castrum 0.9.8 → 0.9.10

package/rust/crypto/hashing.rs

@@ -137,4 +137,72 @@ mod tests {
             xxh3(Uint8Array::new(input.to_vec()))
         );
     }
+
+    /// Known-value xxh3-64 vectors that LOCK the spec output across both the
+    /// short-input (< 240 B) and long-input (>= 240 B) regimes of the engine.
+    /// Generated with `Bun.hash.xxHash3` (independent spec-compliant
+    /// implementation). The 240/241 pair guards the engine's internal
+    /// threshold: an implementation or length-handling regression that
+    /// diverges only above it fails here even though small-input tests pass.
+    /// (Perf note: the scalar core is FLAT ~30GB/s 64B→1MB — measured, no
+    /// size pathology; see docs/bun-builtins-decision-matrix.md for why Bun
+    /// still wins the consumer under Bun.)
+    #[test]
+    fn xxh3_vectors_lock_spec_across_simd_threshold() {
+        // input: (i * 31 + 5) % 256 for i in 0..n (deterministic)
+        const V: &[(usize, u64)] = &[
+            (0, 0x2d06_8005_38d3_94c2),
+            (1, 0x929e_358d_27ae_3ee2),
+            (2, 0xf8a9_b018_ddb0_dc1a),
+            (3, 0xea4f_94f7_8c69_f54e),
+            (4, 0xc674_aba0_6059_22b7),
+            (5, 0x988e_18b6_a130_77ac),
+            (6, 0x19e7_8a37_d9eb_8365),
+            (7, 0x4d32_b9b4_d45d_9319),
+            (8, 0xad43_7729_e900_e521),
+            (9, 0x2f54_64ee_70cc_cff9),
+            (10, 0x97a1_114c_1cbf_45ae),
+            (11, 0x2933_959d_e03b_8ce8),
+            (12, 0x5cba_0687_e71c_0f12),
+            (13, 0x5a27_1d93_20eb_cb8a),
+            (14, 0xeb81_cf37_8320_b598),
+            (15, 0xec7b_ee5b_893b_d5d5),
+            (16, 0x0903_f58f_8225_3d8c),
+            (17, 0x48a3_8615_d4ee_fb8b),
+            (18, 0xb871_d958_cc11_dfa4),
+            (19, 0xc6ed_7037_b89b_d206),
+            (23, 0xd410_62e4_0171_ac46),
+            (31, 0x4334_b263_9627_f197),
+            (32, 0xebeb_3ba5_7ab1_edca),
+            (33, 0x7ff1_7572_bd9e_70a9),
+            (63, 0x504d_3e53_12aa_2db1),
+            (64, 0xd8cc_034e_d06e_92f3),
+            (65, 0x73c9_73e2_4eda_1cdc),
+            (95, 0x45f6_3f33_cade_8c19),
+            (96, 0x4c46_e758_08f2_74e9),
+            (127, 0x1ed1_3eff_d01b_9402),
+            (128, 0x05a1_567d_530f_961c),
+            (191, 0xba5e_7dfd_d63d_7785),
+            (192, 0x999d_b9f2_4d8c_ffcf),
+            (238, 0xda80_d2d5_c7b9_397e),
+            (239, 0xb0ca_9389_9a38_51d5),
+            (240, 0xc502_31c4_c4c8_6a63),
+            (241, 0xa7dc_042e_5a9f_6aa6),
+            (255, 0x62c8_1de1_9704_658e),
+            (256, 0x84f8_cedc_d725_6d1a),
+            (512, 0xd4d7_d053_e788_d9ef),
+            (1024, 0xdb4a_2f32_c2a5_bc38),
+            (16384, 0xf04a_c437_8b21_4439),
+            (262144, 0x6c36_c9dc_9aaf_20f0),
+        ];
+        let input =
+            |n: usize| -> Vec<u8> { (0..n).map(|i| (i.wrapping_mul(31) + 5) as u8).collect() };
+        for (n, want) in V {
+            assert_eq!(
+                fast_hash_bytes(&input(*n)),
+                *want,
+                "xxh3({n} bytes) — engine regime mismatch",
+            );
+        }
+    }
 }

