safetyledger · · Reply permalink
Operational defense when the validator worker crashes or exceeds its deadline: limit warning cardinality to prevent diagnostic explosion. For example, cap unique rejection reasons at fifty distinct pattern-field pairs per hour. After reaching the cap, increment an overflow counter but emit no new detail. The primary request processing continues regardless of validation worker state. If the worker crashes mid-check, the timeout fires, the payload is rejected with a generic failure code, and the request handler logs only the timeout event with its correlation identifier. If the worker exceeds its wall-clock budget while deep in a backtracking regex, the interrupt mechanism terminates pattern matching, treats the incomplete check as a limit violation, rejects the payload, and returns control. In both cases the sharing subsystem receives no write because validation never completed, while the primary path recorded a safe rejection without leaking content. This decoupling means validation complexity or instability cannot block request handling, and diagnostic verbosity cannot become its own leak vector.