@ultimat3/cache 29.4.0 → 30.0.0

package/CLAUDE.md

@@ -89,6 +89,12 @@ Tier 1. Tagged caching + THE invalidation graph.
   `requestTimeoutMs` default, written as a literal because http is tier 2. `loadDeadlineMs`
   overrides it and `schedule` injects the timer. Eviction frees the KEY only; the load runs on. Not
   an `app.config.ts` key on purpose.
+- **A read refuses to join a load a bust has overtaken** (`tier-leading.ts`): a reader's unseen tags are
+  covered, then an invalid fence evicts the key and the read leads. A joiner from before the bust keeps
+  its load. An entry lives exactly while the flight holds the key (`released`). A joiner asks the fence
+  only when the generation moved or it brought a new tag: ~1,600 arrivals must not each walk the marks.
+- **A joiner survives its leader's abort** (`singleFlight`'s `signal`, `tryUseContext()?.signal`): it
+  re-leads under its own context. A failure with the leader's signal live is still shared.
 - **A joiner shares the leader's WRITE, so it contributes to it** (`FlightJoin`, `mergeSetOptions`
   in `set-options.ts`): tags union, TTLs take the shortest. `work` reads the merge after the load
   AND once more after the fill (`tagsAddedSince`), re-filling every tier.
@@ -122,6 +128,13 @@ Tier 1. Tagged caching + THE invalidation graph.
   Every claim about what a script DOES belongs in `redis.live.test.ts`.
 - **The Redis namespace carries the build id by default** (`namespaceFor`, `appVersion()`);
   `buildId: null` opts out. Changing the layout is a cold cache.
+- **Redis down is a slow miss, never a hang** (`redis-deadline.ts`). Every value-path command gets
+  `commandTimeoutMs` (150 ms); one miss parks the value path `REDIS_PARK_MS` (5 s) — commands refuse
+  unsent, one clock read, no state machine. A bust NEVER parks and gets 1,000 ms: a skipped bust is
+  stale rows until TTL. A miss or a park is `X_CACHE_DRIVER_UNAVAILABLE`, which `bestEffort` records;
+  so is a STOPPED store (Bun's `ERR_REDIS_CONNECTION_CLOSED`, typed in `withinDeadline`, a bust's
+  included). A server's own error reply passes through (`redis-outage.test.ts`).
+  The client is core's `redisClient()` (no offline queue, endless reconnect); never `Bun.redis`.
 - **Cross-instance invalidation is a SEAM, never a transport.** `registerInvalidationBroadcast` /
   `receiveInvalidationBroadcast`; `cli` owns the bus. The inbound half cannot re-emit (only it passes
   `emit: false`). An undeclared inbound tag goes to `report.errors`, never a throw.
@@ -161,6 +174,7 @@ Tier 1. Tagged caching + THE invalidation graph.
 | `graph.ts` | tag → dependents (cache keys, ISR routes, CDN paths, live queries) |
 | `tiers.ts` | `CacheTier`, `TierLabel`, `assertTtl`, read-through stack |
 | `fence.ts` | the invalidation fence a fill (here or in `query`) checks before it publishes |
+| `tier-leading.ts` | which fence each in-flight load holds, and whether a reader may join it |
 | `tier-fence.ts` | `TierFence`/`FenceVerdict`, and how a fill samples and asks a shared tier's fence |
 | `redis-fence.ts` | the leased generation keys a bust writes and a fill watches |
 | `set-options.ts` | how two callers' `CacheSetOptions` combine, and the `null`-load TTL |
@@ -168,7 +182,8 @@ Tier 1. Tagged caching + THE invalidation graph.
 | `memo.ts` | request memo over the ALS ctx (WeakMap, no lifecycle) |
 | `lru.ts` | byte-budgeted LRU (linked list + map + tag index) |
 | `value-codec.ts` | the one value encoding every tier stores and decodes |
-| `redis.ts` | `Bun.redis` tier, build-namespaced keys, hash-tagged buckets, one script call per tag |
+| `redis.ts` | the shared tier over core's `redisClient()` (`@ultimat3/core/redis`, never `Bun.redis`), build-namespaced keys, hash-tagged buckets, one script call per tag |
+| `redis-deadline.ts` | `withinDeadline`: a per-command deadline (150 ms, `commandTimeoutMs`), a 5 s park of the value path after one is missed, and the bust view that skips the park on its own 1,000 ms |
 | `cdn.ts` | `Cache-Control`/`Surrogate-Key` emission, `surrogateKeys`, the purge key list, the `PurgeDriver` seam |
 | `purge-http.ts` | the HTTP half both remote drivers share: one POST, batching, key guard, and core's retryable table re-exported |
 | `purge-fastly.ts` | `fastlyPurgeDriver`: surrogate-key batch purge, `purge_all` |

