Validated

# Fix Durable Options History Routing

Turn completed on 2026-05-16 21:59 America/New_York.

## Summary

Options tape history now has a durable public route through same-origin deployments. The live Nginx Proxy Manager route was updated to include `/history/*`, deployment checks now fail when required API paths reach the web app, and the tape UI surfaces older-history load failures instead of leaving the user to infer that only the hot window exists.

## Changes Made

- Added `scripts/check-public-api-routes.ts` and the `check:public-api-routes` package script.
- Updated `scripts/deploy.ts` so same-origin API deploy verification probes required public routes.
- Updated `deployment/docker/README.md` to include `/history/*` in same-origin proxy routing and document the Nginx Proxy Manager regex.
- Added an options tape warning banner for live `/history/options` load errors.
- Updated live Nginx Proxy Manager config for `flow.deltaisland.io` so the public route regex includes `history`.
- Created follow-up Beads issue `islandflow-qd7` for the later `api.flow.deltaisland.io` migration.

## Context

The API and ClickHouse path already supported older options history, but the public same-origin route sent `/history/options` to the Next.js app. That made the live tape feel capped at the newest hot-window rows even though durable history existed behind the API.

## Important Implementation Details

The deploy smoke check performs GET probes and verifies JSON responses for these same-origin routes:

    /prints/options
    /history/options
    /replay/options
    /nbbo/options
    /ws/live

The live proxy matcher is now:

    ^/(ws|replay|prints|joins|nbbo|dark|flow|candles|history)/

## Expected Impact for End-Users

Users on `/tape` can scroll beyond the initial options hot window and receive older ClickHouse-backed rows through the same cursor path for Signal and All prints. If public routing regresses, the tape now shows a visible history loading failure.

## Validation

- Passed: `bun test apps/web/app/terminal.test.ts`
- Passed: `bun test`
- Passed: `bun --cwd=apps/web run build`
- Passed: `bun run check:public-api-routes`
- Passed: remote Nginx syntax check after updating the route.

## Issues, Limitations, and Mitigations

- The long-term API subdomain migration remains separate work. Mitigation: tracked as `islandflow-qd7`.
- The Nginx Proxy Manager database and generated proxy host file were both updated because the existing live file had prior generated-file edits. Mitigation: deployment docs now call out the durable advanced-config/API path.

## Follow-up Work

Complete `islandflow-qd7` to move production API traffic to `api.flow.deltaisland.io` deliberately, including DNS, proxy behavior, CORS/websocket checks, docs, and deployment verification.