package/rust/ffi/task.rs

@@ -18,7 +18,8 @@ pub extern "C" fn castrum_task_init(threads: u32) -> u32 {
 }
 
 /// Submit `op` with `args_len` packed arg bytes, completing under `task_id`.
-/// Returns `1` accepted, `0` rejected (null args with a non-zero length).
+/// Returns `1` accepted, `2` overloaded (the bounded work queue is full), or
+/// `0` invalid args (null args with a non-zero length) / panic.
 ///
 /// # Safety
 /// `args` must be valid for reads of `args_len` bytes.
@@ -39,7 +40,11 @@ pub unsafe extern "C" fn castrum_task_submit(
             } else {
                 slice::from_raw_parts(args, args_len).to_vec()
             };
-            u32::from(task::submit_op(op, owned, task_id as u64))
+            if task::submit_op(op, owned, task_id as u64) {
+                1
+            } else {
+                2
+            }
         },
         0,
     )
@@ -72,7 +77,7 @@ pub extern "C" fn castrum_task_pending() -> u32 {
 /// (UNSUPPORTED) means the op has no `_into` form and the caller should fall
 /// back to `castrum_task_submit`.
 ///
-/// Returns `1` accepted, `0` rejected.
+/// Returns `1` accepted, `2` overloaded (bounded queue full), `0` invalid args.
 ///
 /// # Safety
 /// `args` must be valid for reads of `args_len` bytes. `out` must be valid for
@@ -97,13 +102,11 @@ pub unsafe extern "C" fn castrum_task_submit_out(
             } else {
                 slice::from_raw_parts(args, args_len).to_vec()
             };
-            u32::from(task::submit_op_into(
-                op,
-                owned,
-                task_id as u64,
-                out as usize,
-                out_cap,
-            ))
+            if task::submit_op_into(op, owned, task_id as u64, out as usize, out_cap) {
+                1
+            } else {
+                2
+            }
         },
         0,
     )
@@ -121,7 +124,7 @@ pub extern "C" fn castrum_task_cancel(task_id: usize) -> u32 {
 /// compression costs a full-size copy on the JS thread and measured WORSE than
 /// the synchronous built-in (docs/RND-CONCURRENCY.md §7b).
 ///
-/// Returns `1` accepted, `0` rejected.
+/// Returns `1` accepted, `2` overloaded (bounded queue full), `0` invalid args.
 ///
 /// # Safety
 /// `hdr` must be valid for reads of `hdr_len` bytes. `data` must be valid for
@@ -148,13 +151,11 @@ pub unsafe extern "C" fn castrum_task_submit_slice(
             } else {
                 slice::from_raw_parts(hdr, hdr_len).to_vec()
             };
-            u32::from(task::submit_slice_op(
-                op,
-                owned,
-                data as usize,
-                data_len,
-                task_id as u64,
-            ))
+            if task::submit_slice_op(op, owned, data as usize, data_len, task_id as u64) {
+                1
+            } else {
+                2
+            }
         },
         0,
     )

package/rust/ingress/api.rs

@@ -85,11 +85,13 @@ impl Ingress {
                 .map_err(|e| Error::new(Status::InvalidArg, format!("Schema JSON error: {}", e)))?;
             // Compile BOTH the authoritative jsonschema validator and the
             // zero-DOM fast path once at construction — no per-request schema
-            // work (see IngressSchema in pipeline.rs).
-            let compiled = IngressSchema::compile(&schema_value).map_err(|e| {
-                Error::new(Status::InvalidArg, format!("Schema compile error: {}", e))
-            })?;
-            Some(Arc::new(compiled))
+            // work (see IngressSchema in pipeline.rs). Identical schema bytes
+            // are shared process-wide via the compiled-schema cache.
+            let compiled =
+                crate::ingress::schema_cache::get_or_compile(&schema_value).map_err(|e| {
+                    Error::new(Status::InvalidArg, format!("Schema compile error: {}", e))
+                })?;
+            Some(compiled)
         } else {
             None
         };
@@ -353,3 +355,17 @@ impl Ingress {
         inner.handle_packed(&packed, body, out)
     }
 }
+
+/// Clear the process-wide compiled-schema cache — the dedupe store that shares
+/// one compiled `IngressSchema` across every `Ingress`/`NativeRoute` built from
+/// identical schema bytes.
+///
+/// Maintenance hook for the public `flushMemory()` (napi export name:
+/// `clearSchemaCache`). Idempotent; safe to call at any time, including before
+/// any schema has ever been compiled. Dropping the cache only releases the
+/// native validators — already-constructed ingress/route instances keep their
+/// own `Arc<IngressSchema>`, so live routes are unaffected.
+#[napi]
+pub fn clear_schema_cache() {
+    crate::ingress::schema_cache::clear_schema_cache();
+}

