Skip to main content

Runtime Limits, Failures and Data Ownership

Enterprise 3.3.0+. Enabled installations load in each managed worker. Workers share installations, so mutable factory state is worker-local and replicas may differ. Keep per-request inputs immutable and do not use process memory as a cross-worker transaction store.

Capacity and deadlines​

Native work is bounded by worker count/concurrency and a FIFO queue. maxQueue: 0 rejects excess work immediately; a full queue returns PLUGIN_QUEUE_FULL. One invocation deadline covers queue wait, native execution and callbacks. There is no automatic retry. Callback count/concurrency and tagged payload/depth budgets are separate limits; see Configuration for all defaults/ranges.

A timed-out or crashed worker is terminated and replaced. All in-flight invocations sharing it may fail, including calls from another installation. A replacement reloads factories/manifests; recovery is not a replay of failed requests. Startup waits for every enabled installation and fails closed on incompatible configuration/exports. Never infer exactly-once remote writes from a successful retry or timeout: already-started I/O may have completed, and cancellation of host work is cooperative.

Shutdown stops admission, waits within shutdownTimeoutMs for bounded work, then ends workers. Long-running native work cannot extend that budget. Host callback capacity stays reserved until real host work settles; abandoning a promise does not free it early.

workerHeapMb bounds V8 old-space, not total heap or RSS. OS permissions, external memory, native addons and remote services are not sandboxed by this setting. Plugins are trusted administrator code, not hostile-code isolation. Worker stdin/stdout/stderr are discarded; throwing a raw exception does not expose its message or stack through the safe plugin error contract. Use deterministic tests and explicit data/error contracts, not console logging as a supported plugin diagnostic API.

External data and I/O​

Plugins own their file access, external requests and cache policy. Use read-only mounts where possible, keep request inputs separate from mutable factory state, and bound external I/O and returned data. Access supported server helpers through declared local mapping callbacks rather than passing service handles across IPC.

Persistent background consumers, detached callbacks, unbounded paging and native-addon packaging are unsupported. Timed-out already-started FHIR/network I/O may still run; design idempotency/version guards at the remote service boundary when writes are necessary. Test your artifact under the actual runtime and permissions; the tested runtime contract does not guarantee correctness of arbitrary third-party code.