[audit][standards] RFC 5861 stale-while-revalidate / stale-if-error not supported in core cache logic, only via experimental plugin

Severity: medium · Category: missing-feature
Location: include/proxy/hdrs/MIME.h:214

What's wrong

The cooked Cache-Control mask enum has no bits for stale-while-revalidate or stale-if-error, and recompute_cooked_stuff (src/proxy/hdrs/MIME.cc:3744-3845) only extracts max-age, min-fresh, max-stale, and s-maxage numeric values, so the core freshness logic in HttpTransact (what_is_document_freshness, can-serve-stale via proxy.config.http.cache.max_stale_age) never sees these origin directives. Support exists only in plugins/experimental/stale_response/ (DirectiveParser.cc re-parses Cache-Control itself), which is experimental, must be explicitly loaded, and duplicates header parsing. Origins that rely on RFC 5861 semantics (standard on other CDNs: Fastly, Cloudflare, Varnish) get no async-revalidation or stale-on-5xx behavior from a stock ATS install, and the global max_stale_age knob is not per-object as the RFC requires.

Evidence

include/proxy/hdrs/MIME.h:214-227 enum ends at:
  MIME_COOKED_MASK_CC_S_MAXAGE             = (1 << 11),
  MIME_COOKED_MASK_CC_NEED_REVALIDATE_ONCE = (1 << 12),
  MIME_COOKED_MASK_CC_EXTENSION            = (1 << 13)
// (no SWR/SIE bits); plugins/experimental/stale_response/DirectiveParser.cc implements its own parsing.

Suggested fix

Cook stale-while-revalidate and stale-if-error values in MIMEHdrImpl::recompute_cooked_stuff alongside max-age/s-maxage, and honor them in HttpTransact freshness/serve-stale decisions (per-object override of cache_max_stale_age), promoting the stale_response behavior into core.

Filed from an automated multi-lens codebase audit. Full report: CODEBASE_AUDIT.md / audit-report.html on branch claude/codebase-audit-review-9nw7vz.

Start with include/proxy/hdrs/MIME.h and MIMEHdrImpl::recompute_cooked_stuff in src/proxy/hdrs/MIME.cc, then trace freshness and stale-serving decisions in HttpTransact. Compare the experimental parser in plugins/experimental/stale_response/DirectiveParser.cc with the core paths. Done means core cache logic recognizes both RFC 5861 directives with per-object behavior instead of requiring the plugin.