Fix missing guns on gear page caused by CDN-poisoned manifest shards

.github/workflows/beta-deploy.yml

@@ -43,6 +43,12 @@ jobs:
         mkdir -p ~/.ssh
         echo "$SSH_KEY" > ~/.ssh/deploy_key
         chmod 600 ~/.ssh/deploy_key
+        # Two-phase deploy, same as deploy.yml: upload assets first so clients
+        # never see the new index.html before the files it references exist.
+        rsync -avz --exclude=index.html \
+          -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no -p ${{ secrets.BETA_PORT }}" \
+          ./dist/browser/ \
+          ${{ secrets.BETA_UID }}@${{ secrets.BETA_HOST }}:/home/${{ secrets.BETA_UID }}/d2checklist-beta/
         rsync -avz --delete \
           -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no -p ${{ secrets.BETA_PORT }}" \
           ./dist/browser/ \

.github/workflows/deploy.yml

@@ -44,6 +44,15 @@ jobs:
         mkdir -p ~/.ssh
         echo "$SSH_KEY" > ~/.ssh/deploy_key
         chmod 600 ~/.ssh/deploy_key
+        # Two-phase deploy so clients never load the new index.html (and the new
+        # ?v= asset URLs baked into it) before every asset it references is fully
+        # uploaded. A request for a new-versioned URL mid-upload returns the OLD
+        # file, which Cloudflare then caches for 30 days under the NEW cache key,
+        # poisoning the manifest for every client (see missing-guns bug, Jun 2026).
+        rsync -avz --exclude=index.html \
+          -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no -p ${{ secrets.PORT }}" \
+          ./dist/browser/ \
+          ${{ secrets.UID }}@${{ secrets.HOST }}:/home/${{ secrets.UID }}/d2checklist/
         rsync -avz --delete \
           -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no -p ${{ secrets.PORT }}" \
           ./dist/browser/ \

CLAUDE.md

@@ -24,6 +24,15 @@ New workspaces/worktrees are missing the gitignored `src/environments/keys.ts` a
 cp ~/projects/d2-checklist/src/environments/keys.ts ~/projects/d2-checklist/src/environments/keys-prod.ts src/environments/
 ```
 
+New workspaces are also missing node_modules and the gitignored manifest JSON in `src/assets/` (`destiny2-*.json`), so after copying the keys run:
+
+```bash
+npm install
+npm run manifest:fetch   # downloads the Bungie manifest and generates src/assets/destiny2-*.json
+```
+
+Note: when `manifest:fetch` downloads a new manifest it rewrites package.json's "manifest" value to the raw Bungie version string, which will clobber any cache-busting suffix (e.g. `-r2`) that was added intentionally — re-check package.json after running it.
+
 ## Project structure
 
 - `src/app/` - Angular application source

package.json

@@ -1,7 +1,7 @@
 {
   "name": "d2-checklist",
-  "version": "32.0.1",
-  "manifest": "244019.26.05.29.1640-4-bnet.65312",
+  "version": "32.0.2",
+  "manifest": "244019.26.05.29.1640-4-bnet.65312-r2",
   "license": "MIT",
   "scripts": {
     "ng": "ng",