r34 shared capacity settings

Current public-service and schema-10 upgrade instructions: r34 public service deployment. This includes both 2026-10-09 lifecycle packages. Large active-user capacity requires the measured qualification described there.

These hosted controls are part of the complete release, independently of whether HF uses native persistence or optional external PostgreSQL. Use the actual runtime settings in pf_saas/settings.py as the configuration contract. Names below all have the PF_SAAS_ prefix. The scope matters: a per-process cap does not become a whole-fleet cap by adding replicas. Standalone does not read these hosted settings.

Database connections and deadlines

Linux/Docker and managed PostgreSQL profiles use session advisory resource locks and SQL generation checks. Use direct or session-affine connections; transaction/statement pooling is unsupported for those service clients. The on-host reference already uses a direct local connection.

Native HF retains local per-resource filesystem locks on its single controller, with its global durable ownership/WAL fencing still enforced. It does not add SQL generation writes solely to coordinate these local resource operations. This native exception does not authorize a second controller or remove durable publication acknowledgement.

For PostgreSQL profiles other than native HF, the main pool plus overflow must total at least four connections for shared resource-lock, publication and callback work. Optional managed HF requires at least WORKER_SLOTS + 4. Native HF retains its original per-pool bounds and combined connection ceiling; the additional SQL resource-lock minimum does not apply to its local lock path. The ordinary 5+5 main/overflow defaults satisfy all profiles at one worker slot.

The conservative validation budget is:

(main pool + overflow + lease pool + enabled assistant pool + assistant overflow) * (API processes + worker processes) + reserved connections.

The reference host and local Compose explicitly declare one API plus one worker; with enabled assistant defaults their conservative budget is 36 connections. The distributed example also declares one API plus one worker; with assistant disabled it is 32. Update the counts before growing the fleet. Different pool sizes across replicas require an equivalent conservative fleet calculation; use identical settings in the supplied topology. A runtime declaration does not change the PostgreSQL server's max_connections or reserve sockets itself. Native HF additionally limits its combined main/lease/assistant configured pools to 25, leaving headroom for its local PostgreSQL control and WAL services.

Connection, lock and statement limits bound different operations; they are not one end-to-end request deadline. Batch migration/backfill time must be qualified on a copy of the actual database. For a large migration, use an explicitly reviewed temporary migration-only statement limit; retain the application limit when normal services restart. No service should run mixed schema versions.

HTTP and browser work

Native HF uses a bounded in-memory account limiter on its single controller so ordinary authenticated reads do not create a durable SQL/WAL write solely to count HTTP requests. It uses monotonic one-minute windows, resets its rate counters on controller restart, and returns 429 when an account exhausts its minute allowance or a new account cannot fit the active-counter bound. This counter is intentionally not a durable quota/billing ledger. Native HF must still have one controller; it is not a shared counter across replicas.

Linux/Docker and managed/distributed profiles retain atomic SQL account counters for requests across their service processes. Authentication throttling, authorization, native ownership fencing and durable job/provider/usage accounting remain in place. The native limiter does not bypass those checks.

Polling intervals must be 1,000..600,000 ms and increase from active through idle, hidden and maximum backoff. Shared browser scheduling adds jitter and avoids overlapping polls; stale selections are ignored. Authorized list routes use cursor pages (default 100, maximum 500), and the UI offers further pages. These reduce unnecessary work without changing project authorization.

Assistant and provider admission

Tenant/provider concurrency cannot exceed deployment concurrency. A positive cost ceiling requires both positive conservative tariffs. Zero cost ceilings are explicit absence of that particular cost cap, not free provider use. These are application estimates and admissions, not provider invoices. BYOK and operator credentials remain private; institution and project disclosure policy still applies. Ambiguous external outcomes retain accounting until reconciled; a timeout alone does not authorize duplicate requests or refund a reservation. Scientific execution capacity is separately admitted even when initiated by AI.

Jobs, maintenance and state

Retain existing explicit organization/deployment storage and cost settings when upgrading; defaults are not a quota reset. See the distributed guide for worker host scaling, drain/termination settings and measured-capacity acceptance, and the native guide for native encrypted quota/persistence controls. Optional managed HF has additional TLS, readiness, state-migration and process settings in its own guide. Shared settings do not imply replicated native HF writers or a change to the scientific model.