ops/gnoweb: the CDN serves one visitor's theme to everyone and appends no-store to every response #6421

The Cloudflare layer in front of gno.land and onyx caches one visitor's theme for everyone, and adds no-store to every response. Checked on both chains on 2026-10-28.

Try it: repro.sh (sh repro.sh or sh repro.sh onyx.testnets.gno.land)

no-cookie visitor: data-theme="dark"  cf-cache-status: HIT
asset: cache-control: public, max-age=31536000, immutable, no-store

What a visitor with no cookie receives from the cache, scripts off, after a dark-theme visitor opened the same URL:

1. Cached theme

gnoweb writes data-theme from the theme cookie (handler_http.go:307), and the cache key is the URL alone. Everyone gets the first visitor's theme, until the JS corrects it after paint (a flash). Fix: render no theme from the cookie on cacheable HTML and let the inline script apply it before paint, or bypass the cache when a theme cookie is sent.

2. no-store on everything

gnoweb sends public, max-age=31536000, immutable for fingerprinted assets (cache.go:10); no-store is added downstream, so browsers refetch CSS, JS and fonts on every page. HTML gets no-store too, yet is cached at the edge. Fix: drop the appended no-store, at least on /public/.

3. Short edge TTL

A cold page takes 1.0–1.3 s to the first byte, a cached one 0.12 s, and cached pages expire within seconds. TTLs per page type: #5768.

4. When mainnet gets the new gnoweb (v1.7.0, #6372: mainnet skips v1.6.0)

• A missing file returns 500 on mainnet, shown as the "temporarily unavailable" maintenance page; onyx (v1.6.0-rc.1) returns 404 (fix(gnoweb): reject file names that vm/qfile resolves to another path #6261). Keep the maintenance page for 502/503/504.
• robots.txt and sitemap.xml return 400 on mainnet; onyx serves them; mainnet needs -canonical-origin https://gno.land and no -no-index.

Related: #5768, #6278, #6280.