Our goal is to verify that a small Node function receives a synthetic deploy-specific runtime value without embedding it in the static file or function ZIP. We used a local Node helper calling the REST digest API with draft=true and async=false, one SHA1 static file and one SHA256 function ZIP. Netlify CLI 27.5.2 was installed for authentication/tooling; packaging used @netlify/zip-it-and-ship-it 15.5.1. No cloud build was run.
A single diagnostic draft remained uploading during a five-minute wait, then was cancelled and deleted; deletion was confirmed. The function was not invoked. Our helper failed to retain the create response’s upload lists and individual PUT acknowledgements, and treated omitted GET fields as empty arrays. We cannot establish completed uploads or attribute the stall to Netlify or the Free plan.
Locally, we corrected digest selection, immutable ZIP reuse, missing-list rejection and durable upload acknowledgements. These corrections have local regression evidence; the last correction has no hosted proof.
The API guide describes required lists in the initial digest response and polling for asynchronous requests. For a synchronous deploy whose initial response was lost, which documented endpoint/state can recover authoritative upload requirements? Also, which supported UI/API view can verify masking of a deploy-specific is_secret value on Free without retrieving unrelated site/account variables? Please point to the supported documentation or applicable limitation. We request no account changes or custom-code debugging.