A CDN in front, and every request still at the origin
The CDN is configured, DNS points at it, and its dashboard shows the traffic arriving. Origin load has not moved.
Every response comes back with Age: 0, which is the edge saying it had no copy to give you. Six headers travel on this response. Three of them make it unstorable at a shared cache, and each of the three is enough on its own.
Boundaries, outermost first: One response from the origin: ETag: "a1b2c3" (generated per body), Vary: Accept-Encoding (for gzip and brotli), Cache-Control: private (from the session layer), s-maxage=86400 (set deliberately), Set-Cookie: sid=… (set on every hit), Vary: User-Agent (added for a mobile fix) Outside every boundary: Visitors, Edge cache (Age: 0 every time; FAILED: never stores), Origin (load unchanged; FAILED: serves all of it) Connections: Visitors calls Edge cache (step 1) Edge cache calls Origin — every single time (step 2)