Stable Asura series IDs: strip rotating build hash (#6)

Asura series slugs carry a site-wide build hash (-059befe1) that rotates on every redeploy, silently orphaning all asura bookmarks (old-hash URLs 302 to new-hash ones, so detect() yields keys that never match stored rows).

Backend:
- migrateAsuraKeys in OpenStore: one-off idempotent migration rewriting hashed asura keys to the stable hashless ID, merging collisions to newest updated_at; losers deleted before winner rewrite (PK-collision safe) — regression tests included
- poller latestChapterFrom: build hash made optional in chapter-scoping regex so latest_chapter survives redeploys

Userscript:
- stripBuildHash(/-[0-9a-f]{8}$/) applied to seriesId in both asura detect branches; URLs keep full slug (stale hashes 302)
- load-time migration rewrites cached + retry-queued asura keys to the stripped form so a queued PUT cannot resurrect an orphaned row

Docs: AGENTS.md + CLAUDE.md URL-shape notes; design spec at docs/superpowers/specs/2026-07-28-asura-stable-series-id-design.md

Verified: go test -count=1 ./... green (new rotation + collision tests), node --check green, regex verified against live asurascans.com slugs.

Deploy order: backend first (migration runs at OpenStore). Orphan rows created by not-yet-updated userscripts self-heal on next backend restart.

