Struct SsaReconstructorConfig 

pub struct SsaReconstructorConfig {
    pub incomplete_commitment_lifetime: Duration,
    pub unused_verifier_lifetime: Duration,
    pub max_tracked_peers: usize,
    pub max_awaiting_acks: usize,
    pub max_ack_await_time: Duration,
    pub use_batch_verification: bool,
    pub early_recovery_threshold: f64,
    pub max_ack_buffer_bytes: usize,
}

Configuration for the SSA reconstructor.

Fields

incomplete_commitment_lifetime: Duration

Time until the complete commitment to an SSA must be received.

Default is 2 minutes.

unused_verifier_lifetime: Duration

Maximum time an SSA cycle can go without progress before it is discarded.

Measured from the last acknowledged share anywhere in the cycle, not per polynomial — see SsaCycle for why that distinction is load-bearing. A cycle that is still being served therefore never expires, whatever the line rate.

Default is 30 minutes.

max_tracked_peers: usize

Maximum number of peers that can be tracked simultaneously with unacknowledged shares.

Default is 2000, minimum is 10.

This is a per-peer fan-out bound, and it guards the opposite concentration to max_awaiting_acks: traffic spread thinly across many first-relayers. The two cannot both be saturated at once, which is why their product is not the reconstructor’s memory bound — see PixReconstructorConfig in hopr-transport for the bound that is.

max_awaiting_acks: usize

Maximum number of awaited acknowledgements to extract a single share.

This corresponds to the maximum number of unacknowledged HOPR packets awaiting acknowledgement.

Default is 1 000 000, must be at least 10 000.

Sizes one inner cache per peer, so it must cover the concentrated case: every Session on the node returning through a single first-relayer. At the operating point tests/memory_profile.rs models that is ~542 000 entries, which is what makes a cap of this order the right one rather than an oversight.

max_ack_await_time: Duration

Maximum time an acknowledgement can be awaited before it is discarded.

Default is 30 seconds.

Multiplies the whole awaiting-ack buffer: the reachable state is the Exit’s share-emission rate times this window, so it — not either cap above — is the dial that actually sizes the buffer.

use_batch_verification: bool

Indicates whether to use batch verification algorithm for acknowledgements.

Default is false.

Batching only covers the acknowledgement signature check. While each share also cost a threshold-term multi-scalar multiplication, that MSM dominated and the choice was immaterial — measured 2.46 MiB/s batched against 2.50 MiB/s unbatched. Committing to the constant term alone removed the MSM, and the batching overhead is no longer hidden by it: the same benchmark then measures 50.2 MiB/s batched against 92.8 MiB/s unbatched, so batching costs 46 % of the sustained rate.

Settled against the concurrent pipeline shape, which is what the Exit actually runs and what the sequential figures above could not speak to. concurrent_quota_rate on 48 cores at production width, aggregate MiB/s of Session quota:

callers	unbatched	batched
1	90.9	46.4	unbatched 1.96×
10	130.2	126.2	tie — confidence intervals overlap
48	139.8	152.6	batched 1.09×

So batching does eventually pay, but only above the concurrency the pipeline is configured for: DEFAULT_ACK_INPUT_CONCURRENCY is 10, which is precisely the row where the two are indistinguishable. false stays the default because it is far better at low concurrency and no worse at the configured one, making it the safer choice across the range an operator can set — not because batching is slower everywhere.

Kept configurable for the operator who raises ack_input_concurrency well past its default, where the last row says the choice flips.

Headroom is narrower than it looks. A deployed Exit serves 10–30 clients at 16–20 Mbps, so it absorbs 19–72 MiB/s; against the 130 MiB/s above that is 1.8× at the top of the range, not the 7.3× an earlier reading of these figures claimed. That claim came from comparing against the benchmark suite’s own model of production — 100 Sessions at 1.5 Mbps, 18.75 MiB/s — which understates real per-Session rate by 13×. The rates here are also measured at 4096 polynomials rather than the 512 used previously, which costs about 5 %.

early_recovery_threshold: f64

Fraction of reconstructed polynomials at which to emit an early recovery notification, triggering pipelined SSA request preparation.

