fix(v9): cache the indexed font catalog and x2t wasm -- CJK decks no longer sit on "Loading presentation" for minutes on production

Root cause of "opens instantly on localhost, loads forever on
edit.chaxus.com": the editor's indexed fonts (/fonts/NNN, no extension,
200 KB - 5 MB each) had no Cache-Control rule, so Cloudflare Pages served
them max-age=0 / cf-cache-status DYNAMIC, and in the service worker they
missed the .ttf/.woff skip and fell into stale-while-revalidate whose
`cache: 'no-cache'` revalidation re-downloaded every one on every open.
The SDK loads document fonts through a serial queue; a real Chinese deck
pulled 32 files / 37.6 MB (20 of them the Word/Slide "default fonts"
Arial/Times/Courier x 4 faces the document never uses), and measured
per-file times climbed 3s -> 89s -> 165s -> 214s+ while
isDocumentLoadComplete stayed false. Fix: _headers pins /fonts/* and
x2t.wasm.gz as immutable (they only change with a vendor swap, which
also changes the referencing HTML; editor JS/HTML is deliberately NOT
pinned since some of it carries our runtime patches), and the SW serves
those two shapes cache-first instead of revalidating. Same 3-layer
lesson as the campaign harness: production adds the CDN + SW layers that
localhost never exercises.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: chaxus

public/_headers

@@ -35,3 +35,21 @@
 # week of browser cache with revalidation after is a fine trade.
 /ran-fonts/*
   Cache-Control: public, max-age=604800, must-revalidate
+
+# The editor's indexed font catalog (public/fonts/000..266, XOR wire format,
+# 200 KB - 5 MB each). Named by catalog index and only ever replaced together
+# with the vendor build, so they are effectively immutable. Without an
+# explicit rule Pages served them max-age=0 / cf-cache-status DYNAMIC: every
+# open of a CJK deck re-downloaded 30+ MB of fonts through the SDK's serial
+# font queue and sat on "Loading presentation" for minutes on production
+# while localhost dev was instant. Long-lived at both the CF edge and the
+# browser.
+/fonts/*
+  Cache-Control: public, max-age=31536000, immutable
+
+# The x2t WASM (9.9 MB gz): the single largest first-save download; also
+# swapped only with the vendor. Editor JS/HTML under sdkjs/ and web-apps/
+# is deliberately NOT pinned here -- some of it carries our runtime patches
+# (x2t_helper.js) and the editor iframe HTML, which must revalidate.
+/sdkjs/common/wasm/x2t/x2t.wasm.gz
+  Cache-Control: public, max-age=31536000, immutable

public/sw.js

@@ -97,6 +97,33 @@ self.addEventListener('fetch', (event) => {
   // causes a crash in OnlyOffice v7.5's fallback font code path.
   if (/\.(ttf|woff2?|otf|eot)(\?.*)?$/.test(url.pathname)) return;
 
+  // 4a. The editor's indexed font catalog (/fonts/000..266, no extension) and
+  // the x2t WASM are large, immutable, vendor-versioned binaries. They used to
+  // fall through to stale-while-revalidate below, whose `cache: 'no-cache'`
+  // revalidation re-downloaded every multi-MB font on every open; with the
+  // SDK loading fonts serially, a CJK deck sat on "Loading presentation" for
+  // minutes on production. Serve them cache-first: the network is consulted
+  // only when the entry is missing.
+  const isImmutableBinary = /^\/fonts\/\d{3}$/.test(url.pathname) || url.pathname.endsWith('/x2t.wasm.gz');
+  if (isImmutableBinary) {
+    event.respondWith(
+      caches.match(event.request).then((cached) => {
+        if (cached) return cached;
+        return fetch(event.request).then((networkResponse) => {
+          if (networkResponse && networkResponse.status === 200 && networkResponse.type === 'basic') {
+            const responseToCache = networkResponse.clone();
+            caches.open(RUNTIME_CACHE).then((cache) => {
+              cache.put(event.request, responseToCache);
+              limitCacheSize(RUNTIME_CACHE, MAX_RUNTIME_ITEMS);
+            });
+          }
+          return networkResponse;
+        });
+      }),
+    );
+    return;
+  }
+
   // 4b. Skip the spellchecker engine: it is importScripts'd from inside a
   // dedicated worker during the editor's first boot, and routing that request
   // through a just-activated service worker hangs forever on a cold profile