Part of the origin-side abuse protection plan (assuming Akamai Bot Manager removal). Follows merged PR1 #2263, PR2 #2264, and PR3 (input validation).
Scope (plan §7)
Lightweight in-flight / pool-saturation guard in srv/lib/content-store.js serveHandler: when concurrent DB reads exceed a configured ceiling, shed with 503 + Retry-After rather than OOM. The anonymous content-serve path reads gzip BLOBs per-request from HANA with no static fallback, and we have known OOM sensitivity — this bounds the blast radius of a scraper flood that gets past the edge cache.
Notes / constraints
- Config (concurrency ceiling, Retry-After) from the ImsConfig-backed runtime-config module (~5s cache), env-free.
- Metrics-driven: emit
loadshed.triggered via srv/lib/metrics.js.
- DB-flag gated (registry entry + drift test), fail-open — if the guard errors, serve normally (never block content on the guard).
content-store.js change → re-walk the srv-qa cp list in .deploy/mta.yaml; watch srv-qa memory (OOM history at 768M, needs ≥1536M).
Verification
- Unit (
npm test): guard sheds above ceiling, allows below, releases in-flight count on both success and error paths, fail-open on guard error.
- Manual: concurrent load above ceiling returns
503 + Retry-After; normal traffic unaffected; X-Content-Source + cache headers intact.
Default OFF; enable on DEV, observe, then PROD.
Part of the origin-side abuse protection plan (assuming Akamai Bot Manager removal). Follows merged PR1 #2263, PR2 #2264, and PR3 (input validation).
Scope (plan §7)
Lightweight in-flight / pool-saturation guard in
srv/lib/content-store.jsserveHandler: when concurrent DB reads exceed a configured ceiling, shed with503 + Retry-Afterrather than OOM. The anonymous content-serve path reads gzip BLOBs per-request from HANA with no static fallback, and we have known OOM sensitivity — this bounds the blast radius of a scraper flood that gets past the edge cache.Notes / constraints
loadshed.triggeredviasrv/lib/metrics.js.content-store.jschange → re-walk thesrv-qacplist in.deploy/mta.yaml; watch srv-qa memory (OOM history at 768M, needs ≥1536M).Verification
npm test): guard sheds above ceiling, allows below, releases in-flight count on both success and error paths, fail-open on guard error.503 + Retry-After; normal traffic unaffected;X-Content-Source+ cache headers intact.Default OFF; enable on DEV, observe, then PROD.