perf(feature-flagging): bound exposure delivery memory

[leoromanovsky]

Motivation

Persistent delivery failures retain the complete exposure buffer. New unique events increase that buffer after every failed flush.

A local synthetic test sent 40 batches of 25 unique events to an endpoint that returned HTTP 400. The writer retained 1,000 events. The next request was 390,085 bytes. The retained event count and request size increased linearly. This increases heap use, serialization work, and network traffic during an outage.

The change enforces one delivery attempt per event. It limits a handler batch to 1,000 events and each request body to 5 MiB.

Changes and Decisions

• Clear each batch after its delivery attempt.
• Do not replay after an ambiguous delivery outcome.
• Disable the shared five-retry HTTP policy for exposures.
• Split payloads at the 5 MiB byte limit.
• Send one encoded payload at a time.
• Count drops for queue overflow, payload size, serialization, and delivery failure.
• Encode one event before checking its size. A follow-up will bound captured context before enqueue.

Validation

The same local synthetic test made 40 delivery attempts. It retained no failed events for replay. The largest request contained 38 events and 14,905 bytes. Attempts stopped after the final batch.

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.86 s	14.76 s	[-0.2%; +1.6%] (no difference)
startup:insecure-bank:tracing:Agent	13.58 s	13.75 s	[-2.1%; -0.4%] (maybe better)
startup:petclinic:appsec:Agent	17.50 s	17.32 s	[+0.2%; +1.8%] (maybe worse)
startup:petclinic:iast:Agent	16.75 s	17.58 s	[-8.8%; -0.7%] (maybe better)
startup:petclinic:profiling:Agent	17.44 s	17.33 s	[-0.5%; +1.8%] (no difference)
startup:petclinic:sca:Agent	17.37 s	17.45 s	[-1.3%; +0.5%] (no difference)
startup:petclinic:tracing:Agent	16.60 s	16.68 s	[-1.2%; +0.3%] (no difference)

Commit: b7af7477 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.