Found reviewing PR #144 (round 10). Deliberately out of that PR's scope — a refinement of the bypass it introduces, not a defect in it.
Current behaviour
resolve.ts bypassBackOffWhenUnservable is set only by /internal/*, and on that path it is unconditional: a warm <key>:neg transient marker never short-circuits the load. That is intentional (resolve.ts:205-216) — honouring the marker on a cold slot would 503 without ever calling findRelease, and the crawler would pin the resulting placeholder, which is #143 via the alignment that fixes it.
The operational shape it produces
gitlab.gnome.org is down for 20 minutes. Slack/X/Discord re-request the OG PNG about once a minute per permalink (web-og caches the placeholder at max-age=60). Each request skips the warm marker, runs findRelease out to the 28s hard deadline through the single-instance GitlabRelay DO (max_instances = 1), fails, and re-stamps the marker.
So a down host is probed once a minute per unfurled key for the whole outage, through a shared singleton relay.
Second-order, and the part not covered by the existing rationale: because the crawler keeps re-stamping the marker, it is almost never older than NEG_TTL (60s). Human page views on the same key — which do not bypass — therefore hit a warm marker on nearly every request and stay on the "checking…" card for the entire outage, instead of getting a genuine retry window each minute. The crawler's unthrottled probing starves the humans' back-off of its recovery window.
Sketch of a fix
The existing comment argues that gating the bypass on a fraction of NEG_TTL "would only move which unfurls get the permanent placeholder, not stop them" — true for the crawler, but it does not address the human-page-view starvation. Options worth weighing:
- record a
bypassed flag on the marker and honour it after the first bypass, keeping the "crawler asks once" property for the first unfurl without turning every subsequent one into an unthrottled probe
- do not re-stamp the marker on a bypassed load, so its age reflects the last human attempt and page views keep their per-minute retry window
Either needs a test around the marker's age semantics; neither belonged in #144.
Found reviewing PR #144 (round 10). Deliberately out of that PR's scope — a refinement of the bypass it introduces, not a defect in it.
Current behaviour
resolve.tsbypassBackOffWhenUnservableis set only by/internal/*, and on that path it is unconditional: a warm<key>:negtransient marker never short-circuits the load. That is intentional (resolve.ts:205-216) — honouring the marker on a cold slot would 503 without ever callingfindRelease, and the crawler would pin the resulting placeholder, which is #143 via the alignment that fixes it.The operational shape it produces
gitlab.gnome.orgis down for 20 minutes. Slack/X/Discord re-request the OG PNG about once a minute per permalink (web-og caches the placeholder atmax-age=60). Each request skips the warm marker, runsfindReleaseout to the 28s hard deadline through the single-instanceGitlabRelayDO (max_instances = 1), fails, and re-stamps the marker.So a down host is probed once a minute per unfurled key for the whole outage, through a shared singleton relay.
Second-order, and the part not covered by the existing rationale: because the crawler keeps re-stamping the marker, it is almost never older than
NEG_TTL(60s). Human page views on the same key — which do not bypass — therefore hit a warm marker on nearly every request and stay on the "checking…" card for the entire outage, instead of getting a genuine retry window each minute. The crawler's unthrottled probing starves the humans' back-off of its recovery window.Sketch of a fix
The existing comment argues that gating the bypass on a fraction of
NEG_TTL"would only move which unfurls get the permanent placeholder, not stop them" — true for the crawler, but it does not address the human-page-view starvation. Options worth weighing:bypassedflag on the marker and honour it after the first bypass, keeping the "crawler asks once" property for the first unfurl without turning every subsequent one into an unthrottled probeEither needs a test around the marker's age semantics; neither belonged in #144.