At 500 anonymous code pages a second the forge refuses none and answers p95 under 100 ms, with and without the edge cache #9548

I couldn't do the edge run, so #9514 isn't done. On a copy of this repository, the forge itself now answers 500 anonymous code pages a second with the edge bypassed: p95 21.9 ms with none refused in one run, and p95 41.2 ms with 163 refused in another. On main the same run serves 103.5 a second. These are best-case numbers.

Not measured: the run through the edge, on a copy with production's data. This sandbox can't reach such a copy. Production must not be loaded, and a preview holds no repository. The table is an in-process copy with no edge, the load generator on the same 80-thread shared machine, and a 20 s warm-up. During that warm-up about half the requests are still refused on the wide set.

Before and after (bench/code-pages-at-rate.ts, 3,000 distinct pinned links, 500/s for 20 s after 20 s warm-up, default Shield, 4,000 synthetic addresses; files in bench/results/):

On a 300-link set, this branch serves 500/s with 0 refused and p95 70.4 ms.

What changed, each measured on its own:

• src/kernel/db.ts: Bun keeps only 20 prepared statements per connection. A code page runs about 30 queries, so it re-prepared on every request (~1.4 ms of a ~4 ms cached page). The cap is now 4,096.
• src/http/compress.ts (encodeRecent): identical bytes are compressed with brotli once and reused. Entries are keyed by a hash and checked byte for byte; capped at 48 MB / 1,024 entries. Compression had been ~30% of the main thread. Warm 300-link set: p50 went from 86 to 3.3 ms.
• src/http/crawl.ts: having 32 strangers' pages in flight used to count as "behind" and cut all strangers to 60 a minute. At 500/s that is only 64 ms of latency each, so a short pause refused hundreds. Now it counts only once the oldest has also waited 250 ms (STRANGER_BUDGET.queuedMs).
• src/web/pages/tree_cache.ts: folder listings at a full commit are kept 10 minutes, and ref names for one minute (the staleness the cached ref menu already allows). A cold file page used to read git five times. Cold blob page p50: 26 to 13.5 ms.
• src/web/pages/kept_page.ts (new): keeps a stranger's finished pinned tree or blob page, brotli-compressed (~15 KB each; 64 MB / 8,192 entries; one minute). The 32 MB cache of rendered page columns held only ~220 pages (~150 KB of markup each). This took the wide set from 199 to 500 served/s.

- It is served only after the route has loaded the repository and checked it can be read, so a repository made private is refused at once. - The key covers the URL, the sign-in link, which identity headers are present, the encoding, and the commit a branch resolved to. - It is never used for a signed-in reader, a theme or flash cookie, If-None-Match, Range, or a HEAD request.

• bench/load.ts: new --bypass (adds a cookie, which the edge passes to the forge, at the same URLs strangers ask), --warm, --crawl and --addresses. Each run also prints a per-second served/refused line and target met or what was missed (missed() in load_verdict.ts). A result now records cache: "edge" | "bypass", and --compare refuses to judge one kind against the other.
• scripts/release-load.ts (#9504's per-release compare): runs at 500/s, once through the edge and once bypassed. It writes <version>.json and <version>.bypass.json and compares each with its own kind (src/perf/baseline.ts). A fall of more than 20% in either fails the release.

What to look at:

• Memory: the three new caches can hold up to ~128 MB.
• Two tests changed with the behaviour:

- In test/anonymous-deep.test.ts, the queued-is-behind test now advances the clock by queuedMs. It also asserts that more than the shared budget gets through while pages are in flight but not waiting. - The branch-page test accepts a hit from either the column cache or the kept page.

• Release arguments: test/release-load.test.ts expects the new --warm 20 default.
• Not tried: I didn't raise FORGE_GIT_CONCURRENCY, because a pool of 32 changed nothing (the main thread was the limit). I didn't make the column cache bigger, because holding 3,000 pages would take ~450 MB.
• Plan on the issue: the keep_plan tool wasn't available to this run, so #9514 has no plan written on it.

Checks: bun scripts/gate.ts, bun x tsc --noEmit and bun scripts/design-lint.ts are clean. scripts/fast.ts said the diff was too broad to pick tests, so I chose them: 89 files (the compression, crawl, stranger, load and release, cache, cookie, web and code-page tests, plus every test that reads a blob, tree or raw page) all pass, with 2 tests skipped.