Reviewed-on: #6
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

AGENTS.md

@@ -0,0 +1,158 @@
+# AGENTS.md
+
+Guidance for OpenCode (and Claude Code) working in this repo.
+
+## Status
+
+Active. Backend (`backend/`) and userscript (`userscript/manga-bookmark.user.js`) built. Plan `plans/mangaBookmark.md` = original spec, may drift; trust code + design docs in `docs/superpowers/specs/` over plan.
+
+## What this is
+
+Manga read-progress tracker for user reading on **asurascans.com** (current domain; asuracomic.net 301s here) and **demonicscans.org** from **Bromite** (mobile Chromium). Userscript injects on-page UI (floating button + slide-in panel), syncs progress to self-hosted Go backend so bookmarks unify across both sites and devices.
+
+## Hard constraints (drive design — do not violate)
+
+Bromite uses Chromium's **native** userscript engine, not Tampermonkey:
+- **No `GM_*` APIs anywhere.** No `GM_setValue`/`GM_getValue` (use page `localStorage`), no `GM_registerMenuCommand` (inject on-page UI), no `GM_xmlhttpRequest` for cross-origin (use plain `fetch()`). GM-free script also runs in desktop Tampermonkey/Violentmonkey for faster iteration.
+- Cross-origin `fetch()` works **only** against CORS-enabled backend. Manga sites `https://`, so backend **must be HTTPS** (else mixed-content block).
+- Asura and Demonic = **separate origins, separate `localStorage`** — shared remote store only way to unify bookmarks. Cloud sync required, not optional.
+- Userscript runs in **isolated world**, so embedded API token safe from site's JS.
+- Cloudflare's block on manga sites is **IP-reputation-based, not universal — not reliably reproducible.** Verified 2026-07-26: plain `curl` from both CGNAT dev machine *and* deployed VPS got clean 200s w/ real HTML on both asurascans.com and demonicscans.org (homepage, series, chapter pages) — no interactive Turnstile challenge from either IP at test time. Contradicts earlier, untested assumption CGNAT dev IP would be blocked; wasn't, at least this date. Treat "does curl work now" as live, time-varying fact to re-check, not fixed property of machine — Cloudflare bot scoring can flip clean IP without notice. Any backend fetcher still needs graceful-degrade path for when challenged; adapters should be **verified against live pages** (Playwright MCP, on-device devtools, direct probe) before finalizing, not assumed from single earlier test.
+
+## Architecture
+
+```
+Bromite userscript (isolated world, per-site adapters, localStorage cache)
+   -- fetch() HTTPS -->  reverse proxy (TLS + CORS)  -->  Go net/http  -->  SQLite (volume)
+```
+
+- **Backend** (`backend/`): stdlib `net/http` (handful of routes, no framework) + `modernc.org/sqlite` (pure Go, `CGO_ENABLED=0` -> static binary -> distroless/scratch image). Reverse proxy terminates TLS; Go service listens plain `:8080`.
+- **Single-user store.** One `bookmarks` table keyed `<site>:<series_id>` (`asura`|`demonic`). Sync **last-write-wins**. Schema + endpoint list in plan.
+- **Endpoints:** `GET /bookmarks`, `PUT /bookmarks/{key}` (upsert; see `updated_at` rule below), `DELETE /bookmarks/{key}`, `GET /healthz` (no auth).
+- **Web UI:** same binary serves password-gated browser UI on second
+  hostname — `GET /` (list, or login page when no session),
+  `POST /login`, `POST /logout`, `GET /static/*`, htmx fragment endpoints
+  under `/ui/*`. Templates/assets `go:embed`-ed, so `backend/Dockerfile`
+  must copy `templates/` and `static/` plus `*.go`. Sessions = stateless
+  HMAC cookies keyed off `API_TOKEN`; `WEB_PASSWORD` gates them, when empty
+  web routes not registered at all. UI mutations read-modify-write
+  through `Store.Get` + `Store.Upsert` so `updated_at` rule stays one
+  place. See `docs/superpowers/specs/2026-07-25-web-ui-design.md`.
+- **Latest-chapter poller:** ticker goroutine in same binary re-checks
+  each bookmarked series' newest published chapter from backend's own
+  network access, so `latest_chapter` stays fresh when user not
+  browsing. Second, parallel signal — userscript keeps own
+  `maybeCaptureLatestOnSeriesPage`/`backgroundRefreshLatest` logic unchanged.
+  Two independent clocks: per-bookmark cooldown (`latest_checked_at` column,
+  enforced by `Store.DueForLatestCheck`'s WHERE clause) and wake interval.
+  Row stamped *before* fetch so broken series waits full
+  cooldown instead of retrying every tick; writes go through
+  `Store.Get` + `Store.Upsert` so new chapter never reorders list.
+  Fetches use `bogdanfinn/tls-client` w/ Chrome profile as defence in depth
+  against fingerprint-based blocking; any failure logs and skips. See
+  `docs/superpowers/specs/2026-07-26-server-latest-chapter-polling-design.md`.
+  Poller's `Store.Get` + `Store.Upsert` not wrapped in transaction, so
+  userscript `PUT` committing between the two can be overwritten by
+  poller's stale re-read — reverting read progress and, since stored
+  value now differs, moving `updated_at` and reordering list. Known,
+  accepted limitation for single-user deployment, not bug to fix.
+- **`updated_at` drives list order, moves only on real reading progress:** server applies timestamp when row new or `last_chapter_num` changes, else keeps stored value — favouriting series or recording newly published chapter must not reorder list. `PUT` therefore returns row **as stored**; clients must adopt that response over own payload. See `plans/2026-07-25-bookmark-list-favorites-design.md` §4.
+- **Lifecycle buckets:** `status` on each bookmark is `reading` | `archived` |
+  `finished`, orthogonal to `favorite`. Archived and finished appear only in
+  own tab — not All, Updated, Favourites, or recent strip. Poller keeps
+  checking archived series, skips finished ones. `finished` settable only
+  from web UI; `PUT /bookmarks/{key}` rejects it w/ 400.
+  **Empty incoming status means "keep stored one"** — resolved on
+  `VALUES` side of `Store.Upsert`, not conflict clause, since
+  `excluded.*` = post-evaluation row and default applied there'd
