next-leak 0.3.0 → 0.4.0

package/README.md

@@ -35,7 +35,7 @@ holds it — without being told what to look for.
 | [#95094](https://github.com/vercel/next.js/issues/95094) | Middleware `setTimeout` ids retained by the sandbox | **Reproduced** · mechanism named · 112 MB retained |
 | [#94890](https://github.com/vercel/next.js/issues/94890) | Router LRU cache doesn't count its keys | **Reproduced** · 26.7 → 71.9 MB |
 | [#84884](https://github.com/vercel/next.js/issues/84884) | axios + `AbortSignal` in middleware | **Reproduced** · 32.8 → 369.9 MB |
-| [#94919](https://github.com/vercel/next.js/issues/94919) | RSC tree retained on client aborts | Not reproduced on standalone — [and it says why](#scope-and-limits-read-before-filing-issues) |
+| [#94919](https://github.com/vercel/next.js/issues/94919) | RSC tree retained on client aborts | **Reproduced** · 39 → 139 MB · [with a caveat](#scope-and-limits-read-before-filing-issues) |
 
 The full causal chain, measured on that same issue: leak found (28.7 -> 138.9 MB
 across 8 cycles), the workaround from the thread applied (`clearTimeout(id)`
@@ -86,8 +86,11 @@ The verdict comes from the **shape of the post-GC curve**: retained heap that
 keeps growing every cycle is a leak; growth that flattens is warm-up. Where the
 heap sits is noise — 40 MB and 400 MB say nothing on their own — so only the
 shape is judged. The one absolute number involved is the gate a cycle's growth
-must clear to count, and it scales with the traffic that cycle served, so
-changing `--requests` changes how long the run takes and not what it decides.
+must clear to count, and above 5000 requests per cycle it scales with the
+traffic that cycle served — so in that range changing `--requests` changes how
+long the run takes and not what it decides. Below 5000 the gate stops shrinking
+and sits on the instrument's noise floor instead, so less traffic really does
+buy a less sensitive run: that is the trade `--quick` makes at 2000 requests.
 Every report prints the gate it used.
 
 ## Options
@@ -123,10 +126,14 @@ Dynamic routes need sample params in `next-leak.config.json` in your app dir:
   without it.
 - **`query`** appends a query string per route template
   (`{ "/api/payload/[slug]": "weightKb=2048" }`).
-- **`abandonAfterMs`** makes clients hang up before the response arrives, the
-  way closed tabs, load-balancer timeouts and bots do. Some leaks only exist
-  on that path (`ServerResponse` retained after an early disconnect). Requests
-  abandoned on purpose are not counted as failures.
+- **`abandonAfterMs`** makes clients hang up mid-response, the way closed tabs,
+  load-balancer timeouts and bots do. Some leaks only exist on that path
+  (`ServerResponse` retained after an early disconnect; the RSC tee branch in
+  [#94919](https://github.com/vercel/next.js/issues/94919)). The clock starts
+  at the **first byte of the response**, not at the request — under load a
+  request-relative window cuts before the stream begins and tests a different
+  path. Small values are the point: `4` means "read the first chunk, then
+  vanish". Requests abandoned on purpose are not counted as failures.
 
 `run.json` records what every load phase actually did — requests sent,
 2xx, abandoned — so a run can be audited instead of trusted.
@@ -155,7 +162,9 @@ separates them, because each one has a different fix:
   is deliberately biased toward missing a leak rather than inventing one (a
   single flat or falling cycle is enough to call a route stable), so a leak
   that oscillates while it climbs can land here. To press harder, raise
-  `--cycles` and `--requests`: both make the run more sensitive. If the heap is
+  `--cycles` — every extra cycle is another delta the verdict gets to see.
+  Raising `--requests` only helps from below 5000: above that the gate scales
+  with the traffic, so the longer run decides the same thing. If the heap is
   flat but RSS keeps climbing, the report says so explicitly: that is an
   allocator, external-buffer or fragmentation problem, not a JS-heap leak.
 - **`leak`** — the report names the culprit when attribution resolves: your file (`culprit: src/app/x/page.tsx (your code)`), a dependency (package name), or framework internals. An `ISSUE-<route>.md` draft is generated; if the leak is app-owned, the draft tells you **not** to file it upstream.
@@ -260,6 +269,13 @@ through the build's source maps.
   `--max-old-space`, or every route dies as an OOM that is not the app's
   fault. When a run's heap gets close to the cap, the report says so.
 - Borderline routes can flip between `stable`/`leak` across runs — more cycles resolves this.
+- The [#94919](https://github.com/vercel/next.js/issues/94919) reproduction ships
+  a **custom Express server and deliberately no standalone output**, which this
+  tool cannot measure as published. The figure above comes from the same app
+  built with `output: "standalone"` — the leak is there too, but that is Next's
+  server under test, not the reporter's middleware chain. Instrumenting their
+  own server by hand (same `--import` bootstrap, no CLI) showed the same shape:
+  post-GC heap 43 → 56 MB and arrayBuffers 0.2 → 10.7 MB over four cycles.
 - The **peak-pressure** thresholds are calibrated against one reproduction measured in three regimes plus the bundled fixture, not against the ~40-route validation set the verdicts were tuned on. A peak note never changes a verdict, so the cost of a false one is noise, not a false accusation — but treat the exact thresholds as young.
 - The measured app runs with its real environment: routes that call external services will call them under load. Scope with `--routes` and moderate `--requests` accordingly.
 