To try it:

bun bench/code-pages-at-rate.ts --rate 500 --seconds 20 --warm 20 --crawl 3000
bun scripts/release-load.ts <version> --url <copy behind the edge> --repo trevato/forge   # the run still owed, from a machine that is not the server

On the preview, open a commit-pinned blob page twice while signed out. The second answer comes from the kept page, with content-encoding: br and the same bytes.

🤖 Generated with Claude Code

Closes #9514

I couldn't do the edge run, so #9514 isn't done. On a copy of this repository, the forge itself now answers 500 anonymous code pages a second with the edge bypassed: p95 21.9 ms with none refused in one run, and p95 41.2 ms with 163 refused in another. On main the same run serves 103.5 a second. These are best-case numbers.

Not measured: the run through the edge, on a copy with production's data. This sandbox can't reach such a copy. Production must not be loaded, and a preview holds no repository. The table is an in-process copy with no edge, the load generator on the same 80-thread shared machine, and a 20 s warm-up. During that warm-up about half the requests are still refused on the wide set.

Before and after (bench/code-pages-at-rate.ts, 3,000 distinct pinned links, 500/s for 20 s after 20 s warm-up, default Shield, 4,000 synthetic addresses; files in bench/results/):

On a 300-link set, this branch serves 500/s with 0 refused and p95 70.4 ms.

What changed, each measured on its own:

• src/kernel/db.ts: Bun keeps only 20 prepared statements per connection. A code page runs about 30 queries, so it re-prepared on every request (~1.4 ms of a ~4 ms cached page). The cap is now 4,096.
• src/http/compress.ts (encodeRecent): identical bytes are compressed with brotli once and reused. Entries are keyed by a hash and checked byte for byte; capped at 48 MB / 1,024 entries. Compression had been ~30% of the main thread. Warm 300-link set: p50 went from 86 to 3.3 ms.
• src/http/crawl.ts: having 32 strangers' pages in flight used to count as "behind" and cut all strangers to 60 a minute. At 500/s that is only 64 ms of latency each, so a short pause refused hundreds. Now it counts only once the oldest has also waited 250 ms (STRANGER_BUDGET.queuedMs).
• src/web/pages/tree_cache.ts: folder listings at a full commit are kept 10 minutes, and ref names for one minute (the staleness the cached ref menu already allows). A cold file page used to read git five times. Cold blob page p50: 26 to 13.5 ms.
• src/web/pages/kept_page.ts (new): keeps a stranger's finished pinned tree or blob page, brotli-compressed (~15 KB each; 64 MB / 8,192 entries; one minute). The 32 MB cache of rendered page columns held only ~220 pages (~150 KB of markup each). This took the wide set from 199 to 500 served/s.

- It is served only after the route has loaded the repository and checked it can be read, so a repository made private is refused at once. - The key covers the URL, the sign-in link, which identity headers are present, the encoding, and the commit a branch resolved to. - It is never used for a signed-in reader, a theme or flash cookie, If-None-Match, Range, or a HEAD request.

• bench/load.ts: new --bypass (adds a cookie, which the edge passes to the forge, at the same URLs strangers ask), --warm, --crawl and --addresses. Each run also prints a per-second served/refused line and target met or what was missed (missed() in load_verdict.ts). A result now records cache: "edge" | "bypass", and --compare refuses to judge one kind against the other.
• scripts/release-load.ts (#9504's per-release compare): runs at 500/s, once through the edge and once bypassed. It writes <version>.json and <version>.bypass.json and compares each with its own kind (src/perf/baseline.ts). A fall of more than 20% in either fails the release.

What to look at:

• Memory: the three new caches can hold up to ~128 MB.
• Two tests changed with the behaviour:

- In test/anonymous-deep.test.ts, the queued-is-behind test now advances the clock by queuedMs. It also asserts that more than the shared budget gets through while pages are in flight but not waiting. - The branch-page test accepts a hit from either the column cache or the kept page.

• Release arguments: test/release-load.test.ts expects the new --warm 20 default.
• Not tried: I didn't raise FORGE_GIT_CONCURRENCY, because a pool of 32 changed nothing (the main thread was the limit). I didn't make the column cache bigger, because holding 3,000 pages would take ~450 MB.
• Plan on the issue: the keep_plan tool wasn't available to this run, so #9514 has no plan written on it.

