@@ -85,6 +85,35 @@ cache**，断言总数是 8 + 3×4。原有那条"预热后打开不走网络"
 反向验证：把 `warmEverything` 砍回只有 CORE → 新用例列出 13 个未缓存文件后变红；
 让配额判定恒为 false → 后台层用例变红。
 
+## CI 抓出来的竞态：cache.put 活不过 respondWith
+
+本地全绿，CI 的 `E2E shard 2` 红在 `/sdkjs/slide/sdk-all.js` 没被缓存——**队列里的最后
+一个文件**。
+
+根因不在测试：`respondWith` 在响应交到页面手里的那一刻就算完成，此时 worker 如果没有别的
+待办事项，浏览器**可以立刻终止它**——正在写的 `cache.put` 就跟着没了。文件越大窗口越宽，
+而这正好是反的：13.7 MB 的 SDK 恰恰是最值得留住的那个。本地看不见，因为没有任何东西在催
+worker 关闭。
+
+所以修的是 `public/sw.js`：所有缓存写入都包进 `event.waitUntil(...)`。一共四处——
+vendor 的 cache-first、stale-while-revalidate，以及 network-first 分支里那两处
+CORE_CACHE 写入（HTML 更小，但失败模式一模一样）。
+
+**这是生产环境的正确性修复，不只是让测试变绿。**
+
+测试那一侧也确实有问题，一并修了：页面侧的 Promise 在读完最后一个响应时就 resolve，而
+worker 的 put 在它自己那边稍后完成。要求两者同一瞬间就位是断言的错，不是功能的错——
+改成 `expect.poll` 等最终一致。
+
+`waitUntil` 本身很难用运行时用例守护（要可靠地触发"worker 被终止"）。改用源码契约钉住，
+和仓库里 `landing-pages` / `workflow-contract` 的做法一致：
+`putInRuntimeCache` 的每个调用点都必须在 `event.waitUntil(` 里，fetch handler 里的每处
+`caches.open(CORE_CACHE)` 前面都必须紧跟 `event.waitUntil(`。反向验证：任意一处退回裸调用
+都会变红。
+
+（中途我还写了第三条"禁止裸 put"的断言，但它的正则分不出 put 有没有被 waitUntil 包着——
+删掉了，前两条已经精确覆盖。宁可少一条断言，也不要一条说不清自己在测什么的。）
+
 ## 一条工作树观察
 
 提交前 `git diff` 里出现了四个我没碰过的文件（`l0.ts` 的 projectName fixture、
 
@@ -331,7 +331,13 @@ self.addEventListener('fetch', (event) => {
           if (cached) return cached;
           return fetch(event.request).then((networkResponse) => {
             if (networkResponse && networkResponse.status === 200 && networkResponse.type === 'basic') {
-              putInRuntimeCache(event.request, networkResponse.clone());
+              // waitUntil, not fire-and-forget: respondWith settles as soon as the
+              // response is handed over, and a worker with no outstanding work may
+              // be terminated right then -- taking a half-written entry with it.
+              // The bigger the file the likelier that is, which is backwards: the
+              // 13.7 MB SDK is the one entry most worth keeping. Surfaced as a CI
+              // flake where the last file of a warm-up was missing from the cache.
+              event.waitUntil(putInRuntimeCache(event.request, networkResponse.clone()));
             }
             return networkResponse;
           });
@@ -368,9 +374,9 @@ self.addEventListener('fetch', (event) => {
           // If network is ok, cache and return
           if (networkResponse && networkResponse.status === 200) {
             const responseToCache = networkResponse.clone();
-            caches.open(CORE_CACHE).then((cache) => {
-              cache.put(event.request, responseToCache);
-            });
+            // waitUntil for the same reason as the branches above: nothing else
+            // keeps the worker alive once the response has been handed over.
+            event.waitUntil(caches.open(CORE_CACHE).then((cache) => cache.put(event.request, responseToCache)));
             return networkResponse;
           }
           // If status is not 200, try cache
@@ -392,20 +398,25 @@ self.addEventListener('fetch', (event) => {
           .then((networkResponse) => {
             // Only cache valid 200 responses
             if (networkResponse && networkResponse.status === 200 && networkResponse.type === 'basic') {
-              putInRuntimeCache(event.request, networkResponse.clone());
+              // Same reasoning as the vendor branch above: the revalidation half of
+              // stale-while-revalidate runs after the cached copy was handed back,
+              // so nothing else is keeping the worker alive to finish the write.
+              event.waitUntil(putInRuntimeCache(event.request, networkResponse.clone()));
             } else if (isHashedAsset && networkResponse && networkResponse.status === 404) {
               // A hashed asset that 404s means the page HTML is from another
               // deploy. Surface a network error (never an HTML body) so the
               // browser reports a clean failure, and refresh the cached shell
               // so the next navigation picks up the current HTML.
-              caches.open(CORE_CACHE).then((cache) => {
-                fetch('./index.html', { cache: 'no-cache' }).then((fresh) => {
-                  if (fresh && fresh.status === 200) {
-                    cache.put('./index.html', fresh.clone());
-                    cache.put('./', fresh);
-                  }
-                });
-              });
+              event.waitUntil(
+                caches.open(CORE_CACHE).then((cache) =>
+                  fetch('./index.html', { cache: 'no-cache' }).then((fresh) => {
+                    if (fresh && fresh.status === 200) {
+                      return Promise.all([cache.put('./index.html', fresh.clone()), cache.put('./', fresh)]);
+                    }
+                    return undefined;
+                  }),
+                ),
+              );
               return Response.error();
             }
             return networkResponse;
 
