Guard increments rivet_guard_proxy_request_pending before awaiting the proxy handler and decrements it afterward. If the client cancels and Hyper drops the request future while it is suspended, the explicit decrement is skipped and the gauge leaks until the pod restarts.
The same drop-safety bug also affects:
- Guard in-flight bookkeeping: cancellation skips the per-client slot release, request-ID invalidation, and
rivet_guard_in_flight_request_count update.
- Gasoline operations: dropping
op() while it awaits Operation::run skips the rivet_gasoline_operation_pending decrement. Production shows leaked ACL/Epoxy operation gauges tracking the Guard leak.
Use RAII guards for all acquired pending/in-flight bookkeeping. Add regression tests that abort in-progress request and operation futures and verify gauges and slots return to their previous values. Keep this scoped to cleanup; do not change timeout or proxy behavior.
Guard increments
rivet_guard_proxy_request_pendingbefore awaiting the proxy handler and decrements it afterward. If the client cancels and Hyper drops the request future while it is suspended, the explicit decrement is skipped and the gauge leaks until the pod restarts.The same drop-safety bug also affects:
rivet_guard_in_flight_request_countupdate.op()while it awaitsOperation::runskips therivet_gasoline_operation_pendingdecrement. Production shows leaked ACL/Epoxy operation gauges tracking the Guard leak.Use RAII guards for all acquired pending/in-flight bookkeeping. Add regression tests that abort in-progress request and operation futures and verify gauges and slots return to their previous values. Keep this scoped to cleanup; do not change timeout or proxy behavior.