# RustProxy 0.24.7 transform resource-control audit

## Scope

0.24.7 makes the transformation resource envelope configurable without changing transformation semantics. The global transform configuration now persists a UI resource preset, a process-wide temporary-memory ceiling, and a process-wide concurrent-transform ceiling. Existing configurations inherit the former 128 MiB memory behavior and a 32-attempt concurrency ceiling through serde defaults.

This workspace still has no Rust/Cargo toolchain, so compiler/type/runtime acceptance and sustained RSS profiling remain release-host gates.

## Resource controls

| Control | Default | Range | Behavior |
|---|---:|---:|---|
| `memory_budget_bytes` | 128 MiB | 1 MiB..2 GiB | Process-wide ceiling for estimated origin/decode/output buffers. It is not pre-allocated. If a new transform would exceed the current configured ceiling, the response fails open unchanged with `memory_pressure`. |
| `max_body_bytes` | 2 MiB | 1 KiB..32 MiB | Hard aggregation/decompression ceiling for one transformable response. |
| `max_inflight` | 32 | 1..1024 | Process-wide active transform-attempt ceiling. New work fails open unchanged with `concurrency_pressure` instead of waiting. |

The memory limiter uses atomic byte reservations so a live configuration change takes effect for new attempts without resizing or replacing a semaphore. Existing reservations release their exact charge on drop.

## Presets

Presets persist only administrator intent; numeric values are authoritative. They do not change enabled transform kinds or the extension allow-list.

| Preset | Memory | Max body | Max concurrent |
|---|---:|---:|---:|
| RAM saver | 32 MiB | 1 MiB | 8 |
| Recommended | 128 MiB | 2 MiB | 32 |
| Performance | 512 MiB | 8 MiB | 64 |
| Uber performance | 1 GiB | 32 MiB | 128 |

Manual edits of any of the three resource fields clear the preset label to Custom. Settings stores the selected preset in the same revisioned SQLite configuration document and restores it after reopen.

## Cache compatibility

Global transform representation/eligibility settings are now included in cache compatibility identity. Changing enabled transform kinds, extensions or `max_body_bytes` rotates the identity so cached representations cannot outlive a semantic policy change.

Resource-only fields (`preset`, `memory_budget_bytes`, `max_inflight`) are normalized out of the compatibility hash. Capacity tuning therefore does not purge HOT/COLD objects by itself.

## UI safeguards

The Transform settings page exposes all three resource controls and four presets. It warns when the configured temporary-memory budget is smaller than the worst-case estimate for one maximum-size compressed response, and when the budget exceeds 50% of detected effective host/cgroup RAM. Warnings do not block an intentional expert configuration.

## Runtime dashboard accounting

The same 0.24.7 release now exposes live resource accounting without changing any
resource limit. `GET /api/status` reports a `transform_resources` view and a
`memory_accounting` view. The Overview Process block shows process RSS, HOT cache RAM,
cache transient RAM, the transform reservation/budget, active transform slots and the
remaining non-cache RSS. The transform reservation is an intentionally conservative
limiter charge, so it is shown as an overlapping diagnostic rather than added to RSS.

`non_cache_rss_bytes` is `process RSS - accounted HOT/transient cache RAM` with saturating
subtraction. It therefore still includes transform buffers, connections, TLS, logging,
Tokio/runtime state, allocator overhead and any other untracked process allocations. This
is preferable to inventing per-subsystem heap precision that the allocator does not
provide.

The cache runtime view now also exposes `cold_limit_bytes` and `cold_limit_entries`; the
overview cache block shows current COLD disk bytes and objects against those limits. COLD
is explicitly disk occupancy and is never added to process RAM.

The dedicated Transform dashboard also shows current process-wide reserved bytes versus
`memory_budget_bytes` and active transform attempts versus `max_inflight`.

## Regression coverage

- transform settings validation and serde preset round-trip;
- local atomic memory reservation obeys a runtime byte ceiling;
- local atomic inflight reservation obeys a runtime concurrency ceiling;
- SQLite close/reopen preserves transform preset, memory budget and concurrency limit;
- cache identity ignores resource-only changes but rotates for transform representation/eligibility changes;
- `tools/checks/memory_contracts.py` verifies the new dynamic memory/concurrency bounds without Rust;
- source/release smoke checks verify the Transform UI, OpenAPI fields and release identity.
- source/release smoke checks reject `anyhow::Context` on the boxed bounded-body collection error and require explicit `anyhow::Error` mapping.

## Release-host acceptance gate

Run `./dev.sh fmt`, `./dev.sh check` and `./dev.sh test`, then stress each preset with identity and compressed JS/CSS/HTML/SVG/JSON bodies. Acceptance target: RSS plateaus after warm-up, active transform work never exceeds the configured byte/concurrency ceilings, `memory_pressure`/`concurrency_pressure` appear only when expected, and cache contents remain valid after changing resource-only settings.