perf(deploy): flatten-session caching, bulk DeploySiteAsync, paged management queries

2026-08-14 21:14:22 -04:00
parent ee193cd2bb
commit 48b3c40a7f
59 changed files with 3051 additions and 231 deletions
@@ -158,6 +158,19 @@ Mirrors `TriggerExpressionGlobals` in the same way. Used by `ValidationService.C

 `CheckExpressionSyntax` memoises its verdict in the Template Engine's process-wide `ScriptCompileVerdictCache`, whose key is the pair **(globals surface, SHA-256 of the code)** — not the code alone. The surface discriminator is load-bearing: a trigger expression vetted against `TriggerCompileSurface` is **not** interchangeable with a `ScriptCompileSurface` script-body verdict (different globals resolve different identifiers), so a code-only key could return a stale "clean" for code never compiled against the caller's surface. Keying by surface makes that cross-surface verdict reuse structurally impossible.

+**Eviction is segmented, never wholesale (WP2.5).** The cache is bounded at two
+generations of 2048 entries. New verdicts land in the *hot* generation; a hit in
+*cold* is promoted back into hot; on overflow hot becomes the new cold and only the
+old cold — the half nothing has touched for a full generation — is dropped.
+
+The bound must never be enforced by clearing the cache outright. That reads as
+harmless ("a verdict is cheap to recompute") but is not: a recompute is a fresh
+Roslyn compile, and every script compile loads an assembly through a
+**non-collectible `InteractiveAssemblyLoader`**. Bounding that leak is the entire
+reason this cache exists, so dropping every hot entry at the 4096th distinct script
+would re-open it for the whole working set at once. Segmenting retains anything in
+active use across an eviction while keeping the same ceiling.
+
 #### Parity guard

 A reflection-based parity test in `SiteRuntime.Tests` compares the public member names on `ScriptCompileSurface` against `ScriptGlobals` (and `TriggerCompileSurface` against `TriggerExpressionGlobals`). Any drift between the stub and the real globals causes this test to fail, ensuring the stubs cannot silently fall out of sync.