Checks: bun scripts/gate.ts, bun x tsc --noEmit and bun scripts/design-lint.ts are clean. scripts/fast.ts said the diff was too broad to pick tests, so I chose them: 89 files (the compression, crawl, stranger, load and release, cache, cookie, web and code-page tests, plus every test that reads a blob, tree or raw page) all pass, with 2 tests skipped.

To try it:

bun bench/code-pages-at-rate.ts --rate 500 --seconds 20 --warm 20 --crawl 3000
bun scripts/release-load.ts <version> --url <copy behind the edge> --repo trevato/forge   # the run still owed, from a machine that is not the server

On the preview, open a commit-pinned blob page twice while signed out. The second answer comes from the kept page, with content-encoding: br and the same bytes.

🤖 Generated with Claude Code

I couldn't do the edge run, so #9514 isn't done. On a copy of this repository, the forge itself now answers 500 anonymous code pages a second with the edge bypassed: p95 21.9 ms with none refused in one run, and p95 41.2 ms with 163 refused in another. On main the same run serves 103.5 a second. These are best-case numbers.

Not measured: the run through the edge, on a copy with production's data. This sandbox can't reach such a copy. Production must not be loaded, and a preview holds no repository. The table is an in-process copy with no edge, the load generator on the same 80-thread shared machine, and a 20 s warm-up. During that warm-up about half the requests are still refused on the wide set.

Before and after (bench/code-pages-at-rate.ts, 3,000 distinct pinned links, 500/s for 20 s after 20 s warm-up, default Shield, 4,000 synthetic addresses; files in bench/results/):

On a 300-link set, this branch serves 500/s with 0 refused and p95 70.4 ms.

What changed, each measured on its own:

• src/kernel/db.ts: Bun keeps only 20 prepared statements per connection. A code page runs about 30 queries, so it re-prepared on every request (~1.4 ms of a ~4 ms cached page). The cap is now 4,096.
• src/http/compress.ts (encodeRecent): identical bytes are compressed with brotli once and reused. Entries are keyed by a hash and checked byte for byte; capped at 48 MB / 1,024 entries. Compression had been ~30% of the main thread. Warm 300-link set: p50 went from 86 to 3.3 ms.
• src/http/crawl.ts: having 32 strangers' pages in flight used to count as "behind" and cut all strangers to 60 a minute. At 500/s that is only 64 ms of latency each, so a short pause refused hundreds. Now it counts only once the oldest has also waited 250 ms (STRANGER_BUDGET.queuedMs).
• src/web/pages/tree_cache.ts: folder listings at a full commit are kept 10 minutes, and ref names for one minute (the staleness the cached ref menu already allows). A cold file page used to read git five times. Cold blob page p50: 26 to 13.5 ms.
• src/web/pages/kept_page.ts (new): keeps a stranger's finished pinned tree or blob page, brotli-compressed (~15 KB each; 64 MB / 8,192 entries; one minute). The 32 MB cache of rendered page columns held only ~220 pages (~150 KB of markup each). This took the wide set from 199 to 500 served/s.

- It is served only after the route has loaded the repository and checked it can be read, so a repository made private is refused at once. - The key covers the URL, the sign-in link, which identity headers are present, the encoding, and the commit a branch resolved to. - It is never used for a signed-in reader, a theme or flash cookie, If-None-Match, Range, or a HEAD request.

• bench/load.ts: new --bypass (adds a cookie, which the edge passes to the forge, at the same URLs strangers ask), --warm, --crawl and --addresses. Each run also prints a per-second served/refused line and target met or what was missed (missed() in load_verdict.ts). A result now records cache: "edge" | "bypass", and --compare refuses to judge one kind against the other.
• scripts/release-load.ts (#9504's per-release compare): runs at 500/s, once through the edge and once bypassed. It writes <version>.json and <version>.bypass.json and compares each with its own kind (src/perf/baseline.ts). A fall of more than 20% in either fails the release.
• scripts/hollow-allow.ts: the first check failed because #9540 on main made demoDefaults and demoFactsAt reachable but left them on the allow list. That broke the hollow audit for any branch merged with main. Both entries are removed, and the branch is merged with main.