Range: 0.0..1.0. Default: 0.85.

max_ack_buffer_bytes: usize

Ceiling on the total live state held in the awaiting-acknowledgement buffer, across every peer, in bytes.

This is the global bound; max_tracked_peers and max_awaiting_acks are per-dimension backstops and their product is not one. See SsaReconstructor::insert_encrypted_share for why the product overstates by roughly three thousandfold and why bounding it instead would lose shares.

Enforced at insertion time rather than by validating a workload model. A model has to assume a Session count and a packet rate; the node enforces neither — maximum_managed_sessions validates to 100 000 and SessionCapability::NoRateControl removes the rate limiter entirely — so a configuration can be perfectly valid and still exceed any modelled budget. Counting what is actually held is indifferent to all of that.

Default is 1 GiB, which at AWAITING_ACK_ENTRY_BYTES is ~2.68 M shares in flight.

The minimum is 25 600 B — 64 entries. That is a sanity floor, not a sizing recommendation: its only job is to stop the budget rounding down to a handful of shares. Whether a given value is adequate depends on the node’s traffic, which is exactly the thing this design stopped trying to predict, so the floor deliberately does not pretend to encode it. A node configured near it will drop shares and say so.

Implementations

impl SsaReconstructorConfig

The defaults, named so that a mirror can share them instead of restating them.

hopr-transport’s PixReconstructorConfig is the operator-facing shape of this struct, and a second copy of these literals over there would be a second thing to keep true. Referencing them from both #[default(…)] sites means the two cannot disagree by construction, which is a stronger guarantee than any test comparing them after the fact.

pub const DEFAULT_EARLY_RECOVERY_THRESHOLD: f64 = 0.85

Default early_recovery_threshold.

pub const DEFAULT_INCOMPLETE_COMMITMENT_LIFETIME: Duration

Default incomplete_commitment_lifetime.

pub const DEFAULT_MAX_ACK_AWAIT_TIME: Duration

Default max_ack_await_time.

pub const DEFAULT_MAX_ACK_BUFFER_BYTES: usize

Default max_ack_buffer_bytes.

pub const DEFAULT_MAX_AWAITING_ACKS: usize = 1_000_000

Default max_awaiting_acks.

pub const DEFAULT_MAX_TRACKED_PEERS: usize = 2000

Default max_tracked_peers.

pub const DEFAULT_UNUSED_VERIFIER_LIFETIME: Duration

Default unused_verifier_lifetime.

pub const DEFAULT_USE_BATCH_VERIFICATION: bool = false

Default use_batch_verification.

Trait Implementations

impl Clone for SsaReconstructorConfig

fn clone(&self) -> SsaReconstructorConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for SsaReconstructorConfig

impl Debug for SsaReconstructorConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SsaReconstructorConfig

fn default() -> Self

Return SsaReconstructorConfig { incomplete_commitment_lifetime: Self::DEFAULT_INCOMPLETE_COMMITMENT_LIFETIME, unused_verifier_lifetime: Self::DEFAULT_UNUSED_VERIFIER_LIFETIME, max_tracked_peers: Self::DEFAULT_MAX_TRACKED_PEERS, max_awaiting_acks: Self::DEFAULT_MAX_AWAITING_ACKS, max_ack_await_time: Self::DEFAULT_MAX_ACK_AWAIT_TIME, use_batch_verification: Self::DEFAULT_USE_BATCH_VERIFICATION, early_recovery_threshold: Self::DEFAULT_EARLY_RECOVERY_THRESHOLD, max_ack_buffer_bytes: Self::DEFAULT_MAX_ACK_BUFFER_BYTES }

impl PartialEq for SsaReconstructorConfig

fn eq(&self, other: &SsaReconstructorConfig) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for SsaReconstructorConfig

impl Validate for SsaReconstructorConfig

fn validate(&self) -> Result<(), ValidationErrors>

impl<'v_a> ValidateArgs<'v_a> for SsaReconstructorConfig

type Args = ()

fn validate_with_args(&self, args: Self::Args) -> Result<(), ValidationErrors>