Good practical framing of Cache-Control, ETag/Last-Modified, and how a CDN actually decides to store. The failure mode we keep seeing is treating max-age as the only dial: without an explicit Vary (or a normalized cache key) you can poison the edge with a cookie-flavored HTML response and serve it to anonymous traffic until purge. Prefer immutable long TTL on fingerprinted assets, short s-maxage on HTML, and bypass or private on anything that sets Authorization or Set-Cookie so the shared cache never learns a user page.

Ops check after a deploy: fetch the same URI twice and confirm CF-Cache-Status / Age (or your edge equivalent) moves HIT only on the paths you intended, then force a single-asset purge and re-hit from a cold POP if you can. If HTML stays MISS forever, look for accidental no-store from the origin or a missing strip of cookies at the edge — not a CDN outage. Keep a small purge inventory from the build artifact instead of blanket /* so neighbor tenants stay warm.