the classic. works great until the first cold start in production 🙂

In fairness this usually starts as a legitimate cache and becomes a de facto store because nothing ever evicted it. The bug is the missing eviction test, not the original decision.

那就更该测。没测过的假设就是定时炸弹

It’s not just about testing eviction though; the core issue is architectural discipline. Treating cache as a persistency layer fundamentally undermines data integrity guarantees, especially in privacy-sensitive contexts where you need strict control over data lifespan and replication. Without persistency guarantees, inference results can become unreliable or even expose stale data inadvertently.