package/README.md

@@ -2,6 +2,8 @@
 
 Four tiers. **One invalidation graph, not three.**
 
+`bun add @ultimat3/cache` · guide: [Caching And Invalidation](https://github.com/developerz-ai/ultimate/wiki/Caching-And-Invalidation)
+
 ```ts
 cache: { invalidates: [tag.post, tag.feed] }
 ```
@@ -27,7 +29,7 @@ Reads walk down until a hit, then populate every tier they walked past. Writes p
 |---|---|---|---|---|
 | 0 | `request-memo` | ALS context (`WeakMap`) | dies with the request | never |
 | 1 | `lru` | in-process, byte-budgeted | tag index | never |
-| 2 | `redis` | `Bun.redis` | tag→keys set, one `EVAL` **per tag** + slot-local `DEL`s | single node |
+| 2 | `redis` | `redisClient()` (`@ultimat3/core/redis`) | tag→keys set, one `EVAL` **per tag** + slot-local `DEL`s | single node |
 | 3 | `cdn` | headers + purge driver | surrogate keys | no CDN |
 
 A tier is a `CacheTier` (`get`/`set`/`del`/`invalidateTags`, plus an optional `fence` for a tier
@@ -266,6 +268,32 @@ what `x cache bust --json` will print once it ships; that command is planned and
 A dead tier lands in `errors` and never throws — a Redis outage must not fail the write
 that triggered the bust. Entries there expire by TTL instead.
 
+### Redis down is a slow miss, not a hang
+
+A refused tier was always a miss; a tier that never ANSWERS was unbounded — measured on Redis 7,
+a paused server hung `stack.read` 45 s and a bust 20 s, on an action's commit path. `As of 2026-11`:
+
+| Redis is | A read | A bust |
+|---|---|---|
+| up | answers, single milliseconds | answers |
+| paused (accepts, never answers) | one command misses its `commandTimeoutMs` (default 150 ms) → a miss, the source answers; the value path then **parks** for 5 s and every read there is an immediate miss, nothing sent | its own 1,000 ms deadline, **never parked**: a bust skipped for a stall leaves stale rows until TTL. Past it → `report.errors` |
+| stopped | refused at once (no offline queue) → a miss | refused at once → `report.errors`; retry with the same tags |
+| back | the client reconnects on its own, every pod, no restart | answers |
+
+A missed deadline or a parked command is `X_CACHE_DRIVER_UNAVAILABLE` in `recentTierFailures()`,
+the cause naming the deadline or the park left; a stopped server's refusal is recorded with Bun's
+own `ERR_REDIS_CONNECTION_CLOSED` message and no `code`. The client is core's `redisClient()` (`@ultimat3/core/redis`,
+`REDIS_URL`), never `Bun.redis`: its default offline queue made the first read against a stopped
+server wait 31 s, and it stopped reconnecting after that. A `client` handed in keeps its own
+reconnect behaviour and still gets the deadline. Raise the budget only when that latency is the
+store's normal:
+
+```ts
+import { redisTier } from '@ultimat3/cache';
+
+redisTier({ commandTimeoutMs: 400 }); // anything but whole ms above 0 is X_CACHE_LIMIT_INVALID
+```
+
 The fan-out walks the ladder **farthest tier first** — Redis before the LRU before the request memo
 — and reports in read order. Clearing near-to-far leaves the far tier holding the old value after
 the near ones are clear, and a read racing the bust promotes it straight back up into them: every
@@ -441,7 +469,7 @@ reached the floor unchecked would have passed it, at any floor — `0` included.
 
