Module records 

Receiver-side DHT record store (ADR 022 §Content Records and TTL).

When a publisher P sends StoreRequest { hash: H, holder: P } and the handler admits it (rate limit + holder == authenticated NodeId + StakerSet::is_active(holder) all pass), the record (H, P) is inserted here with expiry_us = receive_us + ttl_us and counted against P’s per-publisher quota.

Admission policy (ADR 022 §Content Records and TTL)

Limit	Default	Behaviour at cap
Per-publisher records	100,000	Hard reject — StoreAck { accepted: false }
Per-hash providers	50	Evict oldest holder for that hash
Per-node global records	1,000,000	Evict globally-oldest record (only when inserting publisher is below per-publisher cap)
Record TTL	1 hour	Receiver-anchored; refreshed on re-publish

The active-staker filter in the handler is the security boundary: a publisher must be a bonded operator to insert at all, so record spam carries a stake cost. The per-publisher cap is a fairness bound on top of that — it keeps one publisher’s footprint from dominating a receiver’s store, so the global set stays a broad sample rather than one node’s catalogue. With the cap in place, the global LRU only fires when the inserting publisher is below quota — i.e. a below-quota publisher is pushing the total over capacity, and evicting the globally-oldest record (likely from a publisher who has stopped re-publishing) is the right call.

Re-publish semantics

Re-publish from the same (holder, hash) pair refreshes the record (re-derives expiry_us from the new receive_us) rather than creating a second record. The per-publisher count nets out unchanged — the refresh removes the stale record and re-adds it, so the count is decremented then re-incremented for the same holder. Per ADR 022 §Content Records and TTL this is what extends record lifetime ahead of the previous expiry while the holder still has the blob.

Structs

Hash

32-byte content hash. Re-exported from the protocol crate’s decdn_protocol::ContentHash newtype — distinct from NodeId at the type level, identical ([u8; 32]) on the wire. A 32-byte content address (BLAKE3 hash).

RecordStore

Receiver-side DHT record store.

RecordStoreConfig

Configuration for the record store (ADR 022 §Content Records and TTL).

Enums

InsertOutcome

Outcome of a RecordStore::insert_at.