diff --git a/.changeset/onboarding-compatible-hosts.md b/.changeset/onboarding-compatible-hosts.md
new file mode 100644
index 0000000..22a2ba9
--- /dev/null
+++ b/.changeset/onboarding-compatible-hosts.md
@@ -0,0 +1,7 @@
+---
+'@inkcre/ext-twitter': minor
+'@inkcre/ext-mail': minor
+'@inkcre/client-web': patch
+---
+
+将 Twitter、Mail 浏览器发行分别对齐到支持 Core Host 0.2 的既有 Python 发行 0.4.0、0.3.0。Web 安装和显式换版本交由所选 Host 校验，使 Python-only Extension 可以从 Web 安装。首次连接成功后再启动浏览器任务扫描，重置时先停止任务。
diff --git a/apps/client-web/src/components/extension/extensionCard/extensionCard.md b/apps/client-web/src/components/extension/extensionCard/extensionCard.md
index ec13f24..b33984f 100644
--- a/apps/client-web/src/components/extension/extensionCard/extensionCard.md
+++ b/apps/client-web/src/components/extension/extensionCard/extensionCard.md
@@ -7,6 +7,8 @@ A component that displays extension information and provides controls for toggli
 - `extension` (InstalledExtension, required): the canonical installed row
 - `enabled` (boolean, required): whether the selected Client's Peer UUID is in `enabled[]`
 - `controlsCurrentWebRuntime` (boolean, required): whether the switch owns this browser's runtime
+- `canChangeVersion` (boolean, required): whether the selected Host can validate a version change
+- `changeVersion` (function, required): application-level version change through the selected Host
 - `setEnabled` (function, required): application-level selected-Client control operation
 
 ## Emits
@@ -21,6 +23,6 @@ A component that displays extension information and provides controls for toggli
 - Mount an Extension-owned setup contribution from this browser's running Web Distribution
 - Keep setup availability independent of which Client is selected for enablement control
 - Edit extension configuration via JSON editor in a dialog
-- Change the exact shared version only while every Peer is disabled
+- Change the exact shared version through the selected Host only while every Peer is disabled
 - Auto-formats configuration as JSON for easier editing
 - Prevents uninstall while any Peer remains enabled
diff --git a/apps/client-web/src/components/extension/extensionCard/extensionCard.ts b/apps/client-web/src/components/extension/extensionCard/extensionCard.ts
index 5713e30..87b2672 100644
--- a/apps/client-web/src/components/extension/extensionCard/extensionCard.ts
+++ b/apps/client-web/src/components/extension/extensionCard/extensionCard.ts
@@ -6,6 +6,11 @@ export const extensionCardProps = {
   extension: { type: Object as PropType<InstalledExtension>, required: true },
   enabled: { type: Boolean, required: true },
   controlsCurrentWebRuntime: { type: Boolean, required: true },
+  canChangeVersion: { type: Boolean, required: true },
+  changeVersion: {
+    type: Function as PropType<(version: string) => Promise<InstalledExtension>>,
+    required: true,
+  },
   setEnabled: {
     type: Function as PropType<(enabled: boolean) => Promise<InstalledExtension>>,
     required: true,
diff --git a/apps/client-web/src/components/extension/extensionCard/extensionCard.vue b/apps/client-web/src/components/extension/extensionCard/extensionCard.vue
index 91beb13..e1ef438 100644
--- a/apps/client-web/src/components/extension/extensionCard/extensionCard.vue
+++ b/apps/client-web/src/components/extension/extensionCard/extensionCard.vue
@@ -94,10 +94,7 @@ const onConfirmVersion = () => {
   versionPopupOpen.value = (async () => {
     try {
       operationError.value = null
-      const updatedExtension = await getExtensionHost().changeVersion(
-        props.extension.name,
-        versionModel.value
-      )
+      const updatedExtension = await props.changeVersion(versionModel.value.trim())
       emit('updated', updatedExtension)
       return false
     } catch (error) {
@@ -154,7 +151,7 @@ const onUninstall = async () => {
           {{ extension.nickname }}
         </span>
       </div>
-      <InkSwitch v-model="toggleModel" size="xs" />
+      <InkSwitch v-model="toggleModel" size="xs" :aria-label="extension.name" />
     </div>
 
