The rule, exactly

An instruction is served from cache when a previous build produced an image from the same parent, with the same instruction, over the same sources. That is the whole rule:

The parent image id. The instruction text, after variables are expanded. And, for COPY and ADD only, a checksum of the files being copied.

Nothing about the result is in there. A RUN that produces byte-identical output still misses if its text changed; a RUN curl that would fetch something new still hits if its text did not. The cache is keyed on the recipe, never on the dish — which is also why a cached RUN curl quietly serves you last week's download.

The parent being in the key is what makes the cascade: one miss and everything above it misses too, however unchanged its own text is.