Bounded-memory artifact streaming: the constant-memory serve path.

The proxy serves an artifact by streaming it through from upstream, never buffering it whole, so a multi-hundred-megabyte tarball never becomes a local memory spike. The mirror worker's whole-artifact fetch (fetchArtifactBytes) is the separate, buffered mirroring concern.

Resource lifetime

A WAI streaming body runs after the handler returns, so an upstream connection released lexically is already gone by the time the body streams. Raw WAI avoids that: the relay opens the connection with responseOpen before it commits the response, and closes it through finally around the whole relay. The open-to-finally handoff is masked, so the request timeout's kill or Warp's teardown on client disconnect cannot strand the connection between responseOpen returning and finally arming responseClose.

Backpressure

pumpBody writes each chunk through the sink's bounded output buffer before pulling the next, and the write blocks once that buffer spills. The proxy therefore reads upstream only as fast as the client drains, in constant memory whatever the artifact's size. Only the first chunk is flushed, for a prompt first byte: at relay byte rates a per-chunk flush degenerates into one socket send per upstream read (see docs/architecture/web-layer.md → "Streaming and resource lifetime").

Progress

The pump reads under the Ecluse.Core.Registry.Progress watchdog, which counts only the time spent waiting on upstream. An upstream that falls below the floor aborts the relay mid-stream, and a client that drains slowly does not.