     <div class="extension-card__actions">
@@ -170,7 +167,7 @@ const onUninstall = async () => {
         @click="onChangeVersionClick"
         :text="t('extension.changeVersion')"
         size="sm"
-        :disabled="extension.enabled.length > 0"
+        :disabled="extension.enabled.length > 0 || !canChangeVersion"
       />
       <InkButton
         @click="onUninstall"
diff --git a/apps/client-web/src/components/extension/installExtension/installExtension.md b/apps/client-web/src/components/extension/installExtension/installExtension.md
index 673ee3e..f560278 100644
--- a/apps/client-web/src/components/extension/installExtension/installExtension.md
+++ b/apps/client-web/src/components/extension/installExtension/installExtension.md
@@ -10,5 +10,7 @@ A component that provides a form interface for installing new extensions.
 
 - Inline form for one canonical `namespace/name` and exact version
 - Install button with loading state
-- Host preflight requires a published native Web Distribution before state insertion
+- The parent supplies installation on the selected Host. The browser requires a Web distribution;
+  a live Core validates its Python distribution. Installation does not enable either Host.
+- Offline installation is disabled; failures retain the input and never select another Host.
 - Automatic form reset after successful installation
diff --git a/apps/client-web/src/components/extension/installExtension/installExtension.ts b/apps/client-web/src/components/extension/installExtension/installExtension.ts
index acf5d1b..ecbeda4 100644
--- a/apps/client-web/src/components/extension/installExtension/installExtension.ts
+++ b/apps/client-web/src/components/extension/installExtension/installExtension.ts
@@ -1,4 +1,16 @@
+import type { PropType } from 'vue'
+import type { InstalledExtension, InstallExtensionInput } from '@inkcre/core'
+
+export const installExtensionProps = {
+  install: {
+    type: Function as PropType<(coordinate: InstallExtensionInput) => Promise<InstalledExtension>>,
+    required: true,
+  },
+  disabled: { type: Boolean, default: false },
+} as const
+
 // --- Emits ---
 export const installExtensionEmits = {
   install: () => true,
+  busy: (_value: boolean) => true,
 } as const
diff --git a/apps/client-web/src/components/extension/installExtension/installExtension.vue b/apps/client-web/src/components/extension/installExtension/installExtension.vue
index f681394..d67b5df 100644
--- a/apps/client-web/src/components/extension/installExtension/installExtension.vue
+++ b/apps/client-web/src/components/extension/installExtension/installExtension.vue
@@ -2,9 +2,9 @@
 import { ref } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { InkForm, InkInput, InkButton } from '@inkcre/ui-web'
-import { installExtensionEmits } from './installExtension'
-import { getExtensionHost } from '@/core'
+import { installExtensionEmits, installExtensionProps } from './installExtension'
 
+const props = defineProps(installExtensionProps)
 const emit = defineEmits(installExtensionEmits)
 const { t } = useI18n()
 
@@ -15,20 +15,21 @@ const error = ref<string | null>(null)
 
 // --- methods ---
 const onSubmit = async () => {
-  if (isLoading.value) return
+  if (isLoading.value || props.disabled) return
   isLoading.value = true
+  emit('busy', true)
   try {
     error.value = null
-    await getExtensionHost().install(form.value)
+    await props.install({ name: form.value.name.trim(), version: form.value.version.trim() })
     emit('install')
     // Reset form on success
     form.value = { name: '', version: '' }
   } catch (cause) {
     const message = cause instanceof Error ? cause.message : String(cause)
-    console.error('Failed to install Registry extension:', cause)
     error.value = message
   } finally {
     isLoading.value = false
+    emit('busy', false)
   }
 }
 </script>
@@ -53,7 +54,7 @@ const onSubmit = async () => {
         required
       />
 