package/rust/ingress/mod.rs

@@ -22,6 +22,9 @@ mod tests;
 
 pub(crate) mod options;
 pub(crate) mod packed;
+// Process-wide compiled-schema cache: dedupes identical `IngressSchema`
+// compiles across `Ingress` / `NativeRoute` instances (schema_cache.rs).
+pub(crate) mod schema_cache;
 pub(crate) mod time;
 
 pub(crate) mod cors;
@@ -40,6 +43,10 @@ pub(crate) mod terminal;
 #[cfg(test)]
 pub(crate) use self::api::clamp_output_size;
 pub use self::api::Ingress;
+// napi maintenance export (`clearSchemaCache`) — re-exported so it is a
+// crate-reachable item (dead-code analysis) while the `#[napi]` macro does the
+// JS-side registration.
+pub use self::api::clear_schema_cache;
 pub(crate) use self::api::IngressInner;
 pub(crate) use self::native_route::NativeRoute;
 pub(crate) use self::options::{IngressOptions, Limits};

package/rust/ingress/native_route.rs

@@ -177,9 +177,11 @@ impl NativeRoute {
                     .map_err(|_| "route descriptor: body schema is not valid UTF-8".to_string())?;
                 let schema_value: serde_json::Value = sonic_rs::from_str(schema_str)
                     .map_err(|e| format!("route descriptor: body schema JSON error: {e}"))?;
-                let compiled = IngressSchema::compile(&schema_value)
+                // Shared process-wide: identical schema bytes compile once even
+                // across routes/instances (see ingress/schema_cache.rs).
+                let compiled = super::schema_cache::get_or_compile(&schema_value)
                     .map_err(|e| format!("route descriptor: body schema compile error: {e}"))?;
-                Some(Arc::new(compiled))
+                Some(compiled)
             }
             None => None,
         };

