3.3 KiB
Request and telemetry availability policy
Body admission keeps twelve anonymous readers and four readers reserved for a currently valid full session or remember credential. A forged cookie, a pending TOTP session, expiry or revocation does not qualify. The admission check is read only: it does not restore a session, refresh activity or issue cookies. Normal endpoint authentication and CSRF checks still run after the bounded body read.
Reader permits are released when reading finishes. Dispatch retains the memory
reservation until its buffered body is released. Anonymous dispatches can reserve
at most 32 MiB of the shared 128 MiB budget. Authenticated requests can use the
remaining budget, with the original per-request limits. Reads still have a total
30-second deadline. Public GET /health returns before body reading and does not
need credentials or body capacity. RPC health still requires a bounded JSON body.
Telemetry keeps at most 128 active identities, reserves one slot for the local node, caps active storage at 32 MiB and keeps 16 reports per history. Remote writes cannot overwrite the local identity, which is established from the node public key or the local writer's private marker. Valid unverified collector records expire after seven days; the oldest eligible remote records are also removed when admission needs space. Local reports are not eviction candidates. The 60-per-minute remote rate check runs before disk scans; local writes are exempt.
Valid legacy histories of up to 200 entries and 4 MiB are copied byte-for-byte to
telemetry-evidence/ before migration to the active limits. Oversized historical
individual reports remain in that evidence even if they cannot fit the new
history. Evidence filenames include a content hash, so a failed migration retry
does not create duplicate copies. Malformed target histories fail without being
overwritten; damaged records encountered during remote retirement and incomplete
staging files are preserved before removal from the active inventory.
Evidence is never automatically deleted and is capped at 128 files and 32 MiB. An exhausted evidence store, unsupported file, legacy file over 4 MiB or inventory over 1,024 files requires operator maintenance and preserves the original input. The operator must inspect and retain required evidence in separately managed storage before resuming. These are explicit migration limits, not assurances that arbitrarily large pre-existing data can be repaired automatically.
Regression fixtures cover anonymous reader saturation and recovery, memory
reservation through dispatch, owner capacity, forged/pending/revoked credentials,
read-only remember validation, health response, remote quota recovery, local
reservation/spoof refusal, legacy migration, damaged history preservation and
bounded evidence refusal. Run backend tests only through
scripts/test-backend-isolated.sh. Formatting or authored fixtures are not runtime,
artifact or release acceptance.
Maintainer UAT: inspect the fleet view with no reports, retained reports, migrated history and an operator-maintenance error; verify the local node remains visible while remote reports turn over. Check dashboard login/recovery, polling and a local upload while controlled anonymous traffic is saturated. Review desktop and phone width in light/dark themes. This work does not authorize deployment or production flooding.