fix: version commit dibaca live per-request + CI polling anti-stale 20x15s

backend/internal/api/server.go

@@ -35,8 +35,7 @@ type Server struct {
 	LLM      *llm.Client
 	Validate *validator.Validate
 	Hub      *Hub
-	// Commit + StartedAt power /api/version (CI anti-stale proof).
-	Commit    string
+	// StartedAt powers /api/version (CI anti-stale proof: process age).
 	StartedAt time.Time
 }
 
@@ -48,7 +47,6 @@ func New(cfg config.Config, db *store.DB, cache *store.Cache, s *sectors.Client)
 		Cfg: cfg, DB: db, Sectors: s, Sched: sched, LLM: llmc,
 		Validate: validator.New(),
 		Hub:      NewHub(),
-		Commit:   readCommit(),
 		StartedAt: time.Now(),
 	}
 	srv.Engine = &routines.Engine{DB: db, Notifier: sched.Notifier, UserKey: cfg.DemoUserKey,

backend/internal/api/version.go

@@ -9,28 +9,29 @@ import (
 
 // Version serves GET /api/version: deployed commit + process start time so CI
 // can prove the live process is the freshly deployed one (anti-stale).
-// Commit is resolved once at startup (see readCommit); an old process keeps
-// reporting its old commit even after CI writes a new version.txt.
+// Commit is read LIVE per request (not cached): CI writes version.txt before
+// restarting, and a stale process is caught because its started_at predates
+// the deploy. Both fields together = full proof.
 func (s *Server) Version(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]any{
-		"commit":            s.Commit,
+		"commit":            readCommitLive(),
 		"started_at":        s.StartedAt.UTC().Format(time.RFC3339),
 		"google_configured": s.Cfg.HasGoogle(),
 	})
 }
 
-// readCommit resolves the deployed commit once at startup: CI writes
-// $GITHUB_SHA to version.txt (WorkingDirectory) before restarting.
-func readCommit() string {
-	if v := strings.TrimSpace(os.Getenv("FLOWSIGHT_COMMIT")); v != "" {
-		return v
-	}
-	for _, p := range []string{"version.txt", "/var/lib/flowsight/version.txt"} {
+// readCommitLive resolves the deployed commit per request: version.txt
+// (written by CI before every restart) wins, then startup env.
+func readCommitLive() string {
+	for _, p := range []string{"/var/lib/flowsight/version.txt", "version.txt"} {
 		if b, err := os.ReadFile(p); err == nil {
 			if v := strings.TrimSpace(string(b)); v != "" {
 				return v
 			}
 		}
 	}
+	if v := strings.TrimSpace(os.Getenv("FLOWSIGHT_COMMIT")); v != "" {
+		return v
+	}
 	return "unknown"
 }