Canonical silentmode.st URLs no longer carry a trailing slash (/tools, not
/tools/). nginx (tracked now in VPS/SilentMode/silentmode-st.nginx) 301s
the old form and serves <dir>/index.html; sub-sites deployed from other
repos with relative asset paths (deviant, sirius-x, theseus-x, hephaestus.x,
fly.x, code) keep their directory URLs. Every page's internal links are
now site-root-relative, which resolves correctly both at /x on nginx and
under the BNS gateway's injected <base href="/bns/silentmode.bch/"> — the
old ../x/ links were already broken on the gateway route.
/theseus becomes the Silent Mode-headered Theseus page (what it is, what's
inside, Windows + Android downloads with manifest hashes, verify), linking
out to the sovereign theseus.x whose VPS mirror moves to /theseus-x/, the
same split as /sirius vs /sirius-x/. /tools is repurposed as the overview:
every site, the on-chain twins, the other clients (relay, Firefox, the
standalone Ariadne Resolver) and the machine endpoints. The old tools page
carried stale APK and resolver hashes; the new pages use the manifest's,
verified against the files on dl.silentmode.st.
scripts/serve-site.mjs mirrors the nginx rules for local preview.
Browsers held a stale shared.css (no Cache-Control on .css, weeks-old
Last-Modified → long heuristic freshness), so the .brand .logo rule added
on 2026-09-07 never applied for returning visitors and the brand wrapped
onto its own nav row on every page except Hephaestus. All 13 pages now
link shared.css?v=YYYYMMDD; bump it on every shared.css change (GOTCHAS).
Theseus browses BCNR-served sites (sirius.x, theseus.x etc.) under a
'bns://<name>' origin. Those pages import the shared bundles at
silentmode.st/js/*.js — cross-origin. Without an
Access-Control-Allow-Origin header on the JS response the browser
refuses the module and every wallet/register/mint flow silently
breaks (the launcher button does nothing, no visible error unless
you open DevTools).
The nginx block for /js/*.js MUST carry the CORS add_header lines.
Documented what to look for and the exact block to keep so a future
nginx rebuild doesn't drop it.
- index.html said 'five products' / 'all five' while listing seven cards
- deviant/brand/social/index.html was a copy of brand/index.html with every
relative link broken (assets live one level up); never deployed, removed
- GOTCHAS.md: never rsync --delete site/ to the VPS (deviant/ there is owned
by D:/Dev/Deviant/site), manifest lives in three places, archive script
Also shipped to VPS this session (no source change): releases-manifest.json
under /opt/silent-mode/site/ was stuck at 0.3.3 since 0.3.4; now 0.3.16.
