milestone 17: real deadlines, validator holes, upstream editor, trusted proxies, contract samples, badvers

src/server/rate_limiter.zig

@@ -2,8 +2,11 @@
 //! the timestamp, so this file holds no clock, no `std.Io` operation and no
 //! socket. `check` neither allocates nor fails.
 //!
-//! Not thread-safe. Phase 7 decides the locking when it wires the limiter into
-//! the query path.
+//! Not thread-safe. The handler owns the locking: every call goes through
+//! `Handler.limiter_mutex` (handler.zig:124), taken uncancelably on the query
+//! path — `handle` has no error union to carry `error.Canceled` out of — and
+//! cancelably in the `runMaintenance` sweep that ages the table out
+//! (app.zig, `maintenanceOnce`), which does.
 //!
 //! The window is fixed, not sliding (PLAN §10 reserves the token bucket for the
 //! API limiter). A fixed window admits at most twice the limit across a window
@@ -116,7 +119,7 @@ pub const RateLimiter = struct {
 
     /// Drops every entry whose window ended more than one full window before
     /// `now`, that is `now - start_ns > 2 * window_ns`. Returns how many it
-    /// dropped. Phase 7 schedules it.
+    /// dropped. `app.runMaintenance` schedules it.
     pub fn sweep(self: *RateLimiter, now: std.Io.Timestamp) u32 {
         const stale_after = 2 * self.window_ns;
         var stale_count: u32 = 0;