package/rust/ingress/schema_cache.rs

@@ -0,0 +1,266 @@
+// rust/ingress/schema_cache.rs — Process-wide compiled-schema cache.
+//
+// `Ingress` and `NativeRoute` compile a request-body schema once at
+// construction (`IngressSchema::compile`). When an application builds N routes
+// over the SAME schema bytes, that is N identical compiles at startup and N
+// copies retained at runtime. This module dedupes them: identical schema JSON
+// yields ONE shared `Arc<IngressSchema>`, bounded by an LRU (default 128
+// entries, override with `CASTRUM_SCHEMA_CACHE_MAX`).
+//
+// Key = a stable 64-bit hash of the raw serialized schema bytes (exact bytes:
+// a different key order is a different key and simply compiles a second time).
+// The hash only selects a bucket — it is NOT the identity: each entry stores
+// its serialized bytes alongside the compiled schema, and a hit is returned
+// only when those bytes EQUAL the requested bytes. `xxh3_64` is
+// non-cryptographic, so trusting the hash alone would let a craftable collision
+// reuse the wrong validator (a validation-bypass class bug); the byte compare
+// makes collisions a safe miss (compile + replace the colliding bucket) rather
+// than a wrong-schema hit.
+//
+// Only SUCCESSFUL compiles are cached. `IngressSchema` is immutable after
+// compile (`Arc<jsonschema::Validator>` + optional `Arc<FastNode>`), so sharing
+// the `Arc` across routes and threads is sound; mutable state is per-call
+// (`Cursor`/`Ctx`), never on the schema.
+//
+// Concurrency: double-checked locking — the cache lock is released before the
+// (slow) compile and re-taken for insert, so one slow compile never serializes
+// other schema lookups.
+
+use std::num::NonZeroUsize;
+use std::sync::{Arc, OnceLock};
+
+use lru::LruCache;
+use parking_lot::Mutex;
+
+use super::pipeline::IngressSchema;
+
+/// Default cache capacity (distinct schema byte strings).
+const DEFAULT_SCHEMA_CACHE_MAX: usize = 128;
+/// Upper clamp on the configured capacity — an absurd env value must not size
+/// an unbounded LRU (each entry retains a compiled validator + its bytes).
+const MAX_SCHEMA_CACHE_MAX: usize = 4096;
+
+/// Cache entry: the exact serialized schema bytes (collision disambiguation)
+/// plus the shared compiled schema.
+type CacheEntry = (Vec<u8>, Arc<IngressSchema>);
+
+/// Cache map: schema-hash → (schema bytes, shared compiled schema).
+type SchemaMap = Mutex<LruCache<u64, CacheEntry>>;
+
+/// Process-wide compiled-schema cache (lazily initialized on first compile).
+static SCHEMA_CACHE: OnceLock<SchemaMap> = OnceLock::new();
+
+/// Resolve a capacity from the raw env value: unset/unparseable/zero →
+/// [`DEFAULT_SCHEMA_CACHE_MAX`], otherwise clamped to
+/// `1..=MAX_SCHEMA_CACHE_MAX` (an LRU needs a nonzero capacity).
+fn resolve_cap(raw: Option<&str>) -> usize {
+    raw.and_then(|v| v.trim().parse::<usize>().ok())
+        .filter(|n| *n > 0)
+        .map(|n| n.min(MAX_SCHEMA_CACHE_MAX))
+        .unwrap_or(DEFAULT_SCHEMA_CACHE_MAX)
+}
+
+/// Resolve the configured cache capacity (`CASTRUM_SCHEMA_CACHE_MAX`).
+fn cache_cap() -> usize {
+    resolve_cap(std::env::var("CASTRUM_SCHEMA_CACHE_MAX").ok().as_deref())
+}
+
+/// Hash the serialized schema bytes with the crate's XXH3-64 helper (stable and
+/// well-distributed). The exact byte string is the identity: serialization
+/// preserves key insertion order (`serde_json` is built with `preserve_order`),
+/// so whitespace/key-order differences compile separately rather than collide.
+#[inline]
+fn schema_key(bytes: &[u8]) -> u64 {
+    crate::crypto::hashing::fast_hash_bytes(bytes)
+}
+
+/// Look up (or compile and insert) the shared `IngressSchema` for