What to look at:

• Memory: the three new caches can hold up to ~128 MB.
• Two tests changed with the behaviour:

- In test/anonymous-deep.test.ts, the queued-is-behind test now advances the clock by queuedMs. It also asserts that more than the shared budget gets through while pages are in flight but not waiting. - The branch-page test accepts a hit from either the column cache or the kept page.

• Release arguments: test/release-load.test.ts expects the new --warm 20 default.
• Not tried: I didn't raise FORGE_GIT_CONCURRENCY, because a pool of 32 changed nothing (the main thread was the limit). I didn't make the column cache bigger, because holding 3,000 pages would take ~450 MB.
• Plan on the issue: the keep_plan tool wasn't available to this run, so #9514 has no plan written on it.

Checks:

• Hollow audit: after the merge, bun scripts/hollow.ts and both hollow test files pass.
• Static checks: bun scripts/gate.ts, bun x tsc --noEmit and bun scripts/design-lint.ts are clean.
• Code-page tests: before the first push, 89 test files covering compression, crawl budgets, caching, cookies, the web pages and every blob, tree and raw page passed.
• Re-run on the merge: a smaller set of 9 files (147 tests) passes again.
• Not run here: test/spawn-cell-e2e.test.ts, which also failed in the check. It needs unix sockets and cells this sandbox can't run, and the check's log says it fails only beside other tests.

To try it:

bun bench/code-pages-at-rate.ts --rate 500 --seconds 20 --warm 20 --crawl 3000
bun scripts/release-load.ts <version> --url <copy behind the edge> --repo trevato/forge   # the run still owed, from a machine that is not the server

On the preview, open a commit-pinned blob page twice while signed out. The second answer comes from the kept page, with content-encoding: br and the same bytes.

🤖 Generated with Claude Code

I couldn't do the edge run, so #9514 isn't done. On a copy of this repository, the forge itself now answers 500 anonymous code pages a second with the edge bypassed: p95 21.9 ms with none refused in one run, and p95 41.2 ms with 163 refused in another. On main the same run serves 103.5 a second. These are best-case numbers.

Not measured: the run through the edge, on a copy with production's data. This sandbox can't reach such a copy. Production must not be loaded, and a preview holds no repository. The table is an in-process copy with no edge, the load generator on the same 80-thread shared machine, and a 20 s warm-up. During that warm-up about half the requests are still refused on the wide set.

Before and after (bench/code-pages-at-rate.ts, 3,000 distinct pinned links, 500/s for 20 s after 20 s warm-up, default Shield, 4,000 synthetic addresses; files in bench/results/):

On a 300-link set, this branch serves 500/s with 0 refused and p95 70.4 ms.

What changed, each measured on its own:

• src/kernel/db.ts: Bun keeps only 20 prepared statements per connection. A code page runs about 30 queries, so it re-prepared on every request (~1.4 ms of a ~4 ms cached page). The cap is now 4,096.
• src/http/compress.ts (encodeRecent): identical bytes are compressed with brotli once and reused. Entries are keyed by a hash and checked byte for byte; capped at 48 MB / 1,024 entries. Compression had been ~30% of the main thread. Warm 300-link set: p50 went from 86 to 3.3 ms.
• src/http/crawl.ts: having 32 strangers' pages in flight used to count as "behind" and cut all strangers to 60 a minute. At 500/s that is only 64 ms of latency each, so a short pause refused hundreds. Now it counts only once the oldest has also waited 250 ms (STRANGER_BUDGET.queuedMs).
• src/web/pages/tree_cache.ts: folder listings at a full commit are kept 10 minutes, and ref names for one minute (the staleness the cached ref menu already allows). A cold file page used to read git five times. Cold blob page p50: 26 to 13.5 ms.
• src/web/pages/kept_page.ts (new): keeps a stranger's finished pinned tree or blob page, brotli-compressed (~15 KB each; 64 MB / 8,192 entries; one minute). The 32 MB cache of rendered page columns held only ~220 pages (~150 KB of markup each). This took the wide set from 199 to 500 served/s.

- It is served only after the route has loaded the repository and checked it can be read, so a repository made private is refused at once. - The key covers the URL, the sign-in link, which identity headers are present, the encoding, and the commit a branch resolved to. - It is never used for a signed-in reader, a theme or flash cookie, If-None-Match, Range, or a HEAD request.