-      <p v-if="error" class="install-extension__error">{{ error }}</p>
+      <p v-if="error" role="alert" class="install-extension__error">{{ error }}</p>
 
       <div class="footer">
         <InkButton
@@ -62,6 +63,7 @@ const onSubmit = async () => {
           size="md"
           native-type="submit"
           :is-loading="isLoading"
+          :disabled="disabled"
         />
       </div>
     </InkForm>
diff --git a/apps/client-web/src/core.ts b/apps/client-web/src/core.ts
index 7bca4d3..506ed40 100644
--- a/apps/client-web/src/core.ts
+++ b/apps/client-web/src/core.ts
@@ -133,11 +133,13 @@ export function getExtensionSetupContribution(name: string): ExtensionSetupContr
 export function adoptWebPeerRuntime(runtime: WebPeerRuntime): void {
   webPeerRuntime?.stop()
   webPeerRuntime = runtime
+  JobManager.startWorker()
 }
 
-export function stopWebPeerRuntime(): void {
+export async function stopWebPeerRuntime(): Promise<void> {
   webPeerRuntime?.stop()
   webPeerRuntime = null
+  await JobManager.stopWorker()
 }
 
 /** Start the lease after Settings has mounted and loaded recovery configuration. */
@@ -261,7 +263,6 @@ export async function initializeCore(options: { loadPeerConfig?: boolean } = {})
     }
   }
   PeerManager.setupBuiltinOutbounds()
-  JobManager.startWorker()
   setupResolvers()
   initializeModuleFederation()
   initializeExtensionHost()
@@ -270,6 +271,5 @@ export async function initializeCore(options: { loadPeerConfig?: boolean } = {})
 }
 
 export async function shutdownCore(): Promise<void> {
-  stopWebPeerRuntime()
-  await JobManager.stopWorker()
+  await stopWebPeerRuntime()
 }
diff --git a/apps/client-web/src/extension-peer-control.ts b/apps/client-web/src/extension-peer-control.ts
index 9fe5080..2f3badd 100644
--- a/apps/client-web/src/extension-peer-control.ts
+++ b/apps/client-web/src/extension-peer-control.ts
@@ -1,10 +1,12 @@
 import {
   InstalledExtensionSchema,
+  InstallExtensionInputSchema,
   ExtensionModel,
   Peer,
   PeerManager,
   PeerProtocolResponseSchema,
   type InstalledExtension,
+  type InstallExtensionInput,
 } from '@inkcre/core'
 import type { ExtensionManager } from '@inkcre/extension-runtime-client-web'
 
