Stream host-supplied Service Worker responses with bounded backpressure

[wieslawsoltes]

Parent resource issue: #266
Nested-webview epic: #264
Parser and connected-resource routing: #308 (separate)
Local-resource admission and localhost mapping: later #266 slices

Proven boundary

Merged #303/#304 provide Service Worker client messaging and WritableStream/TransformStream primitives, and #310/#312/#323 route controlled resources with range/cache metadata and bounded final response bodies. The remaining Code OSS chunk fallback is not covered end to end: the worker posts load-resource to its controlled client, the client returns did-load-resource, ordered did-load-resource-chunk ArrayBuffers, and did-load-resource-end, and the FetchEvent consumes that response stream.

The current generic bridge bounds serialized message queues, but the TransformStream path has no meaningful writable backpressure, its readable cancellation does not retire the writer, and no contract proves malformed, duplicate, late, aborted, timed-out, or navigation-stale host replies fail closed without retaining stream state. This is the earliest remaining dependency before localResourceRoots admission can safely supply bytes.

Scope

• Preserve product-neutral Service Worker Client/ServiceWorker postMessage delivery for metadata, transferred byte chunks, completion, and error messages.
• Make TransformStream writer ready, desiredSize, ordered writes, close, abort, and readable cancellation enforce bounded queued work and deterministic settlement.
• Tie host-response stream lifetime to the controlled fetch/client generation so navigation, unregister, timeout, cancellation, and shutdown reject late chunks and release pending state once.
• Retain the existing 256-message/16 MiB message-queue, 32-response, 64 MiB response-body, and fail-closed clone/transfer bounds.
• Keep request admission, localResourceRoots/path traversal, localhost mapping, CSS url() interception, and consumer-specific Code OSS changes outside this slice.

Acceptance

• A WPT-derived/Chromium contract covers ordered chunk delivery, writer backpressure, close, abort/error, readable cancellation, duplicate/late completion, and browser-shaped stream/message identities.
• A native Code-shaped contract sends load-resource from a FetchEvent to its controlled client, returns metadata plus transferred chunks/end, and observes the exact streamed response without a direct host-loader bypass.
• Malformed/oversized chunks, unknown or stale request IDs, queue exhaustion, timed-out requests, retired client generations, unregister, and shutdown fail closed and leave zero pending host streams/messages.
• A warm 64 KiB response reaches first byte at p95 <= 100 ms; 32 concurrent 1 MiB streamed responses finish without starvation and stay within aggregate queue/body bounds.
• One hundred stream/abort/retire cycles retain <= 8 MiB V8 heap and remain within the focused RSS growth bound, with native and Chromium timings published.
• No changes overlap Preserve unitless line height for generated content #322's generated-content line-height paths, Route connected web resources through controlling Service Workers #308's resource scheduling/CSS URL ownership, or consolidation PR Add Code OSS browser and native desktop compatibility #76.

Proposed focused PR

One generic host-message streaming/backpressure tranche from exact main 3e82305aa0ce9a86fde3406db23681baa873ea45, with native/browser contracts and bounded lifecycle/performance evidence. Keep #266 open for local-resource admission, localhost mapping, CSS URL resources, and cumulative Markdown acceptance.

[wieslawsoltes]

Owned on branch feature/host-message-streaming-266 from exact main 3e82305aa0ce9a86fde3406db23681baa873ea45.

Initial implementation boundary:

• experiments/WebScene.NativeEngine.Probe/native/webscene_v8_runtime.cpp: bounded TransformStream backpressure and cancel/abort settlement.
• experiments/WebScene.NativeEngine.Probe/native/webscene_v8_runtime_service_workers.inc and state types only if the reduced Code-shaped message exchange proves lifecycle tracking is required.
• experiments/WebScene.NativeEngine.Probe/tests/native_v8_runtime_stream_fetch_tests.inc plus the native test registration/CMake entry: message-to-stream correctness, 32-way throughput, timeout/retirement, 100-cycle heap/RSS gates.
• New tests/WebPlatformSubset/contracts/service-worker-host-message-stream* worker/document pair and the additive component profile entry for Chromium/native parity.

Excluded: #322 line-height files, #308 resource scheduling and CSS URL paths, localResourceRoots admission, localhost mapping, CSS metadata/parser/cascade, and consolidation PR #76.

[wieslawsoltes]

PR #333 is open from feature/host-message-streaming-266 at f3713300ea6d72d5a569d64ab57417a109922d8b, based on exact main 8c792eedcc1bd7120455cdf589ef64fbfeec47ed.

Focused evidence:

• native host-stream gate: 100 x 64 KiB p95 3.99179 ms; concurrent 32 MiB 61.423 ms;
• V8 heap 1,201,348 -> 1,201,348 bytes after collection;
• peak RSS 38,338,560 -> 202,817,536 bytes (within the 256 MiB stress budget);
• current RSS 197,083,136 after the one-time bulk high-water -> 118,079,488 after 100 warm/lifecycle cycles and teardown (no retained growth; 64 MiB maximum);
• native WPT-derived contract 7/7 and Chrome 153 contract 7/7;
• related resource-plane, FetchEvent, clients, and range/cache native gates pass.

The implementation keeps the existing 64 MiB response cap and adds a 16 MiB unconsumed writable queue cap, byte-only service-worker response chunks, browser-style TransformStream pressure/cancellation, and prompt runtime retirement on unregister.