doc 26 INC6: Clear-Site-Data cache-only for shim deploy

INC5 fmp4-disable shim required browser hard-reload to fire. Owner's
MNS S1E4 re-test still black-screened because cached index.html ran
old shim + fmp4-HLS bug recurred. Add Traefik response header
'Clear-Site-Data: "cache"' on /web/index.html. Cache-only is safe
(no cookie/storage wipe -> auth + localStorage preserved). One fresh
visit refetches index.html with new shim. Remove middleware after
owner confirms working, otherwise every revisit re-flushes cache.

docs/26-incident-2026-05-09-page-unresponsive-and-playback.md

@@ -1543,3 +1543,57 @@ Server-side state on `nullstone:/home/docker/jellyfin/config/config/`:
 - 4K HDR pre-transcode batch (R&M masters → 1080p H.264 SDR) OR 10.11.8 migration with GPU driver fixed.
 - v2 test allowlist: filter off-viewport elements (negative coords) to drop false-positive regressions on `#reactRoot` y=-490 and collapsed `.mainDrawer` x=-320.
 - Promote `/tmp/*-av1-original-*.mkv.bak` to a real archive directory.
+
+---
+
+## Iteration 4 — INC6 (2026-05-09 ~02:10 UTC)
+
+### Symptom (regression)
+
+Owner re-tested MNS S1E4 after INC5: video showed for split second, then
+black again. Audio kept playing.
+
+### Diagnosis
+
+`docker logs jellyfin` showed ffmpeg STILL using `-hls_segment_type fmp4`
+and `System.IO.EndOfStreamException: Attempted to read past the end of
+the stream.` after first segment. INC5 shim sets
+`localStorage.enableHlsFmp4 = 'false'` BUT requires browser to load the
+new `index.html` for the shim to fire. Owner's browser was serving
+cached `index.html` from disk cache — old shim ran, fmp4 capability
+still advertised in client DeviceProfile, server emitted fmp4-HLS,
+black-screen bug recurred.
+
+### Fix
+
+Traefik response header on `/web/index.html`:
+
+```
+Clear-Site-Data: "cache"
+```
+
+Cache ONLY — cookies + storage + SW untouched. One fresh load wipes
+HTTP cache, browser refetches `index.html`, shim fires, future
+`PlaybackInfo` requests construct DeviceProfile without fmp4 capability,
+server emits TS segments, browser plays through.
+
+Different from earlier `Clear-Site-Data: "cache","cookies","storage"`
+that broke auth — this one is cache-only and safe.
+
+### Action required
+
+Remove the middleware after owner confirms one fresh load fixes it,
+otherwise every revisit re-clears HTTP cache and adds latency.
+
+```
+ssh user@192.168.0.100 'sed -i "/clear-cache-only/d;/INC6 2026-05-09/,/Clear-Site-Data: .cache./d" /opt/docker/traefik/config/dynamic.yml'
+```
+
+(Or restore from `/opt/docker/traefik/config/dynamic.yml.bak.inc6.*`.)
+
+### Lesson
+
+Bind-mount index.html shims need cache eviction to deploy. Bumping a
+hash query param or `Last-Modified` doesn't help if browser already has
+the file in its memory cache for the SPA tab. `Clear-Site-Data: "cache"`
+is the safe one-shot wipe — cookies stay = auth stays.