diff --git a/.github/workflows/upload.yaml b/.github/workflows/upload.yaml
index ed0afcd..475540b 100644
--- a/.github/workflows/upload.yaml
+++ b/.github/workflows/upload.yaml
@@ -9,6 +9,11 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: msg-buffer-deploy-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: false
+  queue: max
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -85,6 +90,38 @@ jobs:
         test -z "$(grep -E 'axios-' extension/dist/index.html)"
         test -z "$(grep -R 'feathericons.com' extension/dist/assets || true)"
 
+    - name: Select CDN asset path
+      id: asset-path
+      env:
+        CDN_ORIGIN: https://cos-sh.tiye.me
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+      run: |
+        set -euo pipefail
+        if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
+          asset_prefix="${GITHUB_REPOSITORY}/pr/${PR_NUMBER}/${GITHUB_RUN_ID}/${GITHUB_RUN_ATTEMPT}/"
+        else
+          asset_prefix="${GITHUB_REPOSITORY}/"
+        fi
+        echo "prefix=${asset_prefix}" >> "$GITHUB_OUTPUT"
+        echo "base-url=${CDN_ORIGIN}/${asset_prefix}" >> "$GITHUB_OUTPUT"
+
+    - name: Build web assets with CDN URLs
+      env:
+        CDN_BASE_URL: ${{ steps.asset-path.outputs.base-url }}
+      run: yarn vite build --base "$CDN_BASE_URL"
+
+    - name: Upload and verify web assets on COS
+      if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+      uses: worktools/cos-upload-action@06d6027dcca6413c5936e04a9b6e9f0d5ef71ba0 # v1.2.0
+      with:
+        source-dir: dist
+        bucket: ${{ secrets.COS_BUCKET }}
+        region: ap-shanghai
+        prefix: ${{ steps.asset-path.outputs.prefix }}
+        public-base-url: ${{ steps.asset-path.outputs.base-url }}
+        secret-id: ${{ secrets.COS_SECRET_ID }}
+        secret-key: ${{ secrets.COS_SECRET_KEY }}
+
     - name: Select deployment path
       if: github.event_name == 'push' && github.ref == 'refs/heads/main'
       id: deploy-path
diff --git a/README.md b/README.md
index d0acf98..694bf33 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,21 @@ Configurations:
 
 https://github.com/calcit-lang/respo-calcit-workflow
 
+### 网页与扩展部署
+
+扩展继续通过原 `yarn build` 构建，`extension/dist` 保持本地相对路径并先执行原扩展验收。
+随后单独重建网页 `dist`，使用 `https://cos-sh.tiye.me/Termina/msg-buffer/` CDN base；
+不会将扩展资源改为远程地址，也不会把扩展包上传到 COS。
+
+PR 网页预览按 `Termina/msg-buffer/pr/<PR 编号>/<run ID>/<attempt>/` 隔离，
+同一 PR 或生产分支串行排队，不取消正在上传的任务。COS Action 固定到正式 v1.2.0，
+通过 `public-base-url` 启用内置校验，不增加额外校验脚本。
+同仓库 PR 与生产上传需要 `COS_BUCKET`、`COS_SECRET_ID`、`COS_SECRET_KEY`；fork PR 不上传。
+服务器继续仅在 main push 部署 `dist/*` 到原路径，本次只更新前端资源配置。
+
+本次是独立 COS/CDN 配置变更，仍使用原 Calcit 0.25.1。正式 0.28 候选已修复本项目的
+DOM、存储与同步回调类型问题，但完整门禁仍被已发布依赖阻断，不能据此声称升级完成。
+
 ### License
 
 MIT