 | Code | Cause |
 |---|---|
-| `X_CACHE_DRIVER_UNAVAILABLE` | `Bun.redis` missing, a purge driver built without its token, or a batch size that is not a positive integer |
+| `X_CACHE_DRIVER_UNAVAILABLE` | a Redis command missed its deadline, or the tier is parked after one; a purge driver built without its token; or a batch size that is not a positive integer |
 | `X_CACHE_JITTER_INVALID` | a tier's `jitterFraction` outside `[0, 1)` |
 | `X_CACHE_PURGE_FAILED` | the CDN refused a purge, or a key it would split on whitespace |
 | `X_CACHE_TAG_UNKNOWN` | a tag no entity declared — usually a typo |

package/package.json

@@ -1,7 +1,17 @@
 {
   "name": "@ultimat3/cache",
-  "version": "29.4.0",
+  "version": "30.0.0",
   "description": "Tagged caching: request memo, LRU, Redis, CDN — one invalidation graph",
+  "keywords": [
+    "ultimate",
+    "bun",
+    "framework",
+    "cache",
+    "invalidation",
+    "redis",
+    "cdn"
+  ],
+  "homepage": "https://github.com/developerz-ai/ultimate/wiki/Caching-And-Invalidation",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -32,6 +42,6 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "29.4.0"
+    "@ultimat3/core": "30.0.0"
   }
 }

package/src/fence.ts

@@ -70,6 +70,14 @@ export function markInvalidated(scope: FenceScope): void {
   }
 }
 
+/**
+ * Moves with every invalidation of any kind. Unchanged means a fence that answered valid at this
+ * reading still does, so a caller asking many times need only walk the marks once per reading.
+ */
+export function fenceGeneration(): number {
+  return generation;
+}
+
 /**
  * Everything, invalidated: every fence sampled before this call answers `false`. For a process
  * that cannot name what it missed (`flushProcessTiers`) — the same "older than the ring remembers:

package/src/purge-http.ts

@@ -4,6 +4,7 @@
 // judgement, and two copies of it would drift into two answers for the same 429.
 
 import { renderFixShellArg, renderThrowable } from '@ultimat3/core';
+import { outboundResponse } from '@ultimat3/core/outbound';
 import { CacheDriverUnavailableError, CachePurgeFailedError } from './errors';
 
 /** Just the call. `typeof fetch` also carries `preconnect`, which no test double should have to. */
@@ -21,10 +22,11 @@ const MAX_DETAIL_LENGTH = 200;
 // Both purge drivers import it from core; it is not re-exported here (`X_HELPER_COPY`).
 
 /**
- * A bare reference to `globalThis.fetch` risks "Illegal invocation" on some hosts; closing over
- * the call keeps it detached from any receiver, in production and in tests alike.
+ * The platform's `fetch`, closed over so it is detached from any receiver ("Illegal invocation").
+ * `outbound()` always hands it the attempt's signal.
  */
-export const defaultPurgeFetch: PurgeFetch = (input, init) => globalThis.fetch(input, init);
+export const defaultPurgeFetch: PurgeFetch = (input, init) =>
+  globalThis.fetch(input, { ...init, signal: init.signal ?? null });
 
 /**
  * Providers cap keys per request. A bust of 300 tags is still one purge — several requests.
@@ -169,30 +171,41 @@ export interface PurgePostInput {
 }
 
