perf(cloud): sharing scalability campaign (P0-P4, stress harness, sharding Phase A)#539
Merged
Merged
Conversation
Neonforge98
force-pushed
the
codex/sharing-scale-maintain
branch
from
July 26, 2026 07:41
736711a to
e47f4b7
Compare
Write amplification (P0): the freeze line treated terminal displayStatus as immutable, but the Claude Code ingest amends recently-terminal events (tool-result backfill, synthetic-input cleanup); every amendment broke the frozen prefix chain and re-uploaded the entire history, measured at 10 rewrites/hour on one live session. The freeze line now holds back a ten-minute mutation horizon (capped at 40 events); amendments land in the mutable tail. Verified live: 6.9 hours, epoch constant while events grew 3762 to 3856, zero rewrites. Background-org consistency (P2): retracts only ran for the active workspace, so sessions that lost admission in a background org stayed published until that org was reopened. Once per engine run, orgs holding local push markers get a retract-only reconcile built from the same admission decision and server-confirmed scope boundary as the pass. Verified end-to-end: a resurrected row in a background org retracted at boot with zero workspace switches. Admission seam (P4): decidePushAdmission extracts the pass's inline rules (fork provenance plus ownership gate) into one pure decision, so the reconcile cannot retract under different rules than the push admitted under. Drops floorEligible, constant-true at its only read. Sharding Phase A: the engine publishes the roster's resolved 0007 home endpoints each pass; org-scoped data-plane calls (RPCs, replay downloads; uploads route transitively) resolve per org with the official project as fallback, plus a per-origin anon-key directory that fails closed on unkeyed shards. Behavior at identity is regression-proven unchanged; realtime socket grouping is the remaining Phase B client item. Measurement closed two premises: org listing latency is RTT-bound and flat to 506 rows (no index migration), and boot pass cost is linear at 0.22s per org (9 to 26 orgs). tests/stress/orgFanout.mjs adds the live-backend harness: 50-member org via the real invite flow, fan-out 49/49, 50-way concurrent comments with zero errors at p50 1.0s, sustained writes flat over five minutes with zero errors. Real gates found ahead of load: GoTrue sign-in limiting (about 30 per window) and plan entitlements (free tier caps 3 members); the 0001 comment cap also counts tombstoned rows, so deletion returns no budget, flagged for a product decision. Campaign record: docs/sharing-scalability-plan-2026-07-25.md. Server halves shipped separately in ORGII-cloud-infra (0009 cascade tombstone, applied; Phase B design doc). Pre-commit hook ran. Total eslint: 2, total circular: 0
Neonforge98
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
P0 — write amplification on live sessions (measured, fixed, verified live).
The freeze line treated terminal
displayStatusas immutable, but the Claude Code ingest amends recently-terminal events afterwards (tool-result backfill, synthetic-input cleanup). Every amendment broke the frozen prefix chain and took the epoch-rewrite path: a full re-upload of the session's entire history — measured at up to 10 rewrites/hour on one live session (3000+ events, MBs per rewrite). The freeze line now holds back a 10-minute mutation horizon (capped at 40 events so the single-segment tail stays bounded); amendments land in the mutable tail. Quiescent sessions freeze to the end — steady-state output unchanged.Verification (dual-instance, live project): 6.9 hours post-deploy on the same live session — events 3762 → 3856 across multiple push waves, ledger
events_epochconstant at 19, zero epoch rewrites (vs 10/hour baseline). Receiver instance on the previous build assembles the new segments cleanly. The absence metric is paired with a liveness metric (epoch constant while events_count grows) — zero-rewrites alone is meaningless while nothing pushes.P4 — single push-admission decision.
decidePushAdmissionextracts the pass loop's inline admission rules (fork provenance + ownership gate) into one pure function returning the denial reason the retract log prints. Prerequisite for any future retract reconcile: a second copy of these rules is how a session gets published under one predicate and retracted under another. RemovesfloorEligible, constant-true at its only read. Behavior-preserving; 10 new tests.Related
docs/sharing-scalability-plan-2026-07-25.mdTests
Full suite 6353 passed; tsc clean; on-device measurements above.