+  wipe bucket on every PUT from client predating column. See
+  `docs/superpowers/specs/2026-07-27-status-buckets-design.md`.
+- **Config via env:** `API_TOKEN`, `ALLOWED_ORIGINS` (comma list), `DB_PATH`
+  (default `/data/bookmarks.db`), `PORT` (default `8080`), `WEB_PASSWORD`
+  (gates browser UI; unset disables it),
+  `LATEST_CHAPTER_POLL_ENABLED`/`_COOLDOWN`/`_INTERVAL`/`_BATCH`/`_STAGGER`
+  (background latest-chapter poller; defaults on, `1h`/`10m`/`14`/`20s`).
+
+### Userscript structure (single IIFE, `manga-bookmark.user.js`)
+
+1. **Site adapters** — one per host, `detect(location, document)` returns page `type` + IDs. ID type/IDs from **URL regex** (most stable); pull `title`/`cover` from **`og:title`/`og:image` meta tags**, not CSS classes.
+2. **API client** — `apiGet/apiPut/apiDelete` w/ bearer header; `localStorage` key `mangabm:cache` for instant render + offline fallback.
+3. **Progress logic** — auto-upsert `last_chapter` only when `chapterNum >= stored last_chapter_num` (re-reading old chapters must not regress progress; unparseable -> set current). Manual panel override forces any value.
+4. **Retry queue** — every write goes through `pushBookmark`/`pushDelete`, so
+   failed mutation parked in `localStorage` (`mangabm:queue`) and replayed on
+   next navigation, reconnect, or `refresh()`. Entries are markers
+   (`{key, op, sendStatus, attempts}`), never payloads — body read from
+   cache at send time, so one entry per key gives ordering + coalescing for
+   free. `sendStatus` **sticky**: while archive pending, later writes to
+   that key keep carrying bucket, stops successful
+   in-between write from silently un-archiving series. `refresh()` drains
+   before fetching, overlays anything still pending, so list never
+   flaps. 400 drops entry, 401 aborts pass and keeps queue,
+   transient failures retry to cap of 10. Latest-chapter writes deliberately
+   stay out of queue. See
+   `docs/superpowers/specs/2026-07-27-offline-retry-queue-design.md`.
+5. **UI** — rendered inside **Shadow DOM** root to isolate from site CSS
+   (critical on mobile). Three tabs (All / Favourites / Archived) + row of
+   link chips to web UI and both manga sites; `WEB_BASE` sits in CONFIG
+   block next to `API_BASE`.
+6. **SPA navigation** — Asura is Astro, client-routed on comic/chapter pages: patch `history.pushState`/`replaceState` + listen `popstate`, re-run `detect()` on URL change so auto-update fires w/o reload. Demonic uses classic reloads (initial `document-idle` run suffices).
+
+### Live URL shapes (verified 2026-07-26, may drift — re-check against live pages before trusting)
+
+- **asurascans.com**: series `/comics/<slug>` (slug carries a trailing
+  site-wide build-hash suffix, e.g. `-059befe1`, that **rotates on every
+  redeploy**), chapter `/comics/<slug>/chapter/<n>`. `seriesId` must strip
+  the hash (`/-[0-9a-f]{8}$/`, `stripBuildHash` in the userscript,
+  `asuraBuildHash` in the backend); URLs keep the full slug — stale-hash
+  URLs 302 to current ones. Astro-rendered; chapter links present in raw
+  server HTML.
+- **demonicscans.org**: series `/manga/<slug>` (slug may URL-encode punctuation, e.g. `%2527` for `'`), chapter `/title/<slug>/chapter/<n>/<page>` (older `chaptered.php?manga=<id>&chapter=<n>` form still exists as redirect, what series-page chapter-list anchors link through).
+  Encodings (incl. triple-encoded punctuation like `%25252D`) are identical
+  on /manga/ and /title/ pages, so decode-once seriesIds match — verified
+  2026-07-28.
+
+## Commands
+
+Backend (`cd backend`):
+- Test all: `go test ./...`
+- Single test: `go test -run TestName ./...`
+- Build static binary: `CGO_ENABLED=0 go build`
+
+Local stack: `docker compose up` (named volume mounted at `/data`, `restart: unless-stopped`).
+
+Smoke test: `curl` endpoints w/ `Authorization: Bearer <token>`; confirm `OPTIONS` preflight returns CORS headers and `/healthz` returns 200.
+
+## Forge: Gitea, not GitHub
+
+`origin` = self-hosted Gitea instance (`gitea.violetcrown.my.id`), so **`gh` doesn't work here — use `tea` (Gitea CLI) for anything past plain git.** Common ones:
+
+- Open PR: `tea pr create --head <branch> --base main --title "..." --description "..."`
+- List / view / check out: `tea pr list`, `tea pr <n>`, `tea pr checkout <n>`
+- Issues: `tea issue create`, `tea issue list`
+- Auth lives in `tea login`, not `GH_TOKEN` env var.
+
+`tea` prints output as rendered boxes not plain text; PR URL lands on last line.
+
+## Security invariants
+
+- Auth on `/bookmarks*`: require `Authorization: Bearer <API_TOKEN>`, **constant-time compare**, 401 otherwise.
+- CORS: reflect `Origin` only when in `ALLOWED_ORIGINS`; allow `GET,PUT,DELETE,OPTIONS` + headers `Authorization,Content-Type`; answer preflight `OPTIONS` w/ `204`.
+
+## Relevant skills
+
+`multi-stage-dockerfile` and `docker-compose-orchestration` for container work (referenced in plan).
+
+## graphify
+
+Project has knowledge graph at graphify-out/ w/ god nodes, community structure, cross-file relationships.
+
+Rules:
+- For codebase questions, first run `graphify query "<question>"` when graphify-out/graph.json exists. Use `graphify path "<A>" "<B>"` for relationships, `graphify explain "<concept>"` for focused concepts. Return scoped subgraph, usually much smaller than GRAPH_REPORT.md or raw grep output.
+- If graphify-out/wiki/index.md exists, use for broad navigation instead of raw source browsing.
+- Read graphify-out/GRAPH_REPORT.md only for broad architecture review or when query/path/explain don't surface enough context.
+- After modifying code, run `graphify update .` to keep graph current (AST-only, no API cost).
+
+## OpenCode-specific
+
+- Caveman mode active by default (`/home/tan/.config/opencode/AGENTS.md`). Keep comms terse — drop articles, fluff, pleasantries. Code/commits/security written normal.
+- `.superpowers/` and `.agents/` dirs hold skill definitions. Gitea at `gitea.violetcrown.my.id`.