@@ -67,3 +69,52 @@ export async function setExtensionPeerEnabled(input: {
   }
   return InstalledExtensionSchema.parse(response.body)
 }
+
+/** Validate with the selected Host; a Python-only Release need not run in the browser. */
+export async function installExtensionForPeer(input: {
+  coordinate: InstallExtensionInput
+  peer: Peer
+  currentPeerId: string
+  manager: ExtensionManager
+  operation: 'install' | 'change-version'
+}): Promise<InstalledExtension> {
+  const coordinate = InstallExtensionInputSchema.parse(input.coordinate)
+  const mode = extensionPeerControlMode(input.peer, input.currentPeerId)
+  if (mode === 'current-runtime') {
+    return input.operation === 'install'
+      ? input.manager.install(coordinate)
+      : input.manager.changeVersion(coordinate.name, coordinate.version)
+  }
+  if (mode !== 'remote-host') {
+    throw new Error(
+      'Installation requires the selected Client to have a live Extension management endpoint.'
+    )
+  }
+  if (input.operation === 'install') {
+    const existing = await ExtensionModel.get(coordinate.name)
+    if (existing && existing.version !== coordinate.version) {
+      throw new Error(
+        `${coordinate.name} is already installed at ${existing.version}. Use Change Version after disabling every Peer.`
+      )
+    }
+  }
+  const delegated = await PeerManager.delegate(
+    EXTENSION_MANAGEMENT_CAPABILITY,
+    { body: { action: 'install', extension: coordinate.name, version: coordinate.version } },
+    input.peer.id
+  )
+  const response = PeerProtocolResponseSchema.parse(delegated)
+  if (response.status !== 200 || response.body === undefined) {
+    const detail =
+      response.body !== null &&
+      typeof response.body === 'object' &&
+      'detail' in response.body &&
+      typeof response.body.detail === 'string'
+        ? response.body.detail
+        : 'Check that its Core version supports installation through Extension management.'
+    throw new Error(
+      `Installation on the selected Client returned HTTP ${response.status}. ${detail}`
+    )
+  }
+  return InstalledExtensionSchema.parse(response.body)
+}
diff --git a/apps/client-web/src/locales/messages/en.json b/apps/client-web/src/locales/messages/en.json
index a857e42..326ddaa 100644
--- a/apps/client-web/src/locales/messages/en.json
+++ b/apps/client-web/src/locales/messages/en.json
@@ -125,6 +125,8 @@
     "setupTitle": "Set up {name}",
     "peerSelector": "Control Extension on Client",
     "peerSelectorPlaceholder": "Select a Client",
+    "installOnSelectedClient": "The selected Client validates installation and version changes. Installation is shared across the instance; enable the Extension separately on each Client that should run it.",
+    "installRequiresLiveClient": "Select an online Client with Extension management to install or change a version.",
     "peerNotFound": "The selected Client no longer exists.",
     "currentBrowser": "This browser",
     "desiredStateOnly": "This Client has no live management endpoint. Changes update its durable enabled state and take effect when that Client next reconciles it.",
diff --git a/apps/client-web/src/locales/messages/zh-CN.json b/apps/client-web/src/locales/messages/zh-CN.json
index b84d234..f816d0d 100644
--- a/apps/client-web/src/locales/messages/zh-CN.json
+++ b/apps/client-web/src/locales/messages/zh-CN.json
@@ -126,6 +126,8 @@
     "setupTitle": "设置 {name}",
     "peerSelector": "控制扩展的客户端",
     "peerSelectorPlaceholder": "选择客户端",
+    "installOnSelectedClient": "所选客户端负责安装与版本变更的兼容性校验。安装记录由整个实例共享；请在需要运行扩展的客户端上分别启用。",
+    "installRequiresLiveClient": "安装或变更版本需要选择在线且支持扩展管理的客户端。",
     "peerNotFound": "所选客户端已不存在。",
     "currentBrowser": "当前浏览器",
     "desiredStateOnly": "此客户端没有在线管理端点；操作只更新其持久启用状态，并在该客户端下次协调状态时生效。",
diff --git a/apps/client-web/src/views/extensions/extensions.scss b/apps/client-web/src/views/extensions/extensions.scss
index 8dbcd5b..b76ce27 100644
--- a/apps/client-web/src/views/extensions/extensions.scss
+++ b/apps/client-web/src/views/extensions/extensions.scss
@@ -22,6 +22,7 @@
   }
 
   &__header {
+    flex-basis: 100%;
     display: grid;
     gap: sys-var(space, sm);
   }
diff --git a/apps/client-web/src/views/extensions/extensions.vue b/apps/client-web/src/views/extensions/extensions.vue
index efcad47..cd96d00 100644
--- a/apps/client-web/src/views/extensions/extensions.vue
+++ b/apps/client-web/src/views/extensions/extensions.vue
@@ -3,9 +3,18 @@ import { computed, onMounted, ref } from 'vue'
 import extensionCard from '@/components/extension/extensionCard/extensionCard.vue'
 import installExtension from '@/components/extension/installExtension/installExtension.vue'
 import { InkDropdown, InkLoading } from '@inkcre/ui-web'
-import { configStore, Peer, type InstalledExtension } from '@inkcre/core'
+import {
+  configStore,
+  Peer,
+  type InstalledExtension,
+  type InstallExtensionInput,
+} from '@inkcre/core'
 import { getExtensionHost, startExtensionHost } from '@/core'
-import { extensionPeerControlMode, setExtensionPeerEnabled } from '@/extension-peer-control'
+import {
+  extensionPeerControlMode,
+  setExtensionPeerEnabled,
+  installExtensionForPeer,
+} from '@/extension-peer-control'
 import { useI18n } from 'vue-i18n'
 