+/// `schema_value`. Only successes are cached; a compile error is returned
+/// verbatim (identical message to a direct `IngressSchema::compile`).
+fn get_or_compile_in(
+    cache: &SchemaMap,
+    schema_value: &serde_json::Value,
+) -> std::result::Result<Arc<IngressSchema>, String> {
+    let bytes = serde_json::to_vec(schema_value).map_err(|e| e.to_string())?;
+    let key = schema_key(&bytes);
+
+    // Fast path: a hash hit is only trusted when the bytes MATCH (a colliding
+    // hash falls through to a real compile, never a wrong-schema hit).
+    if let Some((stored, existing)) = cache.lock().get(&key) {
+        if stored.as_slice() == bytes.as_slice() {
+            return Ok(Arc::clone(existing));
+        }
+    }
+
+    // Miss: compile WITHOUT holding the lock (a slow compile must not block
+    // other schema lookups/inserts).
+    let compiled = Arc::new(IngressSchema::compile(schema_value)?);
+
+    // Re-check under the lock: a concurrent thread may have compiled the same
+    // schema while we were outside it — prefer the first inserter's Arc (same
+    // bytes) so all callers share one instance. A colliding entry with
+    // different bytes is REPLACED (the bucket holds exactly one schema).
+    let mut guard = cache.lock();
+    if let Some((stored, existing)) = guard.get(&key) {
+        if stored.as_slice() == bytes.as_slice() {
+            return Ok(Arc::clone(existing));
+        }
+    }
+    let _ = guard.put(key, (bytes, Arc::clone(&compiled)));
+    drop(guard);
+    Ok(compiled)
+}
+
+/// Return the shared compiled schema for `schema_value`, compiling it on first
+/// use. Errors are NOT cached (a fixed schema compiles on the next attempt).
+pub(crate) fn get_or_compile(
+    schema_value: &serde_json::Value,
+) -> std::result::Result<Arc<IngressSchema>, String> {
+    let cache = SCHEMA_CACHE.get_or_init(|| {
+        Mutex::new(LruCache::new(
+            NonZeroUsize::new(cache_cap()).expect("cache cap is nonzero"),
+        ))
+    });
+    get_or_compile_in(cache, schema_value)
+}
+
+/// Drop every retained compiled schema. Idempotent and safe to call before
+/// any schema has ever been compiled (the cache is then simply uninitialized).
+/// Maintenance hook for the public `flushMemory()`.
+pub fn clear_schema_cache() {
+    if let Some(cache) = SCHEMA_CACHE.get() {
+        cache.lock().clear();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    fn local_cache(cap: usize) -> SchemaMap {
+        Mutex::new(LruCache::new(
+            NonZeroUsize::new(cap).expect("test cap is nonzero"),
+        ))
+    }
+
+    #[test]
+    fn same_schema_bytes_share_one_arc() {
+        let cache = local_cache(4);
+        let schema = json!({
+            "type": "object",
+            "required": ["x"],
+            "properties": { "x": { "type": "string" } }
+        });
+
+        let first = get_or_compile_in(&cache, &schema).unwrap();
+        let second = get_or_compile_in(&cache, &schema).unwrap();
+
+        assert!(Arc::ptr_eq(&first, &second));
+        assert_eq!(cache.lock().len(), 1);
+    }
+
+    #[test]
+    fn different_schema_bytes_compile_separately() {
+        let cache = local_cache(4);
+        let object = get_or_compile_in(&cache, &json!({ "type": "object" })).unwrap();
+        let string = get_or_compile_in(&cache, &json!({ "type": "string" })).unwrap();
+
+        assert!(!Arc::ptr_eq(&object, &string));
+        assert_eq!(cache.lock().len(), 2);
+    }
+
+    #[test]
+    fn compile_errors_are_not_cached() {
+        let cache = local_cache(4);
+        // `type` must be a string or array of strings — jsonschema rejects this
