The site serves the committed build output; a change under src/ ships nothing until it is built and the output committed. Then: the asset URL has no cache-buster, so returning browsers keep the old file (add ?v= with the deploy hash); a script without the nonce is refused by the Content Security Policy, reported in the browser console and nowhere else; a new file type is not in the static-asset allow-list; and the browser's own cache, which a hard reload settles.