CDN and edge caching

Head office prints leaflets; every town office keeps them on a rack and hands them to visitors. The rack has one slot per leaflet title, and each rack copy carries a "take off the rack at" time.

In the offices	In the edge cache
one rack slot per leaflet title, whoever asks	the cache key (step 1)
the rack's "take off at" time, separate from how long a visitor keeps theirs	s-maxage (step 2)
a personal booking confirmation never goes on the rack	private, no-store (step 2)
each town office stocks its own rack on its first request	each PoP keeps its own copies (step 4)
head office recalls every leaflet that mentions route 5	purge by tag (step 7)
a reprint under a new title code, so old stock is simply never asked for	a versioned URL (step 7)
a regional office that restocks the town offices	an origin shield (step 8)

In real terms: a CDN hands a key's stored response to every request building that key while its shared-cache lifetime lasts.

Breaks down when: a clerk would notice a visitor's name printed on a leaflet; an edge never looks inside the body. Wrong inference: "the CDN will spot a personal page." It will not, which is why step 5 exists.

Contrasting case: a clerk who phones head office for every visitor. Nothing leaks, and head office carries all the load. That is no-store everywhere, or a key that includes the session.

Each script sets a virtual clock between requests, so every age is exact.

4.1 ExamHall: the start page that greeted the wrong candidate

EXH-688: candidates saw someone else's name on the exam start page. The shell was public, s-maxage=60 and printed the name from the cookie. MR !1147 split it: the shared shell stays at the edge, and the name comes from /api/me, sent as private, no-store.

BEFORE shell = public, s-maxage=60 and carries the name
  t= 0 Farah /exam/ECON-201/start MISS "ECON-201: Good luck, Farah"
  t=15 Gil   /exam/ECON-201/start HIT "ECON-201: Good luck, Farah"
  t=45 Hana  /exam/ECON-201/start HIT "ECON-201: Good luck, Farah"
AFTER  shell = public, s-maxage=60, no name · /api/me = private, no-store
  t= 0 Farah /exam/ECON-201/start MISS "ECON-201 shell" · /api/me MISS "Farah"
  t=15 Gil   /exam/ECON-201/start HIT "ECON-201 shell" · /api/me MISS "Gil"
  t=45 Hana  /exam/ECON-201/start HIT "ECON-201 shell" · /api/me MISS "Hana"
  origin: /exam/ECON-201/start 1, /api/me 3
ALT    shell as BEFORE, but the edge key includes the session cookie
  origin: /exam/ECON-201/start 3

The body differed by the cookie, the key did not (steps 1, 5). Keying on the cookie also stops the leak, but every candidate then misses; splitting keeps one shared copy.

4.2 ExamHall: notices going stale, then the origin failing

/api/exams/ECON-201/notices is sent with public, max-age=60, stale-while-revalidate=30, stale-if-error=600.

t=  0 200 MISS           body=v1   age=0   origin calls +1
t= 30 200 HIT            body=v1   age=30  origin calls +0
t= 65 notice v2 published
t= 70 200 STALE          body=v1   age=70  origin calls +1
t= 75 200 HIT            body=v2   age=5   origin calls +0
t=100 origin starts answering 503
t=140 200 STALE          body=v2   age=70  origin calls +1
t=200 200 STALE-IF-ERROR body=v2   age=130 origin calls +1
t=800 503 EXPIRED        body=down age=-   origin calls +1

At 70 the request gets v1 at once while the background fetch stores v2 (step 6; this edge always takes that permission). With s-maxage neither window would apply. At 200 only stale-if-error still applies, so the 503 is hidden. At 800 it is past 60 + 600 s and the error reaches the candidate.

4.3 ExamHall: an erratum on three pages

Question 4 appears on the exam page, the question page and the day's timetable. Each response carries a Surrogate-Key naming every exam it shows.

/exams/ECON-201           Surrogate-Key: exam-econ201
/exams/ECON-201/q/4       Surrogate-Key: exam-econ201 q-econ201-4
/timetable/2026-10-10     Surrogate-Key: day-2026-10-10 exam-econ201 exam-law110

purge URL /exams/ECON-201/q/4  removed 1 | /exams/ECON-201 HIT OLD · /exams/ECON-201/q/4 MISS new · /timetable/2026-10-10 HIT OLD
purge tag exam-econ201         removed 3 | /exams/ECON-201 MISS new · /exams/ECON-201/q/4 MISS new · /timetable/2026-10-10 MISS new
versioned paper JSON           v7 HIT "paper v7" · v8 MISS "paper v8" · v8 again HIT | origin calls for the paper 2

A URL purge removes one copy; the tag reaches every page that declared it (step 7). The paper JSON needs no purge: the new page links ?v=8, a new key.

4.4 Proof domain, ticketing: on-sale behind an origin shield

Event 42's seat map is public, s-maxage=60. The London, Paris and Frankfurt PoPs get their first request at 0, 10 and 50 s.

no shield        LHR@0 MISS age=0 · CDG@10 MISS age=0 · FRA@50 MISS age=0 | origin 3 | then FRA@65 HIT, origin 3
with shield      LHR@0 MISS age=0 · CDG@10 MISS age=10 · FRA@50 MISS age=50 | origin 1 | then FRA@65 EXPIRED, origin 2

With the shield, three PoP misses cost the origin one fetch (step 8). Frankfurt's copy arrived already 50 s old, so it expires at 60 s of total age, not 60 s after Frankfurt stored it.