Post-merge review follow-up. src/io/broker/SseActor.ts bounds the inbound buffer with a hardcoded module constant SSE_MAX_BUFFER_CHARS = 1_048_576 (security audit BRK-2). Every other broker cap of this kind is a configurable option; per the repo convention ("every sensible setting in HOCON / on the options type"), this should be an SseOptions field (with a validator + HOCON leaf) rather than a fixed constant, so operators can tune it for legitimately larger SSE frames.
Out of scope for the initial post-merge reconciliation (WP1–WP7); filed for later.
Post-merge review follow-up.
src/io/broker/SseActor.tsbounds the inbound buffer with a hardcoded module constantSSE_MAX_BUFFER_CHARS = 1_048_576(security audit BRK-2). Every other broker cap of this kind is a configurable option; per the repo convention ("every sensible setting in HOCON / on the options type"), this should be anSseOptionsfield (with a validator + HOCON leaf) rather than a fixed constant, so operators can tune it for legitimately larger SSE frames.Out of scope for the initial post-merge reconciliation (WP1–WP7); filed for later.