Description
From the 2026-07-05 performance & architecture review (P0 finding 3).
collect_dispatched_auction (orchestrator.rs:933-1039) has no wall-clock deadline; it relies on per-backend between-bytes timeouts, which a slow-drip bidder resets byte by byte. The design doc's load-bearing invariant — auction overrun never blocks the page past A_deadline — is therefore unenforced. One misbehaving SSP endpoint can stall page completion on every matched navigation.
Fix
Mirror the deadline check the parallel path already has (orchestrator.rs:625-631) so the collect loop is bounded by a hard wall-clock deadline.
Effort / expected effect
- Effort: Small
- Expected effect: Enforces the design's bounded-hold invariant.
Sequencing item 2 of 10.
Description
From the 2026-07-05 performance & architecture review (P0 finding 3).
collect_dispatched_auction(orchestrator.rs:933-1039) has no wall-clock deadline; it relies on per-backend between-bytes timeouts, which a slow-drip bidder resets byte by byte. The design doc's load-bearing invariant — auction overrun never blocks the page pastA_deadline— is therefore unenforced. One misbehaving SSP endpoint can stall page completion on every matched navigation.Fix
Mirror the deadline check the parallel path already has (
orchestrator.rs:625-631) so the collect loop is bounded by a hard wall-clock deadline.Effort / expected effect
Sequencing item 2 of 10.