Replace subscriber outbox estimate with byte-bounded write-deadline policy #116

New issue

Open

opened 2026-09-05 00:20:07 +09:00 by natsukium · 0 comments

natsukium commented

2026-09-05 00:20:07 +09:00

Owner

Migrated from docs/backlog.md (Deferred / Byte-bounded slow-subscriber policy).

Today a subscriber is cut on one signal only: its outbox backlog crossing SUBSCRIBER_BUFFER_CAP, gauged with OutEvent::approx_wire_len, an estimate the emitter makes rather than the payload bytes the wire actually owes. The policy that would replace it is a bounded outbox counting real payload bytes plus a write deadline, so a peer that reads at a trickle is cut on time as well as on volume (ipc.md "Backpressure" states the current contract: volume only). Deferred because nothing has been observed to need it: the split reader/writer loops mean a stalled peer costs only its own connection, and the estimate has never been the thing that mis-evicted anyone. Revisit when a real peer is seen to sit under the cap indefinitely, or when the estimate and the true payment diverge enough to evict a healthy connection.

Design: bounded outbox counting real payload bytes + write deadline, cutting trickle readers on time as well as volume.

Revisit trigger: a peer observed sitting under the cap indefinitely, or estimate-vs-true divergence causing a bad eviction.

Refs: docs/reference/ipc.md Backpressure, crates/felis-daemon subscriber outbox.

Migrated from `docs/backlog.md` (Deferred / Byte-bounded slow-subscriber policy). > Today a subscriber is cut on one signal only: its outbox backlog crossing `SUBSCRIBER_BUFFER_CAP`, gauged with `OutEvent::approx_wire_len`, an estimate the emitter makes rather than the payload bytes the wire actually owes. The policy that would replace it is a bounded outbox counting real payload bytes plus a write deadline, so a peer that reads at a trickle is cut on time as well as on volume ([ipc.md "Backpressure"](reference/ipc.md) states the current contract: volume only). Deferred because nothing has been observed to need it: the split reader/writer loops mean a stalled peer costs only its own connection, and the estimate has never been the thing that mis-evicted anyone. Revisit when a real peer is seen to sit under the cap indefinitely, or when the estimate and the true payment diverge enough to evict a healthy connection. Design: bounded outbox counting real payload bytes + write deadline, cutting trickle readers on time as well as volume. Revisit trigger: a peer observed sitting under the cap indefinitely, or estimate-vs-true divergence causing a bad eviction. Refs: `docs/reference/ipc.md` Backpressure, `crates/felis-daemon` subscriber outbox.

natsukium added the

priority/P2

label

2026-09-05 12:11:16 +09:00

natsukium added the

status/blocked

label

2026-09-07 16:24:28 +09:00