The where-it-lives card actually behaves; assets stop serving stale

Eric, again with the screenshot that tells the truth: "when I click it
it greys out and nothing seems to happen." Two roots. My own
#storedform { display:flex } silently DEFEATED the hidden attribute
(an author display beats the UA's [hidden] rule), so the form was
visible from load and the click's only visible effect was disabling
the link. The rule is now :not([hidden])-scoped, the click swaps the
sentence for the form and focuses the select. And the "unstyled"
select he saw was last week's stylesheet: /static assets had no
cache-busting, so my fresh-fetch Chrome verification passed while his
browser held the old CSS. Asset URLs now carry ?v=<app version> —
an upgrade busts every browser's cache by construction.

Verified the full interaction in-browser this time: form hidden on
load, click reveals with 142 container options in a styled select.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016jXZFSTZQKzAC8fqpWSz9g

tests/test_web_dashboard.py

@@ -205,7 +205,7 @@ def test_stylesheet_is_served_and_linked_by_every_page(tmp_path):
     assert css.headers["content-type"].startswith("text/css")
     assert "--accent" in css.text  # the token layer, not an empty file
     for path in ("/", "/review"):
-        assert 'href="/static/app.css"' in web.get(path).text
+        assert 'href="/static/app.css?v=' in web.get(path).text
 
 
 def test_every_page_marks_itself_current_in_the_nav(tmp_path):
@@ -653,7 +653,7 @@ def test_photo_detail_page_serves_with_photos_nav_active(tmp_path):
 
     (current,) = re.findall(r'<a href="([^"]+)" aria-current="page"', html)
     assert current == "/photos"
-    assert 'src="/static/app.js"' in html
+    assert 'src="/static/app.js?v=' in html
 
 
 def test_pipeline_counts_pending_work_not_queue_rows(tmp_path):
@@ -675,3 +675,14 @@ def test_pipeline_counts_pending_work_not_queue_rows(tmp_path):
     p = _app(cfg).get("/api/pipeline").json()
     assert p["to_update"] == 0  # applied
     assert p["queued_total"] == 1  # still listed until diff reruns
+
+
+def test_assets_are_version_stamped(tmp_path):
+    """A cached stylesheet from last week must not survive an upgrade:
+    asset URLs carry the app version."""
+    from bggpipe import __version__
+
+    html = _app(_cfg(tmp_path)).get("/").text
+    assert f"/static/app.css?v={__version__}" in html
+    assert f"/static/app.js?v={__version__}" in html
+    assert "__ASSET_V__" not in html