@selvajs/server 0.2.0-beta.1 → 0.2.0-beta.2

package/src/access/project-access-input.ts

@@ -0,0 +1,145 @@
+import type { Project, ProjectAccessInput, RequestContext } from '@selvajs/platform';
+
+/**
+ * Assembly of `ProjectAccessInput` — the marshalling layer between an app's
+ * providers and platform's pure access rules (`canView`/`canEdit`/`canSolve`/
+ * `canManage`/…). The rules are pure functions over one input shape; the
+ * knowledge captured here is **which rows each project visibility needs**, so
+ * a consuming app doesn't reimplement (and mis-fetch) it:
+ *
+ * - `platform` → grants (skipped entirely while the feature flag is off)
+ * - `private`  → caller's project member row
+ * - `org` / `public` → caller's project member row (for canEdit/canManage) and
+ *   org member row (for canView). Cross-org public skips the org row.
+ *
+ * Wiring is injected: row lookups as functions (so lazily-initialized
+ * providers work unchanged) and flags read per call (so runtime flag flips
+ * behave like the app's own `flag()` reads).
+ */
+
+export interface ProjectAccessFlags {
+	/** `ALLOW_CROSS_ORG_PUBLIC` — public visibility spans orgs when true. */
+	allowCrossOrgPublic: boolean;
+	/** `ENABLE_PLATFORM_PROJECTS` — platform visibility is live when true. */
+	enablePlatformProjects: boolean;
+}
+
+export interface ProjectAccessInputDeps {
+	getProjectMember(
+		ctx: RequestContext,
+		projectId: string,
+		userId: string
+	): Promise<ProjectAccessInput['member']>;
+	getOrgMember(
+		ctx: RequestContext,
+		orgId: string,
+		userId: string
+	): Promise<ProjectAccessInput['orgMember']>;
+	listPlatformGrants(
+		ctx: RequestContext,
+		projectId: string
+	): Promise<ProjectAccessInput['platformGrants']>;
+	/** Read the two access-relevant feature flags. Called once per assembly. */
+	flags(): ProjectAccessFlags;
+}
+
+export interface ProjectAccessInputBuilder {
+	/**
+	 * Build the rule input for any project-scope rule, fetching exactly the
+	 * rows the rule will consult based on `project.visibility`. Other fields
+	 * default to safe values; pass `overrides` for the rare callers that
+	 * already loaded a row (e.g. tests, batched listing pages).
+	 */
+	buildProjectAccessInput(
+		ctx: RequestContext,
+		project: Project,
+		overrides?: Partial<ProjectAccessInput>
+	): Promise<ProjectAccessInput>;
+	/**
+	 * Build a `ProjectAccessInput` from caller-provided rows without any I/O.
+	 * Used by listing pages that have already batch-loaded membership for many
+	 * projects; the per-row predicate calls this instead of
+	 * `buildProjectAccessInput` to avoid an N+1 fetch.
+	 */
+	projectAccessInputFromRows(
+		ctx: RequestContext,
+		project: Project,
+		rows: {
+			member?: ProjectAccessInput['member'];
+			orgMember?: ProjectAccessInput['orgMember'];
+			platformGrants?: ProjectAccessInput['platformGrants'];
+		}
+	): ProjectAccessInput;
+}
+
+export function createProjectAccessInputBuilder(
+	deps: ProjectAccessInputDeps
+): ProjectAccessInputBuilder {
+	return {
+		async buildProjectAccessInput(
+			ctx: RequestContext,
+			project: Project,
+			overrides: Partial<ProjectAccessInput> = {}
+		): Promise<ProjectAccessInput> {
+			const { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();
+
+			let member: ProjectAccessInput['member'] = null;
+			let orgMember: ProjectAccessInput['orgMember'] = null;
+			let platformGrants: ProjectAccessInput['platformGrants'] = [];
+
+			if (project.visibility === 'platform') {
+				// When the flag is off the rule short-circuits before reading grants —
+				// skip the lookup to keep "feature disabled" cheap.
+				if (enablePlatformProjects) {
+					platformGrants = await deps.listPlatformGrants(ctx, project.id);
+				}
+			} else if (project.visibility === 'private') {
+				member = await deps.getProjectMember(ctx, project.id, ctx.userId);
+			} else {
+				const skipOrgMember = project.visibility === 'public' && allowCrossOrgPublic;
+				[member, orgMember] = await Promise.all([
+					deps.getProjectMember(ctx, project.id, ctx.userId),
+					skipOrgMember ? Promise.resolve(null) : deps.getOrgMember(ctx, project.orgId, ctx.userId)
+				]);
+			}
+
+			return {
+				orgPermissions: ctx.orgPermissions,
+				platformPermissions: ctx.platformPermissions,
+				project,
+				member,
+				orgMember,
+				allowCrossOrgPublic,
+				enablePlatformProjects,
+				platformGrants,
+				actingOrgId: ctx.actingOrgId ?? null,
+				userId: ctx.userId,
+				...overrides
+			};
+		},
+
+		projectAccessInputFromRows(
+			ctx: RequestContext,
+			project: Project,
+			rows: {
+				member?: ProjectAccessInput['member'];
+				orgMember?: ProjectAccessInput['orgMember'];
+				platformGrants?: ProjectAccessInput['platformGrants'];
+			}
+		): ProjectAccessInput {
+			const { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();
+			return {
+				orgPermissions: ctx.orgPermissions,
+				platformPermissions: ctx.platformPermissions,
+				project,
+				member: rows.member ?? null,
+				orgMember: rows.orgMember ?? null,
+				allowCrossOrgPublic,
+				enablePlatformProjects,
+				platformGrants: rows.platformGrants ?? [],
+				actingOrgId: ctx.actingOrgId ?? null,
+				userId: ctx.userId
+			};
+		}
+	};
+}

