No private view is ever cached: private, no-store and Vary on every answer that depends on who is asking #25

Read every line of src/protocol.ts and src/protocol.test.ts, ran the suite at this head (26 pass, 0 fail), and checked the preview (200 in 165 ms, CSP / nosniff / referrer-policy floor intact — the page is still the notes scaffold, which is #7's job, not this pull's). The module is the right shape: pure, no imports from world.ts/db.ts/live.ts/http.ts, strides and scales in one named block, named failures instead of throws on the decode path, parseSteer capping bytes before it parses and never handing a NaN downstream. No secrets, no shell, no SQL, no eval, and no dependency added. Nothing here touches identity or a door, so the identity and both-doors rules are not in play yet.

One miss, and it is the one the module sells hardest.

High — the clamp and the saturation are untested; both can be deleted and the suite stays green. I checked it by mutation: replace toInt16 (src/protocol.ts:116) with a bare Math.round(finite(value) * scale) and toFieldByte (src/protocol.ts:123) with a bare 128 + Math.round(...), and all 8 protocol tests still pass. The header promises that field components "saturate rather than wrap" and that out-of-range numbers clamp, and that promise is exactly what a wire contract four issues will import must pin down. The failure mode is not cosmetic: with the clamp gone, a field component of +12 encodes and decodes as -4.09 — a strong current reads backwards on every client, in the one mechanic the direction is built on — and a position of 1e9 comes back as 2560 instead of the clamped 8191.75. "a wild number is clamped or zeroed, never written as NaN" (src/protocol.test.ts:115) only asserts finiteness, and a wrapped int16 is perfectly finite, so it catches nothing.

Fix first: add the saturation and clamp assertions to that test, by value rather than by finiteness. With the code as shipped, field = 12 decodes to exactly FIELD_MAX and field = -20 to exactly -FIELD_MAX, and a position of 1e9 decodes to 32767 / POSITION_SCALE and -1e9 to -32768 / POSITION_SCALE — four toBe assertions, each of which fails the moment a clamp goes. Note when you write it that a saturated negative field byte decodes to exactly -FIELD_MAX but the byte range is asymmetric around 128, so assert the endpoint value, not Math.abs(...) <= FIELD_MAX for arbitrary inputs.

Low, take or leave. A mote id rides in an int16 through toInt16, so the header's "mote ids are exact" holds only under 32767 and an id above that silently clamps into a collision with another mote. If ids are roster slots this never happens — say so in the comment on MOTE_STRIDE; if they are session-lifetime counters, #9 needs to know to fold them. Also: parseSteer applies STEER_MAX_BYTES only to the text and bytes paths, which is right, but it means the object path trusts its caller — worth a line in the doc comment so the socket in #9 caps the body before it parses rather than after.

Everything else I looked for is there: the round trip is checked per-field against half a quantiser step, the budget test prints the real 924 bytes, the decoder survives 64 noise payloads carrying the right magic without throwing, and every parseSteer rejection is asserted by name. Fix the clamp tests and this lands.

Retraction first: the comment I posted here minutes ago, about src/protocol.ts and a missing clamp test, belongs to a different repository and has nothing to do with this pull. It landed here through a mistake of mine while working out this API; it cannot be deleted, so please ignore it entirely. This comment is my actual review.

Approved. This is the small, exact change the issue asked for, and the preview shows why it matters.

What I verified:

• Live on the preview, /, /api/notes, a 404 and the 405 refusal all answer cache-control: private, no-store with vary: x-forge-identity, x-forge-signature, cookie; the versioned asset still answers public, max-age=31536000, immutable. Worth noting what the edge does: the unversioned /static/app.css comes back through the CDN as cache-control: max-age=14400 — the proxy in front of this app rewrites a weak cache header — and it left private, no-store untouched. Without this change the table page was a candidate for exactly that treatment, which is the risk the issue named.
• The Vary names are read, not guessed. x-forge-identity and x-forge-signature are precisely the two headers who() reads, and cookie is what readNotice() reads. No helper-built response consults a fourth.
• The notice round trip still works under no-store: an anonymous POST /notes on the preview returns 303 with set-cookie: notice=...; HttpOnly; SameSite=Lax; Secure, and the next GET / clears it. no-store does not suppress Set-Cookie, so nothing regressed.
• The tests are real. bun test is 29 pass / 0 fail at 3b0a15f. Reverting only src/http.ts to main's version fails three of them — "no answer that depends on who is asking is cached", "a call site can hand out a public cache on purpose", and the expectPrivate on a missing static file — so the behaviour is pinned, not just described. The /events test opens the stream and reads the first retry: frame, so a later default cannot silently swallow it.
• Scope and shape. Only the header table, two widened signatures, and the docs. No new dependency, no dead code, no TODO. html/json/text spread ...headers last, so a call site's cache-control wins: the public opt-in is explicit and tested. staticFile and events keep their own caching, as the issue required. The screenshots are identical to main, which is the right outcome for a header-only change.

One follow-up, not a blocker and explicitly out of this issue's scope ("touch nothing else in http.ts"): three responses are still built outside the helpers and stand on no floor at all — events() in src/live.ts and the 202 notification new Response(null, { status }) in src/routes.ts carry no CSP and no nosniff. The stream is the one that matters, since /events will carry per-seat state once the table is live and today it has neither the floor nor a Vary. That deserves its own issue rather than a change request here.

The back-button cost is stated in the pull, the README and AGENTS.md, and for a game that redacts a charge per seat it is the right trade. Nothing to fix; land it.