[6.x] Invalidate cached error responses instead of warming them

[duncanmcclean]

This pull request fixes an issue where sites using the "half measure" static caching strategy would dispatch cache warming jobs for every URL ever cached — including 404s and other error responses. On busy public sites, every bot/scanner junk URL ever hit (.env/.php probes, dead URLs, etc.) got cached and tracked alongside real pages, so when STATAMIC_BACKGROUND_RECACHE is enabled and a wildcard invalidation rule matches, a StaticWarmJob was dispatched for every one of them — flooding failed_jobs and delaying real content updates from appearing live.

This was happening because the refresh path warms every URL tracked in the static cache's .urls set, regardless of what's actually cached for it. Warming an error response just fails with the same error again.

This PR fixes it by having refreshUrl() check the status of the cached response: error responses are invalidated instead of being warmed, so the stale entry is evicted and the next visitor caches a fresh copy. As a bonus, junk URLs converge out of the tracked set over time as wildcard refreshes touch them.

Error responses remain tracked in the .urls set, so they stay reachable by invalidateUrl() and flush() — publishing an entry at a previously-404'd URL invalidates the cached 404 as before. One caveat: when an expiry is configured and a tracked entry has expired, its status can't be known, so it's warmed once (and fails), re-cached by the next visitor, then invalidated on the next refresh — it converges after one cycle rather than failing forever.

This PR also guards the ResponsePrepared listener in ApplicationCacher::cachePage() so it only handles the response for the request being cached. Previously, in long-running processes, stale listeners would re-store earlier cache entries using later requests' statuses and headers.

Fixes #10863
Fixes #15054

[jasonvarga]

Critical: untracked error responses become unreachable by invalidation/flush, causing indefinitely stale errors

ApplicationCacher::invalidateUrl() and flush() locate cached response entries only by walking the tracked .urls set — they never compute the hash key directly. Meanwhile hasCachedPage()/getFromCache() look up cached responses independently of .urls, by hashing the request URL directly (that's how a cached 404 keeps being served on repeat hits). Skipping .urls tracking for non-2xx responses breaks that pairing.

Concrete regression (half-measure caching, default config — no expiry set, so entries are cached via Cache::forever()):

1. GET /foo returns 404 (e.g. a not-yet-published/scheduled entry). Cached under responses:hash(/foo), but no longer added to .urls.
2. An entry is later published at /foo → DefaultInvalidator::invalidate() → ApplicationCacher::invalidateUrl('/foo').
3. invalidateUrl filters getUrls($domain) for /foo — finds nothing, since /foo was never tracked. The stale responses:hash(/foo) cache entry is never forgotten.
4. GET /foo again → hasCachedPage() still finds the old cached 404 and serves it. The real, newly-published content never appears — indefinitely, since there's no default TTL.
5. Even php artisan statamic:static:clear doesn't reliably fix this: flush() also only iterates getUrls($domain)->keys(). Unless a dedicated cache store is configured for static caching, the orphaned responses:* entries for untracked error pages are never forgotten by the clear command either.

Before this PR, every cached URL (including 404s) was tracked in .urls, so invalidateUrl/flush could always find and clear it. This needs to be fixed before merge — none of the new tests cover invalidation of a previously-untracked entry, which is why CI is green despite this.

Suggested fix direction: don't solve this by omitting the URL from .urls entirely. Either (a) keep tracking the URL→key mapping for all responses as before, but filter untracked/non-2xx entries out of the wildcard warm/refresh path specifically (refreshWildcardUrl/refreshUrls) rather than out of the tracked set itself — this matches suggestion #3 in the linked issue #15054 ("have refreshWildcardUrl() skip URLs that no longer resolve"); or (b) make invalidateUrl()/flush() able to forget a response by directly hashing the URL, independent of .urls membership.

---

🤖 Generated with Claude Code