CLAUDE.md

@@ -99,8 +99,17 @@ Bromite userscript (isolated world, per-site adapters, localStorage cache)
 
 ### Live URL shapes (verified 2026-07-26, may drift — re-check against live pages before trusting)
 
-- **asurascans.com**: series `/comics/<slug>` (slug carries a trailing hash-like suffix, e.g. `-f886a8af`), chapter `/comics/<slug>/chapter/<n>`. Astro-rendered; chapter links are present in raw server HTML (no client-side-only render blocking a server fetch).
-- **demonicscans.org**: series `/manga/<slug>` (slug may URL-encode punctuation, e.g. `%2527` for `'`), chapter `/title/<slug>/chapter/<n>/<page>` (the older `chaptered.php?manga=<id>&chapter=<n>` form still exists as a redirect and is what series-page chapter-list anchors link through).
+- **asurascans.com**: series `/comics/<slug>` (slug carries a trailing
+  site-wide build-hash suffix, e.g. `-059befe1`, that **rotates on every
+  redeploy**), chapter `/comics/<slug>/chapter/<n>`. `seriesId` must strip
+  the hash (`/-[0-9a-f]{8}$/`, `stripBuildHash` in the userscript,
+  `asuraBuildHash` in the backend); URLs keep the full slug — stale-hash
+  URLs 302 to current ones. Astro-rendered; chapter links present in raw
+  server HTML.
+- **demonicscans.org**: series `/manga/<slug>` (slug may URL-encode punctuation, e.g. `%2527` for `'`), chapter `/title/<slug>/chapter/<n>/<page>` (older `chaptered.php?manga=<id>&chapter=<n>` form still exists as redirect, what series-page chapter-list anchors link through).
+  Encodings (incl. triple-encoded punctuation like `%25252D`) are identical
+  on /manga/ and /title/ pages, so decode-once seriesIds match — verified
+  2026-07-28.
 
 ## Commands (once code exists)
 

backend/latest_sites.go

@@ -14,7 +14,9 @@ type latestChapter struct {
 
 // asuraSlugRe pulls the series slug out of a stored series_url.
 // Shape verified live 2026-07-26: https://asurascans.com/comics/<slug>, where
-// the slug carries a trailing hash-like suffix (e.g. "-f886a8af").
+// the slug carries a trailing build-hash suffix (e.g. "-f886a8af") that
+// rotates on every site redeploy — callers must strip it (asuraBuildHash)
+// before using the slug to scope anything.
 var asuraSlugRe = regexp.MustCompile(`/comics/([^/?#]+)`)
 
