Research history

Dated research and guide updates

1. 31 Oct 2026 · related guide bridge

   Where to go after the immutable-response guide

   The immutable-response guide now points readers to existing deployment and purge-scope, missing-asset, and service-worker guidance. This is a navigation update, not a new HTTP protocol finding or live-behavior result.

   Open the immutable-response guide → · Open the navigation note

2. 28 Oct 2026 · immutable response directive

   What does immutable change for a fresh response?

   Explained RFC 8246’s freshness-bounded recommendation against conditional validation, the return to ordinary revalidation when stale, and the explicit force-reload override. max-age, not immutable, supplies the example lifetime. The MDN Chrome caveat is limited to reload subresources; no browser, cache, endpoint, or provider was tested.

   Open the concise guide → · Open the dated report

3. 25 Oct 2026 · CDN-targeted cache policy

   RFC 9213 and Cloudflare targeted headers

   Separated RFC 9213’s ordered target-list selection and ordinary fallback from RFC 9111’s shared-cache s-maxage. Added a synthetic browser/shared/CDN/Cloudflare freshness comparison, Cloudflare-specific precedence and forwarding, and privacy/key limits. Documentation-only; no cache, zone, endpoint, or deployment was tested.

   Open the reader guide → · Open the dated report

4. 22 Oct 2026 · 304 validation

   Selecting stored responses after a 304

   Explained the RFC 9111 §4.3.4 candidate set, the first-match strong/weak/no-validator rules, and why a 304 updates selected metadata rather than transferring replacement bytes. The four-entry example is synthetic; no cache implementation behavior was tested.

   Open the practical guide · Open the dated report →

5. 16 Sep 2026 · dated baseline

   HTTP caching basics: freshness, validation, and safe storage

   Established the standards-grounded baseline for freshness and reuse, stale responses, conditional validation, private versus shared storage, and common Cache-Control mistakes. The dated report path is retained for continuity.

   Open the report index → · Open the dated baseline →

6. 16 Sep 2026 · focused follow-up

   ETag versus Last-Modified

   Added the validator comparison and precedence rule: If-None-Match wins; a nonmatching ETag does not fall back to Last-Modified. The outcomes are expected rather than live-captured because the test environment lacked curl.

   Open the validator follow-up →

7. 16 Sep 2026 · focused follow-up

   Cache-key & privacy mismatch

   Added the adversarial worksheet for query values, Vary, cookies, Set-Cookie, and Authorization, plus a separate local key/match model. No live shared-cache measurement is claimed.

   Open the cache-key/privacy report →

8. 16 Sep 2026 · focused follow-up

   Locating the serving layer

   Added the layer-boundary comparison, expected A/B outcome matrix, reader decision tree, diagnostic checklist, and explicit limits for browser cache, service worker/Cache API, history/bfcache, intermediary, and origin attribution. No live shared-cache capture is claimed.

   Open the serving-layer guide → · Open the dated report

9. 17 Sep 2026 · focused follow-up

   CloudFront TTL policy and invalidation

   The preserved CloudFront research entry now carries the completed 19 Sep audit refresh: it tightens the standalone s-maxage gap, viewer-only response-header boundary, effective cache-key invalidation scope, rewrite-stage limits, and Completed-status evidence. No live CloudFront measurement or invalidation was performed.

   Open the CloudFront guide page → · Open the dated report

10. 20 Sep 2026 · focused follow-up

    Cloudflare Cache Rules and Origin Cache Control

    Added the documentation-grounded Cloudflare case: OCC and Cache Rule edge precedence, separate Browser TTL, cache-key identity, purge scopes, a matched CloudFront crosswalk, and an authorized-only verification template. No zone response, live measurement, or purge was available.

    Open the Cloudflare guide page → · Open the dated report

11. 23 Sep 2026 · provider-neutral synthesis

    Cache deployment and incident runbook

    Added the shared checks that survive the CloudFront and Cloudflare cases: representation sensitivity, storage audience, browser/shared freshness, validators, key review, named-hop evidence, versioned URLs versus named-provider purge, and downstream limits. Documentation-only; no live provider capture is claimed.

