Load Tests

• Every run needs an explicit acknowledgement. Before starting, Anvil shows the destinations, the planned rate or concurrency and duration, and a reminder that you must own or be authorized to test the target. Start stays disabled until you acknowledge.
• Imported load plans are untrusted and never start automatically.
• An abort rule can stop a run when the failure ratio in a trailing window crosses a threshold; the report is then marked partial.

Stages ramp linearly. Each iteration runs a weighted mix or a chain of saved requests, with optional CSV or JSON datasets and a warmup period that is excluded from summary metrics but kept, flagged, in the timeline.

• A plan measures exactly one kind of unit, so every count, rate and percentile in its report has one denominator. The load editor and anvil load check name the unit and its definitions before a run.
• A UDP or DTLS exchange with nothing received is “no response observed”: neither a success nor a failure, and it has no latency. A datagram sent is never counted as delivered, and the received-to-sent ratio is labelled an observation, not a delivery rate.
• Connection modes. For HTTP requests and gRPC calls and streams, persistent keeps pooled connections per virtual user (for gRPC, one pooled channel per destination) and fresh opens a connection per unit. SSE streams, WebSocket sessions, TCP exchanges and UDP/DTLS exchanges always open their own connection or socket, and the report says the mode does not apply to them.
• Each unit runs the automation path of its request: the script, stop conditions, idle close and total deadline apply. Commands typed into a live interactive session have no load equivalent.

Combinations the engine refuses for any send, such as native gRPC with the HTTP/1.1-only policy or UDP through an HTTP proxy, still fail on each send before any bytes are written. They are local failures in the report, never successes, and an abort rule can stop such a run early.

• Each send is the same call as a manual Send: variables, auth, TLS policy and diagnostics included. HMAC nonces, DPoP proofs and JWT time claims are fresh for every send, and an OAuth token refresh happens once for the whole run.
• The desktop app launches its own executable as the load worker and passes the job over stdin, never the command line or environment. The job carries only the secrets its requests reference.
• Cancel stops scheduling and drains in-flight sends. If the app goes away, the worker stops. If the worker crashes, Anvil rebuilds a partial report from the last progress snapshot and says what is unknown.
• Locking Anvil stops load workers; partial reports are kept.

• Balanced counts. Scheduled, dropped, started, completed, failed, timed out, canceled and still-in-flight always add up, for iterations and for units. The protocol counts balance against the unit counts too, and a report that does not balance says so.
• Latency covers connect to last body byte for requests and calls, and until the end for streams and sessions. For UDP and DTLS exchanges it is the time to the first response instead, because an exchange always waits out its response window. Local preparation and token acquisition are reported separately as setup time.
• Timeouts are censored: counted, but kept out of the latency distributions because their true latency is unknown.
• Percentiles come from merged HDR histograms, never from averaged per-worker percentiles. Success and failure latencies are separate.
• A protocol section shows the unit's definitions and its counts, labelled with the unit's own nouns: gRPC status codes with their names, streams and sessions, close codes by who closed, round trips or “not defined”, frames, datagrams and DTLS handshakes.
• Generator health reports the worker's own CPU, memory and descriptors. For open workloads, a run that could not keep its schedule is marked “target not achieved”; that says nothing about the target's capacity. Generator health is unavailable on Windows.
• Failure samples are bounded and built from redacted records, without response bodies.
• Exports: JSON sealed with an integrity hash, CSV guarded against spreadsheet formula injection, and a self-contained HTML report with no scripts.
• Comparison refuses runs of different load units, such as HTTP requests against WebSocket sessions. For the same unit, it withholds latency deltas when two runs are not comparable, for example a different workload model, connection mode or request set, and says why.

• The combinations in the refusal table have no load unit yet.
• No load action holds sessions open while sending messages at a rate. A WebSocket unit is connect, scripted messages, close.
• WebSocket round trips pair each scripted message with the reply in the same position, so they fit echo-style exchanges. A session whose reply arrives before its message is counted as unpaired and adds no round trip.
• HTTP/3 with the automatic policy tries QUIC again for every request. Each failed attempt is counted, and its time is part of the request's latency.
• Load through an HBONE tunnel in fresh mode is allowed for TCP-based protocols but has not been exercised under load.
• Message counts per stream or session are reported as totals and means, not percentiles.
• One worker process per run on one machine; no distributed load.
• No JMeter adapter.

More Anvil Guides