verify the artifact, not the source
Verification kept producing a specific kind of wrong answer. The tree was correct, the local build was correct, the browser checks were green, and the thing users were actually loading was older than all of it. Two mechanisms were…