Fix missing guns on gear page caused by CDN-poisoned manifest shards

[dcaslin]

Bug

Weapons added since April (e.g. Someday, hash 3232203524) don't load on the gear page. The parser logs Skipping - no desc: <hash> because the hash is missing from the assembled InventoryItem manifest table.

Root cause

Production serves a mixed-generation set of InventoryItem shards:

• shards 0–3: current manifest (4,862 items each) ✅
• shards 4–7: April 15 manifest (4,169 items each) ❌

During the June 10 10:53 UTC deploy, Cloudflare received requests for the new ?v=244019.26.05.29... asset URLs at 10:55:03 — mid-rsync. Shards 0–3 had already been replaced on the origin; 4–7 hadn't, so Cloudflare cached the April files (origin last-modified: 15 Apr 2026) under the new URLs with max-age=2592000 (expires July 10). The origin itself is correct — verified by fetching shard 4 with a cache-busting query param (returns the proper 4,862-item file, last-modified June 10).

"Someday" lands in shard 5 of the new manifest, so it (and roughly half of the ~5,500 entries added since April) resolves to undefined and gets dropped. Affected browsers also persisted the bad mix into IndexedDB keyed by the manifest version, so a CDN purge alone wouldn't heal them.

Fix

• package.json: suffix manifest with -r2 (and bump version to 32.0.2). The value is only used as a cache key (URL ?v= + IndexedDB key, never compared to Bungie's real version), so all clients fetch fresh URLs that miss the poisoned Cloudflare entries and re-download into a fresh IDB key. Note: manifest:fetch rewrites this field when it downloads a new manifest, which is fine — any new Bungie version also changes the key.
• deploy.yml / beta-deploy.yml: two-phase rsync — upload everything except index.html first (no --delete), then a full pass that flips index.html and prunes. Clients can never learn the new ?v= URLs before the files behind them are fully uploaded, so this race can't poison the CDN again.
• CLAUDE.md: document new-workspace setup (npm install, npm run manifest:fetch) and the manifest:fetch clobber gotcha.

Verification

• Prod shard contents diffed against the expected round-robin sharding of the current Bungie SQLite manifest: shards 0–3 match exactly, 4–7 don't (only ~500/4,862 overlap)
• Origin confirmed healthy via cache-busted fetch
• Freshly cooked local shards contain Someday in shard 5 as expected
• Both workflow YAMLs parse; npm run test:ci passes (259/259)

Optional follow-up (outside repo): purge assets/destiny2-inventoryitem-* in Cloudflare to also fix users still on the old app bundle immediately.

🤖 Generated with Claude Code