perf: reuse bounded byte accounting for snapshot admission

Author: hongtao

docs/context-recovery-evidence/snapshot-shape-byte-measurement.json

@@ -0,0 +1,158 @@
+{
+  "schemaVersion": 1,
+  "date": "2026-10-28",
+  "baseSource": "50f73e151c62b74fd772cbfdb575c54610cc8bc2",
+  "change": "Daily snapshot shape admission consumes counters from the complete descriptor-only encoder instead of serializing the retained history and rescanning all raw text.",
+  "bounds": {
+    "encodedBytes": "Exact count from unchanged scalar accounting.",
+    "rawBytesUpperBound": "Encoded bytes plus ASCII array-index key lengths; conservatively bounds the former recursive raw-key count.",
+    "maximumBytes": 117440512,
+    "nodes": 65536,
+    "depth": 64,
+    "nearBoundary": "Conservative proof failure retains the existing exact authenticated hydration; legacy path unchanged."
+  },
+  "regression": {
+    "beforeSkeletonSerializations": 1,
+    "afterSkeletonSerializations": 0,
+    "beforeExitCode": 1,
+    "pureRelated": {
+      "tests": 140,
+      "pass": 140,
+      "fail": 0,
+      "skip": 0
+    },
+    "expanded": {
+      "tests": 168,
+      "pass": 167,
+      "fail": 1,
+      "skip": 0,
+      "failure": "actual encrypted worker exposes reference save/load, exact pages and legacy load across reopen",
+      "code": "context_recovery_storage_unavailable",
+      "scope": "Known Mac native startup failure, retained; Mac platform-conditional returns do not grant Windows qualification."
+    }
+  },
+  "checks": {
+    "syntaxFiles": 1737,
+    "targetedLintPassed": true,
+    "ciGovernancePassed": true,
+    "unifiedDiscoveryConfirmed": true
+  },
+  "benchmark": {
+    "sourceBase": "50f73e151c62b74fd772cbfdb575c54610cc8bc2",
+    "diagnosticDirty": true,
+    "privateHistoryBytes": 8388608,
+    "nativeStorage": false,
+    "qualification": false,
+    "realModelRequests": 0,
+    "samples": [
+      {
+        "mode": "baseline",
+        "sourceSha256": "a0c5484ac757e95f3023a9103667040472650de3acc64996ad57f0f121364820",
+        "timesMs": [181, 161, 159, 173, 175],
+        "skeletonSerializations": 5
+      },
+      {
+        "mode": "modified",
+        "sourceSha256": "79d56799fafcf79ca0da042001d3becbd74b417b6f2f368e2c981f78f3321f9f",
+        "timesMs": [162, 171, 164, 190, 189],
+        "skeletonSerializations": 0
+      }
+    ]
+  },
+  "benchmarkConclusion": "Five 8MiB in-memory snapshot samples do not demonstrate wall-time improvement. Additional full-tree serializations fall from five to zero. No Windows five-second qualification.",
+  "oldSourceWindowsDiagnostic": {
+    "sourceSha": "ae664cc0f6998eac24bd84bdbd19ab14a5ae9020",
+    "taskResult": 0,
+    "childExitCode": 0,
+    "controllerElapsedMs": 161196,
+    "originalDeadlineMs": 180000,
+    "stageIntervals": {
+      "buildMs": [10702, 10598, 7181, 9708],
+      "saveMs": [7407, 7544, 12742, 16027],
+      "reopenMs": 23062,
+      "loadMs": [10043, 10196, 10391, 10990]
+    },
+    "qualification": false,
+    "previous180SecondFailureRetained": true,
+    "diagnosticFailuresRetained": [
+      "Owned-job stdin handshake blocked behind extra Node test parent, before product invocation.",
+      "Incorrect expected stage count rejected seven actual stage sites before product invocation."
+    ]
+  },
+  "baseCoverageFailure": {
+    "sourceSha": "50f73e151c62b74fd772cbfdb575c54610cc8bc2",
+    "runId": 40750514561,
+    "jobId": 123035650972,
+    "conclusion": "failure",
+    "fullLogCharacters": 3741220,
+    "failedTest": "actual core chat WBIPC recovery has exclusive ownership and live credential revocation",
+    "failure": [
+      {
+        "kind": "chat",
+        "mode": "long-persistent",
+        "turn": 0,
+        "phase": "request_failed",
+        "elapsedMs": 5003,
+        "requests": 1,
+        "handshakes": 1,
+        "roots": 1
+      }
+    ],
+    "commits": [
+      {
+        "kind": "chat",
+        "mode": "long-persistent",
+        "phase": "owner-stage",
+        "sequence": 0,
+        "operation": "startup",
+        "stage": "sqlite_commit",
+        "elapsedMs": 1450,
+        "startedAtUnixMs": 1793214679615,
+        "finishedAtUnixMs": 1793214681065,
+        "wallClockRollbackObserved": false,
+        "threadCpuUserUs": 0,
+        "threadCpuSystemUs": 0,
+        "ownerEpoch": 1
+      },
+      {
+        "kind": "chat",
+        "mode": "long-persistent",
+        "phase": "owner-stage",
+        "sequence": 3,
+        "operation": "save-reference-state",
+        "stage": "sqlite_commit",
+        "elapsedMs": 2019,
+        "startedAtUnixMs": 1793214683474,
+        "finishedAtUnixMs": 1793214685493,
+        "wallClockRollbackObserved": false,
+        "threadCpuUserUs": 0,
+        "threadCpuSystemUs": 0,
+        "ownerEpoch": 1
+      },
+      {
+        "kind": "chat",
+        "mode": "long-persistent",
+        "phase": "owner-stage",
+        "sequence": 4,
+        "operation": "save-reference-state",
+        "stage": "sqlite_commit",
+        "elapsedMs": 5448,
+        "startedAtUnixMs": 1793214687388,
+        "finishedAtUnixMs": 1793214692836,
+        "wallClockRollbackObserved": false,
+        "threadCpuUserUs": 0,
+        "threadCpuSystemUs": 0,
+        "ownerEpoch": 1
+      }
+    ],
+    "qualification": false
+  },
+  "invariants": [
+    "Every snapshot independently authenticates actual manifest and payload bytes.",
+    "No authentication proof survives COMMIT.",
+    "Original FULL/DELETE, expiry, exact ACK, budgets and all deadlines unchanged."
+  ],
+  "new24hStarted": false,
+  "realModelRequests": 0,
+  "remaining": "Persistent five-second tail, current-source full gates, latest local installer and both clients, secure quota reconciliation and real providers, valid real24h/expiry, paused maximum-capacity and controlled self-use remain incomplete."
+}