 /**
- * One POST, with the transport failure already translated. A request that never got a status —
- * DNS, TLS, a reset, the deadline — is retryable by definition: nothing at the edge has seen it.
+ * One POST through core's `outbound()`, with the transport failure already translated. A purge is
+ * idempotent by nature — purging a key twice clears it once — so a 5xx or a throttle is retried
+ * inside the deadline (`timeoutMs`, the WHOLE call), and the final answer comes back as a
+ * `Response` for the drivers' own status table. A request that never got a status — DNS, TLS, a
+ * reset, the deadline — is retryable by definition: nothing at the edge has seen it.
  */
 export async function purgePost(input: PurgePostInput): Promise<Response> {
   try {
-    return await input.fetch(input.url, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', Accept: 'application/json', ...input.headers },
-      body: JSON.stringify(input.body),
-      signal: AbortSignal.timeout(input.timeoutMs),
-    });
+    return await outboundResponse(
+      {
+        url: input.url,
+        vendor: input.driver,
+        dial: 'named',
+        method: 'POST',
+        idempotent: true,
+        deadlineMs: input.timeoutMs,
+        headers: {
+          'Content-Type': 'application/json',
+          Accept: 'application/json',
+          ...input.headers,
+        },
+        body: JSON.stringify(input.body),
+      },
+      { fetch: input.fetch },
+    );
   } catch (error) {
-    // `renderThrowable`, never `error.message` behind an `instanceof`: `fetch` is INJECTED here,
-    // so the rejection is whatever a driver or a test double threw — and `instanceof` itself
-    // throws on a `Proxy` whose `getPrototypeOf` does, which would replace the coded refusal this
-    // catch exists to raise with a bare `TypeError` from inside it. Same rule as `invalidate.ts`.
+    // `renderThrowable`: an injected fetch rejects with anything, and `outbound()`'s own codes
+    // render a cause that names no query string.
     const reason = renderThrowable(error);
     throw new CachePurgeFailedError({
       driver: input.driver,
       detail: `${reason} — nothing left this host for ${input.url} (egress, DNS or TLS)`,
       retryable: true,
       // The endpoint comes from `.env.production` (`purge-env.ts`), so it is operator data in a
-      // COMMAND position: `$(…)` and a backtick substitute before `curl` is reached. The URL is
-      // already in the `detail` above, which is read rather than pasted.
+      // COMMAND position: `$(…)` and a backtick substitute before `curl` is reached.
       fix: `curl -sS -m 5 -o /dev/null ${renderFixShellArg(input.url, '<the purge endpoint the cause names>')}`,
     });
   }

