@@ -363,17 +363,21 @@ The expiry invariant holds BY CONSTRUCTION, no filtering logic:
   capture (its loaders never run), so nothing under a hole can tag the shell; it
   stays live and re-renders per request regardless of tag invalidation.
 
-Timing: the capture snapshots the tag union (`attemptCapture`) right after it
-kicks off the shell render. React renders a SYNCHRONOUS server component before
-`renderToReadableStream` returns, so a `cacheTag()` in a synchronous component —
-the #648 case, verified by the cloudflare-basic eviction e2e — is on
-`_requestTags` in time. A tag recorded only AFTER an `await` inside an async
-component lands after that snapshot and is not collected into the shell (a known
-edge, shared with async `cache()`/`"use cache"` reads at capture; the document
-cache does not share it — it buffers the full response body before
-`collectRequestTags`). Deferring the shell's tag snapshot to a render-complete
-barrier is a viable follow-up if async render-recorded shell tags become load-
-bearing.
+Timing: the tag snapshot sits at the putShell WRITE BARRIER (`captureAndStoreShell`,
+right before it builds the `ShellCacheEntry`), not at stream construction. By the
+barrier the capture has already quiesced — handles settled, Flight task-quiet — and
+the deferred cache writes were awaited, so any tag the render recorded onto
+`_requestTags` is on the set: a `cacheTag()` in a synchronous server component (the
+#648 case) AND a tag recorded only AFTER an `await` inside an async server component
+(#676), plus tags propagated by async `cache()`/`"use cache"` reads at capture
+(their `recordRequestTags` can post-date the render). This mirrors the document
+cache, which buffers the full response body before `collectRequestTags`. The earlier
+`attemptCapture` snapshot — taken right after `renderToReadableStream` returned,
+before React had rendered anything past the first await — dropped those late tags
+silently; moving it behind the quiesce gate closed that window (issue #676). Holes
+are unaffected by the move: a masked loader never executes during capture, so
+nothing under a hole records a tag regardless of when the snapshot runs — the
+baked ⇒ evicts / hole ⇒ fresh invariant above still holds by construction.
 
 ### The handles contract: "nesting = liveness"
 
 
@@ -17,7 +17,7 @@ import {
   type RequestContext,
 } from "../../server/request-context.js";
 import { MemorySegmentCacheStore } from "../../cache/memory-segment-store.js";
-import { cacheTag } from "../../cache/cache-tag.js";
+import { cacheTag, recordRequestTags } from "../../cache/cache-tag.js";
 import type { HandlerContext } from "../handler-context.js";
 import type { SSRModule } from "../types.js";
 
@@ -241,6 +241,10 @@ describe("captureAndStoreShell", () => {
     return {
       _cacheStore: putShell ? { putShell } : undefined,
       _reportBackgroundError: vi.fn(),
+      // The real derived context always seeds a fresh _requestTags (shell-capture
+      // attemptCapture); the putShell write barrier snapshots it (issue #676), so
+      // the direct-call stub must model the same required RequestContext field.
+      _requestTags: new Set<string>(),
     };
   }
 
@@ -1258,6 +1262,93 @@ describe("runShellCapture", () => {
     expect(await store.getShell("/p:shell")).toBeNull();
   });
 