 // --- data ---
@@ -18,6 +27,7 @@ const peersLoading = ref(false)
 const extensionsLoading = ref(false)
 const error = ref<string | null>(null)
 const peerError = ref<string | null>(null)
+const installing = ref(false)
 
 const currentPeerFallback = Peer.parse({
   id: currentPeerId,
@@ -58,6 +68,24 @@ const selectedControlMode = computed(() =>
 )
 const isEnabledForSelectedPeer = (extension: InstalledExtension) =>
   extension.enabled.includes(selectedPeerId.value)
+const canInstall = computed(
+  () => selectedControlMode.value !== null && selectedControlMode.value !== 'desired-state'
+)
+
+const installForSelectedPeer = (
+  coordinate: InstallExtensionInput,
+  operation: 'install' | 'change-version'
+) => {
+  const peer = selectedPeer.value
+  if (!peer) throw new Error(t('extension.peerNotFound'))
+  return installExtensionForPeer({
+    coordinate,
+    peer,
+    currentPeerId,
+    manager: getExtensionHost(),
+    operation,
+  })
+}
 
 const refreshPeers = async () => {
   peersLoading.value = true
@@ -122,24 +150,34 @@ const setEnabledForSelectedPeer = (
 
 <template>
   <main class="extensions-view">
-    <installExtension @install="onInstallExtension" />
+    <div class="extensions-view__header">
+      <InkDropdown
+        v-model="selectedPeerId"
+        :label="t('extension.peerSelector')"
+        :placeholder="t('extension.peerSelectorPlaceholder')"
+        :options="peerOptions"
+        :disabled="installing"
+      />
+      <p class="extensions-view__notice">{{ t('extension.installOnSelectedClient') }}</p>
+      <p v-if="!canInstall" class="extensions-view__notice">
+        {{ t('extension.installRequiresLiveClient') }}
+      </p>
+      <p v-if="selectedControlMode === 'desired-state'" class="extensions-view__notice">
+        {{ t('extension.desiredStateOnly') }}
+      </p>
+      <p v-if="peerError" class="extensions-view__error">
+        {{ t('extension.peerListUnavailable', { error: peerError }) }}
+      </p>
+    </div>
 
-    <div class="extensions-view__list">
-      <div class="extensions-view__header">
-        <InkDropdown
-          v-model="selectedPeerId"
-          :label="t('extension.peerSelector')"
-          :placeholder="t('extension.peerSelectorPlaceholder')"
-          :options="peerOptions"
-        />
-        <p v-if="selectedControlMode === 'desired-state'" class="extensions-view__notice">
-          {{ t('extension.desiredStateOnly') }}
-        </p>
-        <p v-if="peerError" class="extensions-view__error">
-          {{ t('extension.peerListUnavailable', { error: peerError }) }}
-        </p>
-      </div>
+    <installExtension
+      :install="(coordinate) => installForSelectedPeer(coordinate, 'install')"
+      :disabled="!canInstall || peersLoading"
+      @busy="installing = $event"
+      @install="onInstallExtension"
+    />
 
