Follow-up from the review of #574 (resend after ACK is judged against its acceptance receipt).
Relay acceptance receipts store the accepted payload so a resend can be compared with it. The wire schema accepts an unbounded content string, and the dead-letter path can write that content into a receipt, so a receipt's size is bounded only by what a sender sends. Day-bucket retention bounds receipts by age, not by size.
The fix: a receipt stores what the comparison needs — a digest of the accepted payload (and its length), not the payload itself — or, if the payload must be kept, a size limit enforced before acceptance with a named refusal. A test sends a payload over the limit (or confirms the receipt holds only the digest) and checks the receipt's size.
Follow-up from the review of #574 (resend after ACK is judged against its acceptance receipt).
Relay acceptance receipts store the accepted payload so a resend can be compared with it. The wire schema accepts an unbounded
contentstring, and the dead-letter path can write that content into a receipt, so a receipt's size is bounded only by what a sender sends. Day-bucket retention bounds receipts by age, not by size.The fix: a receipt stores what the comparison needs — a digest of the accepted payload (and its length), not the payload itself — or, if the payload must be kept, a size limit enforced before acceptance with a named refusal. A test sends a payload over the limit (or confirms the receipt holds only the digest) and checks the receipt's size.