[danielgorgonha]

What & why

New vaults get a ceiling in all, and wait when the volume is nearly full. All in helper-server/src/admission.rs:

• The coordinator accepts at most 60 new vaults an hour from every address together, on top of the per-address limit. A vault already admitted (another device, behind the same or another address, or a retry) is not counted again.
• New vaults are paused while the filesystem that holds KONCLAVE_VAULTS_DIR has less than 5 GiB free (statvfs; with the variable unset there is no floor; an unreadable value pauses new vaults only).
• Existing vaults, payments, reads and devices joining a vault are not affected.
• The refusal uses the existing 429 path with its own sentence ("the coordinator is not accepting new vaults right now, try again later"); no main.rs change.
• The boot log says whether the floor is on, for which directory and how much is free; the log says when new vaults pause and when they resume. No address is logged.
• libc becomes a direct dependency of helper-server (already in the lock); DEPLOY.md and the coordinator CHANGELOG (Security, Known limits) describe it.

Verify-before-finishing checklist

• cargo fmt --check + cargo clippy --all-targets -- -D warnings pass (helper-server)
• cargo test -p helper-server (255) and -p orchestrator (639) pass; the new admission tests were red before the change and each comparison is red-checked by mutation
• No secret, key share, seed, or passphrase in code, logs, URLs, or query strings
• No fund-moving path touched
• Docs/comments in English; commit is type(scope): description; coordinator CHANGELOG updated
• AI disclosure: written with Claude Code; the commit carries Co-Authored-By: Claude <noreply@anthropic.com>, no session link

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
konclave-demo	Ready	Preview	Nov 13, 2026 12:06pm UTC