scripts/deploy-local.sh's header requires the two deploy paths to match on
everything that determines what gets published, and the route check that
replaced the stale INTAKE_ENDPOINT guard had only been added to one of them.
The check POSTs to /api/intake with no Origin header. 404 means the CloudFront
/api/* behaviour is missing; 403 means routed and refused by the handler's own
Origin check, which is a pass — and is why the probe is safe against
production, since it is rejected before any DynamoDB write or any email. It
warns rather than failing, because by that point the site is already deployed.
docs/06 now records it on the cutover item it protects, so that item no longer
rests on someone reading the list.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5