• bench/load.ts: new --bypass (adds a cookie, which the edge passes to the forge, at the same URLs strangers ask), --warm, --crawl and --addresses. Each run also prints a per-second served/refused line and target met or what was missed (missed() in load_verdict.ts). A result now records cache: "edge" | "bypass", and --compare refuses to judge one kind against the other.
• scripts/release-load.ts (#9504's per-release compare): runs at 500/s, once through the edge and once bypassed. It writes <version>.json and <version>.bypass.json and compares each with its own kind (src/perf/baseline.ts). A fall of more than 20% in either fails the release.
• scripts/hollow-allow.ts and scripts/unreached-allow.json: both checks on this pull failed for one cause. #9540 on main made src/actions/pin_demos.ts and src/display/{config,items,known}.ts reachable but left them on both allow lists, so the audits failed on any branch merged with main. The entries are removed, and the branch is merged with current main.

What to look at:

• Memory: the three new caches can hold up to ~128 MB.
• Two tests changed with the behaviour:

- In test/anonymous-deep.test.ts, the queued-is-behind test now advances the clock by queuedMs. It also asserts that more than the shared budget gets through while pages are in flight but not waiting. - The branch-page test accepts a hit from either the column cache or the kept page.

• Release arguments: test/release-load.test.ts expects the new --warm 20 default.
• Not tried: I didn't raise FORGE_GIT_CONCURRENCY, because a pool of 32 changed nothing (the main thread was the limit). I didn't make the column cache bigger, because holding 3,000 pages would take ~450 MB.
• Plan on the issue: the keep_plan tool wasn't available to this run, so #9514 has no plan written on it.

Checks:

• Allow-list audits: on the merge with current main, test/unreached.test.ts, both hollow test files and test/anonymous-deep.test.ts pass.
• Static checks: bun scripts/gate.ts and bun x tsc --noEmit are clean. bun scripts/design-lint.ts was clean before the first push; I didn't run it again since, because these fixes don't touch src/web/.
• Code-page tests: before the first push, 89 test files covering compression, crawl budgets, caching, cookies, the web pages and every blob, tree and raw page passed.
• Not run here: test/spawn-cell-e2e.test.ts, which failed in the first check. It needs unix sockets and cells this sandbox can't run, and the check's log says it fails only beside other tests.

To try it:

bun bench/code-pages-at-rate.ts --rate 500 --seconds 20 --warm 20 --crawl 3000
bun scripts/release-load.ts <version> --url <copy behind the edge> --repo trevato/forge   # the run still owed, from a machine that is not the server

On the preview, open a commit-pinned blob page twice while signed out. The second answer comes from the kept page, with content-encoding: br and the same bytes.

🤖 Generated with Claude Code

I couldn't do the edge run, so #9514 isn't done. On a copy of this repository, the forge itself now answers 500 anonymous code pages a second with the edge bypassed: p95 21.9 ms with none refused in one run, and p95 41.2 ms with 163 refused in another. On main the same run serves 103.5 a second. These are best-case numbers.

Not measured: the run through the edge, on a copy with production's data. This sandbox can't reach such a copy. Production must not be loaded, and a preview holds no repository. The table is an in-process copy with no edge, the load generator on the same 80-thread shared machine, and a 20 s warm-up. During that warm-up about half the requests are still refused on the wide set.

Before and after (bench/code-pages-at-rate.ts, 3,000 distinct pinned links, 500/s for 20 s after 20 s warm-up, default Shield, 4,000 synthetic addresses; files in bench/results/):

On a 300-link set, this branch serves 500/s with 0 refused and p95 70.4 ms.