package/dist/abandon-load.d.ts

@@ -2,7 +2,7 @@ export type AbandonPhaseOptions = {
     url: string;
     amount: number;
     connections: number;
-    /** Destroy the socket this many ms after sending the request. */
+    /** Destroy the socket this many ms after the first byte of the response. */
     abandonAfterMs: number;
     headers?: Record<string, string>;
 };
@@ -15,6 +15,8 @@ export type AbandonPhaseResult = {
      * different path (the server may never have begun rendering).
      */
     abandonedMidStream: number;
+    /** Abandonments where the first-byte budget expired in silence. */
+    abandonedBeforeResponse: number;
     completed: number;
     errors: number;
 };
@@ -27,7 +29,7 @@ export type AbandonPhaseResult = {
  * `ServerResponse` retention to an early disconnect, which only happens when
  * a client goes away mid-flight (closed tabs, load-balancer timeouts, bots).
  *
- * Raw sockets keep this honest: write the request, wait `abandonAfterMs`,
- * destroy the socket. No response is read.
+ * Raw sockets keep this honest: write the request, wait for the response to
+ * start, then wait `abandonAfterMs` and destroy the socket mid-stream.
  */
 export declare function runAbandonPhase(options: AbandonPhaseOptions): Promise<AbandonPhaseResult>;

package/dist/{chunk-E5ZKAANQ.js → chunk-BDIPW6FU.js}

@@ -115,7 +115,7 @@ function abandonmentWarnings(outcome) {
   if (abandoned > 0 && midStream < abandoned * MID_STREAM_FLOOR) {
     return [{
       code: "abandon-before-response",
-      detail: `${outcome.phase} cut ${abandoned} requests before the server sent anything (${midStream} mid-stream) \u2014 this tested pre-response disconnects, not mid-stream teardown; raise abandonAfterMs above the route's time-to-first-byte`
+      detail: `${outcome.phase} cut ${abandoned} requests that never produced a byte (${midStream} mid-stream) \u2014 the route did not start responding, so mid-stream teardown was not exercised; the route is saturated or hung at this load, not mistuned`
     }];
   }
   return [];

package/dist/{chunk-BUNQT6VK.js → chunk-NYWCWKS6.js}

@@ -1,7 +1,7 @@
 import { createRequire as __nextLeakCreateRequire } from 'node:module';import { fileURLToPath as __nextLeakFileURLToPath } from 'node:url';import { dirname as __nextLeakDirname } from 'node:path';const require = __nextLeakCreateRequire(import.meta.url);const __filename = __nextLeakFileURLToPath(import.meta.url);const __dirname = __nextLeakDirname(__filename);
 import {
   effectiveVerdict
-} from "./chunk-E5ZKAANQ.js";
+} from "./chunk-BDIPW6FU.js";
 import {
   assessPeakPressure,
   describePeakPressure

package/dist/{chunk-2BQ5KXIJ.js → chunk-USNLL625.js}

@@ -6,7 +6,7 @@ import {
   effectiveVerdict,
   minGrowthFor,
   warrantsIssueDraft
-} from "./chunk-E5ZKAANQ.js";
+} from "./chunk-BDIPW6FU.js";
 import {
   assessPeakPressure,
   describePeakPressure
@@ -92501,6 +92501,11 @@ var routeConfigSchema = z2.object({
    * that path — vercel/next.js#89091 traces `ServerResponse` retention to
    * an early disconnect — and a load generator that always waits politely
    * never reaches it.
+   *
+   * Counted **from the first byte of the response**, not from the request:
+   * under load a server's first byte arrives long after any sane fixed
+   * window, so a request-relative clock cuts before the stream starts and
+   * tests the wrong path entirely.
    */
   abandonAfterMs: z2.number().int().positive().optional()
 }).strict();
@@ -92764,6 +92769,9 @@ function diffAgainstBaseline(baseline, after, options = {}) {
       node.type,
       (afterTypeSelfSizes.get(node.type) ?? 0) + node.self_size
     );
+    if (node.type === "synthetic") {
+      return;
+    }
     if (!baseline.nodeIds.has(node.id)) {
       if (node.retainedSize >= resolved.newThresholdBytes) {
         const chain = walkChain(node, resolved.chainDepth);
@@ -93260,6 +93268,7 @@ async function requestSnapshot(port, name) {
 
