Audit caching behavior per TZ 4.1.18 (all 3 rules backend-responsibility)

Client makes no stale-serving assumptions: every Online-Board and Schedule
search triggers a fresh upstream fetch; dictionaries are loaded once per
session. Cache-Control TTLs (≤1 min board, ≤10 min schedule) and ETag/304
for dictionary endpoints are set by the backend HTTP layer. CachedApiClient
/ ServerLruCache infrastructure exists in src/shared/api/ for future SSR
caching if needed. All three 4.1.18 rules marked Out-of-scope (backend) in
the spec; coverage counters updated (13 → 16 out-of-scope, TBD −3).

docs/superpowers/specs/2026-04-21-online-board-schedule-tz-redesign-design.md

@@ -134,9 +134,9 @@ _Updated after each plan merges. Plan task: after every merge, append a row to t
 | Partial | **7** (4.1.2-R4 flight-number padding; 4.1.4-R12/R13 city-pair deferred (C3); **P4 adds 4**: 4.1.13.3-R9 multi-seg status-switching; 4.1.13.4-R6 check-in counter; 4.1.14.4-R5 segment dep airport-as-link; 4.1.14.4-R7 segment arr airport-as-link; **P5 adds 1**: 4.1.16-R27 simple date-swap implemented, full §4.1.16.3.1 re-search algorithm deferred) |
 | Missing | 0 |
 | Conflict | **11** (C1–C11 in Conflicts register; C1–C4 resolved, C5 pending P6, C6–C11 resolved; 1 rule cell still Conflict: 4.1.1-R22 = C5 pending P6; **P5 adds C9** «Уточняется» orange color `b43c341`, **C10** §4.1.22 carrier-icon vs aircraft-type clarification `5d31f43`, **C11** 4.1.17-R4 per-type badge independence `63fc606` — all resolved) |
-| Out-of-scope (backend) | 13 (§4.1.5-R1..R11, R13, R28 — backend aggregation service rules; tracked separately) |
+| Out-of-scope (backend) | 16 (§4.1.5-R1..R11, R13, R28 — backend aggregation service rules; **+3 P6**: 4.1.18-R1/R2/R3 — cache TTLs and 304 are backend HTTP-header responsibilities; client makes no stale-serving assumptions) |
 | TBD | **~231** (P5 backlog: §4.1.15-R10/R25 (mobile tooltip, per-flight operating-day blocking); §4.1.16-R9/R10/R11/R14/R15/R28/R29/R30/R31 (mobile tooltip, three-date-group UI, full §4.1.16.3.1 nav algorithm); §4.1.23-R1–R4 widespread wiring deferred; pre-existing P4 deferred 7: 4.1.13.3-R7, R14; 4.1.13.4-R16; 4.1.14.3-R7, R14, R29; 4.1.14.4-R18; pre-existing non-P4 TBDs: §4.1.1-R15/R16/R25; §4.1.5-R12; §4.1.6-R14; §4.1.7-R16; §4.1.17-R8; §4.1.9-R53-R57 P4-tagged; **P6 newly enumerated**: §4.1.18 ×3, §4.1.19 ×22, §4.1.20 ×6, §4.1.21 ×8 (minus R1/R2 = Implemented), §4.1.24 ×48 — all TBD) |
-| **Check** | 381 Done + 308 Implemented + 7 Partial + 1 Conflict + 13 Out-of-scope + ~231 TBD ≈ **941** |
+| **Check** | 381 Done + 308 Implemented + 7 Partial + 1 Conflict + 16 Out-of-scope + ~228 TBD ≈ **941** |
 | **Note (§4.1.22 clarification)** | §4.1.22 in TZ is the **operating carrier** icon algorithm (not aircraft-type icon). Rule descriptions updated to reflect this. Conflict C10. |
 | **Note (§4.1.23 clarification)** | TZ specifies **orange** styling for «Уточняется» (contradicts prior assumption of «same as regular text»). Corrected in 4.1.23-R5. Conflict C9. |
 
@@ -1331,9 +1331,9 @@ Server-side caching of search results with section-specific TTLs: Online-Board
 
 | # | Rule | TZ cite | Viewport | Current impl | Status | Action | Plan |
 |---|---|---|---|---|---|---|---|
-| 4.1.18-R1 | Online-Board search results server-side cache TTL ≤ 1 minute ("кеш для «Онлайн-Табло» должен сохраняться не более 1 мин") | 4.1.18 TZ line 2909 | all | `src/shared/state/*` | TBD | Verify SSR response includes `Cache-Control: max-age=60` (or equivalent) for Online-Board result pages. | P6 |
-| 4.1.18-R2 | Schedule search results server-side cache TTL ≤ 10 minutes ("кеш для «Расписания» должен сохраняться не более 10 мин") | 4.1.18 TZ line 2909 | all | `src/shared/state/*` | TBD | Verify SSR response includes `Cache-Control: max-age=600` (or equivalent) for Schedule result pages. | P6 |
-| 4.1.18-R3 | Dictionary endpoints (cities, airports, aircraft types, §4.8.1.1) must respond with HTTP 304 and `Cache-Control` headers enabling automatic browser caching ("Справочники должны отдаваться сервером с 304 кодом и автоматически кэшироваться браузером") | 4.1.18 TZ line 2910 | all | `src/shared/dictionaries/*` | TBD | Verify that dictionary fetch responses carry ETag/Last-Modified + correct Cache-Control; browser caches on subsequent loads (304 path). | P6 |
+| 4.1.18-R1 | Online-Board search results server-side cache TTL ≤ 1 minute ("кеш для «Онлайн-Табло» должен сохраняться не более 1 мин") | 4.1.18 TZ line 2909 | all | `src/shared/api/client.ts` — no client-side cache; each search triggers a fresh fetch | Out-of-scope (backend) | Backend sets `Cache-Control: max-age≤60` on the `/board` endpoint. Client makes no assumptions about freshness — always fetches on search. Infrastructure cache layer (`CachedApiClient` + `ServerLruCache`) exists in `src/shared/api/` if the SSR tier needs server-to-backend caching in future. | P6 |
+| 4.1.18-R2 | Schedule search results server-side cache TTL ≤ 10 minutes ("кеш для «Расписания» должен сохраняться не более 10 мин") | 4.1.18 TZ line 2909 | all | `src/shared/api/client.ts` — no client-side cache; each search triggers a fresh fetch | Out-of-scope (backend) | Backend sets `Cache-Control: max-age≤600` on the `/schedule` endpoint. Same as R1. | P6 |
+| 4.1.18-R3 | Dictionary endpoints (cities, airports, aircraft types, §4.8.1.1) must respond with HTTP 304 and `Cache-Control` headers enabling automatic browser caching ("Справочники должны отдаваться сервером с 304 кодом и автоматически кэшироваться браузером") | 4.1.18 TZ line 2910 | all | `src/shared/dictionaries/api.ts` — plain `client.get()` with no explicit ETag handling | Out-of-scope (backend) | The browser's fetch cache handles 304 automatically when the backend sets `ETag`/`Cache-Control`. The client sends no `Cache-Control: no-cache` override, so backend-issued caching directives are respected. Dictionary data is loaded once per session (`useDictionaries` mounts once); no stale re-fetch risk. | P6 |
 
 ---