# Debug Session: cdn-backend-unreachable

- Status: OPEN
- Started: 2026-06-20
- Symptom:
  - After enabling Alibaba Cloud CDN for `ticket.fse-media.group`, ticket price calculation fails.
  - The ticket query page does not display ticket items.
- Constraints:
  - No business logic changes before runtime evidence.
  - First code change in existing files must be instrumentation only.
- Hypotheses:
  1. CDN origin/path forwarding for API routes is incorrect.
  2. Frontend requests use relative URLs and now point at the CDN/static origin instead of backend.
  3. Backend CORS or host validation blocks requests from `ticket.fse-media.group`.
  4. HTTPS, certificate, or mixed-content policy blocks API requests.
- Next steps:
  1. Locate the ticket-order and ticket-query frontend request code.
  2. Identify backend API base URL configuration and deployment assumptions.
  3. Reproduce with browser/network evidence and add instrumentation only if needed.
- Runtime evidence:
  1. Live check on `https://ticket.fse-media.group/order` shows `GET /api/public/lines`, `GET /api/public/stations`, and `GET /api/public/config` all return `200`.
  2. Live check on `https://ticket.fse-media.group/search` shows `GET /api/public/tickets?q=` and `GET /api/public/popular` succeed, and the ticket list renders 23 rows.
  3. Direct fetch on the live site confirms `/api/public/fares/query?from=HC-01&to=HC-02` returns valid fare data.
  4. Frontend code uses same-origin relative API paths, so CDN did not break API origin resolution itself.
  5. Live responses for `/ticket-order.js`, `/ticket-search.js`, and `/public-status.js` return `Cache-Control: max-age=43200`, while the affected HTML pages reference them without version query parameters.
- Hypothesis result:
  1. CDN origin/path forwarding for API routes is incorrect: falsified by live `200` responses.
  2. Frontend requests use relative URLs and now point at the wrong origin: falsified by successful same-origin API responses.
  3. Backend CORS or host validation blocks CDN domain: falsified by successful browser fetches from the production page.
  4. HTTPS/certificate/mixed-content issue on API requests: not supported by runtime API evidence.
- Root cause direction:
  1. The codebase contained many hardcoded `http://ticket.fse-media.group/...` links in public pages and JS.
  2. In a CDN + HTTPS deployment, these hardcoded HTTP jumps can split users onto a different protocol path and create intermittent failures or stale-cache behavior.
  3. The affected public pages loaded critical JS assets without version parameters, while CDN/browser caching allowed 12-hour reuse of older scripts.
  4. The booking page had an independent selection-state bug: after both endpoints were selected, clicking a new station only replaced the destination and never restarted the origin/destination flow, which made fare/path results look "stuck".
- Fix applied:
  1. Replaced all hardcoded `http://ticket.fse-media.group` links in `web/*.html` and `web/*.js` with `https://ticket.fse-media.group`.
  2. This keeps all public navigation, ticket detail, and token detail links on the same HTTPS/CDN path as the working API requests.
  3. Added explicit version query parameters to the critical scripts in `ticket-order.html` and `ticket-search.html` so the CDN fetches a fresh asset URL after deployment.
  4. Updated `ticket-order.js` so that clicking a new station after a full start/end selection restarts the selection flow and clears stale route highlights.
- Pending verification:
  1. User to verify ticket price calculation and ticket search list under the CDN domain after redeploy/cache refresh.