fix(hub): no-store on the SPA HTML shell — pull-to-refresh wasn't enough

Likely root cause of a very confusing test result: the /app HTML response
had no Cache-Control at all, so a browser that decided to cache it
heuristically could keep re-serving the SAME old page (old ASSET_V, old JS)
indefinitely — a normal reload, pull-to-refresh included, has no reason to
override a cache entry it still considers fresh. Every static asset already
gets a fresh URL from ASSET_V precisely so a change is visible, but that
only matters if the HTML naming that URL is itself refetched. no-store
forces every navigation here to hit the network.

1 files changed, 15 insertions, 3 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/webapp.py b/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
index 8aff952..6a96602 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/webapp.py
@@ -60,19 +60,31 @@ def _asset_version() -> str:
 ASSET_V = _asset_version()
 
 
+# No Cache-Control here meant no explicit signal either way, and a browser
+# left to its own heuristics can decide this is fresh enough without asking
+# — which nothing about a subsequent reload, pull-to-refresh included,
+# is guaranteed to override. `{v}` only reaches the browser at all if this
+# shell itself is refetched; a heuristically-cached copy of it re-serves the
+# OLD hash and therefore the old JS forever, indistinguishable from a fix not
+# working. `no-store` forces every navigation here to hit the network, which
+# is the only way `{v}` can ever change what a browser holding an old page
+# actually asks for next.
+_NO_STORE = {"Cache-Control": "no-store"}
+
+
 @router.get("/app", response_class=HTMLResponse)
 async def app_root():
-    return HTMLResponse(_HTML)
+    return HTMLResponse(_HTML, headers=_NO_STORE)
 
 
 @router.get("/app/{path:path}", response_class=HTMLResponse)
 async def app_catchall(path: str):
-    return HTMLResponse(_HTML)
+    return HTMLResponse(_HTML, headers=_NO_STORE)
 
 
 @router.get("/", response_class=HTMLResponse)
 async def index():
-    return HTMLResponse(_HTML)
+    return HTMLResponse(_HTML, headers=_NO_STORE)
 
 
 _HTML = """\