docs/context-recovery-handoff.md

@@ -1,5 +1,16 @@
 # 上下文恢复换机交接
 
+## 2026-10-28：消除快照容量证明的整树序列化；50f 五秒 COMMIT 失败保持
+
+实际Windows固定ae旧源码四根32MiB阶段诊断已自然退出0，控制器161196ms；构造10702/10598/7181/9708ms，保存7407/7544/12742/16027ms，同目录重开23062ms，加载10043/10196/10391/10990ms，完成会话恢复。仅授旧源码诊断范围，不覆盖原180秒取消或授最新版本/五秒/24h资格。此前两次诊断自身错误（额外测试父进程吞所属Job握手、阶段数预期错误）发生在产品调用前，已分别冻结，不当作产品根因。
+
+沿重开快照路径发现：完成有界准入后仍JSON.stringify整棵历史并递归扫描原文字节。新回归先红：额外整树序列化1次，现0次；同一编码器仍完整描述符克隆并检查原节点/深度/编码字节，测量只返回计数。编码字节加数组ASCII索引键长度，构成旧raw-key计数的保守上界；只用于v9/v10容量证明，临界失败仍转原完整认证hydrate，旧布局保持原路径。没有跨COMMIT认证缓存或原期限/ACK/持久语义变更。
+
+纯相关四文件140通过；扩大168项167通过/1个既有Mac原生开库不可用，零skip，Windows条件体返回不授Windows实际资格。新度量用例覆盖正常/空/转义/代理项/极端数组键/非法/资源上限/Proxy/getter/后续修改，统一unit发现确认；1737语法、定向Lint及CI治理通过。同8MiB内存快照五次基线181/161/159/173/175ms，修改162/171/164/190/189ms：没有墙钟提速证明，只确认额外整树序列化5→0，不授五秒修复。
+
+50f普通40750514561终态failure：七作业成功，coverage123035650972完整3741220字符日志中Chat long-persistent第0轮实际5003ms请求失败，同轮COMMIT2019/5448ms且线程CPU记录0；不能用JS去重解释或掩盖此持久等待。正式与额外I/O尚未终态；b7的4634ms COMMIT/5009ms请求及原生拒绝子进程退出失败分别保留。证据见context-recovery-evidence/snapshot-shape-byte-measurement.json。没有有效24h在跑/没有重启，模型0、旧实例与最大容量暂停保持。下一步需进一步区分同轮SQL提交的持久I/O等待与观测环境成本，保留原门禁，不移除认证或持久步骤制造绿色。
+
+
 ## 2026-10-28：消除 checkpoint 转引用的连续重复准入；五秒与完整容量失败保持
 
