[jonbaldie]

Summary

successful unsafe response
  Location / Content-Location: item
  resolve against /dir/mutate → /dir/item
  reduce literal dot segments; preserve query; discard fragment
  ban the same-host cached target

Fixes #147. The cache policy explicitly skipped relative paths before constructing a ban. Both headers now resolve against the unsafe request URL. Eight bounded reduction passes fall back to a conservative same-host ban for unusually deep navigation; scheme-relative references remain unsupported.

Evidence

• Before: make test-hostile-unsafe-location failed twice: expected GET relative-Location-item target after POST cache miss, got 'HIT', preserving the original backend request ID.
  After: real HTTP regressions pass for both headers, dot/parent segments (including trailing parents and empty segments), queries/fragments, deep-navigation fallback, unrelated-object preservation, and path-absolute/absolute controls.
• COMPOSE_PARALLEL_LIMIT=1 make -j1 test test-e2e-hard passed on the final revision, including the invalidation mutant canary.
• Original issue replay.sh passed its relative-reference scenario three times: warm GET HIT, then MISS after relative Location, Content-Location, and the path-absolute control.

Merge Danger

Door: two-way

VCL and fixture changes only; revertable without data migration.

Blast Radius: cache

Unusually deep unresolved dot navigation invalidates all objects on the same host rather than risking stale data. Ordinary paths preserve unrelated objects; cross-host behavior is unchanged.