server: a query that finds every permit taken waits for one instead of failing, the budget is 64, permit and upstream turns wait on a futex with one thread each, the thread pool has no task limit, and transparent huge pages are off for the process

src/web/server.zig

@@ -47,6 +47,7 @@ const router = @import("router.zig");
 const sse = @import("sse.zig");
 const tcp_server = @import("../server/tcp_server.zig");
 const udp_server = @import("../server/udp_server.zig");
+const query_budget = @import("../server/query_budget.zig");
 
 const log = std.log.scoped(.web_server);
 
@@ -340,6 +341,9 @@ pub const WebState = struct {
     /// (milestone-10 ruling 10).
     doh_listener: ?*doh_server.DohServer = null,
     dot_listener: ?*dot_server.DotServer = null,
+    /// The query permits every DNS listener shares; `/metrics` reads its
+    /// waits.
+    query_budget: ?*query_budget.QueryBudget = null,
     /// The plain DNS listeners. The app binds one per family per protocol, so
     /// `/metrics` sums each family across its slice (milestone-16 ruling 13).
     udp_listeners: []const *udp_server.UdpServer = &.{},