package/src/compute/__tests__/client-cache.test.ts

@@ -12,6 +12,7 @@ import { describe, it, expect, beforeEach, vi } from 'vitest';
 
 // --- Mock @selvajs/compute -------------------------------------------------
 const createdConfigs: any[] = [];
+const createdSchedulerOptions: any[] = [];
 const disposedSchedulers: any[] = [];
 
 vi.mock('@selvajs/compute', () => {
@@ -21,7 +22,8 @@ vi.mock('@selvajs/compute', () => {
 			return new GrasshopperClient(config);
 		}
 		constructor(public config: any) {}
-		createScheduler() {
+		createScheduler(options: any) {
+			createdSchedulerOptions.push(options);
 			const scheduler = {
 				disposed: false,
 				dispose() {
@@ -40,6 +42,7 @@ import { createClientCache, serverIdentity } from '../client-cache.js';
 function baseConfig() {
 	return {
 		maxSolveDurationMs: 30_000,
+		maxConcurrentSolves: 4,
 		cachesolve: true,
 		cacheerroredsolves: false,
 		reuseServerDefinitionCache: true,
@@ -56,6 +59,7 @@ const server = (id: string, over: Partial<{ serverUrl: string; apiKey: string }>
 
 beforeEach(() => {
 	createdConfigs.length = 0;
+	createdSchedulerOptions.length = 0;
 	disposedSchedulers.length = 0;
 });
 
@@ -157,6 +161,62 @@ describe('createClientCache — X-Selva-Definition (ADR 0004 D2)', () => {
 	});
 });
 
