Three gaps the review missed, docs only.
A hold is no longer extended by repeat detections, which is operator-
visible: an address that keeps trying is now released 15 minutes after its
FIRST detection rather than held indefinitely. Someone debugging why an
address came back needs to know that, and that the rate limiter re-holds it
on the next attempt rather than letting it through free.
Nothing described what happens at maxEntries. Past the cap a detection
still disconnects but is not held, so the address pays full detection cost
per reconnect. Added to Known limits next to the MaxConnections ceiling,
since both end in the same place: a flood past it wants upstream scrubbing,
not a larger cap that only buys a longer on-loop scan.
networking-packets.md listed the three shipping filters without noting the
blocklist is now opt-in.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
5501c922ca