From fbb7c5f9aad914ed64deac3288626bec53d21bb5 Mon Sep 17 00:00:00 2001
From: "prompt.ac/@jeffrey" <mail@aesthetic.computer>
Date: Sat, 5 Sep 2026 08:25:39 -0400
Subject: [PATCH] confessional speedup, part two: the validator survives the
 weather
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The edge proxy strips strong ETags whenever an HTML-rewriting feature is
on, so the shell's validator never reached browsers — mark it weak, which
rides through untouched. Make the catch-all HTML no-cache header
set-if-absent so apps that send their own caching policy stop getting a
doubled Cache-Control.

Claude-Session: https://claude.ai/code/session_01FryvSZ4bmGcpc7q13FNaCj
---
 lith/Caddyfile                         | 18 +++++++++++++++++-
 system/netlify/functions/sotce-net.mjs |  9 ++++++---
 2 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/lith/Caddyfile b/lith/Caddyfile
index a6b0f58e0f..b61fbcadcf 100644
--- a/lith/Caddyfile
+++ b/lith/Caddyfile
@@ -57,8 +57,10 @@
     header @serviceworker Cache-Control "no-cache, no-store, must-revalidate"
 
     # HTML: no-cache (always revalidate, but use ETag for 304)
+    # `?` = set only if absent — proxied apps that send their own
+    # Cache-Control (e.g. the sotce-net shell) were getting both headers.
     @html path / *.html
-    header @html Cache-Control "no-cache"
+    header @html ?Cache-Control "no-cache"
 
     # Encode everything (Caddy does this by default, but be explicit)
     encode zstd gzip
@@ -964,13 +966,19 @@ oskiewar.com, midi.oskiewar.com {
     handle @oskiewarround {
         root * /opt/ac/xbox/live
         rewrite * /mac-test.html
+        header Cache-Control no-cache
         file_server
     }
     # The game source and modules share the /oskiewar prefix with the live API
     # route below, so serve them before the proxy matcher claims them.
+    # `no-cache` here means revalidate, not never-cache: an unchanged file
+    # answers 304 against its ETag and loads from disk. Without the header the
+    # browser's heuristic kept whole modules stale across deploys — a returning
+    # visitor once ran a months-old round-room.mjs against the current relay.
     @oskiewarmodules path /oskiewar.js /oskiewar-sfx.mjs /oskiewar-voice.mjs /oskiewar-midi.mjs
     handle @oskiewarmodules {
         root * /opt/ac/xbox/live
+        header Cache-Control no-cache
         file_server
     }
     handle /oskiewar* {
@@ -992,18 +1000,24 @@ oskiewar.com, midi.oskiewar.com {
     }
     handle /aesthetic.computer/* {
         root * /opt/ac/system/public
+        header Cache-Control no-cache
         file_server
     }
     handle /type/* {
         root * /opt/ac/system/public
+        header Cache-Control no-cache
         file_server
     }
+    # The one asset that genuinely never moves between deploys can skip the
+    # revalidation round-trip for a week.
     handle /ComicRelief-Regular.ttf {
         root * /opt/ac/system/public/papers.aesthetic.computer/foundry/fonts
+        header Cache-Control "public, max-age=604800"
         file_server
     }
     handle /sw.js {
         root * /opt/ac/system/public
+        header Cache-Control no-cache
         file_server
     }
 
@@ -1012,10 +1026,12 @@ oskiewar.com, midi.oskiewar.com {
     handle @oskiewargame {
         root * /opt/ac/xbox/live
         rewrite * /mac-test.html
+        header Cache-Control no-cache
         file_server
     }
     handle {
         root * /opt/ac/xbox/live
+        header Cache-Control no-cache
         file_server
     }
 }
diff --git a/system/netlify/functions/sotce-net.mjs b/system/netlify/functions/sotce-net.mjs
index b5f1773dbe..502e55f518 100644
--- a/system/netlify/functions/sotce-net.mjs
+++ b/system/netlify/functions/sotce-net.mjs
@@ -10244,8 +10244,10 @@ export const handler = async (event, context) => {
 
     let etag = cachedShell?.etag;
     if (!etag) {
+      // Weak ETag on purpose: Cloudflare strips strong ETags whenever an
+      // HTML-rewriting feature is enabled, but lets weak ones through.
       etag =
-        '"' +
+        'W/"' +
         crypto.createHash("sha256").update(body).digest("hex").slice(0, 32) +
         '"';
       if (!dev) {
@@ -10264,9 +10266,10 @@ export const handler = async (event, context) => {
       "Cache-Control": "public, max-age=0, must-revalidate",
     };
 
-    // Weak comparison: proxies may prefix W/ when they compress the body.
+    // Compare on the bare hash so W/ prefixing (ours or a proxy's) never
+    // breaks the match.
     const inm = event.headers["if-none-match"];
-    if (inm && inm.includes(etag.slice(1, -1))) {
+    if (inm && inm.includes(etag.slice(etag.indexOf('"') + 1, -1))) {
       return respond(304, "", shellHeaders);
     }
 
-- 
2.51.2