Shared (cleared on every node): bucket-row presign limits and enabled
header rules, invalidated by the new ConfigRowChangeCustomizer on the
bucket and header-rule tables, and capability statuses, invalidated per
key when a probe result is recorded (other nodes reload from the row).
The 15 s TTLs stay as the safety net. Row-id maps, S3 clients, process
permissions, provider defaults, the running-scan guard and the per-pod
presign rate limiter are node-local, with reasons.
Builds against QQQ 4.1.0-SNAPSHOT (qqq.snapshot.version) until the QQQ
RC with ClusterCaches is published; a release must pin that RC.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>