+describe('createClientCache — scheduler concurrency (audit B6)', () => {
+	it('forwards maxConcurrentSolves as the scheduler maxConcurrent in queue mode', async () => {
+		const cache = createClientCache({ ...baseConfig(), maxConcurrentSolves: 7 });
+		await cache.getClient(server('s1'));
+		expect(createdSchedulerOptions).toHaveLength(1);
+		// Queue mode with NO maxConcurrent defaults to 1 in the scheduler,
+		// serializing every solve on the server — the option must always be set.
+		expect(createdSchedulerOptions[0].mode).toBe('queue');
+		expect(createdSchedulerOptions[0].maxConcurrent).toBe(7);
+	});
+});
+
+describe('createClientCache — per-request telemetry sequence counters', () => {
+	it('onServerTiming bumps rhinoTiming.seq on every write', async () => {
+		const cache = createClientCache(baseConfig());
+		const entry = await cache.getClient(server('s1'));
+		expect(entry.rhinoTiming).toEqual({ last: null, seq: 0 });
+		createdConfigs[0].onServerTiming({ decode: 5, solve: 100, encode: 3 });
+		expect(entry.rhinoTiming.seq).toBe(1);
+		expect(entry.rhinoTiming.last).toEqual({ decode: 5, solve: 100, encode: 3 });
+		createdConfigs[0].onServerTiming({ decode: 1, solve: 2, encode: 3 });
+		expect(entry.rhinoTiming.seq).toBe(2);
+		expect(entry.rhinoTiming.last).toEqual({ decode: 1, solve: 2, encode: 3 });
+	});
+
+	it('onSettle bumps solveMeta.seq on every settle but writes last only on success', async () => {
+		const cache = createClientCache(baseConfig());
+		const entry = await cache.getClient(server('s1'));
+		const onSettle = createdSchedulerOptions[0].onSettle;
+		expect(entry.solveMeta).toEqual({ last: null, seq: 0 });
+
+		onSettle(
+			{ key: 'k' },
+			{
+				status: 'success',
+				fromCache: false,
+				definitionReuploaded: false,
+				durationMs: 10,
+				response: {}
+			}
+		);
+		expect(entry.solveMeta.seq).toBe(1);
+		expect(entry.solveMeta.last).toEqual({ fromCache: false, definitionReuploaded: false });
+
+		// An error settle must still count toward seq (the attribution guard in
+		// the pipeline needs to see ALL concurrent activity) without clobbering last.
+		onSettle({ key: 'k' }, { status: 'error', error: new Error('x'), durationMs: 5 });
+		expect(entry.solveMeta.seq).toBe(2);
+		expect(entry.solveMeta.last).toEqual({ fromCache: false, definitionReuploaded: false });
+
+		onSettle({ key: 'k' }, { status: 'success', fromCache: true, durationMs: 0, response: {} });
+		expect(entry.solveMeta.seq).toBe(3);
+		expect(entry.solveMeta.last).toEqual({ fromCache: true, definitionReuploaded: undefined });
+	});
+});
+
 describe('serverIdentity', () => {
 	it('derives identity from the id', () => {
 		expect(serverIdentity({ id: 'abc' })).toBe('abc');

package/src/compute/__tests__/rate-limit.test.ts

@@ -66,4 +66,41 @@ describe('createComputeRateLimiter', () => {
 		// A different limiter instance is unaffected.
 		expect(other.check('user:alice').allowed).toBe(true);
 	});
+
+	// peek + clear support failure-counting flows (login limiting): peek gates
+	// the attempt without spending budget, check records a failure, clear
+	// forgives on success.
+	describe('peek / clear', () => {
+		it('peek never increments the counter', () => {
+			for (let i = 0; i < 1000; i++) expect(limiter.peek('ip:1.2.3.4').allowed).toBe(true);
+			// Full budget still available after all those peeks.
+			for (let i = 0; i < MAX_PER_WINDOW; i++) {
+				expect(limiter.check('ip:1.2.3.4').allowed).toBe(true);
+			}
+		});
+
+		it('peek reports a full bucket with retryAfter, still without mutating it', () => {
+			for (let i = 0; i < MAX_PER_WINDOW; i++) limiter.check('ip:1.2.3.4');
+			const result = limiter.peek('ip:1.2.3.4');
+			expect(result.allowed).toBe(false);
+			expect(result.retryAfter).toBeGreaterThan(0);
+		});
+
+		it('peek allows again once the window expires', () => {
+			for (let i = 0; i < MAX_PER_WINDOW; i++) limiter.check('ip:1.2.3.4');
+			expect(limiter.peek('ip:1.2.3.4').allowed).toBe(false);
+			vi.advanceTimersByTime(WINDOW_MS + 1);
+			expect(limiter.peek('ip:1.2.3.4').allowed).toBe(true);
+		});
+
+		it('clear drops only the given key', () => {
+			for (let i = 0; i < MAX_PER_WINDOW; i++) {
+				limiter.check('ip:1.2.3.4');
+				limiter.check('ip:5.6.7.8');
+			}
+			limiter.clear('ip:1.2.3.4');
+			expect(limiter.peek('ip:1.2.3.4').allowed).toBe(true);
+			expect(limiter.peek('ip:5.6.7.8').allowed).toBe(false);
+		});
+	});
 });

