diff --git a/.github/workflows/deploy-cloudflare-bridge.yml b/.github/workflows/deploy-cloudflare-bridge.yml
index 43aca28..48a6e6f 100644
--- a/.github/workflows/deploy-cloudflare-bridge.yml
+++ b/.github/workflows/deploy-cloudflare-bridge.yml
@@ -98,21 +98,27 @@ jobs:
             "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pages/projects/secure-tools-web-bridge" \
             --header "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}")"
 
+          jq --raw-output '
+            .result as $project |
+            "Pages project state: name=\($project.name), production_branch=\($project.production_branch), subdomain=\($project.subdomain), custom_domain_count=\($project.domains // [] | map(select(. != $project.subdomain)) | length), source=\(if $project.source == null then "direct-upload" else $project.source.type end), web_analytics=\(if ($project.build_config.web_analytics_tag // "") == "" and ($project.build_config.web_analytics_token // "") == "" then "disabled" else "enabled" end)"
+          ' <<< "$project"
+
           jq --exit-status '
+            .result as $project |
             .success == true and
-            .result.name == "secure-tools-web-bridge" and
-            .result.production_branch == "main" and
-            .result.subdomain == "secure-tools-web-bridge.pages.dev" and
-            (.result.domains | length) == 0 and
-            .result.source == null and
-            (.result.build_config.web_analytics_tag // "") == "" and
-            (.result.build_config.web_analytics_token // "") == ""
+            $project.name == "secure-tools-web-bridge" and
+            $project.production_branch == "main" and
+            $project.subdomain == "secure-tools-web-bridge.pages.dev" and
+            ($project.domains // [] | map(select(. != $project.subdomain)) | length) == 0 and
+            $project.source == null and
+            ($project.build_config.web_analytics_tag // "") == "" and
+            ($project.build_config.web_analytics_token // "") == ""
           ' <<< "$project" > /dev/null || {
             echo "::error::Cloudflare Pages project is missing or violates the H3.2 isolation contract"
             exit 1
           }
 
-          echo "Validated Direct Upload project secure-tools-web-bridge: production branch main, zero custom domains, no Git integration, no Web Analytics."
+          echo "Validated Direct Upload project secure-tools-web-bridge: production branch main, stable pages.dev subdomain only, zero custom domains, no Git integration, no Web Analytics."
 
       - name: Deploy to Cloudflare Pages
         id: deploy
diff --git a/tests/cloudflare-bridge.test.mjs b/tests/cloudflare-bridge.test.mjs
index 6473323..e0f235f 100644
--- a/tests/cloudflare-bridge.test.mjs
+++ b/tests/cloudflare-bridge.test.mjs
@@ -17,10 +17,11 @@ assert.match(workflow, /X-Robots-Tag: noindex, nofollow/);
 assert.match(workflow, /steps\.deploy\.outputs\.deployment-url/);
 assert.match(workflow, /--max-redirs 0/);
 assert.match(workflow, /api\.cloudflare\.com\/client\/v4\/accounts\/\$\{CLOUDFLARE_ACCOUNT_ID\}\/pages\/projects\/secure-tools-web-bridge/);
-assert.match(workflow, /\(\.result\.domains \| length\) == 0/);
-assert.match(workflow, /\.result\.source == null/);
+assert.match(workflow, /\$project\.domains \/\/ \[\] \| map\(select\(\. != \$project\.subdomain\)\) \| length/);
+assert.match(workflow, /\$project\.source == null/);
 assert.match(workflow, /web_analytics_tag/);
 assert.match(workflow, /web_analytics_token/);
+assert.match(workflow, /Pages project state:/);
 assert.match(workflow, /\[\[ ! -e "\$BRIDGE_DIRECTORY\/CNAME" \]\]/);
 assert.match(workflow, /\[\[ ! -e "\$BRIDGE_DIRECTORY\/_redirects" \]\]/);
 assert.doesNotMatch(workflow, /tools\.securetools\.app/);