Prod Deploy is Ready but live URL serves stale bundle that doesn't match committed code.

Help
1

Production deployment is Ready and shows the correct commit, but the live URL serves an old JavaScript bundle whose contents do not match the current source code.

Project: consensus-cfb (Hobby plan)
Production URL: https://www.consensuscfb.com
Latest deploy: commit 309cc58 “Hardcode Supabase client config”
Status: Ready, Production
Build: succeeded with cache disabled, no warnings or errors

Evidence:

  1. Local file src/lib/supabase.ts contains hardcoded Supabase URL and anon key (committed in 309cc58, confirmed via git show HEAD)
  2. The live HTML still references main-app-5dcba2628ed200ee.js, the same bundle filename from multiple deploys ago
  3. fetch() of that bundle returns content that does NOT contain the hardcoded URL string “fltqaizwbqkjswxbfirc” or the JWT header “eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9” — confirmed via:
    fetch(‘/_next/static/chunks/main-app-5dcba2628ed200ee.js’).then(r=>r.text()).then(t=>console.log(t.includes(‘fltqaizwbqkjswxbfirc’), t.includes(‘eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9’)))
    → false, false
  4. Response headers show x-vercel-cache: HIT, last-modified date from before the recent deploys
  5. Same result in Chrome incognito and DuckDuckGo browser (rules out local browser cache and service workers)
  6. Tested with all site data cleared and any service workers unregistered
  7. CDN cache was manually purged via Caches → Purge All
  8. Build cache was disabled on the latest rebuild

Build script: “next build --webpack” (using webpack rather than turbopack)
Framework: Next.js 16.2.6
Two NEXT_PUBLIC_ env vars also fail to be inlined into the bundle, but the current test commit hardcodes the values to bypass that — even the hardcoded values are not appearing in the served bundle.

This looks like the deployment is succeeding but the production URL is serving a stale build from somewhere I cannot purge from the dashboard.