What changed, each measured on its own:

• src/kernel/db.ts: Bun keeps only 20 prepared statements per connection. A code page runs about 30 queries, so it prepared them again on every request (~1.4 ms of a ~4 ms cached page). The cap is now 4,096.
• src/http/compress.ts (encodeRecent): identical bytes are compressed with brotli once and reused. Entries are keyed by a hash and checked byte for byte, with a cap of 48 MB / 1,024 entries. Compression had been ~30% of the main thread. Warm 300-link set: p50 went from 86 to 3.3 ms.
• src/http/crawl.ts: having 32 strangers' pages in flight used to count as "behind" and cut all strangers to 60 a minute. At 500/s that is only 64 ms of latency each, so a short pause refused hundreds. Now it counts only once the oldest has also waited 250 ms (STRANGER_BUDGET.queuedMs).
• src/web/pages/tree_cache.ts: folder listings at a full commit are kept 10 minutes, and ref names for one minute (the staleness the cached ref menu already allows). A cold file page used to read git five times. Cold blob page p50: 26 to 13.5 ms.
• src/web/pages/kept_page.ts (new): keeps a stranger's finished pinned tree or blob page, brotli-compressed (~15 KB each; 64 MB / 8,192 entries; one minute). The 32 MB cache of rendered page columns held only ~220 pages (~150 KB of markup each). This took the wide set from 199 to 500 served/s.

- It is served only after the route has loaded the repository and checked it can be read, so a repository made private is refused at once. - The key covers the URL, the sign-in link, which identity headers are present, the encoding, and the commit a branch resolved to. - It is never used for a signed-in reader, a theme or flash cookie, If-None-Match, Range, or a HEAD request.

• bench/load.ts: new --bypass (adds a cookie, which the edge passes to the forge, at the same URLs strangers ask), --warm, --crawl and --addresses. Each run also prints a served/refused line for every second, then target met or what was missed (missed() in load_verdict.ts). A result now records cache: "edge" | "bypass", and --compare refuses to judge one kind against the other.
• scripts/release-load.ts (#9504's per-release compare): runs at 500/s, once through the edge and once bypassed. It writes <version>.json and <version>.bypass.json and compares each with its own kind (src/perf/baseline.ts). A fall of more than 20% in either fails the release.
• Merge with main: main is merged in up to 213a6af8 (#9549). That commit changed only the hollow and unreached allow lists and src/web/layout.ts, so nothing conflicted.

What to look at:

• Memory: the three new caches can hold up to ~128 MB.
• Two tests changed with the behaviour:

- In test/anonymous-deep.test.ts, the queued-is-behind test now advances the clock by queuedMs. It also asserts that more than the shared budget gets through while pages are in flight but not waiting. - The branch-page test accepts a hit from either the column cache or the kept page.

• Release arguments: test/release-load.test.ts expects the new --warm 20 default.
• Not tried: I didn't raise FORGE_GIT_CONCURRENCY, because a pool of 32 changed nothing (the main thread was the limit). I didn't make the column cache bigger, because holding 3,000 pages would take ~450 MB.
• Plan on the issue: the keep_plan tool wasn't available to this run, so #9514 has no plan written on it.

Checks after the merge: bun scripts/gate.ts, bun x tsc --noEmit and bun scripts/design-lint.ts are clean. scripts/fast.ts said the diff was too broad to pick tests, so I chose them. These 9 files all pass (70 tests): anonymous-deep, compress-recent, load-bench, query-cache, release-load, hollow, hollow-cli, unreached and cache-private. Before the merge, a wider set of 89 files also passed: compression, crawl, stranger, load and release, cache, cookie, web and code-page tests, plus every test that reads a blob, tree or raw page. 2 tests in that set were skipped.

To try it:

bun bench/code-pages-at-rate.ts --rate 500 --seconds 20 --warm 20 --crawl 3000
bun scripts/release-load.ts <version> --url <copy behind the edge> --repo trevato/forge   # the run still owed, from a machine that is not the server

On the preview, open a commit-pinned blob page twice while signed out. The second answer comes from the kept page, with content-encoding: br and the same bytes.

🤖 Generated with Claude Code

Closes #9514

With the edge bypassed, the in-process copy now answers 500 anonymous code pages a second with none refused and p95 at 10.3 ms, after a 40 s warm-up. That result is kept in bench/results/9514-in-process-bypass.json and records "verdict": "target met". #9514 is still not done. The run through the edge, on a copy holding production's data, can't be taken from a crew sandbox, so it is now #9565, and #9514 is linked to wait on it. A cold forge still refuses strangers for its first ~20 s on a wide set; that is #9566.

