Description
Three scale-dependent ceilings recorded during #1469 round-4 review (F8/F9/F10), all documented v1 tradeoffs rather than defects:
-
Sweeper failure paths are O(expired x in-flight) (router.rs fail_instance/sweep_deadlines): each expired handle rescans the full in-flight table under the global mutex. During mass-expiry events (network partition, CP failover) this blocks complete/cancel on the same lock. Fix: maintain a deadline-ordered index plus a handle -> delegation keys index alongside the primary map.
-
One global admission mutex serializes all namespaces (router.rs delegate): the critical section spans registry scan/sort and serialization of prompts up to 256 KiB. Fix: shard admission by namespace; move serialization/frame construction outside the lock with a rollback path.
-
Per-lookup key allocation (DelegationKey::new): every contains_key/get/parent lookup clones two Strings inside the admission lock. Fix: Borrow-based borrowed-key wrapper for reads.
All three should land with a load regression test.
Use Case
A CP instance serving multiple namespaces with hundreds of concurrent delegations (fleet-wide deployment) must not let one namespace's mass-expiry or large prompts stall every other namespace's admission and completion paths.
Description
Three scale-dependent ceilings recorded during #1469 round-4 review (F8/F9/F10), all documented v1 tradeoffs rather than defects:
Sweeper failure paths are O(expired x in-flight) (
router.rsfail_instance/sweep_deadlines): each expired handle rescans the full in-flight table under the global mutex. During mass-expiry events (network partition, CP failover) this blockscomplete/cancelon the same lock. Fix: maintain a deadline-ordered index plus ahandle -> delegation keysindex alongside the primary map.One global admission mutex serializes all namespaces (
router.rsdelegate): the critical section spans registry scan/sort and serialization of prompts up to 256 KiB. Fix: shard admission by namespace; move serialization/frame construction outside the lock with a rollback path.Per-lookup key allocation (
DelegationKey::new): everycontains_key/get/parent lookup clones twoStrings inside the admission lock. Fix:Borrow-based borrowed-key wrapper for reads.All three should land with a load regression test.
Use Case
A CP instance serving multiple namespaces with hundreds of concurrent delegations (fleet-wide deployment) must not let one namespace's mass-expiry or large prompts stall every other namespace's admission and completion paths.