Adom Hydrogen

@@ -197,25 +197,48 @@ so a pushed replacement shows up without the user clearing anything.  ### Serve your dashboard HTML with `Cache-Control: no-store` -Measured on pup, 2026-08-24, and it invalidates the obvious mental model of an update:+This one is PREVENTION, not a war story: no app has yet been caught serving a stale entry+document, and the incident originally cited here turned out to be something else entirely+(see the template-literal rule below). It is still cheap and still right. -> `pkg update` ran, the new server was live, `/api/status` reported the NEW dashboard-> version, and the page in the webview was still executing the OLD build's JavaScript.+A webview can keep a cached HTML page across a version change, so the server reports the new+version while the page runs the old build's JavaScript, and every angle reads healthy on its+own. **Send `Cache-Control: no-store, must-revalidate` on the dashboard HTML itself**, not+only on your API routes. Hashed static assets may cache normally; the entry document must+not. -The webview had cached the HTML across a version change. The app's `/api/*` routes sent-`no-store`; the HTML did not, so the shell reused the page it already had while talking to a-freshly restarted server. Nothing looks wrong from any single angle: the dock's Hard Refresh-Open did its job, the package really did update, the server really is current, and the user-is still looking at yesterday's UI.+**The page-versus-status check**: fetch `<readyUrl>/api/status` and compare the version it+reports against the version the PAGE renders. Do this whenever you screenshot or cold-verify.+Know its limit, honestly: it catches a stale PAGE, and it PASSES cleanly when the page is+current but RENDERING wrong, which is the more common failure. -**Send `Cache-Control: no-store, must-revalidate` on the dashboard HTML itself**, not only on-your API routes. Hashed static assets may cache normally; the entry document must not.+### Regex escapes die inside a JS template literal -**Verifying an update actually reached the user** (do this whenever you screenshot or-cold-verify a dashboard): fetch `<readyUrl>/api/status` and compare the version it reports-against the version the PAGE renders. If they disagree, you are looking at a cached page, not-a stale server. If your dashboard shows no version in-page, the header popover is where the-contract puts it (see the `dash-header` skill).+The rule that actually catches this class of bug, measured on pup 2026-08-24 by replaying+the exact transformation against the exact inputs (three for three).++If your dashboard HTML is built as a **JavaScript template literal**, every backslash escape+in it is consumed as a STRING escape before the browser ever sees a regex. `\b` becomes a+backspace character, `\d` becomes the letter `d`, `\s` becomes `s`. The regex still runs,+silently, against a pattern you did not write:++```+"installed and pinned"   ->  "in talled and pinned"   (a mangled /s+/g ate the letter s)+"pup 2.0.328 answering"  ->  "pup 2"+"6 window(s), 0 tab(s)"  ->  "6 window"+```++It also breaks the **say-strip noun highlight** specifically: `/\bpup\b/` with `\b` eaten+never matches, so the app's noun is never wrapped and never turns teal. That defect is+invisible unless you go looking for the teal, and it looked to its own author like an old+build being served.++- **Double every regex escape** in a template-literal page (`\\b`, `\\d`, `\\s`,+  `\\w`), or build the page from a real template file instead of a literal.+- **Verify against the SERVED BYTES, not the source**: fetch the page over HTTP and grep for+  the intact pattern. The source file looked perfect; the wire did not.+- Spot-check the noun highlight visually: if your app's word is not teal in the prompt rows,+  suspect this before anything else.  ### Retiring your own older instance: the "(deleted)" trap