Scale to zero — this service is idle by default - #2
Merged
Conversation
Called by self-hosted Command Center installs on a ~15-minute background
tick, so it is idle by design. Today, with no self-hosted installs, it
serves literally nothing: the only entries in 24 hours of logs are SSH
sessions.
The comment justifying always-warm claimed a cold start "would routinely
leak into the client's grace-period math". That had the scale wrong by
four orders of magnitude — SENTINEL_LICENSE_GRACE_HOURS is 72 HOURS, and
this service binds its port in ~4s (measured).
Three things make this safe, all verified rather than assumed:
1. Boot fits Fly's window. The proxy waits ~8s for an auto-started
machine to bind; 4s clears it. This is not theoretical — the
Sentinel AI agent needs 10s, missed that window, and had every
wakeup fail with RemoteDisconnected until it was kept warm.
2. The caller waits longer than Fly gives up: Command Center's
check-in timeout is 10s.
3. A miss is free. license_client.py treats network/5xx as
"unreachable" and applies the 72-hour grace, so a failed check-in
is a designed path. The next tick 15 minutes later catches it.
Flips if a license check ever moves onto a user-blocking path — then a
4s cold start is a 4s page stall. Noted in fly.toml.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Self-hosted Command Center installs call this on a ~15-minute background tick. Today, with no self-hosted installs, it serves nothing — the only entries in 24 hours of logs are my own SSH sessions.
The comment justifying always-warm claimed a cold start "would routinely leak into the client's grace-period math." That's off by four orders of magnitude:
SENTINEL_LICENSE_GRACE_HOURSis 72 hours, and this service binds its port in ~4s.Safe for three reasons, all measured rather than assumed:
RemoteDisconnecteduntil it was kept warm.license_client.pytreats network/5xx as "unreachable" and applies the 72-hour grace window — a failed check-in is a designed path, not an error path. The next tick 15 minutes later catches it and no customer notices.Saves ~$2/month, which isn't really the point — the point is the cost now tracks customers instead of the calendar.
Flips if a license check ever moves onto a user-blocking path (synchronous validation on dashboard load). Then a 4s cold start becomes a 4s page stall. Noted in fly.toml.
🤖 Generated with Claude Code