As far as I can understand, any random failure (DNS resolution blip, upstream rate-limiting TLS hiccup, whatever) immediately incurs a 24-hour negative cache. There's no config knob, no API to flush it, and the error gets debug! treatment so the logs just have regular write operations with no indication of what actually happened, and the only way out is a container restart. If you get hit with it on app.bsky.feed.post, you literally cannot post for 24 hours or until you restart.
What's weirder is that REFRESH_FAILURE_BACKOFF is already 60 seconds, which feels about right? I feel like NEGATIVE_CACHE_TTL should be around the same.