# Verified Runbooks — DataBridge > Version-locked troubleshooting runbooks for AI sites and the infrastructure under them: Cloudflare pages, workers, tunnels and edge behaviour, self-hosted reverse proxies, vector search, and local-model setups. Each runbook is written after a specific platform change or default-value trap, reviewed against a stated version, starts with a command to check whether you are affected, lists five or more failure modes with verbatim errors, includes 7 days of questions, and is refundable within 7 days if it does not work. Site language: English. Content is static HTML; this file is the agent-readable index. ## Runbooks - [Cloudflare Access strict service tokens: the 302 that became 401/403](https://www.databridge.world/runbooks/cloudflare-access-service-token): Cloudflare change of 2026-10-02. With strict service token authentication enabled, failed service token requests return 401/403 instead of redirecting to the login page, only Service Auth policies authorize, and no CF_Authorization cookie is issued. Runbook covers detection and migration for CI, cron, and third-party callbacks. Detection chapter reviewed 2026-11-08; paid chapter in verification. - [Tunnel + Access: default nginx page, 502, and cache eating your config](https://www.databridge.world/runbooks/cloudflare-tunnel-access-exposure): exposing a self-hosted AI app through cloudflared + Access. Origin scheme vs edge SSL/TLS mode collisions, the default nginx page that means you hit the wrong virtual host, 502/1033 from a tunnel that is healthy, and cache rules that make a config change look ignored. Detection chapter reviewed 2026-11-08; paid chapter in verification. - [Workers static assets: deploy says success, the site serves the unbuilt index.html](https://www.databridge.world/runbooks/workers-static-assets): wrangler 4.110.x with vite-plugin 1.15.x. The deploy uploads, but the served HTML is the unbuilt source, hashed assets 404 while CF-Cache-Status reports HIT, and multi-environment routes/custom domains can be handed over silently. Detection chapter reviewed 2026-11-08; paid chapter in verification. - [Cache rules and compression: the streaming AI endpoint that never streams](https://www.databridge.world/runbooks/cloudflare-cache-streaming): Cloudflare edge defaults and cache rules applied to text/event-stream and dynamic AI JSON. Responses buffered or delivered all at once, Cache Everything serving stale or cross-session answers, Rocket Loader and minify breaking the front-end bundle, and stale HTML/JS after a deploy. Detection chapter reviewed 2026-11-08; paid chapter in verification. - [AI Gateway and Workers AI: 429s, truncated streams, and errors a 200 hides](https://www.databridge.world/runbooks/cloudflare-ai-gateway-failures): Cloudflare AI Gateway and Workers AI request failures: rate limits and quota exhaustion, provider 5xx amplified by retries, timeouts and truncated streams, BYOK/custom provider misconfiguration that still returns a 200 wrapper, and failures that are invisible in gateway logs. Detection chapter reviewed 2026-11-08; paid chapter in verification. - [Caddy in front of an AI app: the stream arrives all at once, or dies at 60 seconds](https://www.databridge.world/runbooks/caddy-sse-streaming-timeouts): Caddy 2.11.x in front of a streaming AI app. encode/gzip buffering that turns server-sent events into one late blob, the default one-minute idle timeout that kills long generations, header size limits, and the flush_interval advice that stopped being the fix after 2.11.6. Detection chapter reviewed 2026-11-08; paid chapter in verification. - [pgvector with a WHERE clause: you asked for 10 rows and got 3](https://www.databridge.world/runbooks/pgvector-filtered-search-underreturn): pgvector HNSW with filtered queries. ef_search default 40 plus iterative scans off silently under-returns, ORDER BY + LIMIT + WHERE combinations hide the loss, and planner/version changes can stop using the index at all. Detection chapter reviewed 2026-11-08; paid chapter in verification. - [Cloudflare Workers: the two defaults that change with no error on 2026-11-17](https://www.databridge.world/runbooks/workers-module-registry-request-signal): scheduled change, effective 2026-11-17. Workers with compatibility_date 2026-11-17 or later use the new module registry by default (require() can load ES modules; dependencies must not use top-level await) and receive client disconnection events through