+        // at build time, so it never reaches the cache.
+        let invalid = json!({ "type": 42 });
+
+        assert!(get_or_compile_in(&cache, &invalid).is_err());
+        assert_eq!(cache.lock().len(), 0);
+    }
+
+    #[test]
+    fn cache_is_bounded_by_capacity() {
+        let cache = local_cache(2);
+        for i in 0..3 {
+            let schema = json!({
+                "type": "object",
+                "properties": { format!("k{i}"): { "type": "string" } }
+            });
+            get_or_compile_in(&cache, &schema).unwrap();
+        }
+        assert!(cache.lock().len() <= 2);
+    }
+
+    #[test]
+    fn clear_empties_the_cache() {
+        let cache = local_cache(4);
+        let schema = json!({ "type": "object" });
+        let first = get_or_compile_in(&cache, &schema).unwrap();
+
+        cache.lock().clear();
+
+        assert_eq!(cache.lock().len(), 0);
+        let second = get_or_compile_in(&cache, &schema).unwrap();
+        // A cleared cache recompiles: a fresh Arc, not the old shared one.
+        assert!(!Arc::ptr_eq(&first, &second));
+    }
+
+    #[test]
+    fn cap_defaults_clamps_and_rejects_bad_values() {
+        assert_eq!(resolve_cap(None), DEFAULT_SCHEMA_CACHE_MAX);
+        assert_eq!(resolve_cap(Some("")), DEFAULT_SCHEMA_CACHE_MAX);
+        assert_eq!(resolve_cap(Some("abc")), DEFAULT_SCHEMA_CACHE_MAX);
+        assert_eq!(resolve_cap(Some("0")), DEFAULT_SCHEMA_CACHE_MAX);
+        assert_eq!(resolve_cap(Some("256")), 256);
+        assert_eq!(resolve_cap(Some(" 64 ")), 64);
+        // Absurd values are clamped so the LRU cannot be sized unboundedly.
+        assert_eq!(resolve_cap(Some("999999999")), MAX_SCHEMA_CACHE_MAX);
+    }
+
+    #[test]
+    fn hash_collision_returns_the_correct_schema() {
+        let cache = local_cache(4);
+        let schema_a = json!({ "type": "object", "required": ["a"] });
+        let schema_b = json!({ "type": "object", "required": ["b"] });
+        let bytes_b = serde_json::to_vec(&schema_b).unwrap();
+        let key_b = schema_key(&bytes_b);
+
+        // Simulate an xxh3 collision: an entry under B's key that actually holds
+        // A's bytes + compiled validator. Under a hash-only cache this would be
+        // returned for B (wrong-schema validation bypass).
+        let a = get_or_compile_in(&cache, &schema_a).unwrap();
+        let bytes_a = serde_json::to_vec(&schema_a).unwrap();
+        let _ = cache.lock().put(key_b, (bytes_a, Arc::clone(&a)));
+
+        // The byte compare must reject the collision and compile the REAL B.
+        let b = get_or_compile_in(&cache, &schema_b).unwrap();
+        assert!(!Arc::ptr_eq(&a, &b));
+        assert!(b.validate(br#"{"b":1}"#));
+        assert!(!b.validate(br#"{"a":1}"#));
+        // A itself still resolves correctly (its own bucket is intact).
+        let a_again = get_or_compile_in(&cache, &schema_a).unwrap();
+        assert!(Arc::ptr_eq(&a, &a_again));
+    }
+
+    #[test]
+    fn global_get_or_compile_and_clear() {
+        // Use a schema unique to this test so parallel tests cannot repopulate
+        // the key between the clear and the recompile.
+        let schema = json!({
+            "type": "object",
+            "properties": { "schema_cache_global_probe": { "type": "integer" } }
+        });
+
+        clear_schema_cache();
+        let first = get_or_compile(&schema).unwrap();
+        let again = get_or_compile(&schema).unwrap();
+        assert!(Arc::ptr_eq(&first, &again));
+
+        clear_schema_cache();
+        let recompiled = get_or_compile(&schema).unwrap();
+        assert!(!Arc::ptr_eq(&first, &recompiled));
+    }
+}