package/src/compute/__tests__/solve-pipeline.test.ts

@@ -49,8 +49,8 @@ function fakeClient(solve: SolveStub): CachedClient {
 	return {
 		client: {} as GrasshopperClient,
 		scheduler: { solve } as unknown as SolveScheduler,
-		rhinoTiming: { last: null },
-		solveMeta: { last: null }
+		rhinoTiming: { last: null, seq: 0 },
+		solveMeta: { last: null, seq: 0 }
 	};
 }
 
@@ -246,11 +246,15 @@ describe('runSolvePipeline — Server-Timing', () => {
 	});
 
 	it('splits solve into rhino_* + compute_link when the client reported server timing', async () => {
-		// The real onServerTiming callback fires DURING the solve, after the
-		// pipeline has reset the holder — so populate it inside the solve stub, not
-		// before the call (which the pipeline's pre-solve reset would wipe).
+		// The real callbacks fire DURING the solve: onServerTiming per compute
+		// call, onSettle per settle — each bumps its seq. Mimic both so the
+		// pipeline's attribution guard (exactly one write since the snapshot,
+		// settle not fromCache) sees this request's own telemetry.
 		const client: CachedClient = fakeClient(async () => {
+			client.rhinoTiming.seq += 1;
 			client.rhinoTiming.last = { decode: 5, solve: 20, encode: 3 };
+			client.solveMeta.seq += 1;
+			client.solveMeta.last = { fromCache: false, definitionReuploaded: false };
 			return { errors: [], warnings: [] };
 		});
 		const outcome = await runSolvePipeline(baseArgs({ client }));
@@ -264,9 +268,8 @@ describe('runSolvePipeline — Server-Timing', () => {
 	});
 
 	it('surfaces selva_cache + def_reupload verdicts as 0/1 flags', async () => {
-		// Populate during the solve (the onSettle callback's real timing), not
-		// before — the pipeline resets solveMeta before it runs.
 		const client: CachedClient = fakeClient(async () => {
+			client.solveMeta.seq += 1;
 			client.solveMeta.last = { fromCache: true, definitionReuploaded: false };
 			return { errors: [], warnings: [] };
 		});
@@ -278,17 +281,61 @@ describe('runSolvePipeline — Server-Timing', () => {
 		expect(st).toContain('def_reupload;dur=0');
 	});
 