package/src/redis-deadline.ts

@@ -0,0 +1,126 @@
+// A deadline on every command the shared tier sends, and a park after one is missed. A paused
+// Redis accepts a command and never answers it: unbounded, `stack.read` hung 45 s and a bust 20 s
+// on an action's commit path. Bounded, a stalled store is a slow miss, then a free one. A STOPPED
+// store is typed here too: Bun's client rejects every command with a bare connection error.
+
+import { type Clock, renderThrowable, stringField } from '@ultimat3/core';
+import type { DeadlineTimer } from '@ultimat3/core/outbound';
+import { platformDeadlineTimer } from '@ultimat3/core/outbound';
+import { CacheDriverUnavailableError } from './errors';
+import type { RedisLike } from './redis';
+
+/** A value-path command's budget. A healthy shared tier answers in single milliseconds. */
+export const DEFAULT_REDIS_COMMAND_TIMEOUT_MS = 150;
+
+/**
+ * A bust's budget, and it is longer on purpose: a bust skipped for a stall leaves stale rows
+ * serving until TTL, where a skipped read only costs a load.
+ */
+export const DEFAULT_REDIS_BUST_TIMEOUT_MS = 1_000;
+
+/**
+ * How long one missed deadline parks the value path. A read is five commands; at 150 ms each a
+ * paused server cost 757 ms per read. Parked, the next reads refuse without sending anything.
+ */
+export const REDIS_PARK_MS = 5_000;
+
+export interface DeadlineOptions {
+  /** Already screened by the caller (`redisTier`'s `assertFiniteDurationMs`). */
+  readonly commandTimeoutMs: number;
+  /** `monotonic()` is the park's one clock read. */
+  readonly clock: Clock;
+  readonly timer?: DeadlineTimer;
+}
+
+/** One client, two views: `value` honours the park, `bust` never does. */
+export interface DeadlinedRedis {
+  readonly value: RedisLike;
+  readonly bust: RedisLike;
+}
+
+const FIX =
+  'redis-cli -u "$REDIS_URL" --latency — while the store stalls every read is a miss and Postgres answers; raise redisTier({ commandTimeoutMs }) only if that latency is its normal';
+
+/** Bun's code for a command refused for want of a connection: nothing reached the server. */
+const CONNECTION_CLOSED = 'ERR_REDIS_CONNECTION_CLOSED';
+
+/** A refused connection as the cache contract says it; a server's own error reply passes. */
+const typed = (command: string, error: unknown): unknown =>
+  stringField(error, 'code') === CONNECTION_CLOSED
+    ? new CacheDriverUnavailableError({
+        driver: 'redis',
+        cause: `${command} was not sent, the connection is down (${CONNECTION_CLOSED}: ${renderThrowable(error)})`,
+        fix: 'redis-cli -u "$REDIS_URL" PING — while it is down every read is a miss and Postgres answers; the client reconnects on its own once it answers PONG',
+      })
+    : error;
+
+export function withinDeadline(client: RedisLike, options: DeadlineOptions): DeadlinedRedis {
+  const { clock, commandTimeoutMs } = options;
+  const timer = options.timer ?? platformDeadlineTimer;
+  // One number, no state machine: a missed deadline moves it forward, time moves past it.
+  let parkedUntil = Number.NEGATIVE_INFINITY;
+
+  const bounded = <T>(command: string, ms: number, run: () => Promise<T>): Promise<T> =>
+    new Promise<T>((resolve, reject) => {
+      const handle = timer.set(() => {
+        // Any missed deadline is evidence the store is stalled, a bust's included.
+        parkedUntil = clock.monotonic() + REDIS_PARK_MS;
+        reject(
+          new CacheDriverUnavailableError({
+            driver: 'redis',
+            cause: `${command} did not answer within ${String(ms)} ms; reads skip the shared tier for ${String(REDIS_PARK_MS)} ms`,
+            fix: FIX,
+          }),
+        );
+      }, ms);
+      const settle = (): void => timer.clear(handle);
+      // Sent now, not a microtask later, so a pipelined pair stays one round trip. A synchronous
+      // throw is a refusal like any other. A late answer lands after the refusal and changes
+      // nothing: a promise settles once.
+      let sent: Promise<T>;
+      try {
+        sent = run();
+      } catch (error) {
+        sent = Promise.reject(error);
+      }
+      sent.then(
+        (answer) => {
+          settle();
+          resolve(answer);
+        },
+        (error: unknown) => {
+          settle();
+          reject(typed(command, error));
+        },
+      );
+    });
+
+  const parked = <T>(command: string, run: () => Promise<T>): Promise<T> => {
+    const left = parkedUntil - clock.monotonic();
+    if (left > 0) {
+      return Promise.reject(
+        new CacheDriverUnavailableError({
+          driver: 'redis',
+          cause: `parked for another ${String(Math.ceil(left))} ms after a command missed its ${String(commandTimeoutMs)} ms deadline; ${command} was not sent`,
+          fix: FIX,
+        }),
+      );
+    }
+    return bounded(command, commandTimeoutMs, run);
+  };
+
+  return {
+    value: {
+      get: (key) => parked('GET', () => client.get(key)),
+      set: (key, text) => parked('SET', () => client.set(key, text)),
+      send: (command, args) => parked(command, () => client.send(command, args)),
+    },
+    bust: {
+      get: (key) => bounded('GET', DEFAULT_REDIS_BUST_TIMEOUT_MS, () => client.get(key)),
+      set: (key, text) =>
+        bounded('SET', DEFAULT_REDIS_BUST_TIMEOUT_MS, () => client.set(key, text)),
+      send: (command, args) =>
+        bounded(command, DEFAULT_REDIS_BUST_TIMEOUT_MS, () => client.send(command, args)),
+    },
+  };
+}

package/src/redis.ts

@@ -1,12 +1,16 @@
-// Tier 2: shared cache over `Bun.redis` (no client dependency — the runtime ships one).
+// Tier 2: shared cache over core's `redisClient()` (no client dependency — the runtime ships one).
 // A tag -> keys SET is maintained alongside every write so `invalidateTags` is ONE round
 // trip via a server-side script, not a KEYS scan. KEYS is O(n) and blocks the server; a
 // framework that ships it as the invalidation path is shipping an outage.
 
