page loading

nginx.conf.template

@@ -37,14 +37,40 @@ server {
         index  index.html;
         # React Router owns the paths, so an unknown one is a route, not a 404.
         try_files $uri $uri/ /index.html;
+
+        # index.html must be revalidated on every visit, and until now it was
+        # not — the line below is new, and its absence was a real outage.
+        #
+        # The block above said "index.html must NOT be cached" and then set no
+        # cache header at all, which is not the same thing. With neither
+        # `Cache-Control` nor `Expires`, a browser falls back to HEURISTIC
+        # caching: RFC 9111 lets it invent a freshness lifetime from
+        # `Last-Modified`, commonly a tenth of the document's age, and serve the
+        # document from disk WITHOUT revalidating. So a tab kept the previous
+        # index.html, that index.html named `InventoryPage-BAzj-ICF.js`, the
+        # deploy had replaced it with `InventoryPage-Cbh53mHU.js`, and the
+        # import 404'd on a screen that had worked ten minutes earlier.
+        #
+        # `no-cache` does NOT mean "do not store" — it means "revalidate before
+        # use". The ETag still answers 304 on an unchanged deploy, so this costs
+        # one conditional request per visit and never a re-download.
+        add_header Cache-Control "no-cache" always;
     }
 
-    # Hashed filenames, so these can be cached hard. index.html must NOT be,
-    # or a deploy leaves people on the previous bundle until they force-reload.
+    # Hashed filenames, so these can be cached hard — the hash changes when the
+    # content does, which is what makes a year safe.
     location /assets/ {
         root /usr/share/nginx/html;
-        expires 1y;
-        add_header Cache-Control "public, immutable";
+
+        # ONE header, not two. `expires 1y` emits its own
+        # `Cache-Control: max-age=31536000`, and the `add_header` beside it
+        # appended a second, so every asset went out with two conflicting
+        # `Cache-Control` lines — `max-age=31536000` and `public, immutable`,
+        # neither complete. Browsers mostly cope; caches and CDNs in between are
+        # entitled to take the first and drop `immutable`, or to treat the pair
+        # as malformed. Merged into a single directive, with `expires` dropped
+        # because it exists only to emit the header this now sets by hand.
+        add_header Cache-Control "public, max-age=31536000, immutable" always;
     }
 
     # ── Fiesta ───────────────────────────────────────────────────────────────