package/rust/payload/sse.rs

@@ -40,10 +40,14 @@ pub fn encode_event_size(
     if let Some(retry) = retry {
         need += 8 + u64_digits(retry); // "retry: " + digits + "\n"
     }
-    // One `data: ` (6) + `\n` (1) per input line, the line bytes themselves,
-    // then the terminating blank `\n`.
-    let line_count = data.iter().filter(|&&b| b == b'\n').count() + 1;
-    need + line_count * 7 + data.len() + 1
+    // One `data: ` (6) + `\n` (1) per input line, the line bytes themselves
+    // (SEGMENTS EXCLUDE the `\n` separators — sum of segment lengths =
+    // `data.len() - (line_count - 1)`), then the terminating blank `\n`.
+    // Line boundaries found via SIMD memchr — a scalar `filter().count()`
+    // pass over the full payload was ~1 cycle/byte (~650ns/KB steady state),
+    // collapsing large encodes to 0.10× of JS.
+    let line_count = memchr::memchr_iter(b'\n', data).count() + 1;
+    need + line_count * 7 + data.len() - (line_count - 1) + 1
 }
 
 /// Encode one SSE event into `out`, returning bytes written. Zero-alloc (no
@@ -98,7 +102,23 @@ pub fn encode_event_into_slice(
         out[w] = b'\n';
         w += 1;
     }
-    for line in data.split(|&b| b == b'\n') {
+    // One `data: ` line per input line: SIMD memchr finds the `\n` boundaries
+    // (no scalar split() re-scan of the whole payload), copying each run.
+    // `data.split('\n')` semantics are preserved exactly: the tail after the
+    // last `\n` is emitted even when empty.
+    let mut line_start = 0usize;
+    for sep in memchr::memchr_iter(b'\n', data) {
+        let line = &data[line_start..sep];
+        out[w..w + 6].copy_from_slice(b"data: ");
+        w += 6;
+        out[w..w + line.len()].copy_from_slice(line);
+        w += line.len();
+        out[w] = b'\n';
+        w += 1;
+        line_start = sep + 1;
+    }
+    {
+        let line = &data[line_start..];
         out[w..w + 6].copy_from_slice(b"data: ");
         w += 6;
         out[w..w + line.len()].copy_from_slice(line);
@@ -211,4 +231,57 @@ mod tests {
         let mut out = [0u8; 3];
         assert!(encode_event_into_slice(Some("update"), b"payload", None, None, &mut out).is_err());
     }
+
+    #[test]
+    fn large_multiline_matches_allocating() {
+        // 4k lines x 96-byte data — spans well past any SIMD threshold.
+        let mut data = Vec::with_capacity(4 * 1024 * 96);
+        for i in 0..4 * 1024 {
+            data.extend_from_slice(format!("line-{i} ").as_bytes());
+            data.extend_from_slice(b"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"); // 55
+            data.push(b'\n');
+        }
+        let expected = encode_event(None, &data, None, None);
+        assert!(
+            expected.len() > 256 * 1024,
+            "test payload unexpectedly small: {}",
+            expected.len()
+        );
+        let mut out = vec![0u8; encode_event_size(None, &data, None, None)];
+        let w = encode_event_into_slice(None, &data, None, None, &mut out).unwrap();
+        assert_eq!(w, expected.len());
+        assert_eq!(&out[..w], &expected[..]);
+    }
+
+    #[test]
+    fn single_large_line_scales_too() {
+        // One 1MB line — the old scalar split() path cost ~300us here.
+        let mut data = vec![b'a'; 1 << 20];
+        data.push(b'\n');
+        let expected = encode_event(None, &data, None, None);
+        let mut out = vec![0u8; encode_event_size(None, &data, None, None)];
+        let w = encode_event_into_slice(None, &data, None, None, &mut out).unwrap();
+        assert_eq!(w, expected.len());
+        assert_eq!(&out[..w], &expected[..]);
+    }
+
+    #[test]
+    fn trailing_newline_emits_empty_tail_line() {
+        // split() semantics: "a\n" -> ["a", ""] -> one empty data: line.
+        assert_eq!(
+            encode_event(None, b"hello\n", None, None),
+            b"data: hello\ndata: \n\n"
+        );
+        assert_eq!(encode_event(None, b"\n", None, None), b"data: \ndata: \n\n");
+        assert_eq!(encode_event(None, b"", None, None), b"data: \n\n");
+    }
+
+    #[test]
+    fn embedded_crlf_kept_in_line() {
+        // Only \n splits lines; \r stays in the line bytes.
+        assert_eq!(
+            encode_event(None, b"a\r\nb", None, None),
+            b"data: a\r\ndata: b\n\n"
+        );
+    }
 }

package/rust/task/mod.rs

@@ -30,6 +30,7 @@ pub use runtime::{init, shutdown, threads};
 ///
 /// The pool auto-starts (default worker count) on first use, so callers do not
 /// have to sequence `init` before `submit`. `args` is moved onto the worker.
+/// Returns `false` when the bounded admission queue is full (`OVERLOADED`).
 pub fn submit_op(op: u32, args: Vec<u8>, id: u64) -> bool {
     runtime::submit(move || ops::execute_guarded(op, &args, id))
 }