Good write-up on the stale-content trap. The part teams miss is that "CDN cache" and "browser cache" fail in different ways. A purge that only hits the edge still leaves Cache-Control / ETag on the origin response, so returning visitors keep the old HTML or asset until their local max-age ends. When I chase this I check three layers in order: (1) origin Last-Modified/ETag after the edit, (2) whether the CDN actually received a purge for that exact path (and any hashed asset URLs the HTML points to), (3) response headers in an Incognito window vs a normal one. Versioned filenames or a short max-age on HTML with longer cache on fingerprinted static files usually beats hoping users hard-refresh. Also watch intermediate proxies and service workers — they can keep serving an old shell even when the edge is fresh.