fix(cloudflare): bound retained response heap by byte ceiling

[seonghobae]

Problem

Protected #618 moved direct Cloudflare deploy/status/recovery response parsing from response.text() to streaming byte admission, but the shared reader still retained every incoming Uint8Array in a chunks array until EOF. The accepted payload was capped at 1 MiB, yet retained heap/object overhead could still scale with stream chunk cardinality rather than only with the byte ceiling. A highly fragmented response therefore caused avoidable heap/GC amplification inside the production control-plane path before the same bounded payload was decoded.

The WHATWG Streams model exposes chunk reads individually and BYOB exists to let consumers control allocation; the byte-stream contract does not make a per-response chunk-cardinality bound part of Noema's resource guarantee. This repair stays inside Noema deployment/recovery transport. It does not move provider routing, Cloudflare truth, credentials, quarantine/security/outbound authority, or domain data into Noema.

Test-first RED

Test-only exact 115fc46fa0fe66eb21a292823704139659f78986 added a regression requiring the shared reader to avoid retaining a per-chunk array and to preserve successful decoding of a maximally fragmented valid response. Hosted CI run 34589796858 checked out that exact head, passed live-base/toolchain/install/typecheck, then failed at release tests; downstream release/security/KPI evidence steps were skipped. This is the intended reality RED.

Minimum causal repair

Exact b746846e4890c84b568bb29937594e1b17364fa1 replaces the per-chunk retention array with one Uint8Array(maxResponseBytes) allocated for the admitted ceiling. Each accepted chunk is copied directly into that fixed buffer; oversized chunks are still rejected before acceptance, and decoding uses only subarray(0, totalBytes). Existing cancellation, reader-lock release, fatal UTF-8/JSON admission and provider-error semantics are unchanged.

The existing CHANGELOG and OPERABILITY contract from protected #618 already requires incremental consumption under the 1 MiB ceiling and remains semantically current; this PR strengthens retained-heap behavior without changing the public/control-plane contract. The moving product-technical baseline cannot truthfully classify #620 as protected until its normal merge identity exists, so protected-source classification is a post-merge documentation successor rather than a pre-merge fabricated authority claim.

Exact-head evidence

For exact b746846e4890c84b568bb29937594e1b17364fa1 against base 6808a8f08970c107354e81b5a4e21adaf64fc502:

• application CI 34590022584: terminal SUCCESS;
• reviewer-ci 34590022650: terminal SUCCESS;
• required Security Scan 34590022557: terminal SUCCESS;
• patch-validator-image 34590022610: terminal SUCCESS.

Fresh COMMENT-only current-head review found no additional source/test/DDD/owner-boundary finding and there are no unresolved inline threads. This evidence is source integration authority only; it is not immutable release, deployment, recovery rehearsal, SLO, or production outcome evidence.

Summary by CodeRabbit

• 버그 수정

  • 스트리밍 응답 처리 시 응답 청크 수와 관계없이 설정된 바이트 제한 내에서 메모리를 사용하도록 개선했습니다.
  • 작은 단위로 나뉜 응답도 정상적으로 처리되며, 초과 응답 취소와 오류 처리는 기존과 동일하게 유지됩니다.

• 테스트

  • 다양한 청크 크기의 스트리밍 JSON 응답과 메모리 제한 동작을 검증하는 테스트를 추가했습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 50a265a8-2bf5-4782-9b77-20eb110a5013

📥 Commits

Reviewing files that changed from the base of the PR and between 6808a8f and b746846.

📒 Files selected for processing (2)

• scripts/lib/cloudflare-response.mjs
• test/cloudflare-response-bounds.test.ts

---

📝 Walkthrough

Walkthrough

Cloudflare 응답 헬퍼가 청크 배열 대신 maxResponseBytes 크기의 Uint8Array를 사용합니다. 응답 청크를 직접 기록하고 실제 바이트 범위만 디코딩합니다. 1바이트 청크 스트림을 검증하는 테스트를 추가합니다.

Changes

Cloudflare 응답 버퍼링

Layer / File(s)	Summary
제한된 응답 버퍼 읽기 scripts/lib/cloudflare-response.mjs, test/cloudflare-response-bounds.test.ts	응답 청크를 사전 할당한 Uint8Array에 기록합니다. 실제 수신 바이트만 UTF-8로 디코딩합니다. 1바이트 단위 청크와 JSON 결과를 검증합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/cloudflare-fixed-response-buffer-20260911

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head review at b746846e4890c84b568bb29937594e1b17364fa1: the reality RED is valid and isolated to chunk-cardinality retention; the causal source change removes per-chunk retention while preserving pre-accept byte-ceiling rejection, cancellation precedence, reader-lock cleanup, fatal UTF-8/JSON admission, and provider-error semantics. The behavioral one-byte fragmentation regression covers the intended adversarial case. No additional source/test/DDD or owner-boundary finding identified in the two-file diff. This COMMENT is not an approval; merge authority still requires all required exact-head gates terminal GREEN and fresh base/head/thread verification.