 // src/abandon-load.ts
 import net from "net";
+var FIRST_BYTE_BUDGET_MS = 5e3;
 async function runAbandonPhase(options) {
   const target = new URL(options.url);
   const port = Number(target.port || 80);
@@ -93274,6 +93283,7 @@ Host: ${target.host}\r
     sent: 0,
     abandoned: 0,
     abandonedMidStream: 0,
+    abandonedBeforeResponse: 0,
     completed: 0,
     errors: 0
   };
@@ -93297,6 +93307,8 @@ Host: ${target.host}\r
         result.abandoned += 1;
         if (responseStarted) {
           result.abandonedMidStream += 1;
+        } else {
+          result.abandonedBeforeResponse += 1;
         }
       }
       finish();
@@ -93304,11 +93316,17 @@ Host: ${target.host}\r
     socket.once("connect", () => {
       result.sent += 1;
       socket.write(request2);
-      timer = setTimeout(giveUp, options.abandonAfterMs);
+      timer = setTimeout(giveUp, FIRST_BYTE_BUDGET_MS);
       timer.unref();
     });
     socket.on("data", () => {
+      if (responseStarted) {
+        return;
+      }
       responseStarted = true;
+      clearTimeout(timer);
+      timer = setTimeout(giveUp, options.abandonAfterMs);
+      timer.unref();
     });
     socket.once("end", () => {
       if (!settled) {
@@ -93470,6 +93488,7 @@ async function runRitual(options, deps = defaultDeps) {
       sent: outcome.sent,
       abandoned: outcome.abandoned,
       abandonedMidStream: outcome.abandonedMidStream,
+      abandonedBeforeResponse: outcome.abandonedBeforeResponse,
       ok2xx: outcome.completed,
       errors: outcome.errors
     });
@@ -93895,7 +93914,7 @@ async function measureRoute(context, route, requestPath, index) {
   };
 }
 async function writeEvidenceBundle(report, workDir) {
-  const { renderHtmlReport } = await import("./html-report-KQGUDYK5.js");
+  const { renderHtmlReport } = await import("./html-report-VW7VQOCH.js");
   const { renderIssueMarkdown } = await import("./issue-report-HKA26WNV.js");
   for (const route of report.routes) {
     if (route.status === "measured" && warrantsIssueDraft(route)) {

package/dist/cli.js

@@ -9,8 +9,8 @@ import {
   killActiveChildren,
   parseCliArgs,
   runMeasurement
-} from "./chunk-2BQ5KXIJ.js";
-import "./chunk-E5ZKAANQ.js";
+} from "./chunk-USNLL625.js";
+import "./chunk-BDIPW6FU.js";
 import "./chunk-XHPUAMJG.js";
 import "./chunk-6XYFBOL2.js";
 

package/dist/{html-report-KQGUDYK5.js → html-report-VW7VQOCH.js}

@@ -1,8 +1,8 @@
 import { createRequire as __nextLeakCreateRequire } from 'node:module';import { fileURLToPath as __nextLeakFileURLToPath } from 'node:url';import { dirname as __nextLeakDirname } from 'node:path';const require = __nextLeakCreateRequire(import.meta.url);const __filename = __nextLeakFileURLToPath(import.meta.url);const __dirname = __nextLeakDirname(__filename);
 import {
   renderHtmlReport
-} from "./chunk-BUNQT6VK.js";
-import "./chunk-E5ZKAANQ.js";
+} from "./chunk-NYWCWKS6.js";
+import "./chunk-BDIPW6FU.js";
 import "./chunk-XHPUAMJG.js";
 import "./chunk-6XYFBOL2.js";
 export {

package/dist/index.js

@@ -39,13 +39,13 @@ import {
   sourceIndexAt,
   summarizeBaseline,
   validateTarget
-} from "./chunk-2BQ5KXIJ.js";
+} from "./chunk-USNLL625.js";
 import {
   renderHtmlReport
-} from "./chunk-BUNQT6VK.js";
+} from "./chunk-NYWCWKS6.js";
 import {
   classifyTrend
-} from "./chunk-E5ZKAANQ.js";
+} from "./chunk-BDIPW6FU.js";
 import {
   renderIssueMarkdown
 } from "./chunk-WXAFXVWS.js";

package/dist/ritual.d.ts

@@ -39,6 +39,8 @@ export type LoadOutcome = {
     abandoned?: number;
     /** Abandonments where the response had already started — the mid-stream path. */
     abandonedMidStream?: number;
+    /** Abandonments where the first-byte budget expired in silence. */
+    abandonedBeforeResponse?: number;
 };
 /**
  * Whether the heap actually held still before each sample was taken.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next-leak",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Find out whether your Next.js app actually leaks memory — how much, on which route, and whose fault it is.",
   "keywords": [
     "nextjs",