-	it('resets stale telemetry holders before solving', async () => {
-		// A warm client carrying a previous request's timing must not leak it into
-		// this solve's Server-Timing when the current solve reports nothing.
+	it('does not attribute stale telemetry a previous request left on the warm client', async () => {
+		// The holders are shared per-server. Data written before this solve's
+		// snapshot (seq unchanged during the solve) must not leak into this
+		// request's Server-Timing.
 		const client = fakeClient(async () => ({ errors: [], warnings: [] }));
-		client.rhinoTiming.last = { decode: 99, solve: 99, encode: 99 };
-		client.solveMeta.last = { fromCache: true };
+		client.rhinoTiming = { last: { decode: 99, solve: 99, encode: 99 }, seq: 3 };
+		client.solveMeta = { last: { fromCache: true }, seq: 5 };
 		const outcome = await runSolvePipeline(baseArgs({ client }));
 		expect(outcome.kind).toBe('ok');
 		if (outcome.kind !== 'ok') return;
-		// Holders were reset to null before solve; the stub never repopulated them.
 		expect(outcome.envelope.headers['Server-Timing']).not.toContain('rhino_decode');
 		expect(outcome.envelope.headers['Server-Timing']).not.toContain('selva_cache');
 	});
+
+	it('drops telemetry when a concurrent request also settled in the window (audit B6)', async () => {
+		// With maxConcurrentSolves > 1 two solves can interleave. More than one
+		// settle since this request's snapshot makes the shared slots ambiguous —
+		// the pipeline must omit the segments rather than report another
+		// request's cache verdict / rhino timing as ours.
+		const client: CachedClient = fakeClient(async () => {
+			// Our own solve's callbacks…
+			client.rhinoTiming.seq += 1;
+			client.rhinoTiming.last = { decode: 5, solve: 20, encode: 3 };
+			client.solveMeta.seq += 1;
+			client.solveMeta.last = { fromCache: false, definitionReuploaded: false };
+			// …then a concurrent request settles before we read.
+			client.rhinoTiming.seq += 1;
+			client.rhinoTiming.last = { decode: 1, solve: 1, encode: 1 };
+			client.solveMeta.seq += 1;
+			client.solveMeta.last = { fromCache: true };
+			return { errors: [], warnings: [] };
+		});
+		const outcome = await runSolvePipeline(baseArgs({ client }));
+		expect(outcome.kind).toBe('ok');
+		if (outcome.kind !== 'ok') return;
+		const st = outcome.envelope.headers['Server-Timing'];
+		expect(st).not.toContain('selva_cache');
+		expect(st).not.toContain('rhino_decode');
+	});
+
+	it('never attributes rhino timing to a Selva-cache hit (no compute call of ours)', async () => {
+		// Our request was served from the in-process cache while a concurrent
+		// request's compute call produced the only rhino timing in the window.
+		const client: CachedClient = fakeClient(async () => {
+			client.rhinoTiming.seq += 1; // the OTHER request's compute call
+			client.rhinoTiming.last = { decode: 7, solve: 70, encode: 7 };
+			client.solveMeta.seq += 1; // our own settle — a cache hit
+			client.solveMeta.last = { fromCache: true };
+			return { errors: [], warnings: [] };
+		});
+		const outcome = await runSolvePipeline(baseArgs({ client }));
+		expect(outcome.kind).toBe('ok');
+		if (outcome.kind !== 'ok') return;
+		const st = outcome.envelope.headers['Server-Timing'];
+		expect(st).toContain('selva_cache;dur=1');
+		expect(st).not.toContain('rhino_decode');
+	});
 });

package/src/compute/__tests__/transform-input.test.ts

@@ -59,11 +59,18 @@ describe('transformInputParameter — number / integer', () => {
 		expect(out.default).toBe(3);
 	});
 
-	it('forces stepSize to 1 for integers', () => {
+	it('honors a schema-authored stepSize verbatim for integers (compute ≥3.1.0-beta.5)', () => {
+		// The package used to force integer stepSize to 1; since beta.5 a
+		// server-authored stepSize wins and the 1-heuristic is only the fallback.
 		const out = transformInputParameter(
 			input({ paramType: 'integer', stepSize: 0.5, default: 2 }),
 			4
 		);
+		expect(out).toMatchObject({ paramType: 'Integer', stepSize: 0.5, default: 4 });
+	});
+
+	it('falls back to stepSize 1 for integers without an authored stepSize', () => {
+		const out = transformInputParameter(input({ paramType: 'integer', default: 2 }), 4);
 		expect(out).toMatchObject({ paramType: 'Integer', stepSize: 1, default: 4 });
 	});
 });

