- web/public/_headers: /assets/* → public, max-age=31556952, immutable (Vite content-hashed output) - / → public, max-age=0, must-revalidate (the HTML entry points at the current hashed assets) - no CORS/Set-Cookie/other rules — same-origin policy stays the app's design - verified: web/dist/_headers exists after the theme+web build