CINVALIDATE: purge the cache by meaning, with a preview before you commit
Sometimes you need to clear 'everything about the old pricing' — a fuzzy, semantic set. CINVALIDATE takes a natural-language instruction, previews what it would purge, and only acts on COMMIT.
Cache invalidation by exact key is easy and rarely what you want. The real need is fuzzy: 'clear everything about the discontinued product,' 'purge the answers that referenced the old policy.' That's a semantic set, not a key list, and CINVALIDATE addresses it directly — you describe what to remove in natural language and it finds the entries whose meaning matches.
The safety design is the important part. CINVALIDATE previews by default: it shows you which entries the instruction would purge, scoped by TENANT, bounded by LIMIT, and tunable by THRESHOLD, without deleting anything. Only when you add COMMIT does it act. Destructive operations that match by meaning need a dry run, because 'matches the meaning of' is exactly the kind of predicate that's easy to get subtly wrong.
Five stages score every write before it can ever be served.
That preview-then-commit rhythm turns a scary operation into a routine one. You can tighten the threshold until the preview shows exactly the set you intended, then commit with confidence — instead of firing a fuzzy delete and discovering the blast radius afterward.
The bottom line
Invalidation is where caches earn distrust, because it's where a small mistake clears the wrong things. CINVALIDATE makes the mistake visible before it's permanent, which is the only responsible way to delete by meaning.