On main the same run serves 103.5 a second with 7,930 refused. Measured on this branch at 704ac702, on an 80-thread shared machine with load average ~43:

The 20 s row is shown because it misses. Earlier 20 s runs on a quieter machine gave 0 and 163 refused. On a wide set the first ~20 s after a start refuse about half the strangers. In production only the edge covers that window: its copies outlive a deploy, and a URL it doesn't hold gets 429 with Retry-After.

What changed for the performance (each measured on its own; details in docs/features/load-test.md):

• src/kernel/db.ts: each connection now keeps 4,096 prepared statements instead of Bun's default 20. A code page runs about 30 queries, so it had been preparing them again on every request.
• src/http/compress.ts (encodeRecent): identical bytes are compressed with brotli once and reused, up to 48 MB.
• src/http/crawl.ts: 32 strangers' pages in flight count as "behind" only once the oldest has waited 250 ms (STRANGER_BUDGET.queuedMs).
• src/web/pages/tree_cache.ts: folder listings at a full commit and ref names are kept, so a cold file page reads git once instead of five times.
• src/web/pages/kept_page.ts (new): a stranger's finished pinned page is kept compressed for a minute, up to 64 MB. It is served only after the route has checked the repository can be read.
• bench/load.ts and scripts/release-load.ts: the load runs once through the edge and once bypassed, at 500/s. Each is compared only with its own kind, and a fall of more than 20% fails the release.

What changed in this round, for sentinel's review:

• Shared compression cache (finding 1): compress() reuses a cached encoding only for a body no identity shaped (sharedBody). These are encoded per response: requests with a cookie, Authorization, x-plat-user or x-plat-edge-token, and answers that set a cookie or are private/no-store. Kept pages still go through the cache directly. A new test in test/compress-recent.test.ts covers all seven cases.
• Kept page headers (finding 2): keepPage replays only an allowlist, KEPT_HEADERS: content-type, CSP, cache-control, vary, etag, last-modified, link, speculation-rules, referrer-policy and x-content-type-options.

- The page's CSP names its inline styles by hash, not a nonce, so replaying it with the same body is exact. - test/kept-page-headers.test.ts gives the first answer server-timing, x-request-id, date, age and a made-up header, and fails if any of them reaches the second reader.

• Crawl guard (finding 3): two new tests in test/anonymous-deep.test.ts.

- After lost finishes are forgotten and the queue refills to 32, a real wait still cuts strangers to exactly behindAll. - With 20 entries past a minute and 12 fresh ones behind them, only the old 20 are forgotten. The test counts exactly how many go through before the first refusal, so dropping too many or too few fails it.

• Results and follow-ups (finding 4): bench/load.ts now writes verdict ("target met" or what missed) into every result file. The kept bypass result is the clean run above.
• Prepared-statement cap (finding 5): test/db-query-cache.test.ts checks the setting and that 200 distinct statements stay prepared once each. At Bun's default of 20, 180 of the 200 are prepared again, so the test would catch a Bun upgrade that reverts it.
• Cache stats (finding 6): the owner's /system page has a Code page caches table. It lists kept pages, encoded bodies, page columns, and folders and refs, each with entries, bytes, cap, hits, misses and hit rate. The caps are exported from each module rather than repeated. The three new caches add up to 128 MB at most (64 + 48 + 16), which a test asserts.

Where I went another way: the review mentioned a vitals page, but there is no such page. The cache stats went on /system, the owner-only page that already shows the forge's memory.

Checks: bun scripts/gate.ts, bun x tsc --noEmit and bun scripts/design-lint.ts are clean. scripts/fast.ts said the diff was too broad to pick tests, so I chose 22 files: the compression, crawl, kept page, database, /system, load, release, hollow and unreached tests, plus the web and webspec suites. All 243 tests in them pass.

To try it:

bun bench/code-pages-at-rate.ts --rate 500 --seconds 20 --warm 40 --crawl 3000

On the preview, sign in as the owner and open /system to see the cache table. Open a commit-pinned blob page twice while signed out; the second answer has content-encoding: br and none of the first answer's server-timing.

🤖 Generated with Claude Code

Part of #9514

With the edge bypassed, the in-process copy now answers 500 anonymous code pages a second with none refused and p95 at 10.3 ms, after a 40 s warm-up. That result is kept in bench/results/9514-in-process-bypass.json and records "verdict": "target met". #9514 is still not done. The run through the edge, on a copy holding production's data, can't be taken from a crew sandbox, so it is now #9565, and #9514 is linked to wait on it. A cold forge still refuses strangers for its first ~20 s on a wide set; that is #9566.

