feat(security): short TTL read-through cache in front of the ConfigDb key store

archreview/plans/R3-05-acl-hot-path-expiry-plan.md

@@ -618,3 +618,17 @@ for the orchestrator.
   `Anonymous_grant_resolution_is_bounded_too` (moved forward from the plan's T3 list — the deadline half
   reaches `FindGrantsAsync` in the same change, so it is asserted in the same change).
 - 5 tests, green.
+
+### T3 — TTL read-through cache + the falsification control
+
+- **RED observed:** `error CS0117: 'BoundedApiKeyStore' does not contain a definition for
+  'MaxCacheEntries'` — the cache and its ceiling absent.
+- **DEVIATION (fail-closed refinement, 2 lines):** the plan keys `FindAsync`'s cache on `apiKeyId` alone.
+  Taken literally that lets the cache **resurrect a key that expired by the clock** for up to a TTL, which
+  is exactly the axis 03/S19 exists to close. A cached hit is therefore re-checked against the caller's
+  `utcNow` before it is served (`IsExpired`) — so the TTL bounds how stale an `Enabled` **revocation** may
+  be, and nothing else. `utcNow` is still not part of the key (it changes every call and would defeat the
+  cache entirely).
+- The counter's `cache_hit` / `timeout` `Add` calls are deliberately NOT here — they are T4, and writing
+  them early would have made T4's red vacuous.
+- 11 tests in the class, green.

archreview/plans/R3-05-acl-hot-path-expiry-plan.md.tasks.json

@@ -19,7 +19,7 @@
     {
       "id": "T3",
       "subject": "BoundedApiKeyStore: short TTL read-through cache + falsification control (a revoked key is denied once the TTL has passed)",
-      "status": "pending",
+      "status": "done",
       "blockedBy": [
         "T2"
       ]