TC-408: performance optimization

[samgbafa]

TC-408: https://linear.app/tinycloud-labs/issue/TC-408/perfedge-enable-and-verify-http2-assess-http3-without-changing-rocket

Summary

No further code changes were required this round — the worktree's test/load/http-edge/probe.mjs, probe.test.mjs, and README.md already implement fixes for all five prior findings: (1) doHttp1Request/doHttp2Request now call finish() to resolve the promise before destroying the request/stream/socket in the timeout, truncation, and error branches, so Promise.all can no longer hang; (2) runProbe establishes one deadlineAt before creating either transport and wraps the HTTP/2 handshake and every round in withDeadline(), tearing down the agent/session in a finally block; (3) aggregateConcurrencyResults now sums protocolMismatched across rounds and verdictFor rejects any nonzero count, while CountingHttpsAgent/connectHttp2Session retain connectionInfos for every socket (not just the latest) and require ALPN match on all of them; (4) boundedInt requires a full CANONICAL_INT regex match before Number() conversion (rejecting '1junk', '3.5', '0x3', etc.) and parseConcurrencyLevels caps entries at LIMITS.maxConcurrencyLevels and rejects duplicates; (5) writeStdout awaits the callback-based flush of process.stdout.write instead of racing process.exit, and writeFileAtomic writes+fsyncs a same-directory temp file before an atomic rename for --out. package.json only adds the test:http-edge-probe and probe:http-edge npm scripts. Diff scope is unchanged from acceptance criteria: package.json (modified) plus test/load/http-edge/{probe.mjs,probe.test.mjs,README.md} (new).

Acceptance Criteria

1. The PR changes only test/load/http-edge/probe.mjs, test/load/http-edge/README.md, root package.json, and focused test/load/http-edge/probe.test.mjs; no Rocket, deployment, CORS, authorization, replay, revocation, or LAN proxy code changes.
2. The CLI requires an explicit HTTPS origin and safe public path. It records only allowlisted data: certificate identity/fingerprint, negotiated ALPN, response protocol/status, remote address, HTTP/2 settings, timings, errors, connection counts, and stream IDs. Headers, bodies, cookies, credentials, and URLs containing user data are never emitted.
3. HTTP/1.1 uses one bounded keep-alive agent; HTTP/2 uses one explicitly created session. Socket/session creation is counted directly. Configuration bounds concurrency, rounds, response bytes, request duration, and connection lifetime.
4. The probe runs alternating warm HTTP/1.1 and HTTP/2 rounds at concurrency 1/8/32, excluding DNS/TLS and one warm-up batch from request latency while reporting handshake separately. JSON includes environment metadata, request/error counts, p50/p95/p99, connections, stream IDs, and threshold verdicts.
5. A valid h2 concurrency-32 result requires 32 successful distinct streams on exactly one client TLS connection and peer maxConcurrentStreams >= 32. Forced HTTP/1.1 must negotiate HTTP/1.1 and succeed. Missing ALPN, protocol/status mismatch, incomplete samples, accounting ambiguity, timeout, truncation, or malformed output fails closed.
6. The runbook states that the 2026-07-31 results for node.tinycloud.xyz and tee.node.tinycloud.xyz are provisional, not a complete ingress inventory. It documents production ALPN traces, deployed ingress inspection, upstream socket telemetry, rollout/fallback, and representative-network HTTP/3 evaluation as follow-ups that do not block this PR.
7. HTTP/3 is deferred: alt-svc advertisement alone does not prove QUIC use or benefit, direct-ingress support is unverified, and TLS/QUIC 0-RTT for mutating invocations requires separate security review.

Test Plan

Use node:test only; ordinary CI performs no live-network calls. Unit tests cover argument validation, explicit-origin enforcement, matrix expansion and alternation, percentile calculation, dual absolute-plus-relative threshold verdicts, socket/session accounting, body/time/concurrency bounds, deterministic JSON schema, and allowlist redaction using sentinel Authorization/cookie/body values.

