Merge branch 'production' into patricia/pcx19773-web-bot-auth-verified-bots

Author: patriciasantaana

.github/CODEOWNERS

@@ -138,7 +138,7 @@
 /src/content/docs/workers/observability/ @irvinebroque @mikenomitch @rohinlohe @kodster28 @cloudflare/pcx-technical-writing
 /src/content/docs/workers/static-assets @irvinebroque @GregBrimble @WalshyDev @kodster28 @cloudflare/deploy-config @cloudflare/pcx-technical-writing
 /src/content/docs/workflows/ @elithrar @celso @cloudflare/pcx-technical-writing
-/src/content/docs/sandbox/ @whoiskatrin @ghostwriternr @cloudflare/pcx-technical-writing @ai-agents
+/src/content/docs/sandbox/ @whoiskatrin @ghostwriternr @cloudflare/pcx-technical-writing @cloudflare/ai-agents
 
 # DDoS Protection
 

src/content/docs/cloudflare-one/email-security/retro-scan.mdx

@@ -5,7 +5,7 @@ sidebar:
   order: 10
 ---
 
-Retro Scan allows you to scan up to 14 days of old messages in your Microsoft 365 inboxes and check if your current email security solution missed any threats. 
+Retro Scan allows you to scan up to 14 days of old messages in your Microsoft 365 inboxes and check if your current email security solution missed any threats. Once you receive your Retro Scan report, you will be able to remediate malicious messages.
 
 :::note
 Retro Scan is only available for Microsoft 365 accounts.

src/content/docs/dns/zone-setups/partial-setup/dns-resolution.mdx

@@ -85,3 +85,31 @@ In this case, Cloudflare will always resolve the CNAME target based on the value
       C
       end
 ```
+
+### Auth DNS points to `cdn.cloudflare.net`
+
+Considering the following scenario:
+
+- The target zone (Cloudflare zone 2 in this example) is a partial zone and the DNS record on the partial is proxied.
+- The DNS record on the authoritative DNS server points to `cdn.cloudflare.net`
+
+If such setup is in place, the subdomain (`www.partialzone.com` in this example) will resolve to a Cloudflare proxy IP, which will ultimately result in an error. Consider using [custom hostnames](/cloudflare-for-platforms/cloudflare-for-saas/domain-support/) and [Orange-to-Orange](/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/how-it-works/) setup instead.
+
+```mermaid
+    flowchart TD
+      accTitle: DNS resolution flow with CNAME target in a zone within the same account and auth DNS pointing to cdn.cloudflare.net
+      A[Request to <code>www\.alice.com</code>] --> B[<code>CNAME</code> record for <code>www\.alice.com</code> to <code>www\.partialzone.com</code>]
+      B --> C[<code>CNAME</code> record for <code>www\.partialzone.com</code> to <code>www\.partialzone.com.cdn.cloudflare.net</code>]
+      C --> D[<code>Cloudflare proxy IP</code>]
+      subgraph Cloudflare account
+        subgraph Cloudflare zone 1
+          B
+        end
+        subgraph Cloudflare zone 2
+        E[Proxied <code>A</code> record for <code>www\.partialzone.com</code> to <code>203.0.113.1</code>]
+        end
+      end
+      subgraph Authoritative DNS
+      C
+      end
+```

src/content/docs/fundamentals/reference/cloudy-ai-agent.mdx

@@ -1,6 +1,10 @@
 ---
-title: Cloudy AI agent
+title: Cloudy AI agent (beta)
 pcx_content_type: reference
+sidebar:
+  label: Cloudy AI agent
+  badge:
+    text: Beta
 ---
 
 Cloudy is Cloudflare's first version of an AI agent, with assistant-like functionality designed to help users understand and improve their Cloudflare configurations in multiple areas of the product suite.

src/content/docs/sandbox/tutorials/code-review-bot.mdx

@@ -265,7 +265,7 @@ The `.dev.vars` file is automatically gitignored and only used during local deve
 
 ## 5. Expose local server with Cloudflare Tunnel
 
-To test with real GitHub webhooks locally, use [Cloudflare Tunnel](/cloudflare-one/connections/connect-networks/) to expose your local development server.
+To test with real GitHub webhooks locally, use [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/) to expose your local development server.
 
 Start the development server:
 
@@ -282,7 +282,7 @@ cloudflared tunnel --url http://localhost:8787
 This will output a public URL (for example, `https://example.trycloudflare.com`). Copy this URL for the next step.
 
 :::note
-If you do not have `cloudflared` installed, refer to [Install cloudflared](/cloudflare-one/connections/connect-networks/downloads/).
+If you do not have `cloudflared` installed, refer to [Downloads](/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/).
 :::
 
 ## 6. Configure GitHub webhook for local testing