2026-10-02 (entirely-api d683220 + entirely-portal fb82052, MAN-9209): GET /portal/cert-invoice/preview/invoice/{id} (View Invoice link) and GET /portal/cert-invoice/{id}/invoice-preview (Preview Invoice button) both serve the newest draft by mtime via local_file_service.find_latest and send Cache-Control: no-store (live-render fallback too). Before: the View Invoice route returned a FileResponse with Last-Modified and no Cache-Control (Caddy adds none on /api/*), so the browser’s heuristic freshness (about a tenth of the file’s age, ~19 h for an 8-day-old page) kept showing the 9/24 v1 (6,075,7productiondays)allmorningafterv2/v3(4,275, 4 days) were drafted; it also picked the file by name sort (_v9 over _v10). The portal link now carries ?t=previewRefreshKey like the Preview buttons. Rule: any route that serves a draft/preview document sends no-store, and any link that re-opens a regenerated document carries the refresh key.