Editing Spacelift (section)

== What actually broke ==

* '''AMI drift wiped a fleet.''' A <code>data "aws_ami" { most_recent = true }</code> lookup meant a routine, unrelated push replaced the entire web fleet the moment AWS published a new image — new IPs, and any state that only lived on local disk was gone. Fix: pin the AMI as a fixed-default variable, bump it deliberately.
* '''The AWS console reads a literal <code>Name</code> tag.''' Resources tagged with lowercase <code>name</code> are valid but invisible in the console's Name column. Every resource needs <code>Name = "..."</code>, capital N.
* '''Deleting a stack doesn't clean up its dependency link.''' Emptying the networking stack's config to tear it down left the app stack's dependency reference dangling — the next run on either stack failed with a vague missing-input error until the link was removed and, later, explicitly re-added before rebuilding.
* '''Free-tier restrictions fail mid-operation.''' Requesting a <code>t3.medium</code> resize got rejected by a <code>FreeTierRestrictionError</code> — but only after AWS had already stopped the instance to attempt the resize, leaving it stopped (and, without an Elastic IP already attached, on a fresh IP).
* '''Uploaded-file PHP execution was silently broken.''' Because the vhost proxies every <code>*.php</code> request straight to PHP-FPM at the server-config level, MediaWiki's and WordPress's default "disable script execution in the uploads directory" <code>.htaccess</code> protection didn't actually apply — confirmed by dropping a harmless <code>.php</code> test file in <code>wp-content/uploads/</code> and watching it execute. Fixed with an explicit <code>SetHandler none</code> + <code>Require all denied</code> override in both upload directories.