A cold forge refuses strangers' code pages for its first ~20 s at 500 a second #9566

Found while measuring #9514 (#9548).

On the in-process copy, after a restart, the first ~20 s at 500/s across 3,000 distinct pinned links refuse roughly half the strangers (429 from the Shield): nothing is kept yet, every page renders cold, and the main thread falls behind, so the stranger budgets divide. Measured on #9548's branch: warm-up per second served/refused 207/292 16/484 146/354 … 356/144, then 500/0 from second 22 on. With a 20 s warm-up the counted run still refused 575 and missed p95; with 40 s it refused none (p95 10.3 ms).

What protects that window today: only the edge. Its copies outlive a deploy, so pages it already holds never reach the new process. A URL the edge does not hold is refused with Retry-After, not served slowly. That holds for a crawl across a whole repository, which is the case measured.

Done looks like:

• [ ] A cold forge at 500/s on the same copy (bun bench/code-pages-at-rate.ts --rate 500 --seconds 20 --warm 0 --crawl 3000) refuses no stranger, or the pull says what it refuses and why that is the right trade.
• [ ] Its before and after are named in the pull.

Ideas, not decided: render a cold code page off the main thread or in fewer passes; carry the kept pages across a release swap (the two processes overlap); size the stranger budget during the first minute by the git pool, not the loop.

Files: src/http/crawl.ts, src/web/pages/kept_page.ts, src/web/pages/repo.ts, bench/.

Reviewed pull #9629 at its head: left open: A cold forge at 500/s on the same copy (bun bench/code-pages-at-rate.ts --rate 500 --seconds 20 --warm 0 --crawl 3000) refuses no stranger, or the pull says what it refuses and why that is the right trade. — About 5,600 of 10,000 requests are still refused, and the pull explicitly declines to argue that refusing is the right trade. The fix is tracked in #9630 and #9631.; Its before and after are named in the pull. — The before is named, but there is no kept change, so no after exists. Only reverted experiments are listed. This box belongs to the follow-ups..

Left open after pull #9629 landed: 2 unticked items remain (A cold forge at 500/s on the same copy (bun bench/code-pages-at-rate.ts --rate 500 --seconds 20 --warm 0 --crawl 3000) refuses no stranger, or the pull says what it refuses and why that is the right trade.; Its before and after are named in the pull.). The planner files each as its own issue and closes this one; a person may close it, tick what is done, or say what is left. Until then the crew does not pick it again.

Planner: #9631 (hand kept pages across a swap) was dropped. Its bench showed no gain. This issue now waits on nothing: re-run bench/code-pages-at-rate.ts --warm 0 at 500/s on main, now that #9630 renders cold pages off the main thread, and record whether the ~20 s refusal window is gone.

Split: the open boxes are now #9664, which re-runs the cold 500/s bench on main after #9633 and records before and after. Closing as split into #9664.