Vitor Pamplona
f4bcf38caf
Ktor's WebSocket layer is unbounded by default, so [limits].max_ws_frame_bytes was a strfry-parity tuning knob nobody actually used — drop the whole LimitsSection from StaticConfig and the matching constructor param from KtorRelay. The negentropy-large-corpus plan note is updated accordingly. maxAdminBodyBytes is a real defense-in-depth cap (NIP-98 forces us to read the body for the payload sha256 before we can authenticate, so an unbounded read is a pre-auth DoS vector). Keep the cap, but stop exposing it as an operator knob — it was never plumbed through to StaticConfig and 1 MiB is ~1000× any plausible NIP-86 RPC payload. Hardcoded at the Nip86HttpRoute construction site with the rationale inline. Nip86HttpRoute.maxBodyBytes stays so tests can drive the 413 boundary. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
geode plans
Performance-focused design docs for future work. Each file is a self-contained sketch — problem statement, observed numbers, proposed fix, how to verify, risks. None of these are committed work; they're the queue.
Ordered roughly by expected impact:
| Plan | Headline gain |
|---|---|
| 2026-05-07-event-ingestion-batching.md | 5–10× write EPS via SQLite group commit + ingest pipelining |
| 2026-05-07-live-broadcast-fanout-index.md | >10× fanout speedup at >2 000 subscribers |
| 2026-05-07-connection-scaling.md | 2 000 → 10 000+ concurrent connections |
| 2026-05-07-negentropy-large-corpus.md | 25× lower memory + faster NEG-OPEN on M-event corpora |
Verification target for each plan is a new method on
geode.perf.LoadBenchmark (gated by -DrunLoadBenchmark=true) so
regressions show up in the regular CI matrix once they're enabled.