Operate safely

Measure scaling and bound every host

Separate compiler throughput, bundle cost, response amplification, and the limits a public service must add.

sheet
17 / 18
rev
v1.0
sections
2
compiled
2

01 / CompilerRead scaling and size as separate budgets

Since 0.4 there is no default component or connection count. Note that this is a compiler capability, not permission for a public endpoint to accept arbitrary work — the two are easy to confuse and expensive to confuse. Whenever the source is not ours, set components, connections, sourceCharacters, wireCrossings, and svgOutputBytes through the per-compilation limits option.

A wall-clock deadline is still required on top of that, because every one of those fields bounds a size and none of them bounds time. A small document with pathological geometry can be expensive to route, and no count of output bytes will catch it.

port:PN "A" at (70, 100) #violet
capacitor:CN "C" at (330, 100) #cyan [orientation=down]
component:BOX "enclosure" at (330, 250) #slate [width=150 height=70]
port:QN "B" at (700, 100) #emerald

PN.out -> CN.in #violet [ortho]
CN.out -> QN.in #emerald [ortho]
compiled by @schemd/core → shown in the rail

The release gate measures two client costs, each in gzip and brotli-11. A tree-shaken host that imports only compileSchematic must stay below 42 KiB gzip and 36.5 KiB brotli; the complete public entry, which includes exports a given host may never call, below 45 KiB gzip and 39 KiB brotli. 1.0 measures about 41.7 KiB and 44.8 KiB gzip. Both are budgets, not claims that TypeScript declarations, the npm tarball, installed files, or a website route have the same size. Run bun run size on the exact release commit instead of repeating a registry screenshot as a bundle measurement.

The compile path is about 4.5 KiB larger than 0.8, and it is worth being explicit about why rather than quietly restating a number. The rebuild deleted the old router, its reorder and rip-up rescue, bundle nudging, and the parallel per-kind switches, and paid for routing by net with negotiated congestion, a spatial index that keeps compilation linear, exact integer geometry, measured text, and the diagnostics model behind diagnoseSchematic. The routing stack is where the bytes are, and it is code, which compresses worse than the templates it replaced. The one lever left — moving diagnostic prose behind codes — is not one this project takes, because a diagnostic that does not say how to fix the diagram is the defect.

Scaling is gated independently, and 1.0 keeps compilation linear: a uniform-grid index over obstacles, wires and labels means a search reads only its own window, and 10,000 components compile in about 0.27 s.

1.0 moves the medians in both directions. A contended twelve-wire reversal bus compiles in 1.48 ms, from 16.6 ms in 0.8 — it now routes in the first pass, because the search bound counts the bends a pin's facing makes unavoidable. Dense 16×16 routing is slower, 15.2 ms from 4.1, because every one of its 32 targets sits behind a tightly packed column of parts and wrapping each one with clearance is real work on a finer lattice. A simple document costs about 0.38 ms, from 0.22.

Those are warm medians from one machine, and the durable claim is the guarded slope rather than the absolute millisecond value. Run bun run benchmark on our own hardware before quoting any of them.

02 / HostIsolate deadlines and cap amplification

The official compile endpoint applies limits stricter than the library defaults, rejects oversized request bodies before JSON allocation, rate-limits by client, and runs a compilation outside the request thread. A deadline can terminate that worker; Promise.race around synchronous compilation cannot. Concurrency and queue depth are finite, and a full queue returns a retryable capacity error instead of multiplying memory by the rate-limit burst.

clock:CKR "CLK" at (90, 120) #amber
flipflop:FDR "FF" at (340, 120) #cyan [type=d]
port:QDR "Q" at (620, 120) #emerald

CKR.out -> FDR.clock #amber [digital ortho]
FDR.q -> QDR.in #emerald [digital ortho]
compiled by @schemd/core → shown in the rail

Successful and line-numbered failed compilations share a SHA-256-keyed LRU capped at 64 entries and 16 MiB. The cache key includes mode, bounds, title, and source; hits refresh recency. Registry data uses one immutable stale-while-revalidate snapshot and one in-flight refresh promise. Documentation and simulation caches are keyed by finite registries rather than user input.

The browser IDE compiles locally in a lazily started native worker containing @schemd/core and uses the endpoint only as a fallback. That removes a network round trip and server work from normal typing, and the worker boundary lets a deadline terminate a pathological local compile, without putting the compiler on documentation, catalogue, or simulation critical paths. The website build budget verifies both facts from Vite’s manifest.

Performance work is not finished when one benchmark turns green. Re-run bun run benchmark on the target hardware, read p95 and p99 under concurrent load rather than a warm median, and measure the serialized response — not only parser time — before raising any public-host budget.