 referenceStateFromCheckpoint原先先完整normalize，再交parseRootCheckpoint再次normalize同份私有历史。回归先红：实际2次/预期1次；现专用入口从未知输入完整准入一次，再对本次拥有的root完成同样摘要重算和全部语义校验，外部expected-root解析接口仍独立准入且保持原关联检查。没有暴露可跳校验的内部函数、跨调用缓存或跨COMMIT复用认证。覆盖逐调用重新准入、输出隔离、旧无publications格式、有效摘要但非法budget、摘要/期限篡改、空/非法/getter/Proxy输入；相关四文件174项通过，零fail/skip，但Mac中Windows条件体返回不授Windows实际资格。

docs/context-recovery-implementation-status.md

@@ -1,5 +1,16 @@
 # HTTPS Proxy 多端上下文恢复实施状态
 
+## 2026-10-28：消除快照容量证明的整树序列化；50f 五秒 COMMIT 失败保持
+
+实际Windows固定ae旧源码四根32MiB阶段诊断已自然退出0，控制器161196ms；构造10702/10598/7181/9708ms，保存7407/7544/12742/16027ms，同目录重开23062ms，加载10043/10196/10391/10990ms，完成会话恢复。仅授旧源码诊断范围，不覆盖原180秒取消或授最新版本/五秒/24h资格。此前两次诊断自身错误（额外测试父进程吞所属Job握手、阶段数预期错误）发生在产品调用前，已分别冻结，不当作产品根因。
+
+沿重开快照路径发现：完成有界准入后仍JSON.stringify整棵历史并递归扫描原文字节。新回归先红：额外整树序列化1次，现0次；同一编码器仍完整描述符克隆并检查原节点/深度/编码字节，测量只返回计数。编码字节加数组ASCII索引键长度，构成旧raw-key计数的保守上界；只用于v9/v10容量证明，临界失败仍转原完整认证hydrate，旧布局保持原路径。没有跨COMMIT认证缓存或原期限/ACK/持久语义变更。
+
+纯相关四文件140通过；扩大168项167通过/1个既有Mac原生开库不可用，零skip，Windows条件体返回不授Windows实际资格。新度量用例覆盖正常/空/转义/代理项/极端数组键/非法/资源上限/Proxy/getter/后续修改，统一unit发现确认；1737语法、定向Lint及CI治理通过。同8MiB内存快照五次基线181/161/159/173/175ms，修改162/171/164/190/189ms：没有墙钟提速证明，只确认额外整树序列化5→0，不授五秒修复。
+
+50f普通40750514561终态failure：七作业成功，coverage123035650972完整3741220字符日志中Chat long-persistent第0轮实际5003ms请求失败，同轮COMMIT2019/5448ms且线程CPU记录0；不能用JS去重解释或掩盖此持久等待。正式与额外I/O尚未终态；b7的4634ms COMMIT/5009ms请求及原生拒绝子进程退出失败分别保留。证据见context-recovery-evidence/snapshot-shape-byte-measurement.json。没有有效24h在跑/没有重启，模型0、旧实例与最大容量暂停保持。下一步需进一步区分同轮SQL提交的持久I/O等待与观测环境成本，保留原门禁，不移除认证或持久步骤制造绿色。
+
+
 ## 2026-10-28：消除 checkpoint 转引用的连续重复准入；五秒与完整容量失败保持
 
 referenceStateFromCheckpoint原先先完整normalize，再交parseRootCheckpoint再次normalize同份私有历史。回归先红：实际2次/预期1次；现专用入口从未知输入完整准入一次，再对本次拥有的root完成同样摘要重算和全部语义校验，外部expected-root解析接口仍独立准入且保持原关联检查。没有暴露可跳校验的内部函数、跨调用缓存或跨COMMIT复用认证。覆盖逐调用重新准入、输出隔离、旧无publications格式、有效摘要但非法budget、摘要/期限篡改、空/非法/getter/Proxy输入；相关四文件174项通过，零fail/skip，但Mac中Windows条件体返回不授Windows实际资格。