package/src/compute/client-cache.ts

@@ -59,21 +59,28 @@ export interface CachedClient {
 	client: GrasshopperClient;
 	scheduler: SolveScheduler;
 	/**
-	 * Last decode/solve/encode reported by the compute server (Server-Timing).
-	 * Written by onServerTiming, read right after scheduler.solve resolves to split
-	 * the solve wall time into on-compute-server work vs. the compute↔web-server
-	 * link. Queue-mode schedulers serialize solves, so this correlates with the
-	 * request that just resolved; a Selva-cache hit leaves it null (no compute
-	 * call). Debug aid — a concurrent burst may misattribute one request's timing.
+	 * Last decode/solve/encode reported by the compute server (Server-Timing),
+	 * written by onServerTiming. `seq` increments on every write. The scheduler
+	 * runs up to `maxConcurrentSolves` solves at once, so `last` alone can't be
+	 * trusted per-request: callers snapshot `seq` before their solve and
+	 * attribute `last` only when exactly one write happened since (necessarily
+	 * theirs — see the guard in `runSolvePipeline`), dropping the segment
+	 * otherwise instead of misattributing another request's timing.
 	 */
-	rhinoTiming: { last: { decode: number; solve: number; encode: number } | null };
+	rhinoTiming: { last: { decode: number; solve: number; encode: number } | null; seq: number };
 	/**
 	 * Last solve's cache verdicts from the scheduler's onSettle: whether the
 	 * in-process response cache served it (no compute call) and whether the
-	 * definition had to be re-uploaded. Same read-after-solve pattern and
-	 * concurrency caveat as rhinoTiming.
+	 * definition had to be re-uploaded. `seq` increments on EVERY settle
+	 * (success or error); `last` is only written on success. Same
+	 * snapshot-and-attribute pattern as rhinoTiming — onSettle always fires
+	 * before the corresponding `scheduler.solve()` promise resolves, so at the
+	 * caller's read point its own settle is included in `seq`.
 	 */
-	solveMeta: { last: { fromCache: boolean; definitionReuploaded?: boolean } | null };
+	solveMeta: {
+		last: { fromCache: boolean; definitionReuploaded?: boolean } | null;
+		seq: number;
+	};
 }
 
 /**
@@ -90,6 +97,12 @@ export interface ClientCacheConfig {
 	cacheerroredsolves: boolean;
 	/** Reference large definitions by server cache key (pointer) instead of re-uploading. */
 	reuseServerDefinitionCache: boolean;
+	/**
+	 * Max in-flight solves per compute server (scheduler `maxConcurrent`; excess
+	 * FIFO-queues). Size to the server's `compute.geometry` child count
+	 * (`ComputeLimits.computeMaxConcurrentSolves`).
+	 */
+	maxConcurrentSolves: number;
 	/** Concise cache/timing logs. When false, `onDebugLog` is never invoked. */
 	debug: boolean;
 	/** VERBOSE lib-level logging (full solve request/response incl. geometry). */
@@ -136,9 +149,10 @@ export function createClientCache(config: ClientCacheConfig): ClientCache {
 
 	async function build(server: ResolvedServer, definitionGuid?: string): Promise<CachedClient> {
 		// Holders for per-request results from the client/scheduler callbacks; the
-		// caller reads them right after each solve resolves to build Server-Timing.
-		const rhinoTiming: CachedClient['rhinoTiming'] = { last: null };
-		const solveMeta: CachedClient['solveMeta'] = { last: null };
+		// caller reads them right after each solve resolves to build Server-Timing,
+		// using the seq counters to detect (and drop) ambiguous concurrent writes.
+		const rhinoTiming: CachedClient['rhinoTiming'] = { last: null, seq: 0 };
+		const solveMeta: CachedClient['solveMeta'] = { last: null, seq: 0 };
 
