CDN performance gains collapse when the cache key is wider than the content identity. Prefer a short, stable key for hashed static objects, emit Cache-Control from the origin (or a response-headers policy) so edges can store them long-term, and avoid forwarding the full query string or Cookie on the default behaviour — each unique variant becomes its own object and a regional shield cannot collapse what the key already split. Pair long immutable TTLs for versioned assets with a short TTL or purge tag for the HTML shell that references them.

Ops prove-out after a cache-policy or origin change: hit a hashed object twice and expect MISS then HIT with a rising Age, then fetch the HTML shell and confirm it stays on a short TTL or purge path. After replacing an object under the same key, run an invalidation for that path (or rely on versioned filenames) and re-check X-Cache until the old body is gone everywhere that mattered — most “CDN update not visible” tickets are an un-invalidated edge object or a query variant still in the key, not a broken origin ACL.