diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d1e1083..2eacd80 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -125,15 +125,19 @@ jobs:
         run: |
           ver="$(node -p "require('./package.json').version")"
           name="$(node -p "require('./package.json').name")"
-          # registry 有缓存延迟，给它 30 秒
-          for i in $(seq 1 10); do
-            if npm view "$name@$ver" version >/dev/null 2>&1; then
-              echo "$name@$ver 已在 registry 上"
+          # registry 有 CDN 延迟，npm 自己会说 "may take a few minutes to become
+          # available"。第一次发 0.9.0 时只等 30 秒就判失败，其实包是发成功的
+          # ——等太短会把 CDN 抖动当成发版失败，等太久又把真失败拖成十分钟。
+          # 现在给 4 分钟（24 × 10s），超过这个数就是真没上去。
+          for i in $(seq 1 24); do
+            if npm view "$name@$ver" version --prefer-online >/dev/null 2>&1; then
+              echo "$name@$ver 已在 registry 上（第 $i 次查询命中）"
               exit 0
             fi
-            sleep 3
+            echo "第 $i/24 次没查到，10 秒后重试"
+            sleep 10
           done
-          echo "::error::npm publish 报告成功，但 registry 上查不到 $name@$ver"
+          echo "::error::npm publish 报告成功，但 4 分钟后 registry 上仍查不到 $name@$ver"
           exit 1
 
   release:
diff --git a/tests/test-release-body.mjs b/tests/test-release-body.mjs
index a93e797..57a8ab0 100644
--- a/tests/test-release-body.mjs
+++ b/tests/test-release-body.mjs
@@ -151,5 +151,14 @@ ok('release.yml 先测试后发版', /needs:\s*\[test\]/.test(yml));
 ok('Release 等 publish 完成才建', /needs:\s*\[test, publish\]/.test(yml));
 ok('重复打同一个 tag 不会重复建 Release', /gh release view/.test(yml) && /已存在/.test(yml));
 
+// 回查窗口：npm 官方会说 "may take a few minutes to become available"，
+// 等 30 秒就把 CDN 抖动误判成发版失败（0.9.0 真踩过）。
+ok('发完回查给了分钟级窗口，且查询绕过 CDN 缓存',
+  /seq 1 24/.test(yml) && /--prefer-online/.test(yml) && /sleep 10/.test(yml));
+ok('回查超时才算失败，不是首次没查到就失败',
+  /for i in \$\(seq 1 24\); do/.test(yml) && /exit 1/.test(yml));
+ok('回查只在上传过的那次跑（跳过 publish 时不该卡在回查）',
+  /- name: 发完回查一次\s*\n\s*if: steps\.check\.outputs\.published == 'true'/.test(yml));
+
 console.log('\n' + (fail === 0 ? 'all release body tests passed ✓' : fail + ' 项失败'));
 if (fail) process.exitCode = 1;