # a tagged release
+#   bash scripts/deploy.sh --check    # only check for files changed by hand (changes nothing)
 #
 # PM2 uses this install's own ecosystem.config.js (app names, ports). It isn't in git, so
 # deploys never change it; the first deploy creates it from ecosystem.config.example.js.
+#
+# A deploy stops before touching anything when files in the repo folder were changed or added
+# by hand: they'd be built into the release (or block the checkout). ALLOW_LOCAL_CHANGES=1
+# deploys anyway. Ignored files (.env, uploads, backups, the PM2 config) never count.
 set -Eeuo pipefail
 
 # The checkout below replaces this file, and bash reads a script as it runs — so run from a
 # copy that can't change underneath us.
 if [ -z "${HOPE_DEPLOY_COPY:-}" ]; then
+  DIR="${HOPE_DEPLOY_DIR:-$(cd "$(dirname "$0")/.." && pwd)}"
+  # Run from a copy outside the repo (e.g. downloaded to /tmp): the folder you're in.
+  if [ ! -d "$DIR/.git" ] || [ ! -d "$DIR/backend" ]; then DIR="$PWD"; fi
   COPY="$(mktemp)"
   cp "$0" "$COPY"
-  HOPE_DEPLOY_COPY=1 HOPE_DEPLOY_DIR="$(cd "$(dirname "$0")/.." && pwd)" exec bash "$COPY" "$@"
+  HOPE_DEPLOY_COPY=1 HOPE_DEPLOY_DIR="$DIR" exec bash "$COPY" "$@"
 fi
 
 cd "$HOPE_DEPLOY_DIR"
+if [ ! -d .git ] || [ ! -d backend ]; then
+  echo "!!> $PWD isn't a Cross Events install. Run this from the install's folder (e.g. /var/www/hope-events)."
+  exit 1
+fi
+CHECK_ONLY=0
+if [ "${1:-}" = "--check" ]; then CHECK_ONLY=1; shift; fi
 TARGET="${1:-main}"
 PREVIOUS="$(git describe --tags --exact-match 2>/dev/null || git rev-parse --short HEAD)"
 
@@ -51,6 +65,30 @@ checkout() {
   restore_pm2_config
 }
 
+# Files changed or added by hand (anything git reports, apart from this install's PM2 config,
+# which releases before 1.37.4 tracked). Ignored files — .env, uploads, backups — aren't listed.
+local_changes() {
+  git status --porcelain --untracked-files=all | awk -v keep="$PM2_CONFIG" 'substr($0, 4) != keep'
+}
+
+CHANGES="$(local_changes)"
+if [ -n "$CHANGES" ]; then
+  echo "!!> Files in $PWD were changed or added by hand:"
+  echo "$CHANGES" | sed 's/^/      /'
+  echo "    A release would build them in (or refuse to replace them), so the deploy can fail."
+  echo "    Move added files (??) somewhere outside this folder, and put changed ones ( M) back with"
+  echo "    \"git checkout -- <file>\" — after checking nothing in them is needed."
+  if [ "$CHECK_ONLY" = 1 ]; then exit 1; fi
+  if [ "${ALLOW_LOCAL_CHANGES:-}" != 1 ]; then
+    echo "    Nothing was changed. To deploy anyway: ALLOW_LOCAL_CHANGES=1 bash scripts/deploy.sh $TARGET"
+    exit 1
+  fi
+  echo "    ALLOW_LOCAL_CHANGES=1 — deploying anyway."
+elif [ "$CHECK_ONLY" = 1 ]; then
+  echo "==> No files changed by hand in $PWD — ready to deploy."
+fi
+if [ "$CHECK_ONLY" = 1 ]; then exit 0; fi
+
 echo "==> Deploying $TARGET (currently $PREVIOUS)"
 
 # Node 20 reached end of life in April 2026 (no more security fixes). Releases still run on it,