Skip to main content

SSR dependency work budgets — RECORD-4714

Companion to config origin admission/cooldown (RECORD-4692, Web #525, already on develop) and MW PR645. No deployment is performed by this PR. Production configuration-origin protection remains gated by RECORD-4692's own qualification; do not claim complete production protection until that gate is enabled with the reviewed settings.

Node instrumentation installs a server-only fetch guard. The proxy creates one deadline and overwrites an internal request header for the following server render. A client-supplied deadline cannot extend it. React render-scoped caching shares the deadline across later page, localization and fetcher fan-out. Retries consume the same remaining duration. Static generation without request headers retains a bounded operation timeout.

Each configured dependency origin has a bounded active pool and FIFO queue; unknown origins share one additional pool, so arbitrary URLs cannot create new budgets. Queue cancellation removes the waiter. Active capacity is retained until the entire transport/body/parser settles, including providers ignoring abort. No race against a synthetic timeout frees a still-occupied slot. Caller signals and the remaining deadline reach fetch, including CMS page/localization reads.

Shared configuration operations deliberately retain RECORD-4692's origin-owned signal and admission. A cancelled or expired proxy detaches its waiter without cancelling an origin needed by other viewers. Config response bytes are still bounded. Client-side fetch behavior is unchanged; Node-only imports never enter its bundle.

Response readers count actual streamed bytes, not just Content-Length, and cancel oversized streams before parsing. Config cache admission checks UTF-8 serialized entry bytes and evicts oldest distinct entries when its total byte budget is exceeded. Session aliases do not count the same payload twice. Oversized writes preserve existing stale data without refreshing its timestamp. These wire/JSON bounds are not an assertion about JavaScript heap expansion.

Runtime Helm settings (local/build/test files also provide development defaults):

  • SSR_REQUEST_BUDGET_MS: proxy plus subsequent SSR dependency work.
  • SSR_DEPENDENCY_MAX_ACTIVE / SSR_DEPENDENCY_MAX_QUEUED: per-origin process bounds.
  • SSR_MAX_RESPONSE_BYTES: streamed dependency response ceiling.
  • CONFIG_CACHE_MAX_ENTRY_BYTES / CONFIG_CACHE_MAX_BYTES: retained config payloads.

Missing/invalid server limits fail initialization. Before promotion, load-test at the approved replica count including deployment surge: fleet HTTP allowance is the sum of per-origin active limits across live pods, not a global vendor quota. Exercise cold unique contexts, hot shared contexts, disconnects, slow/chunked bodies, oversized compressed responses, 429/5xx and recovery. Measure completed pages and retained session correctness as well as 503s, RSS and request counts. Production load qualification and heap tuning are release work, not claimed by the local test results. Roll back the paired application/configuration version; do not remove these required values while this binary remains deployed.

Validation covers actual stream cancellation, queue overflow/cancellation, abort-ignoring settlement, sequential deadline reuse, cache bytes/stale age, proxy header forwarding and existing bootstrap/session isolation tests.