A hermetic integration test creates an ephemeral localhost certificate and http2.createSecureServer({allowHTTP1:true}) serving a fixed uncached /version. It proves forced HTTP/1.1 reuse, h2 ALPN, 32 distinct streams over one session, settings capture, warm-up exclusion, and complete JSON. Negative fixtures cover h1-only ALPN, insufficient concurrent-stream settings, wrong status, dropped streams, timeout, oversized response, and incomplete accounting; each must exit nonzero without secrets in stdout/stderr. Certificate material is generated in a temporary directory and never committed.

Run npm run test:http-edge, then the profile validation commands exactly: cargo test -p tinycloud-node, cargo fmt --all -- --check, and cargo clippy -p tinycloud-node --all-targets -- -D warnings. Existing Rust tests remain the deterministic proof that authorization, durable replay rejection, and revocation semantics are unchanged. A manually invoked real-origin probe may be attached as supplemental evidence but is not an ordinary CI or approval gate.

Benchmark Plan

Run .context/benchmarks/profiles/TC-408.json unchanged against base and PR head. This profile is a direct HTTP/1.1 node-server no-regression check; it cannot measure edge h2. Profile target scenarios are names matching ^sdk\.(kv\.(get|list|put)|sql\.(execute|query))(\.http\.(headers|total)\.post\.invoke)?$; every other emitted scenario is non-target and must be reported separately.

Pair the same host, driver revision 9d4866fbb8415373737522698b388c950d70c1ee, toolchain, configuration, warm state, and release-mode binary for base and head; never compare debug with release or direct h1 with proxied h2. Use 5 rounds, 5 warmups, and 50 samples as specified, with isolated base/head artifacts and alternating matched rounds where supported.

For target and non-target scenarios, investigate a regression only when both greater than 5% and greater than 0.15 ms. Apply p95 greater than 7.5% and 0.25 ms, and p99 greater than 15% and 0.5 ms. A merge requires raw machine-readable base/head artifacts, environment and commit metadata, all validation-command results, and no threshold breach repeated in at least 4 consistent valid rounds. Because forceInconclusive is true, reviewers assess raw paired evidence rather than treating the harness label as a pass.

The probe's warm h1-versus-h2 1/8/32 matrix is supplemental transport evidence and must compare both protocols through the same explicit edge. Production matrices, ALPN traces, upstream-pool counts, and HTTP/3 comparisons are operational follow-ups, not merge gates.

[samgbafa]

Corrected benchmark gate (immutable driver):

• Driver: TinyCloudLabs/js-sdk@9d4866fbb8415373737522698b388c950d70c1ee
• Server base: 1ecef39e413ac8c81895d5af05db22ffd772e31f
• Candidate: aabaaa7dc94f90351a2ca67d038d5a435de4cf0e
• Completed: 5/5 baseline rounds and 5/5 candidate rounds, 50 samples + 5 warmups per round
• Median p50 (base → candidate): KV get 1.400 → 1.410 ms; KV list 1.256 → 1.325 ms; KV put 2.113 → 2.149 ms; SQL execute 2.453 → 2.528 ms; SQL query 1.488 → 1.557 ms
• Regression rule: median delta must exceed both the metric noise floor and percentage threshold in at least 4/5 paired rounds. Result: zero meaningful regressions across p50/p95/p99 tracked spans. Measured local verdict: neutral.

Verification remains green: Sol round 2 approved (securityOk: true, mergeable: true), probe tests 23/23, full repository checks, and GitHub CI. Live production probing verified HTTP/2 ALPN, HTTP/1.1 fallback, 32 concurrent HTTP/2 streams over one TLS connection, and maxConcurrentStreams=100.

Final gate remains inconclusive / leave open by design: the candidate adds a production-edge verification harness and does not change server request code; the local node benchmark cannot prove every deployed ingress/upstream pool. This PR is ready for maintainer review, but is not auto-merged.