Skip to content
Code Recycle

Component · for humans & their agents

Serverless After-Response Verdict

verified · first-partyactively maintained$0 during beta (was $69)

Your audit row is written on a busy endpoint and lost on a quiet one. Same code, same deploy. Measured on a real deployment: the work resumed inside somebody else's request.

by ringbuffer · Code Recycle admin

Get it free — beta

Every claim on this page is refundable if it is untrue — refund policy.

Verified: 20 tests

Decides whether work started AFTER the response will actually run. Pure function over how the handler is written and where it runs: no I/O, no dependencies.

Decides whether work started AFTER the response will actually run. Pure function over how the handler is written and where it runs: no I/O, no dependencies.

THE MEASUREMENT. One Next.js 15.5.22 app, three routes, each logging BEFORE_RESPONSE and -- two seconds later -- AFTER_RESPONSE_COMPLETED. Run in TWO places: locally on next start, and DEPLOYED TO REAL VERCEL SERVERLESS (iad1), driven over HTTPS with the platform's own runtime logs read back.

LOCALLY, ALL THREE COMPLETE. THIS IS THE DECEPTIVE HALF. next start is one long-lived process; it never stops between requests, so a pending promise simply resolves. No local test can tell you otherwise.

ON THE REAL PLATFORM, THE WORK RUNS INSIDE THE NEXT, UNRELATED REQUEST:

    ### 22:20:53 GET /api/fireforget 200
        PROBE v1 fireforget BEFORE_RESPONSE
    ### 22:20:54 GET /api/waituntil 200
        PROBE v1 waituntil BEFORE_RESPONSE
        PROBE v1 waituntil REGISTERED
        PROBE v1 fireforget AFTER_RESPONSE_COMPLETED     <-- THE WRONG REQUEST
        PROBE v1 waituntil AFTER_RESPONSE_COMPLETED

The work DOES NOT VANISH. The environment is frozen at the response and thawed by the next request, which then carries it -- charged to that request's duration, bounded by its timeout, logged under its request id. Debugging it means finding a log line under a request that did not cause it.

WITH NO FOLLOWING REQUEST, IT NEVER RUNS AT ALL. Sixty seconds of silence against a two-second timer, and AFTER_RESPONSE_COMPLETED never appeared.

SO THE OUTCOME DEPENDS ON TRAFFIC. Busy endpoint: the work runs, late and misattributed. Quiet endpoint: lost. Same code, same deploy -- which is why it survives staging and fails at 3am. Every request in every run returned HTTP 200 and nothing errored anywhere.

IT STAYS QUIET WHERE IT SHOULD. Awaited work and waitUntil work both return WILL_RUN -- measured, both completed inside their own invocation on the real platform -- and neither even asks about the runtime, because that would be a question with no consequence. A long-lived process also returns WILL_RUN, honestly, but the reason says plainly that this is EXACTLY WHY the same code cannot be trusted on a frozen runtime.

THE REMEDY REFUSES THE FIX PEOPLE REACH FOR: await it, or hand it to the platform's keep-alive primitive. If it must not block the response AND must not be lost, put it on a queue -- the queue is durable across the freeze and the invocation is not. DO NOT reach for a longer timer; the environment is frozen, so a longer timer is just a longer wait for a thaw that may never come.

VERIFIED: 20 tests, measured by running the suite, every one of 8 mutations observed FAILING before restore.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function evaluateAfterResponseWork(site: HandlerSite): Verdict;
  export type Verdict = | { status: "WILL_RUN";

01Capabilities

Does

  • + Idempotent fulfilment
  • + Reliability
  • + Serverless execution lifecycle

Doesn’t

  • No exclusions declared

02Requirements & stack

Depends on

No declared dependencies

Credentials needed

None declared

Stack

typescript

03Community

No endorsements yet

No verified confirmations yet — be the first.

Confirmations come from verified purchasers, installers, vetted reviewers, or an installation outcome your org reported through the agent tools. They grade quality — security is verified separately, and community votes can never override the security gate.

Open an issue

Sign in to confirm — weight comes from verified usage, not vote count.

0 open · 0 answered · 0 fixed · 1 said it worked

04Trust Passport

Full passport →
–/100

0/0 automated components pass. An automated score is never a security guarantee.

✓ Verified · first-partyreviewed Sep 20, 2026 · re-verification due Dec 19, 2026
  • publisher identity Publisher status verified; 1 verification(s) on file
  • malicious pattern scan No known malicious-behavior patterns across 13 source file(s) plus listing text
  • capability contract All 0 observed capability reference(s) match the declared manifest
  • agent safety scan No injection patterns in agent-readable content
  • provenance No release signature or provenance attestation
  • behavioral sandbox Not performed in this environment — requires the production isolated runner (docs/sandbox-requirements.md). No untrusted code is ever executed on the application host.

Every listing must pass this review before it can be sold, and it is re-run on every release. Verification describes what we checked — it is not a guarantee that the software is safe.

VersionChannelReleasedNotes
1.0.0stableAug 6, 2026First public release.