Negative caching without inventing absence

An origin can explicitly report that a key does not exist under a known namespace and consistency contract. That is different from a network timeout or an internal error that left existence unknown. Permission-denied responses may be intentionally indistinguishable from absence to a user, but that does not justify reusing the result for another authorization scope. Preserve typed outcomes and the same tenant, representation, and permission boundaries used for positive entries.

A negative entry should carry enough metadata to distinguish why it was stored and which source/version supports it. A lagging replica can report absence after creation, and an earlier absence read can pause before publishing a fresh-TTL entry much later. In the bound below, L_source must cover the time from creation through the last accepted stale-absence publication, including replica lag, read/response delays, and fill publication. If any of those delays is unbounded, a publication-anchored TTL alone gives no finite global visibility bound. Strict read-after-create can instead require authoritative validation or a guard rejecting outdated publication.

Caching a transient failure can reduce repeated expensive attempts during an outage, but it is an error-backoff policy rather than authoritative absence. Give it an explicit short duration and recovery behavior. If every retry refreshes that duration, the cached error can remain indefinitely while the origin has recovered. A high hit ratio during this state may mean that many users are efficiently receiving the wrong availability outcome. Separate negative hits and transient-error hits from positive useful hits.

A broad error key can amplify one failed request across unrelated resources or users. A cache-wide backend-unavailable marker may be intentional, but then its blast radius and reopening checks must be explicit. Request coalescing, bounded retries, and circuit-breaking can control origin pressure without pretending that an unknown object is absent. Test recovery as carefully as failure: create a previously missing key, restore the origin, and change authorization while negative entries are warm.

Measure the reason, source, age, and scope of negative reuse without logging sensitive keys. Compare origin QPS with user-visible absence and error rates. A typo-heavy public search may benefit from caching true misses, while identifiers that are frequently created need a different lifetime. Put explicit limits on untrusted unique negatives so an adversary or random identifier stream cannot consume the entire cache. Admission policy matters for negatives just as it does for positive objects.

The probability lab illustrates an assumption to question. Reset and set both p=0.2, n=10, predict two independent negative outcomes on average, then inspect. A real shared outage can make errors highly correlated, so this binomial distribution is not an outage forecast or a negative-cache implementation. Play highlights exact possible counts rather than sampling origin failures. Explain how typed outcomes and source scope would distinguish genuine absence from a correlated infrastructure failure before permitting either kind of reuse.