[KSlashh]

Audit items M26 and M27. Open against dev.

Graph rebuilds (M26). /v1/graphs/{id}/tx and /v1/graphs/{id}/txn take no auth and have no cache or rate limit, and each request did the full graph work twice: once in load_validated_graph_definition, which rebuilds the graph to check its pre-signatures, and once more in the handler's from_simplified. Both ran on the tokio workers while the request held a pool connection.

load_validated_graph_definition is split into a database read (read_graph_definition) and a CPU check (StoredGraphDefinition::build). build returns the graph it already rebuilt. Both endpoints now:

• read the definition and release the connection;
• run build on the blocking pool, at most 2 at a time (GRAPH_BUILDS);
• use the returned graph instead of rebuilding it.

Other callers of load_validated_graph_definition are unchanged.

Connections during external calls (M27). The pool has 10 connections, shared with the engine. get_instances, get_instance, get_graph, get_graphs and the two endpoints above kept their connection through the esplora and Goat calls, so plain GET requests could take every connection; engine and inbox writes then timed out and /v1/health returned 503. Each of them now releases its connection after its last query.

Review notes

• A request waiting for a build slot holds no connection and no raw definition: the slot is taken before the definition is read.
• No separate RPC pool: once requests hold connections only for their queries, the shared pool is not held across external calls.
• The debug endpoints (send-challenge, send-verifier-challenge) still use the old path; they are behind rpc-debug-endpoints.

Tests: the public build rejects an unsigned graph with the same error as the validated load, and the read returns nothing for an unknown graph and fails for a mismatched instance. Node tests, workspace clippy with -D warnings (with and without rpc-debug-endpoints) and fmt pass.

The test coverage and validation notes above are from the zkm PR notes. Branch scope and diff formatting were checked locally; builds and tests were not rerun during publication.