+  // #676: a cacheTag() recorded AFTER an await inside an async shell server
+  // component. React renders the synchronous tree during RSC-stream construction,
+  // so a sync cacheTag lands; a tag recorded on a later microtask/macrotask (past
+  // the await) lands after construction. The shell tag snapshot now sits at the
+  // putShell WRITE BARRIER — after the capture quiesces — so the late tag is
+  // collected, unioned with the static ppr.tags, and revalidateTag() evicts the
+  // shell. captureShellHTML gates on the same promise the component awaits, so the
+  // tag records within the capture's quiesce window (the real async component the
+  // shell waits for).
+  it("collects a cacheTag() recorded after an await in async shell content (#676)", async () => {
+    const putShell = makePutShell();
+    let recorded: Promise<void> = Promise.resolve();
+    const { ctx, ssrModule } = makeCtx(
+      okMatch,
+      vi.fn(async () => {
+        await recorded;
+        return { prelude: enc("<body>x</body>"), postponed: null };
+      }),
+    );
+    (ctx as any).renderToReadableStream = vi.fn(() => {
+      recorded = (async () => {
+        await new Promise((r) => setTimeout(r, 0));
+        cacheTag("async-shell-tag");
+      })();
+      return emptyStream();
+    });
+
+    await runShellCapture(
+      ctx,
+      new Request("http://localhost/p"),
+      {},
+      new URL("http://localhost/p"),
+      makeReqCtx(),
+      ssrModule,
+      { key: "/p:shell", store: { putShell } as any, tags: ["ppr:static"] },
+      0,
+    );
+
+    expect(putShell).toHaveBeenCalledTimes(1);
+    const tags = new Set(putShell.mock.calls[0]![4]);
+    expect(tags).toEqual(new Set(["ppr:static", "async-shell-tag"]));
+  });
+
+  // #676 (async "use cache" propagation): a "use cache" read that HITs during the
+  // capture render propagates its entry tags to the document artifact via the
+  // cache runtime's recordRequestTags(entry.tags) — and an async cached function
+  // records them AFTER its await resolves. Simulate that timing: the render kicks
+  // off a delayed continuation that recordRequestTags() after an await, gated the
+  // same way the cache read-HIT test gates on the read. The late tag must reach
+  // the stored entry, same as the render-callable cacheTag form above.
+  it("collects an async use-cache read's tags recorded after an await (#676)", async () => {
+    const putShell = makePutShell();
+    let recorded: Promise<void> = Promise.resolve();
+    const { ctx, ssrModule } = makeCtx(
+      okMatch,
+      vi.fn(async () => {
+        await recorded;
+        return { prelude: enc("<body>x</body>"), postponed: null };
+      }),
+    );
+    (ctx as any).renderToReadableStream = vi.fn(() => {
+      const reqCtx = getRequestContext();
+      recorded = (async () => {
+        await new Promise((r) => setTimeout(r, 0));
+        // What cache-runtime.ts does on a "use cache" read-HIT: propagate the
+        // resolved entry's tags to the request's document artifact.
+        recordRequestTags(["async-use-cache-tag"], reqCtx);
+      })();
+      return emptyStream();
+    });
+
+    await runShellCapture(
+      ctx,
+      new Request("http://localhost/p"),
+      {},
+      new URL("http://localhost/p"),
+      makeReqCtx(),
+      ssrModule,
+      { key: "/p:shell", store: { putShell } as any },
+      0,
+    );
+
+    expect(putShell).toHaveBeenCalledTimes(1);
+    const tags = new Set(putShell.mock.calls[0]![4]);
+    expect(tags.has("async-use-cache-tag")).toBe(true);
+  });
+
   // Capture data snapshot: a cache read-HIT the capture render performs through
   // the ambient (recording) store is recorded onto entry.snapshot, so a HIT can
   // replay it and match the frozen prelude. See cache/shell-snapshot.ts.
 
@@ -487,9 +487,12 @@ export function gateFlightForCapture(
  * store, and passed to scheduleShellCapture directly — it is NOT threaded through
  * the request context. `tags` carries the route's OPERATIONAL `ppr.tags`; the
  * capture UNIONS them with the shell's own auto-collected (non-loader) request
- * tags from its derived render (the collected set stays authoritative). `store`
- * is the same store the serve path resolved for its getShell read
- * (requestCtx._cacheStore), so the capture writes where the serve reads.
+ * tags from its derived render (the collected set stays authoritative). That
+ * union happens at the putShell WRITE BARRIER in captureAndStoreShell — after the
+ * capture quiesces — not at stream construction, so a tag recorded after an await
+ * in async shell content is still collected (issue #676). `store` is the same
+ * store the serve path resolved for its getShell read (requestCtx._cacheStore),
+ * so the capture writes where the serve reads.
  */
 export interface ShellCaptureDescriptor {
   key: string;
@@ -776,24 +779,18 @@ async function attemptCapture(
       },
     });
 
-    // Shell tags = the non-loader request tags the capture render recorded on its
-    // own fresh _requestTags (loaders are masked, so loader cache tags — which
-    // belong to the holes, not the shell — are correctly excluded), UNIONED with
-    // the middleware's operational `tags` option (descriptor.tags). The collected
-    // set is authoritative; the option only adds tags the render cannot know.
-    const collected = [...derivedCtx._requestTags];
-    const union = new Set<string>([...(descriptor.tags ?? []), ...collected]);
-    const tags = union.size > 0 ? [...union] : undefined;
-
+    // Pass the descriptor with its STATIC ppr.tags unchanged. The shell's own
+    // render-recorded tags are snapshotted at the putShell WRITE BARRIER inside
+    // captureAndStoreShell, not here: a tag recorded AFTER an await in async shell
+    // content (and tags propagated by async cache()/"use cache" reads) lands after
+    // this synchronous construction point, so snapshotting here dropped it — the
+    // shell-tag snapshot must sit behind the quiesce gate (issue #676).
     return captureAndStoreShell(
       ssrModule,
       rscStream,
       freshHandleStore,
       derivedCtx,
-      {
-        ...descriptor,
-        tags,
-      },
+      descriptor,
     );
   });
 }
@@ -1035,6 +1032,19 @@ async function captureAndStoreShell(
       }
     }
 
+    // Shell tags snapshot at the WRITE BARRIER, not at stream construction: by
+    // here the capture has quiesced and the deferred cache writes were awaited, so
+    // tags recorded AFTER an await in async shell content (and by async
+    // cache()/"use cache" reads propagating through recordRequestTags) are
+    // included — issue #676. Loaders are masked, so loader cache tags — which
+    // belong to the holes, not the shell — never execute during capture and cannot
+    // contribute. Union with the route's static ppr.tags (capture.tags); the
+    // collected set is authoritative, the option only adds what the render cannot
+    // know.
+    const collected = [...reqCtx._requestTags];
+    const union = new Set<string>([...(capture.tags ?? []), ...collected]);
+    const shellTags = union.size > 0 ? [...union] : undefined;
+
     const store = capture.store ?? reqCtx._cacheStore;
     if (store?.putShell) {
       try {
@@ -1058,7 +1068,7 @@ async function captureAndStoreShell(
           entry,
           capture.ttl,
           capture.swr,
-          capture.tags,
+          shellTags,
         );
       } catch (error) {
         // Best-effort: a failed put must never throw out of the background task.
 
