Getting Cache-Control right is half the CDN story: what the shared cache may store, how long it stays fresh, and which request dimensions fork the key. The other half shows up on publish — TTL alone rarely clears every POP that still holds the old object, so you need a purge path that matches how the object was filled. Self-hosted fleets hit the same inventory problem once more than one node keeps a copy. We have been building CDNCA (AGPL-3.0) so CDN nodes and a plugin marketplace live on one control plane; marketplace features roll out release by release. In the setups you see most often, does a careful header matrix or an explicit invalidation on deploy prevent more stale-viewer incidents?