feat(be): evict idle tracked default accounts - #4236
Closed
sea-snake wants to merge 1 commit into
Closed
Conversation
Tracking every sign-in makes an anchor accumulate a reference-list row per origin, driven by an operation with no per-anchor cap. This bounds it at 500 rows holding nothing but a tracked default, evicting the least recently used down to a watermark rather than failing a sign-in: the cap counts only evictable rows, so reaching it always means victims exist. Choosing a default account creates such a row too, so it is capped on the same path. Eviction removes the whole row and its config row, never writes an empty list in its place, and leaves a default alone while a named account shares its row. The row the caller just wrote is excluded from the victims, since every message in a round reads the same `time()` and would otherwise tie. One call evicts a bounded batch, so an anchor far above the cap cannot turn its own sign-in into a message that exceeds the instruction limit. A default account is reconstructible from `(anchor, origin)`, so an evicted row comes back at the same principal on the next sign-in. Implements docs/ongoing/tracked-default-accounts.md §6 and §7 (D5-D12). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
✅ No security or compliance issues detected. Reviewed everything up to 43a0fc3. Security Overview
Detected Code Changes
|
Contributor
Author
|
Folded into #4235. These three cannot be deployed separately: tracking makes every sign-in at a new origin mint an application row from an operation with no per-anchor cap, eviction is what bounds that and the only thing that makes an application's reference count fall, and reaping is dead code without it. Verified rather than assumed — with tracking alone, one anchor signing in at 2 000 origins creates 2 000 reference rows and 2 000 application rows. Shipping a prefix would mean unbounded, attacker-drivable stable-memory growth, so they are now one PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Changes
Tests
Design: #4222 (
docs/ongoing/tracked-default-accounts.md). Overview: #4230.