- privateRevalidate sets max-age=0 on cache-control values with s-maxage - server/plugins/journal-revalidate.ts wraps res.setHeader per request, so Nitro's 200 and h3's 304 answers both carry it - purge-check: max-age=0 on 200 and 304, purged _payload.json, a second purge after re-caching, X-Real-IP refused, 404 on a server without a token - README: cachePurgeToken row and a Site cache purge section