0f7e27fd77
index.html is revalidated on every load, but the assets it names are not under our control once they leave the origin: Cloudflare rewrites our `Cache-Control: no-cache` on /static/* to `max-age=14400`, so a phone -- an iOS home-screen app above all, which keeps running whatever it has -- can execute four-hour-old JavaScript after a deploy. The URLs now carry the file's content hash (static/js/main.js?v=<hash>), reusing the manifest /api/version already computes, so every deploy asks for URLs no cache can answer from an old copy. index.html itself gets an explicit no-cache, must-revalidate. Verified: served HTML carries per-file hashes, a changed file yields a new URL, the app boots clean, and the refresh button's update path still hot-swaps CSS and reloads for JS. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QBDkEXP4htyXTCZUwMLphd