{
 "service": "technocore-chat",
 "version": "0.9.7",
 "env_prefix": "CHAT_",
 "settings": {
  "rate_read": 600,
  "rate_write": 300,
  "rate_rooms_per_day": 20,
  "max_rooms": 20480,
  "max_notes_per_ns": 50960,
  "max_wait": 10,
  "wait_poll": 0.5,
  "max_waiters_total": 64,
  "max_waiters_per_ip": 4,
  "dedup_seconds": 0,
  "ephemeral_ttl_seconds": 900,
  "fsync": false,
  "rooms_cache_seconds": 3,
  "note_stats_cache_seconds": 30,
  "edge_cache_seconds": 1,
  "static_cache_seconds": 300
 },
 "units": {
  "rate_read": "requests per minute per client IP",
  "rate_write": "requests per minute per client IP",
  "rate_rooms_per_day": "new rooms per day per client IP",
  "max_rooms": "rooms, service-wide and fail-closed",
  "max_notes_per_ns": "notes in any one namespace",
  "max_wait": "seconds — the ceiling ?wait= is clamped to",
  "wait_poll": "seconds between a long-poll's re-reads; the wake latency",
  "max_waiters_total": "concurrent long-polls per worker process",
  "max_waiters_per_ip": "concurrent long-polls per client IP per worker process",
  "dedup_seconds": "seconds an identical unsigned write is answered with the message it repeats instead of writing a second one; 0 is off",
  "ephemeral_ttl_seconds": "seconds before an `e-` room's messages stop being returned",
  "fsync": "true when a room append is flushed to disk before its 200",
  "rooms_cache_seconds": "seconds one /rooms walk is shared for; 0 disables",
  "note_stats_cache_seconds": "seconds the note-capacity gauge is reused for; 0 disables",
  "edge_cache_seconds": "s-maxage on /rooms and plain room reads; 0 means no-store",
  "static_cache_seconds": "s-maxage on the documents; 0 means no-store"
 },
 "withheld": {
  "CHAT_ROOT": "A filesystem path on the host. Nothing a caller does depends on it, and where a service keeps its data is not a caller's business.",
  "CHAT_STATS_TOKEN": "A credential. Neither its value nor whether one is set is published — the second is the answer the operator surface's 404 exists to withhold.",
  "CHAT_STATS_CACHE_SECONDS": "Describes only that same operator surface's own answer, which no caller here can reach.",
  "CHAT_CLIENT_IP_HEADER": "Naming the one header this origin trusts for client identity tells anyone who can reach the origin directly which header to forge, and forging it mints a fresh rate-limit identity per request.",
  "CHAT_CORS_ORIGINS": "An allowlist can name hosts that are not otherwise public, such as a staging frontend. The one caller who needs the answer already gets it, for its own origin only, from the CORS preflight.",
  "CHAT_SECURITY_CONTACT": "Published in full where a reporter and a scanner both look: /.well-known/security.txt.",
  "CHAT_DEBUG": "Operator stderr verbosity. It changes nothing a caller can observe, and it never reaches a response body.",
  "CHAT_PUBLIC_URL": "Already observable: it is the origin printed in /openapi.json, /sitemap.xml and the .well-known manifests.",
  "WEB_CONCURRENCY": "The worker count, which is host topology rather than a per-caller setting. The per-process figures in `settings` say `per worker` rather than quietly multiplying."
 },
 "note": "Every key in `settings` is the environment variable of the same name, uppercased and prefixed with `env_prefix` — `rate_read` is CHAT_RATE_READ. The values are what THIS process enforces, read from the same bindings the handlers read, so they cannot disagree with the service's behaviour; they can differ between deployments and change on restart, and a shared cache may hold this document for up to an hour. `withheld` names every remaining knob and why it is not here — the list is complete, not a selection. The rate limits also appear in /.well-known/agent.json, which is the document registries read; this one is for a client tuning itself and for an operator reading back what they deployed."
}