+    <div class="extensions-view__list">
       <div v-if="extensionsLoading || peersLoading" class="flex items-center justify-center">
         <InkLoading />
       </div>
@@ -152,6 +190,10 @@ const setEnabledForSelectedPeer = (
         :enabled="isEnabledForSelectedPeer(extension)"
         :controls-current-web-runtime="selectedControlMode === 'current-runtime'"
         :set-enabled="(enabled) => setEnabledForSelectedPeer(extension, enabled)"
+        :can-change-version="canInstall"
+        :change-version="
+          (version) => installForSelectedPeer({ name: extension.name, version }, 'change-version')
+        "
         @updated="updExtension"
         @uninstalled="refreshExtensions"
       />
diff --git a/apps/client-web/src/views/settings/settings.vue b/apps/client-web/src/views/settings/settings.vue
index a9e2929..c878b39 100644
--- a/apps/client-web/src/views/settings/settings.vue
+++ b/apps/client-web/src/views/settings/settings.vue
@@ -88,8 +88,8 @@ const onSave = async () => {
 
 // Reset config
 const onReset = async () => {
+  await stopWebPeerRuntime()
   await configStore.resetMeta()
-  stopWebPeerRuntime()
   Object.assign(metaFormConfig, configStore.metaConfig)
   Object.assign(peerFormConfig, PeerConfigSchema.parse(configStore.peerConfig))
 }
diff --git a/docs/30-unit-tdd/client-runtime-and-delegation.md b/docs/30-unit-tdd/client-runtime-and-delegation.md
index 7b66b0c..4d7bef1 100644
--- a/docs/30-unit-tdd/client-runtime-and-delegation.md
+++ b/docs/30-unit-tdd/client-runtime-and-delegation.md
@@ -64,6 +64,12 @@ issuer, audience, role, and maximum lifetime from the generated Peer runtime con
 the token when the secret changes, and clears it when the secret is removed. PostgREST JSON access,
 raw byte access, and Peer HTTP delegation reuse this single authentication authority.
 
+The browser Job worker starts only when a successfully connected Web Peer runtime is adopted.
+Opening an unconfigured Settings page does not start database polling. Saving or importing a valid
+connection uses that same adoption path; repeated saves reuse the worker's existing timer. Reset
+waits for worker shutdown before clearing configuration, so in-flight work can finish cleanup
+against the original database connection.
+
 The browser signer backdates `iat` by five seconds and derives `exp` from that adjusted value. This
 absorbs ordinary sub-second or small deployment clock skew at the authentication boundary without
 increasing the shared maximum lifetime or leaking retries into PostgREST/domain callers.
diff --git a/docs/30-unit-tdd/native-extension-runtime.md b/docs/30-unit-tdd/native-extension-runtime.md
index 95c2350..9634812 100644
--- a/docs/30-unit-tdd/native-extension-runtime.md
+++ b/docs/30-unit-tdd/native-extension-runtime.md
@@ -48,8 +48,13 @@ SQL, PostgREST routes, and generated relation types. The PostgREST adapter is on
 not the Host contract.
 
 Installed state records exact name and version plus the set of enabled Peer IDs. The browser view
-manages the current Peer. Cross-Peer extension management is an exact delegated capability, not a
-generic Core API call.
+selects the Host that validates installation or version changes. The current browser uses its
+Module Federation Host; an online Core uses `core.extension.management.v1` with the exact Release
+coordinate and validates its Python distribution. A Python-only Release therefore does not need
+a browser distribution to be installed from the Web interface. Installation does not enable either
+Host, and the shared version still affects every Peer. Offline Peers cannot validate an installation
+or version change; the view must not silently redirect it to a different Host. Cross-Peer management
+is an exact delegated capability, not a generic Core API call.
 
 Version change and uninstall are refused while any Peer remains enabled or a local runtime is
 running. Startup reads canonical installed state and starts only entries enabled for the current
diff --git a/docs/40-deployment/native-extension-delivery.md b/docs/40-deployment/native-extension-delivery.md
index 30102cb..fe0ff42 100644
--- a/docs/40-deployment/native-extension-delivery.md
+++ b/docs/40-deployment/native-extension-delivery.md
@@ -28,6 +28,12 @@ Extension packages. On a protected `main` push,
 Client checks, Pages production, and Pages preview are separate application lifecycles. They cannot
 publish native Extensions. Local development and local verification must never publish either.
 
