[AdaAibaby]

What

client-proxy resolves every request's route from the Redis catalog (catalogResolution → GetSandbox) with a 1s timeout and no fallback. While Redis is briefly unreachable, requests to already-running sandboxes fail even though the VM and its routing record (TTL = full lifetime) are fine.

This adds a small in-memory route cache that is consulted only when the backing catalog returns a transient error, so a short Redis blip no longer breaks routing for running sandboxes. Refs #3788.

How

CachingSandboxCatalog decorates any SandboxesCatalog:

• success → refresh the entry, return fresh;
• transient error (Redis unreachable) and the caller's context is still live → serve the last known route if within maxStale (default 60s), else return the error;
• caller context already cancelled → return the error untouched, nothing served (the request is gone anyway);
• ErrSandboxNotFound → never served from cache (a stale route would mis-route to a dead worker); evicts the entry;
• DeleteSandbox → evicts; cache is size-capped (50k) with oldest-first eviction.

Routing records only change on resume/worker-move, so a ≤60s stale route during a flap is a good trade against failing live traffic, and correctness is bounded: no stale not-found, bounded staleness, and a Redis error is already distinct from redis.Nil.

Fallback use is counted (clientproxy.catalog.cache.fallback.total, result=hit when a fresh entry is served, result=stale when nothing fresh remains and the error stands) so the cache's effect — and a flap that outlives the window — is visible on dashboards rather than silent. Wired in client-proxy/main.go; a nil meter is a no-op.

Scope

This is a read-side safety net, deliberately minimal: no new steady-state load (the cache only does work on an error path), no behavior change on the happy path, and nothing resurrected after delete/not-found. It does not touch the write side.

Test

catalog_cache_test.go: serves cached route on transient error; never serves not-found from cache (and evicts); propagates error once stale beyond the window; evicts on delete; returns the error without serving cache when the caller context is cancelled. go test -race ./packages/shared/pkg/sandbox-catalog/ passes (the cache tests; the Redis-backed tests need a live instance); client-proxy builds.

[cla-bot]

Thank you for your pull request and welcome to our community. We could not parse the GitHub identity of the following contributors: AdaAibaby.
This is most likely caused by a git client misconfiguration; please make sure to:

1. check if your git client is configured with an email to sign commits git config --list | grep email
2. If not, set it up using git config --global user.email email@example.com
3. Make sure that the git commit email is configured in your GitHub account settings, see https://github.com/settings/emails