Repository navigation
rewrite: expose the frame-memory budget and per-IP cap as settings, not only as RelayConfig #989
Description
#959 adds frame_memory_budget_bytes and max_connections_per_ip as RelayConfig fields. That is the surface ADR 0005:104-110 records for port-only policy knobs, and it is what the two new bounds need to exist.
It is not operator-facing: nostreamd builds its config with RelayConfig { drain_timeout, ..Default::default() } (main.rs:119-122), so a running daemon cannot change either bound without a code change.
The operator-facing surface is a Settings key, which is a different job: the defaults document is the validator's schema (validate.rs:6-7), so a new key means the defaults roundtrip parity test (defaults_roundtrip.rs:41-56), the guided defaults, and a config-parity check against the capture. That work was deliberately kept out of #959's $2.00 bound rather than folded into it silently.
What this needs
- Decide the key names and their units (
frame_memory_budget_bytes,max_connections_per_ip), matching the defaults document's naming conventions. - Wire them from
SettingsintoRelayConfigat the daemon's single construction site, with the same default (256 MiB,64) so the two surfaces cannot disagree. - Extend the defaults roundtrip and any settings-document parity test.
Until then, the bounds in #959 hold at their compiled defaults, which is what the ADR records.
Activity
chappie-daemon commentedon Oct 25, 2026
State after the reversal, recorded here because this issue is the authority for the ADR paragraph the reversal quotes.
995 (job 017) is the config-plumbing half and stays open with this issue. It exposes
network.frameMemoryBudgetBytesandlimits.connection.maxConnectionsPerIp, wiresRelayConfig::from_settings, adds the document keys, the parity test and theRelayConfig::default()↔ document assertion. It also gave0the meaning use the compiled default — which was rejected in review.The policy half is #996 (job 018, PR 997), stacked on 995. A stated
0is a validator issue on both keys (frameMemoryBudgetBytes must be greater than 0,maxConnectionsPerIp must be greater than 0),BoundRefusal::Zerois deleted,from_settingsfalls back on absent only, and ADR 0008's## What 0 meansquotes:331— "A zero budget or a zero cap is a literal the operator wrote" — as the rule the validator now enforces.This issue is not closed by 995. Closing it would bury the fact that the branch 995 points at contradicted the sentence it cites. Merge order is 990 → 995 → 997; the two stacked PRs need explicit retargets, because GitHub moves a pull request only when its base branch is deleted.
And one level up, #998 carries what neither half closed: the validator owns the floor but not the ceiling, so
--checkstill accepts a value the relay quietly replaces.Merge branch 'rewrite/main' into factory/017-frame-budget-settings
feat(config): expose the frame-memory budget and per-IP cap as settin…
chappie-daemon commentedon Nov 1, 2026
Closed by
4a7e74c8(PR #995), verified in the tree:git merge-base --is-ancestor 4a7e74c8 rewrite/mainreturns 0.Closed by hand rather than by the PR's
Closeskeyword: GitHub only auto-closes on merge when the pull request targets the repository's default branch, andcameri/nostream's default ismainwhile this PR targetedrewrite/main. The keyword was decoration and the issue stayed open after the merge.Every factory job landing on the rewrite now closes its own issue with
gh issue close <n> --reason completedand reads the state back asCLOSED, never trusting the PR body.