Summary

• When upstream APIs return errors (HTTP 403/429/timeout), fetchers return null. Previously null was not cached, causing repeated request storms every refresh cycle against broken APIs
• Adds a sentinel value (__WM_NEG__) cached with a short 2-minute TTL on null results — subsequent requests within that window skip upstream entirely
• Thrown errors (transient like ETIMEDOUT) bypass sentinel caching and retry immediately
• Filters sentinels from getCachedJsonBatch pipeline reads to prevent leakage
• Fixes pre-existing theater posture coalescing test (expected 2 OpenSky fetches for 2 theater query regions, not 1)

Trigger: WTO API returning HTTP 403 for all 6 concurrent /data requests, every 10-minute cycle, indefinitely. But the fix protects all 52 handlers using cachedFetchJson.

Design decisions

• Sentinel string vs separate :neg key: Zero extra Redis calls on cache hit (no second GET), natural key expiration
• T extends object constraint: Compile-time safety against sentinel collision — all 52 callers use arrays/objects
• Default 2-min negative TTL: Long enough to prevent storms, short enough for recovery. Per-caller override via optional 4th parameter

Test plan

• npx tsc --noEmit — frontend types pass
• npx tsc --noEmit -p tsconfig.api.json — no new API type errors
• Pre-push hook: typecheck + full Vite build pass
• 15/15 redis caching tests pass (3 new negative-cache tests + fixed theater posture test)
• New test: sentinel suppresses subsequent upstream calls
• New test: cachedFetchJsonWithMeta returns { data: null, source: 'cache' } on sentinel hit
• New test: thrown fetcher errors skip sentinel caching