# Caching (/product/infrastructure/caching)



## The rule

A server read of public or protected data wraps its query in a cache scope, tags it with the tenant and the resource, and gives it the longest life. A mutation then expires the tag. The platform database, the tenant's messages, its settings, its theme, its references and its catalog all read this way.

The cache scope cannot see request context, so anything request-derived is read outside and passed in as an argument, which then becomes part of the key. That is why cached reads use the credentialed read-only role and never the per-request token: the slug is the key, and it stays internal to the cached function. A private read is never cached; if one ever needed to be, the user's id would be the key, never the token.

## The tags

| Tag                                  | Covers                                                 | Expired by                                     |
| ------------------------------------ | ------------------------------------------------------ | ---------------------------------------------- |
| tenant, per slug                     | The tenant's routing row and its enabled module codes. | Provisioning, deprovisioning, a module change. |
| messages, per slug and language      | The tenant's copy overrides.                           | The copy admin, text edit mode, the assistant. |
| settings, per slug                   | The application-wide settings bundle.                  | Any application-wide settings write.           |
| module settings, per slug and module | One module's grids and form surface.                   | That module's settings write only.             |
| theme, per slug                      | The tenant's theme selection.                          | The branding screen, the assistant.            |
| references, per slug                 | Lookup types, lookups and statuses.                    | The references admin.                          |

A tenant miss is never cached. The cached read throws so the entry is rejected, because the longest life would otherwise pin a transient null until restart. The status probe that classifies the miss stays uncached, which is also what lets a reactivated tenant serve immediately.

## The static shell

A page's static shell is what prerenders and serves instantly. Anything above the first suspense boundary that reads a header or a cookie costs every route its shell, silently. The tenant gate and the translation layer therefore read only the URL segments the proxy wrote, which are prerender-safe and readable inside a cache scope. The session read sits inside the boundary in its own private cache scope.

## The smaller caches

Beside the server cache sit three narrower ones: a per-process map of database clients keyed by endpoint, a module-scope browser token shared by every query on a page, and the per-tenant Data API client held in the React tree. None survive their container, session or tree.