Fluid Compute Instance Safety
Fluid compute lets multiple invocations share the same physical instance concurrently, which turns any module-scope mutable request state into a cross-user data leak rather than the merely wasteful pattern it was on classic serverless, and it does so silently on projects that never opted in because Fluid has been default-on for new projects since April 23 2025. The request-context file shows the broken shape, a module-level current user clobbered by a neighbouring request across an await, explains why it passes every local test and every preview deployment, and replaces it with an AsyncLocalStorage store plus a tenant accessor that throws instead of quietly querying unscoped. The lifecycle file draws the background-work boundary that waitUntil does not draw for you: promises passed to it share the function's timeout and are cancelled if the function times out, so webhooks, audit rows, and billing meters silently vanish after a 200 and belong in a durable queue instead. It also wires attachDatabasePool, which exists because Fluid suspends instances and keeps the instance alive long enough for idle clients to be evicted, and documents the uncaught-exception change where the platform now drains in-flight requests before stopping the process.
npx shadcn@latest add https://ui.aryank.space/r/fluid-compute-instance-safety.jsonInstalls from ui.aryank.space. To add it by hand, copy the files in Files below, or register the @compronents namespace via the docs.
Fluid runs concurrent invocations on ONE shared instance. User A's request writes currentUser at module scope, user B's request runs at the same time on the same instance, and B's response comes back with A's cart. Look at the results: both say cart: A. That is a cross-user data leak.