lib/proxy/context-recovery-state-encoder.js

@@ -14,11 +14,12 @@ const RECOVERY_STATE_BYTES = 112 * 1024 * 1024;
 function invalid() {
   return new TypeError('invalid_context_recovery_state_data');
 }
-function cloneRecoveryStateData(input, maximum = RECOVERY_STATE_BYTES, facts) {
+function encodeRecoveryStateData(input, maximum = RECOVERY_STATE_BYTES, facts, measure = false) {
   if (!Number.isSafeInteger(maximum) || maximum < 1 || maximum > RECOVERY_STATE_BYTES + 4096)
     throw invalid();
   let remaining = maximum,
     nodes = 65536;
+  let arrayKeyBytes = 0;
   const ancestors = new Set();
   // Short checkpoint IDs must not consume every memo slot before repeated
   // original bodies arrive. Keep both tiers local to this parse, with the
@@ -152,6 +153,7 @@ function cloneRecoveryStateData(input, maximum = RECOVERY_STATE_BYTES, facts) {
       if (typeof name !== 'string' || !slot?.enumerable || !Object.hasOwn(slot, 'value'))
         throw invalid();
       if (index) spend(1);
+      if (measure && array) arrayKeyBytes += name.length;
       const keyBytes = array ? 0 : stringBytes(name, collect) + 1;
       if (!array) spend(keyBytes);
       const keyRaw = collect ? (array ? Buffer.byteLength(name) : latestRaw) : 0;
@@ -192,7 +194,19 @@ function cloneRecoveryStateData(input, maximum = RECOVERY_STATE_BYTES, facts) {
     } else if (facts && depth === 0) Object.freeze(output);
     return output;
   }
-  return clone(input, 0);
+  const value = clone(input, 0);
+  // JSON covers all scalar/key raw bytes except array-index property names.
+  // Adding those ASCII names conservatively bounds the legacy raw-key metric.
+  // Only counters escape measurement; the private clone is not retained.
+  return measure
+    ? { encodedBytes: maximum - remaining, rawBytesUpperBound: maximum - remaining + arrayKeyBytes }
+    : value;
+}
+function cloneRecoveryStateData(input, maximum, facts) {
+  return encodeRecoveryStateData(input, maximum, facts);
+}
+function measureRecoveryStateData(input, maximum) {
+  return encodeRecoveryStateData(input, maximum, undefined, true);
 }
 
-module.exports = { RECOVERY_STATE_BYTES, cloneRecoveryStateData };
+module.exports = { RECOVERY_STATE_BYTES, cloneRecoveryStateData, measureRecoveryStateData };

lib/proxy/context-recovery-storage-blobs.js

@@ -14,6 +14,7 @@ const {
   RECOVERY_STATE_BYTES,
 } = require('./context-recovery-state-data');
 const { recoveryRootCapacity } = require('./context-recovery-capacity');
+const { measureRecoveryStateData } = require('./context-recovery-state-encoder');
 const { parseReferencePayloads } = require('./context-recovery-reference-write');
 const {
   parseReferenceState,
@@ -205,7 +206,7 @@ function createRecoveryBlobStorage(database, cipher, getStoreId, enabled) {
       const empty = (list) => list.map((source) => ({ ...source, output: '' }));
       // The exact hydrated shape, with scalar empty strings instead of originals,
       // preserves both normalizers' node/depth and array-prefix requirements.
-      const skeleton = normalizeRecoveryCheckpointData({
+      const input = {
         version: 1,
         kind: 'recovery-write-ahead',
         digest: '0'.repeat(64),
@@ -221,7 +222,21 @@ function createRecoveryBlobStorage(database, cipher, getStoreId, enabled) {
         },
         stagedSources: empty(reference.stagedSources),
         publications: reference.publications,
-      });
+      };
+      if (sourceVersion === 9 || sourceVersion === 10) {
+        const size = measureRecoveryStateData(input);
+        const originals = referenceSources(reference).reduce(
+          (bytes, source) => bytes + source.bytes,
+          0
+        );
+        // The conservative raw bound may request the existing exact hydration
+        // near a limit; it never admits more bytes, nodes or depth than before.
+        return (
+          Math.max(size.encodedBytes, size.rawBytesUpperBound) + 6 * originals <=
+          RECOVERY_STATE_BYTES
+        );
+      }
+      const skeleton = normalizeRecoveryCheckpointData(input);
       function rawBytes(value) {
         if (typeof value === 'string') return Buffer.byteLength(value);
         if (!value || typeof value !== 'object') return 0;

