user_avatar.php wrote a ".none" sentinel whenever it failed to obtain avatar bytes, conflating "LDAP errored/timed out" with "user has no avatar". A brief lldap blip (restart, slow response past the 3s timeout, network hiccup) therefore cached a 404 for the full AVATAR_CACHE_TTL (1h default), leaving avatars broken long after lldap recovered. Track whether the LDAP query actually completed (`$ldapQueryOk`) and only write the negative-cache sentinel when lldap genuinely answered with no/ invalid avatar. On error/timeout, leave no sentinel so the lookup retries once lldap is healthy again. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>