1 files changed, 26 insertions, 1 deletions
diff --git a/packages/meshbay-hub/tests/test_asset_versioning.py b/packages/meshbay-hub/tests/test_asset_versioning.py
index e5889f0..3d84d99 100644
--- a/packages/meshbay-hub/tests/test_asset_versioning.py
+++ b/packages/meshbay-hub/tests/test_asset_versioning.py
@@ -23,7 +23,7 @@ import re
 import pytest
 from fastapi.testclient import TestClient
 
-from meshbay_hub.api.webapp import ASSET_V, STATIC_DIR, _asset_version
+from meshbay_hub.api.webapp import _ASSETS, ASSET_V, STATIC_DIR, _asset_version
 from meshbay_hub.app import create_app
 
 
@@ -101,3 +101,28 @@ def test_the_fingerprint_follows_the_content(tmp_path, monkeypatch):
     finally:
         target.write_bytes(original)
     assert _asset_version() == before, "the fingerprint is not reproducible"
+
+
+def test_every_static_script_participates_in_the_fingerprint():
+    """
+    `_ASSETS` is hand-maintained, and forgetting an entry fails silently: the
+    file is imported by the page, so the browser fetches it, but it does not
+    feed the content hash — so a change confined to that one file ships at the
+    URL a cache already holds. Nothing errors, and the symptom is a fix that
+    "doesn't work" on exactly the machines that visited before.
+
+    Found by `source-merge.js`, added to the Search view and left out of the
+    list. It happened to be harmless that day because `search-page.js` changed
+    in the same commit and *is* listed — which is the worst way for this to go
+    unnoticed. The checklist in docs/apps.md §4 step 5 names this trap; this
+    enforces it instead of relying on remembering.
+
+    `sw.js` is the one deliberate exclusion — the service worker is served
+    unversioned on purpose (`test_the_service_worker_is_not_versioned`).
+    """
+    on_disk = {p.name for p in STATIC_DIR.glob("*.js")} - {"sw.js"}
+    missing = sorted(on_disk - set(_ASSETS))
+    assert not missing, (
+        f"static scripts missing from webapp._ASSETS: {missing}. A change to "
+        "one of these will not move the asset URL, so a browser that cached "
+        "the page keeps running the old copy")