Both process-wide negative caches were filled with errors from a fetch driven
by the caller's context, so an unauthenticated client that aborted a request
which hit a cache miss wrote its own context.Canceled into a 5-minute shared
failure cache -- also blocking the owner's admin panel. The outbound fetch at
both sites is now driven by a server-owned context (WithoutCancel plus a 30s
timeout), so caller cancellation can no longer reach the cache while genuine
upstream failures are still cached.
Verified by a panel of agents; the added tests fail against an unpatched base
with a poisoned cache, and the pre-existing error-caching tests still pass.
The missing singleflight on CheckForUpdate is pre-existing and unchanged.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>