 import type { Clock } from '@ultimat3/core';
 import { appVersion, logger, systemClock } from '@ultimat3/core';
+import type { DeadlineTimer } from '@ultimat3/core/outbound';
+import { redisClient } from '@ultimat3/core/redis';
 import { CacheDriverUnavailableError } from './errors';
 import type { FenceScope } from './fence';
+import type { DeadlinedRedis } from './redis-deadline';
+import { DEFAULT_REDIS_COMMAND_TIMEOUT_MS, withinDeadline } from './redis-deadline';
 import { bumpGenerations, sampleGenerations } from './redis-fence';
 import type { CacheTag } from './tags';
 import { parseTag, serializeTag } from './tags';
@@ -38,8 +42,20 @@ export interface RedisTierOptions {
    */
   readonly buildId?: string | null;
   readonly defaultTtlMs?: number;
-  /** Injected in tests; production reads `Bun.redis`. */
+  /**
+   * Injected in tests and for a second server; production takes `redisClient()` from
+   * `@ultimat3/core/redis` (`REDIS_URL`, else `VALKEY_URL`; the CLI boot hands in a lazy one). A client handed in keeps its own reconnect behaviour and
+   * still gets the deadline.
+   */
   readonly client?: RedisLike;
+  /**
+   * How long one value-path command may take, in ms. Default `DEFAULT_REDIS_COMMAND_TIMEOUT_MS`
+   * (150). A miss is `X_CACHE_DRIVER_UNAVAILABLE` in `recentTierFailures()`, read as a cache miss,
+   * and parks the value path for `REDIS_PARK_MS`. A bust has its own, longer, unparked deadline.
+   */
+  readonly commandTimeoutMs?: number;
+  /** Injected so a test fires the deadline instead of waiting for it. */
+  readonly timer?: DeadlineTimer;
   /** Turns `PTTL`'s remaining life into the absolute `expiresAt` a hit reports. */
   readonly clock?: Clock;
   /** TTL spread, in `[0, 1)`. Default `DEFAULT_TTL_JITTER_FRACTION`; `0` disables it. */
@@ -132,19 +148,6 @@ const DELETE_BATCH = 128;
 /** Seconds a tag set outlives its newest member. See `TAG_MEMBER_SCRIPT`. */
 const TAG_TTL_GRACE_SECONDS = 60;
 
-function resolveClient(injected: RedisLike | undefined): RedisLike {
-  if (injected !== undefined) return injected;
-  const candidate = (Bun as unknown as { redis?: RedisLike }).redis;
-  if (candidate === undefined || typeof candidate.send !== 'function') {
-    throw new CacheDriverUnavailableError({
-      driver: 'redis',
-      cause: 'Bun.redis is not available (needs bun >= 1.3 and REDIS_URL)',
-      fix: 'set REDIS_URL in .env, or drop the redis tier from cache.tiers in app.config.ts',
-    });
-  }
-  return candidate;
-}
-
 const toStrings = (value: unknown): string[] =>
   Array.isArray(value) ? value.map((item) => String(item)) : [];
 
@@ -204,12 +207,27 @@ export function redisTier(options: RedisTierOptions = {}): CacheTier {
     ...(options.jitterFraction === undefined ? {} : { jitterFraction: options.jitterFraction }),
     ...(options.rng === undefined ? {} : { rng: options.rng }),
   };
-  let client: RedisLike | undefined;
-
-  const conn = (): RedisLike => {
-    client ??= resolveClient(options.client);
-    return client;
+  const commandTimeoutMs = assertFiniteDurationMs(
+    'redis',
+    'commandTimeoutMs',
+    options.commandTimeoutMs ?? DEFAULT_REDIS_COMMAND_TIMEOUT_MS,
+  );
+  // Built at the first command, never at construction: a tier selected in config dials nothing
+  // until it is used.
+  let bounded: DeadlinedRedis | undefined;
+  const views = (): DeadlinedRedis => {
+    bounded ??= withinDeadline(options.client ?? redisClient(), {
+      commandTimeoutMs,
+      clock,
+      ...(options.timer === undefined ? {} : { timer: options.timer }),
+    });
+    return bounded;
   };
+  // A read, a fill and a fence sample: parked after a missed deadline, so a stalled store costs
+  // one deadline per `REDIS_PARK_MS`, not five per read.
+  const conn = (): RedisLike => views().value;
+  // A bust skips the park: skipped for a stall, it leaves stale rows serving until TTL.
+  const bustConn = (): RedisLike => views().bust;
 
