fix(assets-sync): split commit_batch to fit ingress message limit

[lwshang]

Problem

Large deploys hit the IC's per-message ingress size limit on commit_batch. A real example from a downstream project: 1713 files with a multi-kilobyte Content-Security-Policy declared in _headers, producing 4843 batch operations. The boundary node rejects the call with:

status 413 Payload Too Large
Payload is too large: maximum body size is 4194304 bytes.

The 4 MiB number is the local boundary node's HTTP body cap; the real limit on production application subnets is 2 MiB per ingress message (MAX_INGRESS_BYTES_PER_MESSAGE_APP_SUBNET in dfinity/ic/rs/limits/src/lib.rs). Most of the payload bytes come from per-asset headers that _headers resolves to (a 1.5 KiB CSP × 1713 CreateAsset ops ≈ 2.9 MiB on its own).

Fix

Split commit_batch into multiple ingress calls when the operation set would exceed the limit.

Per-group caps:

• 500 operations — bounds certified-tree work per call and limits the blast radius of a mid-deploy failure.
• 1.5 MiB of inlined header bytes — leaves ~500 KiB of headroom under the 2 MiB cap for fixed per-op overhead (keys, chunk_ids, sha256s, variant tags, request envelope). Header bytes are the only variable-sized per-op field and are where real-world overruns come from.

Intermediate splits use a placeholder batch_id = 0; a trailing empty-ops call on the real batch_id releases the canister-side batch entry. The canister's commit_batch does not validate batch existence and consumes chunk_ids regardless of which batch created them, so chunks uploaded once under the real batch_id remain reachable across all splits — only create_batch GCs orphaned chunks.

Small deploys still use a single commit_batch with the real batch_id; the placeholder dance only kicks in when splitting is actually needed.

Same shape of fix that dfx's ic-asset/src/sync.rs uses for the same problem.

Trade-off

Splitting forfeits cross-batch atomicity. A failure mid-deploy leaves the canister with the operations from previously-successful calls applied; the next sync run diffs against the canister and resumes.

Test plan

• cargo test -p assets-sync --lib — 177 tests pass, 10 new
• cargo build -p plugin --target wasm32-wasip2 --release — clean build
• Manual: re-run icp deploy against the downstream project that hit the original 413 and confirm it now goes through

🤖 Generated with Claude Code