I upgraded the site's Next.js framework to the latest major version. File conventions and several configuration options had changed, so there was a lot to adjust, but both the build and the deployment went through cleanly.
The same day, I turned on Cloudflare's bot-blocking feature to tighten security β and soon one of the site's diagnostic tools started failing again and again. The pattern was strange: pages loaded fine, but only the API calls failed. The server logs showed nothing wrong, so I suspected other causes at first, but I finally found the answer in Cloudflare's event log. The bot-blocking feature handled normal page visits well, but it treated API requests made directly by code as non-human and blocked them. Turning it off fixed the problem immediately. It was a clear reminder that a site-wide security feature can have side effects in unexpected places.
That day I also brought the Report Checker (a tool for polishing reports and proposals), which I had built and run as a separate service, into this site as one of its tools.