Prod /api/health reports stale version (0.9.0) — serverless version not propagating across releases

[forcingfx]

Symptom

https://my.feedzero.app/api/health reports a stale version that never advances with releases:

$ curl -sSL https://my.feedzero.app/api/health
{"ok":true,"version":"0.9.0","time":"2026-05-31T20:56:01.804Z"}

main is at 0.12.0 (and was 0.11.0 since #216), yet prod serverless still reports 0.9.0. This is pre-existing across 0.10 / 0.11 / 0.12 — surfaced while cutting 0.12.0.

Why this matters

tests/smoke/health-version.test.ts asserts prod /api/health version == package.json. That smoke has therefore been failing or never run against prod for three releases. The user-visible "version in Settings" (#216) may be affected too if the SPA bundle is stale the same way.

Evidence / what was ruled out

• Build command is correct. vercel.json → buildCommand: "npm run build:all" → vite build && node scripts/build-api.js.
• Version source is correct. Both scripts/build-api.js and vite.config.js read readFileSync("package.json").version and inline it (process.env.APP_VERSION / import.meta.env.VITE_APP_VERSION). No env-var dependency.
• The committed bundle is stale. api/health.ts on main is an esbuild bundle with 0.9.0 hardcoded. Per ADR 007, build-api.js is supposed to overwrite it at build time — so this committed value should be irrelevant if the build runs.
• The merge did deploy. Vercel created a Production deployment for the d44c86e merge (GitHub deployment 4882716652, state success).
• Could not test the fresh deployment directly. The per-deployment URL (feedzero-b0hjehp9t-…vercel.app) is behind Vercel deployment-protection auth; anon curl is redirected to SSO. Needs vercel curl / a bypass token / the Vercel MCP.

Suspected causes (needs Vercel log access to disambiguate)

1. build-api.js isn't actually running / its regenerated api/*.ts isn't what gets deployed (build serves the committed stale bundle).
2. The production alias my.feedzero.app points at an older deployment than d44c86e.
3. Serverless function / build output caching serving an old health function.

Next steps

• With Vercel access, hit the d44c86e Production deployment's /api/health directly (via vercel curl / bypass token). If it returns 0.12.0, the issue is the production alias / caching; if 0.9.0, the issue is the build pipeline not regenerating api/*.ts.
• Inspect the d44c86e build logs: did node scripts/build-api.js run, and what package.json version did it read?
• Once root cause is known, wire health-version.test.ts into the post-deploy SMOKE step so this can't silently regress again.

Repro

curl -sSL https://my.feedzero.app/api/health   # expect 0.12.0, actual 0.9.0