    Open the runbook guide → · Open the dated report

12. 25 Sep 2026 · bounded stale follow-up

    When stale HTTP content is allowed

    Separated storage, freshness, stale permission, and validation gates; added the browser/shared timing example, directive matrix, symptom paths, named-hop evidence limits, private/public/versioned guardrails, and an authorized-only test matrix. The source review is documentation-only; no live stale, 304, provider, browser, origin, purge, or invalidation result is claimed.

    Open the reader summary → · Open the dated report

13. 28 Sep 2026 · service-worker lifecycle follow-up

    Service-worker updates and stale client assets

    Separated update check, installation, waiting, activation, forced activation, and claim; explained why an open page and its old asset URLs can remain after a controller change; and set a conservative, policy-based cache-retirement path. Documentation-only; no app, browser, or live lifecycle result is claimed.

    Open the reader guide → · Open the dated report

14. 4 Oct 2026 · browser HTTP-cache partitioning follow-up

    Browser HTTP-cache partitioning: context is not policy

    Separated the Fetch user-agent partition model from RFC 9111 cache-key, Vary, freshness, and validation rules; compared Chrome/Chromium, Firefox, and WebKit documentation; and explained why browser partitioning does not control a CDN or replace private/no-store. Context examples are expected, not tested; no browser, endpoint, intermediary, or cache was measured.

    Open the reader summary → · Open the dated report

15. 1 Oct 2026 · HTTP redirect caching follow-up

    HTTP redirect caching and stale route targets

    Explained that each redirect response has its own requested URI, Location, cacheability, and freshness. Added a status/method comparison, a per-hop diagram, bounded policy choices, and a symptom-first checklist. All scenarios are expected and unexecuted; no route, browser, provider, or live cache test is claimed.

    Open the reader summary → · Open the dated report

16. 7 Oct 2026 · request-side HTTP cache controls

    What does request Cache-Control ask the next cache to do?

    Separated the six RFC 9111 request directives from response policy. Request directives are advisory, not universal bypass, origin-contact, or purge commands; only-if-cached is a preference, not a guarantee. The examples are expected standards semantics, not live observations: no authorized runtime or browser/provider experiment was available.

    Open the decision-first summary → · Open the dated report

17. 10 Oct 2026 · POST response

    When can a POST response be cached?

    Separated POST-specific response eligibility—explicit freshness plus same-target Content-Location, with possible later GET/HEAD reuse only—from unsafe-request write-through and 2xx/3xx target-URI invalidation at traversed caches. The synthetic matrix is expected and unexecuted; no implementation result is claimed.

    Open the reader summary → · Open the dated report

18. 13 Oct 2026 · missing versioned assets

    Negative caching of missing versioned assets

    Added the standards-level boundary for 404/410 responses: heuristically cacheable does not mean stored, and status alone supplies no lifetime. A stored negative response may remain reusable after bytes return at the same URI; a later no-store response is not a purge. The diagnostic guidance distinguishes named HTTP-cache evidence from service-worker or application responses. Documentation-only; no cache, browser, provider, endpoint, or deployment was observed.

    Open the reader summary → · Open the dated report

19. 16 Oct 2026 · Age/current_age follow-up

    How Age relates to current_age

    Explained RFC 9111 §4.2.3’s initial-age choices and resident-time calculation; clarified when an unvalidated stored response must be emitted with Age equal to its calculated current age. The arithmetic is fully synthetic; no live endpoint, browser, cache, provider, or header behavior was tested.

    Open the reader guide → · Open the dated report

20. 19 Oct 2026 · Authorization reuse clarification

    Does proxy-revalidate permit shared reuse of an Authorization response?

    RFC 9111 §3.5 lists must-revalidate, public, and s-maxage as shared-cache permissions for an Authorization request. proxy-revalidate instead governs validation before stale reuse. Erratum 9004 proposed a no-behavior-change clarification; its accessible record was Reported and final disposition was not confirmed. No cache implementation behavior was tested.

    Open the dated report →