Public compute endpoints are protected like production APIs
Every public lab endpoint validates its input, rate-limits each client, admits one benchmark at a time and stops long runs at a deadline.
Context
Two lab experiments run on the server (the Fibonacci race and the thread benchmark). They are public and CPU- or thread-heavy by design, on a single small Cloud Run instance.
Decision
Every lab endpoint validates its input ranges, applies a per-client token bucket, and passes through a global concurrency gate (one benchmark at a time). Long runs have deadlines and return partial results. Streams are bounded in duration because an open stream is a billed request on Cloud Run.
Consequences
- A busy server answers 429 with
Retry-Afterand an RFC 9457 problem body; the UI explains it. - Every simulation that does not need the server runs in the browser, which also keeps costs near zero.