 // demonicChapterRe matches the pre-redirect anchors demonic series pages link
@@ -47,9 +49,14 @@ func latestChapterFrom(site, seriesURL, body string) (latestChapter, bool) {
 		if m == nil {
 			return latestChapter{}, false
 		}
+		// Stored URLs predating a redeploy may carry a stale build hash;
+		// chapter hrefs in the fetched body carry the current one. Strip to
+		// the stable ID (same rule as migrateAsuraKeys) and make the hash
+		// optional in the pattern, so scoping survives rotations.
+		slug := asuraBuildHash.ReplaceAllString(m[1], "")
 		// Compiled per call rather than cached: this runs once per fetch, which
 		// is at most a few times a minute, and the slug varies per series.
-		re = regexp.MustCompile(`/comics/` + regexp.QuoteMeta(m[1]) + `/chapter/([0-9.]+)`)
+		re = regexp.MustCompile(`/comics/` + regexp.QuoteMeta(slug) + `(?:-[0-9a-f]{8})?/chapter/([0-9.]+)`)
 	case "demonic":
 		re = demonicChapterRe
 	default:

backend/latest_sites_test.go

@@ -57,6 +57,13 @@ func TestLatestChapterFrom(t *testing.T) {
 			site: "asura", seriesURL: asuraURL, body: asuraCrossSeriesFixture,
 			wantOK: true, wantNum: 181, wantLabel: "Chapter 181",
 		},
+		{
+			name:      "asura scoping survives a build-hash rotation",
+			site:      "asura",
+			seriesURL: "https://asurascans.com/comics/chronicles-of-the-demon-faction-059befe1",
+			body:      asuraCrossSeriesFixture,
+			wantOK:    true, wantNum: 181, wantLabel: "Chapter 181",
+		},
 		{
 			name: "asura with an unparseable series url",
 			site: "asura", seriesURL: "https://asurascans.com/", body: asuraSeriesFixture,

backend/store.go

@@ -4,6 +4,7 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"regexp"
 	"strings"
 
 	_ "modernc.org/sqlite"
@@ -120,6 +121,10 @@ func OpenStore(path string) (*Store, error) {
 		db.Close()
 		return nil, fmt.Errorf("migrate schema: %w", err)
 	}
+	if err := migrateAsuraKeys(db); err != nil {
+		db.Close()
+		return nil, fmt.Errorf("migrate asura keys: %w", err)
+	}
 	return &Store{db: db}, nil
 }
 
@@ -141,6 +146,73 @@ func migrateColumns(db *sql.DB) error {
 	return nil
 }
 
+// asuraBuildHash matches the trailing "-xxxxxxxx" site-wide build ID Asura
+// appends to every series slug. It rotates on each site redeploy, so it
+// must not be part of series_id. Must stay in sync with stripBuildHash in
+// userscript/manga-bookmark.user.js.
+var asuraBuildHash = regexp.MustCompile(`-[0-9a-f]{8}$`)
+
+// migrateAsuraKeys rewrites asura bookmarks whose series_id still carries
+// the build hash to the stable, hashless ID. Rows keyed with a hash are
+// orphaned on every Asura redeploy (old-hash URLs 302 to new-hash ones, so
+// detection yields a key that never matches). When two hash-generations of
+// one series collide, the row with the newest updated_at wins and the rest
+// are deleted. Idempotent: hashless IDs never match the regex.
+func migrateAsuraKeys(db *sql.DB) error {
+	rows, err := db.Query(`SELECT key, series_id, updated_at FROM bookmarks WHERE site = 'asura'`)
+	if err != nil {
+		return fmt.Errorf("list asura rows: %w", err)
+	}
+	type row struct {
+		key, id string
+		updated int64
+	}
+	var all []row
+	for rows.Next() {
+		var r row
+		if err := rows.Scan(&r.key, &r.id, &r.updated); err != nil {
+			rows.Close()
+			return fmt.Errorf("scan asura row: %w", err)
+		}
+		all = append(all, r)
+	}
+	if err := rows.Close(); err != nil {
+		return err
+	}
+
+	groups := map[string][]row{}
+	for _, r := range all {
+		stripped := asuraBuildHash.ReplaceAllString(r.id, "")
+		groups[stripped] = append(groups[stripped], r)
+	}
+	for stripped, g := range groups {
+		winner := 0
+		for i := range g {
+			if g[i].updated > g[winner].updated {
+				winner = i
+			}
+		}
+		// Losers go first: rewriting the winner to the stripped key while a
+		// pre-existing hashless row still holds it is a primary-key collision.
+		for i, r := range g {
+			if i == winner {
+				continue
+			}
+			if _, err := db.Exec(`DELETE FROM bookmarks WHERE key = ?`, r.key); err != nil {
+				return fmt.Errorf("drop duplicate %q: %w", r.key, err)
+			}
+		}
+		if r := g[winner]; r.id != stripped {
+			if _, err := db.Exec(
+				`UPDATE bookmarks SET key = ?, series_id = ? WHERE key = ?`,
+				"asura:"+stripped, stripped, r.key); err != nil {
+				return fmt.Errorf("rewrite key %q: %w", r.key, err)
+			}
+		}
+	}
+	return nil
+}
+
 func existingColumns(db *sql.DB, table string) (map[string]struct{}, error) {
 	rows, err := db.Query(`SELECT name FROM pragma_table_info(?)`, table)
 	if err != nil {

