prerender-v0.97.0 — @harperfast/prerender

Fixes from a full review of the plugin, reviewed again as one branch in several rounds (#226). The full list, with every option and metric, is in the PR.

• Sitemap walk safety.
  • A failed child no longer turns shifted URLs into departures. It holds back only the URLs on the routes it last held.
  • A truncated document counts as a failed child.
  • sitemap.shrinkGuard refuses a much shorter document, or a dropped child that still holds URLs listed nowhere else. A refusal is accepted only after a new origin version (newVersionAfter) or acceptAge.
  • One lossless departure budget per walk, sitemap.departure.maxPerWalk (default 5000). It is spent only on departures that get an action and shared round-robin across children, and the rest are deferred to later walks.
  • The bypass token goes only to the root's host or domains, only over https, and redirects are followed manually.
  • Every hold-back is listed on the run row (holdBack).
• Change probe.
  • A pass skips only rows probed since it began. reprobeAfter is retired.
  • The anchored pass is chained, caught up at boot, and resumed after a throw.
  • The reseed after a canary trip acts on changes, except covered or healed pages.
  • The render check (renderCheck, on) confirms a suspect render by one re-probe drawn from the sweep's own origin budget.
  • Per-batch counters, plus probe_errors / caught_up / ignored / covered / anchor / detection_lag / render_mismatch.
• Render queue.
  • The slow-lane retry waits the effective cadence.
  • "Render this now" asks get a head start (urgentAt, 0.5) below detected changes.
  • fileDueNow off the owner forwards to the owner.
  • A result from a lease older than a change mark doesn't store the old page. Grant times are exact and releases are generation-checked.
  • render change_lag_ms and render_size.
• Serve path.
  • Proxied 3xx keep Location.
  • Pages found but not served are proxied without validators, and cached pages carry a weak ETag.
  • Peer rescue checks the owner copy's serve status.
  • HEAD goes upstream as HEAD.
  • Invalidation state is held per worker from a subscription.
  • Proxied bodies go through originBodyStream, because Readable.toWeb's cancel can throw.
• Admin and config.
  • POST /prerender_admin/revalidate works again (broken since 0.94.0).
  • Override rows report masking / redundant, and a set that would newly drop routes is refused.
  • Timer and read limits have maxima, and the analytics scan streams.

Deploying

• Worker restart required. New attributes on RenderSchedule, ProbeState, ConfigOverride and Sitemap. The lease buffer is renamed, so expect one duplicate-render burst.
• Don't write config overrides during the rolling restart.
• Check stored child sitemaps are https on a host in domains.
• Departures are metered at 5000 per walk even with maxActions: -1. Set maxPerWalk: -1 for the old behaviour.
• Don't raise page.swrTtl yet: the probe's hard expiry is still relative to it.