Could these be opt-in Canals (Water-Channels) ?

Ref: Historic community reactions to less-formal posts / articles, where the expectation for work formality was not satisfied.

Appreciate for some colleagues, there are scenarios where the ideal is not achievable for all code, application config and infrastructure config, especially where parallel work by multiple organizations operate on the same integration.
These can be Operational aspects in addition to understood Development scenarios.
Differencing can smooth the transitions for example:
* A deployment or configuration has occurred and the person responsible is not aware of Mirrored or DR environment also requiring a coordinate parallel update. Scheduled tasks come to mind.
* Upgrade may be staggered to minimize user downtime window, and app / infrastructure config may have planned gaps that need to be followed up and closed.
* There may be more than one organization and team responsible for managing, supporting and deploying updates. Where communication and documentation have not been usefully shared, cross-system comparison is good fallback to detect and comprehensively resolve the gap.
* It can help halt incompatible parallel roll-outs.
* A partial configuration deployment can be caught and reported between environments.
* Differencing can be useful between pre-upgrade and post-grade environments when applying root cause analysis for new LIVE problems, to quickly eliminate recent changes from being suspected of a problem application behavior. To allow investigation to proceed and iterate and avoid solution / upgrade rollback.
Just don't feel bad about not achieving an ideal, if have been left responsible for herding cats. There are ways to help that deployment work also.

I note the original question mentioned web production components. In the case of CSP pages, I use Ompare facility to always detect for the generated class and not the static csp source file. This will alert to cases where new csp page was deployed but manual / automatic compilation did not occur, and the app is still running the old version of the code.

Ompare - Compare side-by-side multiple disconnected IRIS / Cache systems.
https://openexchange.intersystems.com/package/ompare
This was developed in order to compare environments on different networks. It works by profiling code and configuration, across one or more namespaces, generating a signatures and optional source file to be imported into the reporting service.

The SQL Profile capability is reused to provide comparison of integration production settings across environments.
It ignores non-functional differences in code like blank lines, method / line-label order. Useful for manual integration that has occurred in different order or with different comments.
It provides reporting to show side-by-side differences of the same namespaces across multiple instances.

Has been useful for assurance environment parity, for upgrade sign-off.

Article - Using Ompare to compare CPF configuration and Scheduled Tasks between IRIS instances
https://community.intersystems.com/post/using-ompare-compare-cpf-configuration-and-scheduled-tasks-between-iris-instances

I created a lighter no-install version to compare changes in releases of IRIS versions.
/Ompare-V8 see: https://openexchange.intersystems.com/package/Ompare-V8

I feel there could be some options. Direct access restriction can potentially be applied on service by settings AllowedIPAddresses AND / OR enforcing clientside certificates on SSLConfig. Infrastructure firewall is also a possibility. If offloading authentication and TLS with standard requests, basic authentication at the webserver configuration is also viable. As REST parameters or HTTP Headers, could also validate against Integration Credentials Store.

From Gertjan's suggestion, this won't survive page refresh caused by compile button click, or other navigation, but it does seem to jam the session door open, by pinging the server every minute:

clearTimeout(zenAutoLogoutTimerID)
clearTimeout(zenAutoLogoutWarnTimerID)
var pingServer=setInterval(function(){var xhttp = new XMLHttpRequest();xhttp.open("GET", "EnsPortal.BPLEditor.zen", true);xhttp.send();},60000);

ie: After opening the BPL page, launch Developer tools and run JavaScript commands in console tab.

Would making a deep clone immediately after first opening the object resolve this?

Class dc.Per Extends %Persistent
{
Property Color As %String;
}

Test:

>s obj=##class(dc.Per).%New()
 
>s obj.Color="Red"
 
>w obj.%Save()
1
>kill obj
 
>s obj=##class(dc.Per).%OpenId(1)
 
>s objcopy=obj.%ConstructClone(1)
 
>w objcopy
2@dc.Per
>w obj
1@dc.Per

One approach that might be suitable is to have a look at overriding method OnFailureTimeout in the sub-class, which seems for this purpose.

Anticipate the ..FailureTimeout value will need to be more than 0 for OnFailureTimeout to be invoked.

Another area to review could be overriding OnGetReplyAction, to extend the retry vocabulary.

Voted

I understand the objection. However this approach is used successfully on busy systems to side-step contention with large and deep global structures.

You could try enabling this service on system Startup, with the code snippet in a custom ZSTART routine.

Have a look at the resource: https://docs.intersystems.com/irisforhealth20231/csp/docbook/Doc.View.cl...

 ClassMethod IsValid(s As %String) As %Boolean
{
    // Floats around them no good characters
    s s=$ZSTRIP(s,"*E","","()")
    // Erupts Combination jabs "(" followed by ")"
    // Relentless follow up until stringy looks unbalanced
    f {q:s'[("()") s s=$Replace(s,"()","")}
    // Swings for the knock out
    q s=""
}

Hi Rathinakumar,

One reason may be process contention for same block.

Most application processes work by $Ordering forward from the top of the global down.

When doing table scans, this can results in processes waiting, or running behind another process.

As an alternative for Support and Large Reporting Jobs you can instead "$Order UP" instead.

s sub=$o(^YYY(sub),-1) q:sub=""

Interested if this may mitigate any performance issue caused by contention on a busy system.

Had similar:
zn "%SYS"
set svc=##class(Security.Services).%OpenId("%service_telnet")
set svc.Enabled=1
do svc.%Save()

Note: Class documentation says DO NOT update with SQL.
But can see / check settings in %SYS, with for example:
SELECT * from Security.Services

set basename="Test.Sub.Base"
set file="c:\temp\subclasses.xml"

// Get list of compiled sub-classes
do $SYSTEM.OBJ.GetDependencies(basename,.out,"/subclasses=1")
// If you didn't want the base class
kill out(basename)

// Write the classes to terminal
zwrite out

// Suffix for export
set next="" for {set next=$Order(out(next)) quit:next=""  set toExport(next_".CLS")=""}
// Fire in the hole !!
do $SYSTEM.OBJ.Export(.toExport,file,"/diffexport")

// to display different qualifier flags and values used by various OBJ methods ( /diffexport ):
do $SYSTEM.OBJ.ShowQualifiers()

Another option have used is stunnel, on Linux variants (SUSE and RedHat).

Where Cache / IRIS connects to local proxy, which then connects via TLS to LDAP service.

Note: If running proxy in process jail, and find it can't get re-lookup of DNS after being started, ie dns lookup is once on start up. An approach is a mini-service script to monitor the DNS to IP resolution periodically, and auto-restart the stunnel proxy when it changes. One advantage being, if the DNS resolution service is temporarily unavailable, the running proxy carries on using the previously resolved IP address.