diff --git a/deploy.sh b/deploy.sh
index 5e62b13..9775439 100644
--- a/deploy.sh
+++ b/deploy.sh
@@ -6,8 +6,8 @@
 #
 #   1. npm run build (vite, base=/blobbo/)
 #   2. rsync dist/ to VPS staging
-#   3. docker cp into forum-nginx web root
-#   4. curl verify (cache-busted)
+#   3. OVERLAY into forum-nginx web root (keep old chunks; prune >7d orphans)
+#   4. verify live index AND that its entry chunk serves as JavaScript
 #
 # Follows the GAMES/ deploy doctrine (see cratewars/deploy.sh template).
 # Requirements: ssh humanjing@100.71.119.27 (tailscale), container forum-nginx.
@@ -41,14 +41,32 @@ echo "[2/4] Syncing dist/ to VPS staging ..."
 ssh "$VPS" "rm -rf '$STAGING' && mkdir -p '$STAGING'"
 rsync -az --exclude='.DS_Store' "$SCRIPT_DIR/dist/" "$VPS:$STAGING/"
 
-echo "[3/4] Replacing container content ..."
-ssh "$VPS" "docker exec $CONTAINER sh -c 'rm -rf ${REMOTE_WEB_ROOT:?}' && docker cp $STAGING/. $CONTAINER:$REMOTE_WEB_ROOT/"
+echo "[3/4] Overlaying container content (no wipe) ..."
+# OVERLAY, don't 'rm -rf': assets are content-hash-named, so a browser (or CDN)
+# holding a PREVIOUS index.html must still find the chunks it references, or the
+# page dies with "expected a JS module, got text/html" (the missing chunk falls
+# back to index.html). Copying over the top keeps old chunks alive as a grace
+# window. Vite rewrites every current chunk each build, so their mtime is fresh;
+# prune only files orphaned for >7 days so /assets can't grow without bound.
+# ponytail: 7-day window is plenty for a browser cache; widen if a CDN caches index longer.
+ssh "$VPS" "docker exec $CONTAINER sh -c 'mkdir -p ${REMOTE_WEB_ROOT:?}' \
+  && docker cp $STAGING/. $CONTAINER:$REMOTE_WEB_ROOT/ \
+  && docker exec $CONTAINER sh -c 'find ${REMOTE_WEB_ROOT}/assets -type f -mtime +7 -delete 2>/dev/null || true'"
 
-echo "[4/4] Verifying live URL ..."
+echo "[4/4] Verifying live index + entry chunk ..."
 BUST="$(date +%s)"
-CODE_HTTP="$(ssh "$VPS" "curl -s -o /dev/null -w '%{http_code}' http://localhost/blobbo/?v=$BUST")"
-echo "      container-local /blobbo/ -> HTTP $CODE_HTTP"
 CODE_LIVE="$(curl -s -o /dev/null -w '%{http_code}' "https://partly.party/blobbo/?v=$BUST")"
 echo "      https://partly.party/blobbo/ -> HTTP $CODE_LIVE"
-[ "$CODE_LIVE" = "200" ] || { echo "      ✗ live check failed"; exit 1; }
+[ "$CODE_LIVE" = "200" ] || { echo "      ✗ live index check failed"; exit 1; }
+# The index-only check can't catch a broken chunk graph: a missing chunk is
+# served as the HTML fallback (200 text/html), which is exactly the bug that
+# bit us. Fetch the entry chunk the LIVE index references and confirm it comes
+# back as JavaScript — the check that would actually have caught it.
+MAIN="$(curl -s "https://partly.party/blobbo/?v=$BUST" | grep -oE '/blobbo/assets/main-[^"]+\.js' | head -1)"
+[ -n "$MAIN" ] || { echo "      ✗ no main chunk found in live index"; exit 1; }
+CT="$(curl -s -o /dev/null -w '%{content_type}' "https://partly.party${MAIN}?v=$BUST")"
+case "$CT" in
+  application/javascript*|text/javascript*) echo "      entry chunk ${MAIN##*/} -> ${CT} ✓" ;;
+  *) echo "      ✗ entry chunk ${MAIN##*/} served as '${CT}', not JS — broken deploy"; exit 1 ;;
+esac
 echo "      ✓ deployed."