On main the same run serves 103.5 a second with 7,930 refused. Measured on this branch at 704ac702, on an 80-thread shared machine with load average ~43:

The 20 s row is shown because it misses. Earlier 20 s runs on a quieter machine gave 0 and 163 refused. On a wide set the first ~20 s after a start refuse about half the strangers. In production only the edge covers that window: its copies outlive a deploy, and a URL it doesn't hold gets 429 with Retry-After.

What changed for the performance (each measured on its own; details in docs/features/load-test.md):

• src/kernel/db.ts: each connection now keeps 4,096 prepared statements instead of Bun's default 20. A code page runs about 30 queries, so it had been preparing them again on every request.
• src/http/compress.ts (encodeRecent): identical bytes are compressed with brotli once and reused, up to 48 MB. Only a body no identity shaped goes in (sharedBody). Signed-in, private and cookie-setting answers are encoded per response.
• src/http/crawl.ts: 32 strangers' pages in flight count as "behind" only once the oldest has waited 250 ms (STRANGER_BUDGET.queuedMs).
• src/web/pages/tree_cache.ts: folder listings at a full commit and ref names are kept, so a cold file page reads git once instead of five times.
• src/web/pages/kept_page.ts (new): a stranger's finished pinned page is kept compressed for a minute, up to 64 MB.

- It is served only after the route has checked the repository can be read. - It replays only the headers that say what the page is (KEPT_HEADERS). A request id, timing, date or cookie from the first answer never reaches the next reader.

• bench/load.ts and scripts/release-load.ts: the load runs once through the edge and once bypassed, at 500/s. Each is compared only with its own kind, and a fall of more than 20% fails the release. Every result file now records its verdict.
• /system: the owner's page has a Code page caches table with each cache's entries, bytes beside its cap, hits, misses and hit rate. The three new caches hold 128 MB at most (64 + 48 + 16).

Tests added for sentinel's review:

• Shared compression cache: test/compress-recent.test.ts checks that bodies a cookie, Authorization, an edge identity, a set cookie, or private/no-store shaped are never kept in the shared cache.
• Kept page headers: test/kept-page-headers.test.ts fails if a per-response header reaches the second reader.
• Crawl guard: test/anonymous-deep.test.ts covers a refilled real queue being cut to behindAll, and expiry forgetting only pages past a minute.
• Prepared-statement cap: test/db-query-cache.test.ts fails at Bun's default of 20.
• Cache table: test/system-memory.test.ts covers the /system table.

Fixes for the failed check:

• test/cookie-flags.test.ts: it counts every "set-cookie" literal as a cookie-setting site, so sharedBody now reads the cookie list with getSetCookie().
• test/unreached.test.ts: main's #9555 made src/display/selections.ts reachable, so it is off scripts/unreached-allow.json.
• test/traffic-truth.test.ts, "it keeps prefixes and a sketch, never an address…": not changed. This branch doesn't touch src/perf/traffic.ts. The test checks a HyperLogLog count salted at random per process, within 12%. With 1,024 registers the standard error is about 3.2%. Across 30 salts here the worst error was 7%. That failure looks like a rare unlucky salt.

Main is merged up to 43459aec.

Checks: bun scripts/gate.ts, bun x tsc --noEmit and bun scripts/design-lint.ts are clean. After the merge, the cookie-flags, unreached, hollow, hollow-cli and traffic-truth tests passed three runs in a row, and 9 test files covering compression, kept pages, crawl, /system, the database, load and release all pass.

To try it:

bun bench/code-pages-at-rate.ts --rate 500 --seconds 20 --warm 40 --crawl 3000

On the preview, sign in as the owner and open /system to see the cache table. Open a commit-pinned blob page twice while signed out; the second answer has content-encoding: br and none of the first answer's server-timing.

🤖 Generated with Claude Code

Part of #9514

Left #9514 open: 1 unticked item remain (bench/load.ts at 500/s, against a copy holding production-shaped data, reports zero 429s or 5xx and p95 under 100 ms. It is run once through the edge cache and once with the cache bypassed, and both results are kept in bench/results.).