Daily bug scan: public replay route regression

The scan found one concrete regression tied to recent durable-options routing work: the deployed public route check now fails because /replay/options returns HTML instead of JSON on https://flow.deltaisland.io.

Recorded as Beads issue islandflow-r7n

Summary

I scanned the commits from the last 24 hours, focused on the recent options-history and live-tape routing changes, and verified the new public route checker against the live app origin. The only concrete failure was the replay endpoint check.

Changes Made

Created Beads bug islandflow-r7n to track the public replay proxy regression.
Added this turn document for the automation handoff.

Context

Commit 1424a27 added scripts/check-public-api-routes.ts and wired it into deploy verification to catch same-origin routing mistakes after the durable options history work. That script now provides a concrete signal that the public replay path is misrouted.

Important Implementation Details

services/api/src/index.ts does implement GET /replay/options.
deployment/docker/README.md says same-origin proxy mode must forward /replay/* to the API service.
The live check failed with HTML from the web app, which indicates the edge proxy is not forwarding that path to the API host.

bun run scripts/check-public-api-routes.ts https://flow.deltaisland.io
...
error: /replay/options returned non-JSON content (text/html; charset=UTF-8)

Expected Impact for End-Users

Replay-mode options data requested through the public app origin can land on the Next.js app instead of the API, which breaks the endpoint and can leave replay experiences incomplete or empty.

Validation

Reviewed recent commits: 1424a27, d334e16, 23ed380.
Ran bun run scripts/check-public-api-routes.ts https://flow.deltaisland.io and reproduced the failing replay route.
Confirmed the API service route exists by inspecting services/api/src/index.ts.
Ran bun test apps/web/app/terminal.test.ts; it did not execute in isolation because the file depends on workspace alias resolution for @islandflow/types.

Issues, Limitations, and Mitigations

This appears to be an environment or edge-proxy regression, not a source-level API bug.
No repo code fix was applied because the failing behavior is coming from live routing outside this checkout.
The Beads issue includes the minimal mitigation: update the public proxy matcher, then rerun the route check.

Follow-up Work

islandflow-r7n: update the live proxy so /replay/* reaches the API service.
Rerun bun run check:public-api-routes after the edge change to confirm recovery.
Optionally coordinate with islandflow-qd7 if the team still plans to move production to api.flow.deltaisland.io and reduce same-origin proxy risk altogether.