backend/store_test.go

@@ -905,3 +905,132 @@ func TestDueForLatestCheckSkipsFinishedKeepsArchived(t *testing.T) {
 		t.Fatal("due included a finished series")
 	}
 }
+
+// Asura slugs used to include the site build hash; rows keyed with it must
+// be rewritten to the stable ID on open, merging hash-generations of the
+// same series into the newest row.
+func TestOpenStoreMigratesAsuraBuildHashKeys(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "hash.db")
+
+	store, err := OpenStore(dbPath)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	seed := []Bookmark{
+		{Key: "asura:swordmasters-youngest-son-f886a8af", Site: "asura",
+			SeriesID: "swordmasters-youngest-son-f886a8af", Title: "Old gen",
+			LastChapterNum: 50, UpdatedAt: 100},
+		{Key: "asura:swordmasters-youngest-son-059befe1", Site: "asura",
+			SeriesID: "swordmasters-youngest-son-059befe1", Title: "Re-bookmarked",
+			LastChapterNum: 60, UpdatedAt: 200},
+		{Key: "asura:overgeared-059befe1", Site: "asura",
+			SeriesID: "overgeared-059befe1", Title: "Single gen", UpdatedAt: 150},
+		// Hash-like suffix on another site must be left alone.
+		{Key: "demonic:x-deadbeef", Site: "demonic",
+			SeriesID: "x-deadbeef", Title: "Not asura", UpdatedAt: 300},
+	}
+	for _, b := range seed {
+		if _, err := store.Upsert(b); err != nil {
+			t.Fatalf("seed %s: %v", b.Key, err)
+		}
+	}
+	if err := store.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+
+	reopened, err := OpenStore(dbPath)
+	if err != nil {
+		t.Fatalf("reopen: %v", err)
+	}
+	t.Cleanup(func() { reopened.Close() })
+
+	list, err := reopened.List()
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	byKey := map[string]Bookmark{}
+	for _, b := range list {
+		byKey[b.Key] = b
+	}
+	if len(list) != 3 {
+		t.Fatalf("want 3 rows after merge, got %d: %+v", len(list), list)
+	}
+	merged, ok := byKey["asura:swordmasters-youngest-son"]
+	if !ok {
+		t.Fatalf("merged key missing: %+v", byKey)
+	}
+	// Newest row wins the merge.
+	if merged.Title != "Re-bookmarked" || merged.LastChapterNum != 60 || merged.UpdatedAt != 200 {
+		t.Fatalf("merge kept wrong row: %+v", merged)
+	}
+	if merged.SeriesID != "swordmasters-youngest-son" {
+		t.Fatalf("series_id not stripped: %q", merged.SeriesID)
+	}
+	if _, ok := byKey["asura:overgeared-059befe1"]; ok {
+		t.Fatal("single-generation hashed key not rewritten")
+	}
+	if _, ok := byKey["asura:overgeared"]; !ok {
+		t.Fatal("single-generation row missing under stripped key")
+	}
+	if _, ok := byKey["demonic:x-deadbeef"]; !ok {
+		t.Fatal("non-asura row touched")
+	}
+
+	// Idempotent: a third open changes nothing.
+	third, err := OpenStore(dbPath)
+	if err != nil {
+		t.Fatalf("third open: %v", err)
+	}
+	third.Close()
+}
+
+// A hashed row and a pre-existing hashless row of the same series collide on
+// the stripped key. The winner rewrite must happen only after the loser is
+// gone, or the UPDATE hits a primary-key collision and OpenStore fails.
+func TestOpenStoreMigratesAsuraHashlessCollision(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "collision.db")
+
+	store, err := OpenStore(dbPath)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	seed := []Bookmark{
+		{Key: "asura:overgeared", Site: "asura", SeriesID: "overgeared",
+			Title: "Hashless", LastChapterNum: 10, UpdatedAt: 100},
+		{Key: "asura:overgeared-059befe1", Site: "asura",
+			SeriesID: "overgeared-059befe1", Title: "Hashed newer",
+			LastChapterNum: 20, UpdatedAt: 200},
+	}
+	for _, b := range seed {
+		if _, err := store.Upsert(b); err != nil {
+			t.Fatalf("seed %s: %v", b.Key, err)
+		}
+	}
+	if err := store.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+
+	reopened, err := OpenStore(dbPath)
+	if err != nil {
+		t.Fatalf("reopen: %v", err)
+	}
+	t.Cleanup(func() { reopened.Close() })
+
+	list, err := reopened.List()
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(list) != 1 {
+		t.Fatalf("want 1 row after merge, got %d: %+v", len(list), list)
+	}
+	merged := list[0]
+	if merged.Key != "asura:overgeared" {
+		t.Fatalf("merged key = %q, want asura:overgeared", merged.Key)
+	}
+	if merged.SeriesID != "overgeared" {
+		t.Fatalf("series_id = %q, want overgeared", merged.SeriesID)
+	}
+	if merged.Title != "Hashed newer" || merged.LastChapterNum != 20 || merged.UpdatedAt != 200 {
+		t.Fatalf("merge kept wrong row: %+v", merged)
+	}
+}