 		const clientConfig: GrasshopperComputeConfig = {
 			serverUrl: server.serverUrl,
@@ -160,6 +174,7 @@ export function createClientCache(config: ClientCacheConfig): ClientCache {
 				const solve = t.solve ?? 0;
 				const encode = t.encode ?? 0;
 				// Always recorded (cheap): the caller reads this after scheduler.solve.
+				rhinoTiming.seq += 1;
 				rhinoTiming.last = { decode, solve, encode };
 				if (!config.debug) return;
 				// Heuristic thresholds: a genuine parse/solve is many ms; a cache hit
@@ -189,6 +204,10 @@ export function createClientCache(config: ClientCacheConfig): ClientCache {
 		const client = await GrasshopperClient.create(clientConfig);
 		const scheduler = client.createScheduler({
 			mode: 'queue',
+			// Queue mode defaults maxConcurrent to 1, which would serialize every
+			// solve on this server through a single slot while the compute VM's
+			// other compute.geometry children idle (audit B6) — always pass it.
+			maxConcurrent: config.maxConcurrentSolves,
 			timeoutMs: config.maxSolveDurationMs,
 			cache: { maxEntries: 20, ttlMs: 5 * 60_000 },
 			// Solve large definitions by server cache-key (pointer) instead of
@@ -199,6 +218,9 @@ export function createClientCache(config: ClientCacheConfig): ClientCache {
 			// this solve was served from the app's own cache — Rhino.Compute was never
 			// called. `false` means it went to the compute server.
 			onSettle: (_ctx, result) => {
+				// Count EVERY settle (success or error) so the caller's attribution
+				// guard sees all concurrent activity, not just successful writes.
+				solveMeta.seq += 1;
 				if (result.status !== 'success') return;
 				// Always recorded (cheap): the caller surfaces these on Server-Timing.
 				solveMeta.last = {

package/src/compute/limits.ts

@@ -115,6 +115,16 @@ export interface ComputeLimits {
 	 * honoring the flag. Conservative default off.
 	 */
 	computeCacheErroredSolves: boolean;
+	/**
+	 * Max in-flight solves this app instance sends to ONE compute server
+	 * (forwarded as the SolveScheduler's `maxConcurrent`; excess solves FIFO-queue).
+	 * Size it to the server's `compute.geometry` child count — Rhino.Compute
+	 * spawns N children per VM precisely to run N solves concurrently, and a
+	 * lower value idles that capacity while users queue (audit B6: the scheduler's
+	 * queue-mode default is 1, which serialized ALL solves per server). Multiple
+	 * app instances each apply their own cap.
+	 */
+	computeMaxConcurrentSolves: number;
 }
 
 /**
@@ -142,6 +152,8 @@ export function resolveComputeLimits(env: EnvRecord): ComputeLimits {
 		definitionCacheTtlMs: readPositiveInt(env, 'DEFINITION_CACHE_TTL_MS', 5 * 60 * 1000),
 		computeReuseDefinitionCache: readBool(env, 'COMPUTE_REUSE_DEFINITION_CACHE', true),
 		computeServerCachesolve: readBool(env, 'COMPUTE_SERVER_CACHESOLVE', true),
-		computeCacheErroredSolves: readBool(env, 'COMPUTE_CACHE_ERRORED_SOLVES', false)
+		computeCacheErroredSolves: readBool(env, 'COMPUTE_CACHE_ERRORED_SOLVES', false),
+		// 4 matches rhino.compute's default --childcount; tune to the actual VM.
+		computeMaxConcurrentSolves: readPositiveInt(env, 'COMPUTE_MAX_CONCURRENT', 4)
 	};
 }

package/src/compute/rate-limit.ts

@@ -18,6 +18,10 @@
  *
  * The window + cap are injected (they live in `ComputeLimits`), so this module
  * reads no env of its own.
+ *
+ * Not compute-only despite the name: `peek` + `clear` make it usable for
+ * failure-counting flows too (login limiting keys by IP, records only failed
+ * attempts via `check`, and forgives on success via `clear`).
  */
 
