Browsers held a stale shared.css (no Cache-Control on .css, weeks-old
Last-Modified → long heuristic freshness), so the .brand .logo rule added
on 2026-09-07 never applied for returning visitors and the brand wrapped
onto its own nav row on every page except Hephaestus. All 13 pages now
link shared.css?v=YYYYMMDD; bump it on every shared.css change (GOTCHAS).
Theseus browses BCNR-served sites (sirius.x, theseus.x etc.) under a
'bns://<name>' origin. Those pages import the shared bundles at
silentmode.st/js/*.js — cross-origin. Without an
Access-Control-Allow-Origin header on the JS response the browser
refuses the module and every wallet/register/mint flow silently
breaks (the launcher button does nothing, no visible error unless
you open DevTools).
The nginx block for /js/*.js MUST carry the CORS add_header lines.
Documented what to look for and the exact block to keep so a future
nginx rebuild doesn't drop it.
- index.html said 'five products' / 'all five' while listing seven cards
- deviant/brand/social/index.html was a copy of brand/index.html with every
relative link broken (assets live one level up); never deployed, removed
- GOTCHAS.md: never rsync --delete site/ to the VPS (deviant/ there is owned
by D:/Dev/Deviant/site), manifest lives in three places, archive script
Also shipped to VPS this session (no source change): releases-manifest.json
under /opt/silent-mode/site/ was stuck at 0.3.3 since 0.3.4; now 0.3.16.