userscript/manga-bookmark.user.js

@@ -66,6 +66,18 @@
     return out;
   }
 
+  // Asura appends a site-wide build hash to every slug
+  // ("...-059befe1"); it rotates on each redeploy, so it must not be part
+  // of the series identity — old keys can never match pages after a
+  // redeploy. Only the ID strips it; seriesUrl keeps the full slug because
+  // navigation needs the current hash (stale ones 302). Must stay in sync
+  // with asuraBuildHash in backend/store.go.
+  // ponytail: a real title ending in exactly 8 hex chars would lose its
+  // last segment; none known.
+  function stripBuildHash(slug) {
+    return slug.replace(/-[0-9a-f]{8}$/, "");
+  }
+
   const asura = {
     site: "asura",
     // asuracomic.net deep links 301 to the asurascans.com *root*, dropping the
@@ -83,7 +95,7 @@
         return {
           type: "chapter",
           site: this.site,
-          seriesId: m[1],
+          seriesId: stripBuildHash(m[1]),
           title: cleanTitle(meta("og:title")),
           cover: meta("og:image") || "",
           seriesUrl: loc.origin + "/comics/" + m[1],
@@ -98,7 +110,7 @@
         return {
           type: "series",
           site: this.site,
-          seriesId: m[1],
+          seriesId: stripBuildHash(m[1]),
           title: cleanTitle(meta("og:title")),
           cover: meta("og:image") || "",
           seriesUrl: loc.origin + "/comics/" + m[1],
@@ -384,6 +396,38 @@
 
   const queue = loadQueue();
 
+  // Keys cached (or parked in the retry queue) by versions before the
+  // Asura build-hash strip still carry the hash. Align them with the
+  // server-side migration so a queued PUT cannot resurrect an orphaned
+  // row and the cache matches what the server now returns. Duplicate
+  // cache entries collapsing onto one key are left as-is — the next
+  // refresh() replaces the whole list from the already-merged server.
+  (function migrateLocalKeys() {
+    let dirty = false;
+    for (let i = 0; i < state.list.length; i++) {
+      const b = state.list[i];
+      if (b.site !== "asura" || !b.series_id) continue;
+      const id = stripBuildHash(b.series_id);
+      if (id === b.series_id) continue;
+      state.list[i] = Object.assign({}, b, { series_id: id, key: "asura:" + id });
+      dirty = true;
+    }
+    if (dirty) {
+      reindex();
+      saveCache(state.list);
+    }
+    dirty = false;
+    for (const e of queue) {
+      if (!e.key.startsWith("asura:")) continue;
+      const k = "asura:" + stripBuildHash(e.key.slice("asura:".length));
+      if (k !== e.key) {
+        e.key = k;
+        dirty = true;
+      }
+    }
+    if (dirty) saveQueue(queue);
+  })();
+
   function queueCount() {
     return queue.length;
   }