[dendisuhubdy]

Closes #157

Design

One byte budget (admission::AdmissionBudget, a tokio semaphore counted in bytes, shared by both RPC listeners and the node loop). It is never waited on: a charge that does not fit is refused at once.

holder	charge	released
RPC POST body (rpc::charge_body middleware, runs before axum reads the body)	Content-Length, capped at the body limit; the whole limit if none	when the response is built. rand_sendTransaction waits for its verdict inside this window, so the hex body stays charged
verify queue, gossip and RPC (Node::on_gossiped_tx, Node::submit_tx)	admission::charge_of(tx) = bincode::serialized_size, no encode	when Verdict (it carries the charge) is dropped at the end of on_verdict

When the budget is full:

• RPC answers -32005 (busy, retry), HTTP 503 with Retry-After: 1, and data: {wanted, available, limit}. The refused body is drained chunk by chunk and never buffered. Without the drain, hyper closes the connection on a client that is still writing, and the client sees a reset instead of the error. A refusal in the node loop (the verify-queue charge) is the new MempoolError::AdmissionBusy. It is retryable and never cached, and the RPC maps it to the same -32005. rand already backs off and retries -32005 (is_rate_limited, 5 tries over about 31 s), so the CLI needs no change.
• Gossip reports Ignore, never Reject, so the forwarder isn't penalised. Nothing goes in the refused cache, and a park waiting for the body is still filled.

Default budget: 1/16 of total RAM, clamped to 64–256 MiB, and never under one largest submission (body cap + block cap). That gives about 117 MiB on the fleet's 1967 MB droplets and 256 MiB on hosts with about 4 GB or more. --admission-budget-mb overrides it. A value under the floor is refused at startup. RAM is read with randprotocol_prover::memory::total_bytes() (sysinfo, already a dependency). It is wired through RpcOptions.admission_budget, so the many literal NodeConfigs stay untouched. rand_status gains admission_bytes and admission_budget_bytes.

Ack semantics: found, documented, not changed

The code already acknowledged only after hand-off. The RPC reply is sent from Node::on_verdict only after the transaction verified, insert_verified pooled it at the current tip, and net.broadcast handed it to the swarm task. No path returns a hash for a transaction that is only queued. This PR documents that in docs/rpc.md ("What a hash means"). The gap left is the in-process window between handing the transaction to the swarm task and the first peer receiving it. The 18 lost acknowledgements in the issue fell in that window when the OOM killer ran, and the budget is what prevents those kills.

Ops

deploy/vps-setup.sh and deploy/cutover-droplet-rand.sh units set MemoryHigh=85%, which makes the kernel reclaim and throttle instead of OOM-killing. There is deliberately no MemoryMax. docs/node-hardware.md now gives 4 GB as the validator minimum and keeps the swap advice. Nothing was deployed.

Tests (deterministic: every step waits on a message or a return, never on a clock)

• admission::tests::the_admission_budget_refuses_past_its_limit_and_releases_on_drop: fills to exactly the limit and refuses one byte more. Bytes come back on drop, a clone shares the budget, a charge larger than the whole budget is always refused, and a zero charge always fits.
• admission::tests::the_default_admission_budget_follows_the_host and a_transaction_is_charged_its_encoded_length.
• node::tests::the_verify_queue_is_bounded_by_the_admission_budget: with no verify slots, gossip past the budget is reported Ignore and not cached, and RPC past it gets AdmissionBusy (retryable). Handling the verdict releases the charge, and the next transaction is then queued.
• rpc::tests::concurrent_large_submissions_past_the_admission_budget_are_told_to_retry: 8 concurrent ~1.6 MB rand_sendTransactions over real HTTP against a budget of 3 bodies, with a stand-in node loop that holds its replies. Exactly 3 reach the node and 5 get 503 / -32005 / Retry-After. in_use is exactly 3 bodies, and no 4th submission arrives. After release, all 3 succeed, in_use returns to 0, and a retry goes through. It passed 30 of 30 repeated runs.

Local runs (debug): node lib 774 passed. The 1 failure is msauth_key::an_exe_in_the_tree_target…, which is environmental: it needs the test binary under this tree's target/, and I used a shared CARGO_TARGET_DIR. Integration tests: network 14, rpc_contract 11, submit 2, ws 9. Prover lib 14. cargo clippy --no-deps -p randprotocol-node -p randprotocol-prover --all-targets -D warnings is clean. cargo fmt was not applied: the repo isn't rustfmt-formatted and CI doesn't check it, and running it rewrites about 40k lines.

Merge notes for the other v0.8.3 PRs

• v0.8.3: Dandelion++ stem relay for transactions (#145) #155 (Dandelion): the verify queue's element is now (Transaction, VerifySource, AdmissionCharge). v0.8.3: Dandelion++ stem relay for transactions (#145) #155's stem push site will fail to compile until it takes a charge: self.admission.try_charge(admission::charge_of(&tx)), shedding on Err. That is intended, because stem transactions are admission memory too. Under v0.8.3: Dandelion++ stem relay for transactions (#145) #155 the RPC hash means "stemmed or fluffed" rather than "broadcast". The doc paragraph should say so at merge.
• v0.8.3: prover/verify performance + faucet flag (#151 #152 #153) #156: its decode_hex_body line in rand_sendTransaction is untouched here. This PR only changes the reply match below it.
• CHANGELOG.md "Unreleased" will conflict trivially with v0.8.3: node fixes (#143 #144 #146 #149) #150/v0.8.3: Dandelion++ stem relay for transactions (#145) #155/v0.8.3: prover/verify performance + faucet flag (#151 #152 #153) #156, which all replace "Nothing yet."

🤖 Generated with Claude Code

https://claude.ai/code/session_01GFs5h141Ct6RTGGrCTQ1vy

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!