deploy.sh: correct the docroot, guard the target, fix control socket

Three fixes found by deploying for real.

Docroot is /afs/csail/group/ei/www/_site, not .../www. The original deploy was
`scp -r ./_site <host>:/afs/csail/group/ei/www/`, and with no trailing slash that
copies the directory in rather than its contents, so the served files sit one
level below the path the old notes gave. Syncing to the parent would have written
63 files into the shared ei-group web root, which also holds data/ and ei/, and
left the real site untouched.

Add a target-identity check before any sync: require team/index.html to exist and
index.html to mention "Algorithmic Alignment", else abort with the command to find
the real docroot. This catches a wrong CSAIL_WWW before it writes anything.

Fix the ControlPath: macOS $TMPDIR is a long /var/folders/... path and blew the
~104-char Unix domain socket limit, so multiplexing failed and Duo prompted per
connection. Use /tmp/aag-%C.

Also make the target overridable via CSAIL_WWW, and document that --delete must
never be used against the shared parent directory.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018asg1b3bxs9Bckinz6Qwxz

Author: dhadfieldmenell

claude.md

@@ -42,11 +42,17 @@ Run the deploy script from the repo root:
 It gets a Kerberos ticket if needed, builds the site, syncs it, removes known stale
 files, and checks the live URLs afterwards. Duo will prompt once.
 
-**Do not run `rsync --delete` against this target.** `/afs/csail/group/ei/www/` is the
-*shared* web root for the `ei` group and contains other sites (notably the `ei/`
-subtree) that this repo does not produce; `--delete` would erase them. The sync is
-deliberately additive, so any file this site stops publishing must be deleted by name -
-see the `STALE` list in `deploy.sh`.
+**The docroot is `/afs/csail/group/ei/www/_site`** - note the `_site` suffix. The
+original deploy used `scp -r ./_site <host>:/afs/csail/group/ei/www/`, and with no
+trailing slash that copied the *directory* in, so the served files live one level
+deeper than the path in the old notes suggests.
+
+**Never run `rsync --delete` against the parent `/afs/csail/group/ei/www/`.** It is the
+shared `ei`-group web root and also contains `data/` and `ei/`, which this repo does not
+produce; `--delete` there would erase them. `deploy.sh` is additive and never uses
+`--delete`, so any file this site stops publishing must be removed by name - see the
+`STALE` list in the script. It also refuses to run unless the target already looks like
+a previous deploy of this site.
 
 Use **align-3**: as of Sept 2026 `align-1` resolves but does not answer on port 22.
 SSH there needs two factors (Kerberos, then Duo via keyboard-interactive), so deploys

deploy.sh

@@ -14,7 +14,11 @@ set -euo pipefail
 
 REMOTE_USER="${CSAIL_USER:-dhm}"
 REMOTE_HOST="${CSAIL_HOST:-align-3.csail.mit.edu}"
-REMOTE_DIR="/afs/csail/group/ei/www"
+# Override with: CSAIL_WWW=/some/other/path ./deploy.sh
+# NOTE the historical deploy was `scp -r ./_site <host>:/afs/csail/group/ei/www/`,
+# which (no trailing slash) creates a `_site` SUBDIRECTORY. Confirm where the live
+# site is actually served from before changing this.
+REMOTE_DIR="${CSAIL_WWW:-/afs/csail/group/ei/www/_site}"
 SITE_URL="https://algorithmicalignment.csail.mit.edu/"
 
 cd "$(dirname "$0")"
@@ -75,6 +79,28 @@ ssh "${SSH_OPTS[@]}" "${REMOTE_USER}@${REMOTE_HOST}" \
 cleanup() { ssh "${SSH_OPTS[@]}" -O exit "${REMOTE_USER}@${REMOTE_HOST}" 2>/dev/null || true; }
 trap cleanup EXIT
 
+# --- 3b. Confirm we are updating THIS site, not some other one --------------
+# The target must already look like a previous deploy of this site. Without this
+# check a wrong REMOTE_DIR silently dumps 63 files into someone else's web root.
+say "Verifying target is this site"
+if ssh "${SSH_OPTS[@]}" "${REMOTE_USER}@${REMOTE_HOST}" \
+     "test -f '$REMOTE_DIR/team/index.html' && grep -q 'Algorithmic Alignment' '$REMOTE_DIR/index.html'" 2>/dev/null; then
+  echo "OK: $REMOTE_DIR holds an existing deploy of this site"
+else
+  cat >&2 <<ERR
+
+ERROR: $REMOTE_DIR does not look like this site.
+Expected team/index.html and an index.html mentioning "Algorithmic Alignment".
+
+Deploying anyway could overwrite an unrelated site. Find the real docroot first:
+
+  ssh ${REMOTE_USER}@${REMOTE_HOST} 'ls /afs/csail/group/ei/www/ /afs/csail/group/ei/www/_site/ 2>&1 | head -40'
+
+then re-run with:  CSAIL_WWW=<correct/path> $0 ${1:-}
+ERR
+  exit 1
+fi
+
 # --- 4. Sync (additive — NO --delete) ---------------------------------------
 if [[ $APPLY -eq 1 ]]; then
   say "Syncing (real)"