 export interface RateLimitResult {
@@ -39,6 +43,14 @@ export interface ComputeRateLimiter {
 	 * Returns `{ allowed: false, retryAfter }` once the bucket is full.
 	 */
 	check(key: string): RateLimitResult;
+	/**
+	 * Check WITHOUT recording. For flows that only count selected outcomes —
+	 * e.g. login limiting, where `peek` gates the attempt and `check` records
+	 * only failures (a success calls `clear` instead).
+	 */
+	peek(key: string): RateLimitResult;
+	/** Drop `key`'s bucket — e.g. a successful login forgives prior failures. */
+	clear(key: string): void;
 	/** Test seam — wipes in-memory state. Production code never calls this. */
 	reset(): void;
 	/** The resolved config, exposed for time-based test assertions. */
@@ -76,6 +88,21 @@ export function createComputeRateLimiter(config: ComputeRateLimiterConfig): Comp
 			entry.count += 1;
 			return { allowed: true };
 		},
+		peek(key: string): RateLimitResult {
+			const now = Date.now();
+			const entry = buckets.get(key);
+
+			if (!entry || now > entry.resetAt) {
+				return { allowed: true };
+			}
+			if (entry.count >= maxPerWindow) {
+				return { allowed: false, retryAfter: Math.ceil((entry.resetAt - now) / 1000) };
+			}
+			return { allowed: true };
+		},
+		clear(key: string): void {
+			buckets.delete(key);
+		},
 		reset(): void {
 			buckets.clear();
 		}

package/src/compute/solve-pipeline.ts

@@ -156,11 +156,15 @@ export async function runSolvePipeline(args: SolvePipelineArgs): Promise<SolveOu
 	const treeBuildMs = performance.now() - treeBuildStart;
 
 	// --- solve --------------------------------------------------------------
-	// Reset the per-request telemetry holders so a Selva-cache hit (no compute
-	// call) isn't attributed a stale timing from an earlier request on this warm
-	// client. See the rhinoTiming/solveMeta concurrency caveat in client-cache.
-	client.rhinoTiming.last = null;
-	client.solveMeta.last = null;
+	// Snapshot the shared telemetry sequence counters. The holders live on the
+	// warm client and are written by every request on this server; with
+	// maxConcurrentSolves > 1 another request can write them mid-flight. After
+	// the solve, a slot is attributed to THIS request only when exactly one
+	// write happened since this snapshot — for solveMeta that single settle is
+	// necessarily ours (onSettle fires before scheduler.solve() resolves).
+	// Anything ambiguous is dropped from Server-Timing, never misattributed.
+	const settleSeqBefore = client.solveMeta.seq;
+	const rhinoSeqBefore = client.rhinoTiming.seq;
 
 	let result: GrasshopperComputeResponse;
 	const solveStart = performance.now();
@@ -213,6 +217,17 @@ export async function runSolvePipeline(args: SolvePipelineArgs): Promise<SolveOu
 
 	const serverTotalMs = performance.now() - args.loadStartMs;
 
+	// --- per-request telemetry attribution (see snapshot above) -------------
+	// settle: ours iff exactly one settle happened since the snapshot. rhino:
+	// only meaningful when the settle is ours AND it was a real compute call
+	// (a Selva-cache hit never reaches the server), and only unambiguous when
+	// exactly one Server-Timing callback fired in the window.
+	const settle = client.solveMeta.seq === settleSeqBefore + 1 ? client.solveMeta.last : null;
+	const rhino =
+		settle && !settle.fromCache && client.rhinoTiming.seq === rhinoSeqBefore + 1
+			? client.rhinoTiming.last
+			: null;
+
 	// --- Server-Timing envelope (the versioned wire contract) ---------------
 	const serverTiming = buildServerTiming({
 		defLoadMs: args.defLoadMs,
@@ -221,8 +236,8 @@ export async function runSolvePipeline(args: SolvePipelineArgs): Promise<SolveOu
 		serializeMs,
 		gzipMs,
 		serverTotalMs,
-		rhino: client.rhinoTiming.last,
-		settle: client.solveMeta.last,
+		rhino,
+		settle,
 		prepMarks: args.prepMarks ?? []
 	});