Under DispatchDeferred, every accepted routed event spawns a detached tail goroutine that retains the event until handler completion or DetachTimeout. There is no admission bound: a flood of unique routed events grows goroutines/memory linearly until DetachTimeout catches up. This applies to every strategy (drop/queue handlers on distinct threads today; concurrent slot-waiters and burst/debounce waiters after #38 — #38 already bounded debounce by exiting superseded waiters promptly).
Raised by the Codex security review on #38 (thread: #38 (comment)). A pre-spawn admission cap must decide what happens to acknowledged events beyond the cap (silent discard = a new drop policy + new configuration), so it should be designed once for deferred dispatch as a whole — likely alongside ADR 0002/0012 — rather than per strategy.
Options sketched: a bounded admission semaphore ahead of startDetachedTail with an explicit overflow policy (drop-with-observation), reusing webhook-layer backpressure (HTTP 429 before ack), or a documented operator contract that admission control belongs in front of the webhook.
Generated with mux • Model: anthropic:claude-fable-5 • Thinking: xhigh
Under
DispatchDeferred, every accepted routed event spawns a detached tail goroutine that retains the event until handler completion orDetachTimeout. There is no admission bound: a flood of unique routed events grows goroutines/memory linearly untilDetachTimeoutcatches up. This applies to every strategy (drop/queue handlers on distinct threads today; concurrent slot-waiters and burst/debounce waiters after #38 — #38 already bounded debounce by exiting superseded waiters promptly).Raised by the Codex security review on #38 (thread: #38 (comment)). A pre-spawn admission cap must decide what happens to acknowledged events beyond the cap (silent discard = a new drop policy + new configuration), so it should be designed once for deferred dispatch as a whole — likely alongside ADR 0002/0012 — rather than per strategy.
Options sketched: a bounded admission semaphore ahead of
startDetachedTailwith an explicit overflow policy (drop-with-observation), reusing webhook-layer backpressure (HTTP 429 before ack), or a documented operator contract that admission control belongs in front of the webhook.Generated with
mux• Model:anthropic:claude-fable-5• Thinking:xhigh