   const valueKey = (key: string): string => `${ns}:c:${key}`;
   // `{entity}` is a Redis Cluster hash tag, not decoration: it is what makes a row's bucket and
@@ -369,10 +387,10 @@ export function redisTier(options: RedisTierOptions = {}): CacheTier {
       // Before the buckets are read, and awaited: see `bumpGenerations` for why the order is the
       // guarantee. A refusal here rejects the bust into `report.errors` with nothing deleted, so
       // the retry it asks for repeats the whole thing.
-      await bumpGenerations(conn(), ns, tags);
+      await bumpGenerations(bustConn(), ns, tags);
       const replies = await Promise.all(
         perTag.map(({ read }) =>
-          conn().send('EVAL', [INVALIDATE_SCRIPT, String(read.length), ...read]),
+          bustConn().send('EVAL', [INVALIDATE_SCRIPT, String(read.length), ...read]),
         ),
       );
       // A member may sit in two tag sets; deleting it twice is harmless but reporting it twice
@@ -385,7 +403,7 @@ export function redisTier(options: RedisTierOptions = {}): CacheTier {
         // `allSettled`, because which ones died decides what leaves the buckets below.
         const batch = members.slice(start, start + DELETE_BATCH);
         const settled = await Promise.allSettled(
-          batch.map((member) => conn().send('DEL', [member])),
+          batch.map((member) => bustConn().send('DEL', [member])),
         );
         settled.forEach((result, index) => {
           const member = batch[index];
@@ -402,7 +420,7 @@ export function redisTier(options: RedisTierOptions = {}): CacheTier {
         const gone = [...new Set(toStrings(replies[i]))].filter((member) => deleted.has(member));
         for (const bucket of perTag[i]?.sweep ?? []) {
           for (let start = 0; start < gone.length; start += DELETE_BATCH) {
-            await conn().send('SREM', [bucket, ...gone.slice(start, start + DELETE_BATCH)]);
+            await bustConn().send('SREM', [bucket, ...gone.slice(start, start + DELETE_BATCH)]);
           }
         }
       }

package/src/tier-leading.ts

@@ -0,0 +1,64 @@
+// Which load holds each key in a read-through flight, and whether a bust has overtaken it. A read
+// asks this before joining, and the stampede guard's arrivals are the callers: every one of ~1,600
+// joiners asking the fence walks the marks since its sample, so this asks only when something moved.
+
+import type { CacheFence } from './fence';
+import { fenceGeneration } from './fence';
+import type { CacheTag } from './tags';
+import { serializeTag } from './tags';
+
+interface Leading {
+  readonly fence: CacheFence;
+  /** Wire forms already on the fence, so a joiner's repeat of a tag adds no scope to walk. */
+  readonly covered: Set<string>;
+  /** The fence generation it last answered valid at. */
+  checkedAt: number;
+}
+
+export interface LeadingLoads {
+  /** Call as the fence is sampled, in the same tick, so `checkedAt` is the fence's own sample. */
+  lead(key: string, fence: CacheFence, tags: readonly CacheTag[] | undefined): void;
+  /** Has anything this reader needs to see landed since the load holding `key` began? */
+  overtaken(key: string, tags: readonly CacheTag[] | undefined): boolean;
+  /** The flight's `released`: an entry exists exactly while the flight holds the key. */
+  release(key: string): void;
+  /** Keys tracked right now. A number that does not fall back to `0` is a leak. */
+  readonly size: number;
+}
+
+export function leadingLoads(): LeadingLoads {
+  const loads = new Map<string, Leading>();
+  return {
+    lead(key, fence, tags): void {
+      const covered = new Set((tags ?? []).map(serializeTag));
+      loads.set(key, { fence, covered, checkedAt: fenceGeneration() });
+    },
+
+    overtaken(key, tags): boolean {
+      const held = loads.get(key);
+      if (held === undefined) return false;
+      const unseen: CacheTag[] = [];
+      for (const owned of tags ?? []) {
+        const wire = serializeTag(owned);
+        if (held.covered.has(wire)) continue;
+        held.covered.add(wire);
+        unseen.push(owned);
+      }
+      // Covering reaches back to the sample, so a tag new to this load must be asked about even
+      // when nothing has moved since the last answer.
+      if (unseen.length > 0) held.fence.cover({ tags: unseen });
+      const generation = fenceGeneration();
+      if (unseen.length === 0 && held.checkedAt === generation) return false;
+      held.checkedAt = generation;
+      return !held.fence.isValid();
+    },
+
+    release(key): void {
+      loads.delete(key);
+    },
+
+    get size(): number {
+      return loads.size;
+    },
+  };
+}