test/context-recovery-state-measure.test.js

@@ -0,0 +1,108 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const {
+  cloneRecoveryStateData,
+  measureRecoveryStateData,
+} = require('../lib/proxy/context-recovery-state-encoder');
+
+function rawBytes(value) {
+  if (typeof value === 'string') return Buffer.byteLength(value);
+  if (!value || typeof value !== 'object') return 0;
+  return Object.keys(value).reduce(
+    (bytes, key) => bytes + Buffer.byteLength(key) + rawBytes(value[key]),
+    0
+  );
+}
+
+test('state measurement preserves encoded bytes and conservatively bounds raw array keys', () => {
+  for (const value of [
+    null,
+    true,
+    false,
+    -0,
+    1e100,
+    '',
+    '原文🙂',
+    '\ud800',
+    '\udc00',
+    '\0\b\t\n\f\r"\\',
+    [],
+    {},
+    [null, false, -0],
+    { 'escaped"key': ['原文🙂', { nested: '\ud800' }] },
+    Array(1025).fill(''),
+    { nested: [Array(10000).fill(''), ['exact']] },
+    { first: 'x'.repeat(600000), second: 'x'.repeat(600000) },
+    Array.from({ length: 65536 }, (_, index) => String.fromCharCode(index)).join(''),
+  ]) {
+    const encodedBytes = Buffer.byteLength(JSON.stringify(value));
+    const measured = measureRecoveryStateData(value, encodedBytes);
+    assert.equal(measured.encodedBytes, encodedBytes);
+    assert.ok(measured.rawBytesUpperBound >= rawBytes(value));
+    assert.deepEqual(Object.keys(measured).sort(), ['encodedBytes', 'rawBytesUpperBound']);
+    assert.equal(
+      JSON.stringify(cloneRecoveryStateData(value, encodedBytes)),
+      JSON.stringify(value)
+    );
+    if (encodedBytes > 1) assert.throws(() => measureRecoveryStateData(value, encodedBytes - 1));
+  }
+});
+
+test('state measurement keeps complete descriptor, depth and occurrence admission', () => {
+  let touched = 0;
+  const hook = () => {
+    touched++;
+    throw Error('must not run');
+  };
+  const revoked = Proxy.revocable({}, {});
+  revoked.revoke();
+  const cycle = {};
+  cycle.self = cycle;
+  const sparse = [];
+  sparse.length = 1;
+  let deep = 'leaf';
+  for (let index = 0; index < 65; index++) deep = [deep];
+  for (const value of [
+    undefined,
+    NaN,
+    Infinity,
+    1n,
+    () => {},
+    cycle,
+    sparse,
+    deep,
+    Array(65536).fill(null),
+    Object.defineProperty({}, 'value', { enumerable: true, get: hook }),
+    new Proxy({}, { ownKeys: hook, getPrototypeOf: hook, getOwnPropertyDescriptor: hook }),
+    revoked.proxy,
+    new Date(),
+    { [Symbol('hidden')]: 'value' },
+  ]) {
+    assert.throws(() => cloneRecoveryStateData(value));
+    assert.throws(() => measureRecoveryStateData(value));
+  }
+  assert.equal(touched, 0);
+  for (const maximum of [0, -1, NaN, Infinity, 1.5, 112 * 1024 * 1024 + 4097])
+    assert.throws(() => measureRecoveryStateData({}, maximum));
+});
+
+test('state measurement counts without serialization and never retains prior admission', (t) => {
+  const value = { entries: Array(32).fill('private synthetic body') };
+  const expected = Buffer.byteLength(JSON.stringify(value));
+  t.mock.method(JSON, 'stringify', (input) => {
+    assert.ok(input === null || typeof input !== 'object', 'must not serialize the retained tree');
+    return String(input);
+  });
+  assert.equal(measureRecoveryStateData(value).encodedBytes, expected);
+  value.entries.push('changed');
+  assert.ok(measureRecoveryStateData(value).encodedBytes > expected);
+  Object.defineProperty(value, 'later', {
+    enumerable: true,
+    get() {
+      return assert.fail('getter invoked');
+    },
+  });
+  assert.throws(() => measureRecoveryStateData(value));
+});