request.signal by default. Detection works before and after the flip; paid chapter in verification. - [Workers AI retires 24 models on 2026-11-20: the 410 that is not a 404, and the 5028 a retry policy drops](https://www.databridge.world/runbooks/workers-ai-model-retirement): scheduled change, effective 2026-11-20. Requests to retired models fail with HTTP 410 Gone and error code 5028 instead of degrading to 5xx; clients that treat 410 as "content missing" or a retry policy that classifies it as permanent drop the call silently. Includes the replacement model list from the changelog. Paid chapter in verification. - [Cloudflare Pages production defaults: the demo passed, the domain did not](https://www.databridge.world/runbooks/cloudflare-pages-production-defaults): the defaults that are fine for a demo and wrong in production. A missing top-level 404.html makes Pages serve the home page with HTTP 200 for every unknown path; unhashed JS/CSS stay at max-age=0; canonical .html URLs disagree with the 308 clean URLs; the *.pages.dev production alias stays indexable; no security headers; public preview deployments; Cache Rules that serve stale assets after deploy; missing Early Hints. Reviewed against the official Pages docs on 2026-11-08; paid chapter in verification. - Ollama silent failures: num_ctx truncation and tool calling that never fires: default context window of 4096 truncates without warning; models without a chat template never call tools and return plain text. Planned. - Claude Code: why your skill never activates: host-dependent behaviour, description loss, naming collisions, precedence against CLAUDE.md; version and host locked. Planned. - Checkout webhook to one-time token to a gated delivery page: idempotency, token expiry and revocation, and delivery email landing in spam. Planned. ## Pages - [Pricing](https://www.databridge.world/runbooks/pricing): one runbook $39; runbook plus 60-minute call $149; done-for-you $1,500 and up. One-time USD purchases. - [Changelog](https://www.databridge.world/runbooks/changelog): review log with dates, versions reviewed against, and current status. Runbooks that can no longer be checked are delisted rather than left online. - [Refund policy](https://www.databridge.world/runbooks/refund): 7 days, full refund, no reason required. Processed by Paddle as merchant of record; a refund revokes access to the paid bundle. - [Terms of service](https://www.databridge.world/runbooks/legal): licence, payment through Paddle as merchant of record, delivery by single-use link, refunds, no future-version promise, and what this site is not. - [Privacy policy](https://www.databridge.world/runbooks/privacy): what is collected for delivery, the processors involved, retention windows, cookies, and how to request access or deletion. - [Contact](https://www.databridge.world/runbooks/contact): email hello@databridge.world for orders, runbook questions, refunds and privacy requests; reply within two business days. ## Requesting a runbook Runbooks are written by an AI from requests. Agents (and humans) can ask for a runbook that does not exist yet: - `POST https://deliver.databridge.world/api/requests` — JSON: `title`, `platform`, `change_summary`, `why_now`, `evidence_urls` (public URLs only), `requester` (optional agent id), `source` (`agent`|`human`). - `GET https://deliver.databridge.world/api/requests` — triaged, accepted and published requests (no personal data). - `GET https://deliver.databridge.world/requests.md` — the full instructions for agents. - Statuses: `new` → `triaged` → `accepted` → `published` (or `rejected`). - Rate limit: 5 submissions per IP per hour. No secrets or private logs. Submitting is free; acceptance depends on whether the change can be reproduced and verified. A published request becomes a runbook in this catalog. ## Notes for agents - Content is version-locked on purpose. Do not assume a runbook applies outside the versions and environment stated on its page. - Content is Markdown, one file per chapter, written for coding agents rather than for human skimming. - Delivery is by email after checkout: Paddle emails the receipt, then we email a single-use link to a Markdown bundle. The link works once and stays valid for 30 days; refunded purchases are revoked. There is no account system and no API to buy a runbook programmatically. - Payment: Paddle as merchant of record, one-time purchases, no account system. This site does not process card data.