Denial of service and document growth

Network peers and relay clients can consume resources with connection churn, message floods, oversized payloads, repeated valid actions, or intentionally large CRDT histories. The relay has a sliding-window rate limiter, but this is not a complete application DoS defense and does not limit every downstream cost.

Set connection, room, payload, action, and document quotas at deployment and game layers. Reject malformed input early, bound collections and replay work, and monitor persistence size. Avoid writing high-frequency frames to the Chronicle. Use checkpoints and engine.compact() at an agreed epoch boundary only after disconnecting network/sync; all peers must use the same boundary.

Compaction removes history, so it is not a substitute for retention, audit, or replay policy. Plan recovery and backpressure before exposing a relay publicly.