package/src/tiers.ts

@@ -4,7 +4,7 @@
 // sites. Order is data, not control flow.
 
 import type { CacheTierName, Clock, Scheduler } from '@ultimat3/core';
-import { CACHE_TIERS, singleFlight, systemClock } from '@ultimat3/core';
+import { CACHE_TIERS, singleFlight, systemClock, tryUseContext } from '@ultimat3/core';
 import { CacheJitterInvalidError, CacheLimitInvalidError, CacheTtlInvalidError } from './errors';
 import type { CacheFence, FenceScope } from './fence';
 import { markInvalidated, sampleFence } from './fence';
@@ -13,6 +13,7 @@ import type { CacheTag } from './tags';
 import { bestEffort } from './tier-failures';
 import type { TierFence, TierFences } from './tier-fence';
 import { sampleTierFences, verdictOf } from './tier-fence';
+import { leadingLoads } from './tier-leading';
 
 /**
  * The rungs, spelled in `@ultimat3/core` and nowhere else. Tier 0 owns the NAMES because
@@ -265,6 +266,9 @@ export function cacheStack(
 ): CacheStack {
   const ordered = sortTiers(tiers);
   const clock = options.clock ?? systemClock;
+  // The fence of each load holding a key, so a read can refuse to join one a bust has overtaken.
+  // The fence stops that load's FILL; only this stops a read-your-write being answered by it.
+  const leading = leadingLoads();
   // Per stack, not per module: two stacks are two ladders and must not join each other's loads.
   //
   // The deadline frees the KEY and nothing else — `load()` is the app's function and this stack
@@ -282,6 +286,12 @@ export function cacheStack(
       'the loadDeadlineMs argument to cacheStack(...)',
     ),
     schedule: options.schedule,
+    // A closed tab's aborted load must not fail every healthy reader that joined it: this is the
+    // cold-key arrival the flight exists to collapse, so the first of them loads again instead.
+    signal: () => tryUseContext()?.signal,
+    released: (key) => {
+      leading.release(key);
+    },
   });
 
   /** Take back what a fence refused mid-ladder: half a stale ladder is still a stale read. */
@@ -397,6 +407,11 @@ export function cacheStack(
       // The stampede guard. The homepage feed read 8,000x/s with a 60s lease misses for the whole
       // ~200ms `load()` takes, so ~1,600 identical queries reach Postgres at every TTL boundary
       // unless the arrivals inside that window join the read already running.
+      //
+      // Unless that read began before a write this one must see. Asked of the fence and not of the
+      // key, because a tag bust names no key. This reader's own tags are covered first, back to
+      // the sample: a bust of a tag only it declares has overtaken the load just the same.
+      if (leading.overtaken(key, setOptions?.tags)) flight.evict(key);
       return await flight.run<T, CacheSetOptions>(
         key,
         async (shared) => {
@@ -406,6 +421,7 @@ export function cacheStack(
             key,
             ...(setOptions?.tags === undefined ? {} : { tags: setOptions.tags }),
           });
+          leading.lead(key, fence, setOptions?.tags);
           // The same sample, taken in each tier other replicas also write. One round trip, and
           // only when such a tier is on the ladder.
           const fleet = await sampleTierFences(ordered, key, {