The maximum number of bytes we are willing to buffer when reading an API
response from an iroh QUIC stream. This must be large enough to accommodate
the largest possible signed session outcome. A session can contain up to
broadcast_rounds_per_session (default 3600) rounds, each peer produces one
unit per round, and each unit can be up to ALEPH_BFT_UNIT_BYTE_LIMIT
bytes. The response is JSON-serialized which hex-encodes the consensus
bytes, roughly doubling the size. We use 2x the raw max as a conservative
upper bound. For a 4-peer federation this is ~1.44 GB.
Wall-clock budget for a single iroh API request to make it through the QUIC
bi-stream (open + write + finish + read response). If exceeded we close the
underlying [Connection], which causes IConnection::is_connected to
return false on the next pool lookup so a fresh connection is established
for the retry. Used for endpoints that respond promptly (block_count,
status, etc).
Application-level QUIC error code we use when closing a [Connection]
after a request timeout. Recorded by the peer as the close reason; chosen
arbitrarily but stable across stable and iroh_next impls so the two
emit identical telemetry. The value 1 distinguishes us from a graceful
close (0).
Wall-clock budget for an iroh API request to a server-side long-poll
endpoint (await_* / wait_*). These wait on the server until an event
fires (block height reached, contract cancelled, etc.) before responding,
so they need a generous bound. Set well above realistic mainnet block
intervals; if a long-poll legitimately needs longer than this the upstream
request_current_consensus_retry loop will reconnect and retry.
Request timeout strategy: long-poll endpoints (await_* / wait_*)
get the long bound, everything else gets the default. The string match
is a heuristic; it covers all currently-defined fedimint long-poll
endpoints and stays correct if new ones follow the existing naming
convention. False positives (a non-long-poll endpoint that happens to
match the prefix) just give that one method a longer leash; the worse
case is a false negative — a long-poll method that doesn’t match
either prefix would get the 60s default and fail fast on legitimate
waits, but the upstream retry loop would reconnect and try again.