fix(rate-limit): bound stream retention

[seonghobae]

Finding

Fresh protected main@5eb40da90bc18fc0fee7c18bfa86a337968fd3fb retained every accepted stream chunk in both distributed rate-limit bounded readers: the 256-byte internal request and the 4,096-byte Durable Object decision response. Both paths enforced authoritative byte ceilings but kept chunks[] until EOF and then allocated/copied into a second contiguous buffer, so legal high-fragmentation streams could make retained chunk-object/backing-store count scale independently of the byte limit.

Reality RED

Test-only exact b461c68369fe78d39b335e4353d287f3c5d85207 added executable retained-storage regressions while leaving production source unchanged. Hosted application CI 34640763052 checked out that exact head, passed base/toolchain/install/typecheck, then failed at release tests, establishing the intended RED rather than an infrastructure failure.

Causal repair

Production repair 74791910c8865ce82e2eba61a1523d251b9976cb replaces per-chunk retention in both readers with one preallocated bounded Uint8Array, rejects an oversize chunk before copying it, writes accepted bytes directly at the current offset, and decodes only the received subarray. Existing fail-closed cancellation, malformed-body handling, fatal UTF-8/duplicate-key/JSON admission, configured byte ceilings, bucket semantics, identity authority, and Durable Object ownership remain unchanged.

Documentation convergence is included on the current exact candidate f59fce008a4da70f89e9927f692b823506594ed5: docs/distributed-rate-limiting.md records the 256/4,096-byte fixed-buffer retention boundary and keeps deployed heap/p95 as separate evidence; CHANGELOG.md records PR #650 under Unreleased without promoting source hardening to immutable release or production outcome authority.

All required hosted gates must be terminal GREEN on this current exact head before Ready/merge. Predecessor GREEN will not be reused.

Owner boundary

This lane is confined to Noema's distributed rate-limit Durable Object transport/storage hygiene. It does not change rate-limit truth or bucket semantics, identity authority, credentials, provider/model routing, foreign outbound or quarantine authority, release/deployment, or production KPI authority. Source-level retention hardening is not immutable release, deployed heap/p95 evidence, or a production outcome.

Summary by CodeRabbit

• 개선 사항
  • /exchange 및 분산 rate limit 처리에서 요청과 결정 본문을 고정 크기 버퍼로 읽도록 개선했습니다.
  • 요청 본문은 256바이트, 결정 본문은 4,096바이트까지 허용하며, 초과 입력은 즉시 거부됩니다.
  • 스트리밍 청크 수와 관계없이 메모리 사용량을 일정하게 유지합니다.
  • 기존 취소, UTF-8, JSON 검증 및 권한 검증 동작은 유지됩니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 410f8ad4-affc-4269-b85c-4b7389e85265

📥 Commits

Reviewing files that changed from the base of the PR and between 5eb40da and f59fce0.

📒 Files selected for processing (4)

• CHANGELOG.md
• docs/distributed-rate-limiting.md
• src/rate-limit.ts
• test/rate-limit-retention.test.ts

---

📝 Walkthrough

Walkthrough

요청 및 결정 스트림 리더가 청크 배열 대신 고정 크기 Uint8Array에 직접 기록합니다. 요청은 256바이트, 결정은 4,096바이트로 제한합니다. 초과 입력은 복사 전에 거부하며, 관련 문서와 소스 구조 검증 테스트를 추가합니다.

Changes

스트림 저장소 변경

Layer / File(s)	Summary
요청 및 결정 리더 저장소 src/rate-limit.ts, docs/distributed-rate-limiting.md, CHANGELOG.md	요청 및 결정 본문을 고정 크기 Uint8Array에 직접 기록합니다. 요청은 256바이트, 결정은 4,096바이트로 제한합니다. 초과 입력은 기존 오류와 취소 처리를 적용하기 전에 거부합니다.
저장소 유지 검증 test/rate-limit-retention.test.ts	소스에 청크 배열 누적이 없고, 고정 버퍼의 set 및 subarray 처리가 존재하는지 검사합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/rate-limit-retention-20260912

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current exact f59fce008a4da70f89e9927f692b823506594ed5 reviewed across the production diff, retained-storage regression, distributed rate-limit operating documentation, and CHANGELOG convergence. No additional valid source/test/DDD/owner-boundary finding remains in this exact diff. This is a COMMENT-only source review, not self-approval; merge authority still requires all required hosted gates to finish terminal GREEN on this exact head, zero unresolved review threads, and an unchanged live base/head check immediately before merge.