@@ -88,6 +88,50 @@ function describeTagEviction(mode: "dev" | "build") {
       await warmToHit(request, url);
     });
 
+    test("a shell tagged AFTER an await in an async server component is evicted by updateTag(), then recaptures (#676)", async ({
+      request,
+    }) => {
+      // The async twin of the sync case above: BlogLayout renders AsyncShellTagger,
+      // an async bake-lane server component that records its cacheTag() only after
+      // an await. Before the write-barrier snapshot moved behind the quiesce gate,
+      // that post-await tag was dropped from the shell entry and this invalidation
+      // could not evict — the exact #676 loss. Distinct probe/param => distinct
+      // shell key and tag, so it never touches the sync case or a sibling shell.
+      const probe = uniqueProbe("async-evict");
+      const tag = `pprblog-async-shell-${probe}`;
+      const url = f.url(`/ppr-blog?asyncshelltag=${probe}`);
+
+      // 1. Prime: virgin shell key MISSes; the background capture records the
+      // async-recorded cacheTag(tag) into the shell entry (only reachable because
+      // the snapshot now runs at the putShell write barrier, post-quiesce).
+      const first = await request.get(url, { headers: HTML_HEADERS });
+      expect(first.status()).toBe(200);
+      expect(first.headers()["x-rango-shell"]).toBe("MISS");
+
+      // 2. Warm until the capture lands as a HIT.
+      await warmToHit(request, url);
+
+      // 3. Invalidate the async-recorded tag.
+      const inv = await request.get(f.url(`/test/invalidate-tag/${tag}`));
+      expect(inv.status()).toBe(200);
+
+      // 4. The shell carries the async tag => it is evicted; the next document GET
+      // MISSes (recapture). Poll to absorb KV marker propagation on the dev worker.
+      await expect
+        .poll(
+          async () =>
+            (await request.get(url, { headers: HTML_HEADERS })).headers()[
+              "x-rango-shell"
+            ],
+          { timeout: 15000 },
+        )
+        .toBe("MISS");
+
+      // 5. It recaptures and HITs again (re-tagged), so the async tag keeps
+      // tracking the shell across generations.
+      await warmToHit(request, url);
+    });
+
     test("an untagged sibling probe shell survives a different tag's invalidation (isolation)", async ({
       request,
     }) => {
 
@@ -9,6 +9,22 @@ import {
   type BlogSidebarData,
 } from "../loaders/blog.js";
 
+// #676 render-callable cacheTag AFTER an await: an ASYNC bake-lane server
+// component. Regular server components are NOT masked at capture (only loaders
+// are), so this runs during the shell capture; its tag records past the await —
+// after the synchronous RSC construction where the shell tag snapshot used to
+// sit. The snapshot now sits at the putShell write barrier (after the capture
+// quiesces), so this late tag is still collected and updateTag() drops the shell.
+// Gated (via BlogLayout's `asyncshelltag` probe) so only the async-eviction e2e
+// triggers it — never /blog, never a sibling shell.
+async function AsyncShellTagger({ probe }: { probe: string }) {
+  await Promise.resolve();
+  // Colon-free tag: it round-trips through the /test/invalidate-tag/:tag URL
+  // param without a ":" URL-encoding into a mismatch.
+  cacheTag(`pprblog-async-shell-${probe}`);
+  return null;
+}
+
 export function BlogLayout(ctx: HandlerContext) {
   // #648 render-callable cacheTag: this baked server component tags the PPR shell
   // it renders into — NO cache()/"use cache" anywhere in its tree — so
@@ -24,12 +40,18 @@ export function BlogLayout(ctx: HandlerContext) {
     cacheTag(`pprblog-shell-${shellProbe}`);
   }
 
+  // #676 async variant: the tag is recorded AFTER an await inside AsyncShellTagger,
+  // not synchronously here. Gated on its own probe so its shell key and tag are
+  // distinct from the sync `shelltag` case and any sibling shell.
+  const asyncShellProbe = ctx.searchParams.get("asyncshelltag");
+
   const breadcrumb = ctx.use(Breadcrumbs);
   breadcrumb({ label: "Home", href: ctx.reverse("home") });
   breadcrumb({ label: "Blog", href: ctx.reverse("blog") });
 
   return (
     <div data-testid="blog-layout" style={{ display: "flex", gap: "2rem" }}>
+      {asyncShellProbe ? <AsyncShellTagger probe={asyncShellProbe} /> : null}
       <main style={{ flex: 1 }}>
         <Outlet />
       </main>