Closes#1551.
## Problem
`/api/*` Go responses emit no `Cache-Control` header. CDNs (Cloudflare,
nginx, Varnish) default to caching `application/json` for **15 min – 4
h** when no directive is set. Observed against a public
Cloudflare-fronted CoreScope instance (`meshcore.meshat.se`):
- 17 consecutive polls of `/api/observers` over ~10 min returned
byte-identical responses
- Response headers showed `cf-cache-status: HIT`, `age: 878` (~15 min)
- Cache-busting query param → `cf-cache-status: MISS` with fresh
`last_seen` values
This causes WebSocket pushes to diverge from REST GETs (WS fresh, REST
stale) and produces false-positive stale/online flips for observers near
the 10-min threshold.
## Fix
New `noStoreAPIMiddleware` in `cmd/server/routes.go` wired into the
gorilla/mux chain alongside the existing `backfillStatusMiddleware`.
Sets `Cache-Control: no-store` on every response whose request path
starts with `/api/`.
## Design choice: `no-store` vs `private, max-age=0`
Chose `no-store`. CoreScope's REST endpoints are fresh-on-every-request
by contract (WS pushes diff against REST GETs), so any intermediary
cache is wrong. `no-store` forbids **any** cache (CDN, browser,
intermediary). `private, max-age=0` still permits short browser caches
and some intermediaries — no benefit here.
## Scope discipline
- `/api/` prefix only.
- Static assets (`/`, `/app.js`, `/style.css`, …) keep their existing
`no-cache, no-store, must-revalidate` headers from `spaHandler` in
`main.go`. Hashed assets stay CDN-cacheable by design.
- The middleware runs for **all** registered routes including the
websocket upgrade HTTP request, since `/ws` is served through the same
mux.
## TDD
- **Red** `1beb5432`: `cmd/server/cache_control_api_test.go` asserts
`Cache-Control: no-store` on `/api/stats`, `/api/observers`,
`/api/packets`, `/api/nodes`, and asserts the middleware does NOT leak
onto `/` or `/app.js`. Fails on assertion (no Cache-Control header
emitted) — not a compile error.
- **Green** `13be675f`: middleware + wiring. All assertions pass; full
`cmd/server` suite stays green.
## Files
- `cmd/server/routes.go` — middleware definition +
`r.Use(noStoreAPIMiddleware)`
- `cmd/server/cache_control_api_test.go` — 6 sub-tests across 2
top-level tests
## Preflight
`bash ~/.openclaw/skills/pr-preflight/scripts/run-all.sh origin/master`
→ clean (exit 0).
---------
Co-authored-by: corescope-bot <bot@corescope>
Kpa-clawbot