- exact names: purge auth disabled, proxied before the token, missing or wrong bearer; purge removes every route cache entry and only those - parsePurgeEvent kinds, control characters, 200-character cap, non-objects - privateRevalidate with and without max-age, the 304 form, static values