+Python and Module Federation producers for one Extension must target the same exact Release when
+both Hosts are needed. A published Python-only Release may receive its missing Module Federation
+association through the normal publish workflow; existing associations are not overwritten. Select
+the Changesets increment that reaches that Release rather than downgrading the shared installation
+or manually editing generated package versions.
+
 ## Registry Authority and Secret Boundary
 
 Publication runs only in the protected GitHub `production` environment. The scoped bearer secret
@@ -49,13 +55,16 @@ shared/exposed JavaScript and CSS reference. The uploaded snapshot is therefore
 relocatable; publication does not invent a generic target descriptor or rewrite the producer
 manifest.
 
+Public executable responses use `Cache-Control: public, no-cache` and an ETag. Immutable Release
+bytes do not imply an immutable HTTP cache policy: browsers must revalidate Registry readability
+so a blocked Release stops being served. Verification also checks CORS, the trusted Registry origin,
+manifest structure, and the exact bytes of every referenced asset.
+
 The executable contract is
-[`scripts/verify-native-extension-distribution.mjs`](../../scripts/verify-native-extension-distribution.mjs),
-guarded by [`scripts/native-extension-distribution.test.mjs`](../../scripts/native-extension-distribution.test.mjs).
+[`scripts/verify-native-extension-distribution.mjs`](../../scripts/verify-native-extension-distribution.mjs).
 Verify locally without publishing:
 
 ```bash
-pnpm exec vitest run scripts/native-extension-distribution.test.mjs
 pnpm --filter @inkcre/core build
 pnpm --filter './extensions/*' build
 node scripts/verify-native-extension-distribution.mjs inspect-local \
diff --git a/scripts/verify-native-extension-distribution.mjs b/scripts/verify-native-extension-distribution.mjs
index 7f6bd33..2113f23 100644
--- a/scripts/verify-native-extension-distribution.mjs
+++ b/scripts/verify-native-extension-distribution.mjs
@@ -210,7 +210,7 @@ export async function verifyPublicModuleFederation({
   const manifestResponse = await fetchImplementation(manifestUrl, {
     headers: { Origin: PRODUCTION_BROWSER_ORIGIN },
   })
-  assertPublicImmutable(manifestResponse, 'public mf-manifest.json')
+  assertPublicArtifactResponse(manifestResponse, 'public mf-manifest.json')
   const publicManifest = await manifestResponse.json()
   const localManifest = await readJson(path.join(artifactDirectory, 'mf-manifest.json'))
   const expectedManifest = structuredClone(localManifest)
@@ -221,7 +221,7 @@ export async function verifyPublicModuleFederation({
     const response = await fetchImplementation(new URL(relativePath, publicPrefix), {
       headers: { Origin: PRODUCTION_BROWSER_ORIGIN },
     })
-    assertPublicImmutable(response, `public Module Federation asset ${relativePath}`)
+    assertPublicArtifactResponse(response, `public Module Federation asset ${relativePath}`)
     const [publicBytes, localBytes] = await Promise.all([
       response.arrayBuffer().then((value) => Buffer.from(value)),
       readFile(path.join(artifactDirectory, ...relativePath.split('/'))),
@@ -237,17 +237,18 @@ export async function verifyPublicModuleFederation({
   }
 }
 
-function assertPublicImmutable(response, label) {
+function assertPublicArtifactResponse(response, label) {
   assert.ok(response.ok, `${label} returned HTTP ${response.status}`)
   assert.equal(
     response.headers.get('access-control-allow-origin'),
     '*',
     `${label} must allow browser reads`
   )
-  assert.match(
-    response.headers.get('cache-control') ?? '',
-    /\bimmutable\b/,
-    `${label} must be immutable`
+  // Immutable bytes still require revalidation so Registry blocking remains effective.
+  assert.equal(
+    response.headers.get('cache-control'),
+    'public, no-cache',
+    `${label} must revalidate Registry readability`
   )
   assert.ok(response.headers.get('etag'), `${label} must include an ETag`)
 }