fix(seo): scope hreflang alternates to canonical routes

[sbc1-code]

Crossing, best-time and comparison pages inherited homepage EN/x-default alternates despite correct canonicals. Generated HTML now replaces shell hreflangs on every route; SPA canonical updates replace stale alternates and reset restores homepage defaults. Only published translations form EN/ES pairs. Existing blog, methodology and privacy pairs, canonicals, embed→crossing canonicals and PR128 report-time data remain intact.

Validation:

• Full npm run build and npm test passed, including 402 desktop/mobile browser navigations with all external providers mocked/blocked and service workers blocked.
• Final additional desktop/mobile navigation checks passed: shared-URL language switching, crossing, best-time, comparison, blog EN/ES, Back, home return and fresh Spanish article entry cleanup.
• Static checks validate 213 generated pages, exact canonicals and reciprocal targets across all 18 published blog pairs. Four unit tests cover single URLs, real/missing translation twins, stale/duplicate SPA alternates and preserving RSS links.
• Independent read-only review approved with no blocking findings; reviewer independently passed unit/static/diff checks and verified PR128 ancestry.
• Recovery checkout commit c0a7b9a has the exact same tree (0474168e055e452e8e68ebdef6d9f360b48dde72) as the locally built/tested/reviewed patch. Used existing repo no-reply commit identity; no account setting changes.

Dynamic walk-or-drive sitemap inventory remains a separate follow-up. No changes to dependencies, feeds, ads, analytics, credentials or services. CI and exact production manifest/assets/metadata verification are pending.

[sbc1-code]

Independent review gate (read-only sub-agent, separate from implementer) approved the final code/tests/docs with no blocking findings. Reviewer independently ran 4 hreflang unit tests, checked exact metadata and reciprocal targets across 213 generated pages, and passed git diff --check. Confirmed all 18 published blog pairs, methodology/privacy twins, embed→crossing canonical preservation and PR128 ancestry. The reviewed/tested tree is 0474168e055e452e8e68ebdef6d9f360b48dde72 at PR head c0a7b9a.

Local full build/npm test passed (402 desktop/mobile navigations). Final additional language-switch and fresh Spanish article entry cleanup checks passed on both viewports. All external browser traffic was blocked or mocked; user browser tabs/profiles were unused. Current main has advanced only data files since the base, with no source conflicts. CI and exact production verification remain gates before claiming release.

[sbc1-code]

Publication run38284994002 reached its20-minute timeout and was cancelled; the deployment step was skipped, so fdbb877 was not published by that run. Logs show static metadata checks passed for213 generated pages and both report-time/FAQ fixtures passed; one viewport completed hreflang navigation and the other waited without a bounded predicate timeout.

Independent source/history review confirmed a pre-existing crossing html.lang reset race after data/aggregate updates. A scoped test recovery bounds waits, logs stages, and verifies both rendered Spanish copy and selected control while retaining every exact canonical/hreflang assertion. Full production-setting npm test passed (402 navigations) and independent review approved. Recovery draft PR and fresh CI/publication verification follow; no claim that production is updated.

[sbc1-code]

Production verified at 18:01 UTC on deployment dpl_8ALviguJ21rtkspDNoy5JGaDRWxy (READY), aliased to borderpulse.com and www.borderpulse.com. Both Vercel metadata and public /data/publication.json identify commit 877c8cf. It preserves PR128 and PR129; only collector snapshot files differ from fdbb877.

HTTP-only verification passed for every one of the 171 published sitemap pages: exact canonical, route-appropriate hreflangs, existing reciprocal targets, all 36 published blog pages/18 pairs, and methodology/privacy twins. Every JavaScript/CSS asset matched the locally reproduced production-setting build byte for byte (SHA-256). No ads or analytics scripts executed.

Original run 38284994002 was cancelled by GitHub's 20-minute job timeout; implementer did not cancel it, and upload was skipped. Intervening successful run 38287082996 published the current snapshot. Independent review identified a pre-existing document-language cleanup race plus unbounded fixture waits; test-only recovery PR130 is merged after full tests and both CI runs passed. Its automatic publication run 38287800593 was already active before the latest instruction to avoid another deployment. No further deployment was initiated. Sitemap inventory and document-language lifecycle remain separate follow-ups.

[sbc1-code]

Final recovery publication succeeded: https://github.com/sbc1-code/borderpulse/actions/runs/38287800593 . Vercel deployment dpl_FN9QPJxUFXDfU9f1UeuE45uBmmxX is READY and aliased to borderpulse.com/www.borderpulse.com; Vercel commit metadata and public /data/publication.json both identify 2b40cb2.

Final HTTP-only verification passed for all 171 sitemap pages, including home, crossing, best-time, comparison, blog EN/ES and language pairs: exact canonicals, route-appropriate hreflangs, 36 blog pages/18 reciprocal pairs, and methodology/privacy twins. All 24 served JavaScript/CSS assets matched the reproduced production-setting build by SHA-256. No provider scripts executed. PR128 and PR129 are ancestors of the served commit; report-time data behavior is preserved.

The original run 38284994002 was cancelled by GitHub's 20-minute job timeout, not manually cancelled by the implementer; deployment was skipped. The independently reviewed test-only recovery keeps all metadata assertions while bounding waits and avoiding the pre-existing document-language cleanup race. Full local release tests and both PR130 CI runs passed before merge. This automatic publication was already active before the request to avoid another deployment; none was initiated afterward. No remaining release blocker. Dynamic sitemap inventory and document-language cleanup remain separate.