@@ -52,21 +52,31 @@ test.describe('landing page warm-up', () => {
     // Driven directly rather than waiting on idle timing, which is unbounded.
     await page.evaluate(() => (window as any).__landingPrefetch.warmEverything());
 
-    const result = await page.evaluate(async () => {
+    // Polled, not asserted outright. The page's promise settles when the last
+    // response has been read; the worker's cache.put runs on its own side and
+    // finishes shortly after. Demanding both at the same instant made this fail
+    // in CI on the queue's final file -- true of the assertion, not the feature.
+    const missing = async () =>
+      page.evaluate(async () => {
+        const lp = (window as any).__landingPrefetch;
+        const wanted: string[] = lp.CORE.concat(...lp.ENGINES.map(lp.formatUrls));
+        const held = new Set<string>();
+        for (const name of await caches.keys()) {
+          const cache = await caches.open(name);
+          for (const request of await cache.keys()) held.add(new URL(request.url).pathname);
+        }
+        return wanted.filter((u) => !held.has(u));
+      });
+
+    await expect.poll(async () => (await missing()).length, { timeout: 120_000 }).toBe(0);
+
+    const shape = await page.evaluate(() => {
       const lp = (window as any).__landingPrefetch;
-      const wanted: string[] = lp.CORE.concat(...lp.ENGINES.map(lp.formatUrls));
-      const held = new Set<string>();
-      for (const name of await caches.keys()) {
-        const cache = await caches.open(name);
-        for (const request of await cache.keys()) held.add(new URL(request.url).pathname);
-      }
-      return { engines: lp.ENGINES, missing: wanted.filter((u) => !held.has(u)), total: wanted.length };
+      return { engines: lp.ENGINES, total: lp.CORE.length + lp.ENGINES.length * lp.formatUrls('docx').length };
     });
-
-    expect(result.engines, 'all three editors must be warmed').toEqual(['docx', 'xlsx', 'pptx']);
-    expect(result.missing, `not cached after the warm-up: ${result.missing.join(', ')}`).toEqual([]);
+    expect(shape.engines, 'all three editors must be warmed').toEqual(['docx', 'xlsx', 'pptx']);
     // Sanity: the core (8) plus four files per editor.
-    expect(result.total).toBe(8 + 3 * 4);
+    expect(shape.total).toBe(8 + 3 * 4);
   });
 
   test('the core assets end up in the service worker cache without any interaction', async ({ page }) => {
 
@@ -423,6 +423,45 @@ describe('the runtime cache outlives deploys, so it has to be kept honest', () =
   });
 });
 
+/**
+ * A cache write has to outlive the response it came from.
+ *
+ * `respondWith` settles the moment the response is handed to the page, and a
+ * worker with no outstanding work may be terminated right there -- taking a
+ * half-finished `cache.put` with it. The larger the file the wider that window,
+ * which is exactly backwards: the 13.7 MB SDK bundle is the entry most worth
+ * keeping. It surfaced as a CI failure where the last file of a warm-up was
+ * missing from the cache, and it is invisible locally because nothing pressures
+ * the worker to shut down.
+ */
+describe('cache writes are held open past the response', () => {
+  const src = readFileSync(resolve(__dirname, '../../public/sw.js'), 'utf8');
+
+  it('every runtime cache write is wrapped in event.waitUntil', () => {
+    // One call site per caching branch: the vendor cache-first path and the
+    // stale-while-revalidate path. (The helper's own arrow definition does not
+    // match, which is what makes this a count of call sites.)
+    const calls = [...src.matchAll(/putInRuntimeCache\(/g)];
+    expect(calls.length, 'expected a call site in each caching branch').toBe(2);
+
+    const guarded = [...src.matchAll(/event\.waitUntil\(putInRuntimeCache\(/g)];
+    expect(guarded.length, 'a putInRuntimeCache call is not inside event.waitUntil').toBe(calls.length);
+  });
+
+  it('holds the core-cache writes open too', () => {
+    // The HTML branch had the same shape. Smaller files, same failure mode.
+    const fetchHandler = src.slice(src.indexOf("addEventListener('fetch'"));
+    const coreWrites = [...fetchHandler.matchAll(/caches\.open\(CORE_CACHE\)/g)];
+    expect(coreWrites.length, 'expected the network-first and 404-recovery writes').toBe(2);
+    for (const match of coreWrites) {
+      const before = fetchHandler.slice(Math.max(0, match.index - 200), match.index);
+      expect(before, 'a CORE_CACHE write in the fetch handler is not inside event.waitUntil').toMatch(
+        /event\.waitUntil\(\s*$/,
+      );
+    }
+  });
+});
+
 describe('bin/build.sh stamps both versions into sw.js', () => {
   const script = readFileSync(resolve(__dirname, '../../bin/build.sh'), 'utf8');