Distinct-source floods of 50k-250k machines are seen in practice, which
overflows a 156,437 cap. Past the cap Hold() refuses to track, so those
addresses are still disconnected by whichever gate caught them but pay full
detection cost on every reconnect instead of a cheap accept-gate deny --
the expensive path during exactly the event the list exists for.
324,449 is the next Dictionary capacity in the from-empty progression
(36,353 -> 75,431 -> 156,437 -> 324,449), so it fills one exactly. ~17 MB.
The hot-path cost barely moves: cap-triggered sweeps are throttled to one a
second, so a flood pays 0.65ms/sec, 0.065% of the loop. Only the flood-end
sweep grows, from ~2ms to ~6ms, once.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
87ddb22369