relay/ storeEvent calls persistAll() → fs.writeFileSync of the entire event array (up to maxEvents, default 1000) per incoming EVENT — blocking O(N) I/O on the event loop. Per-socket rate limiting (60/min) bounds a single client, but many sockets sustain it.

Fix direction: an append-only log (one line per event, like the JSONL the sweeper already tolerates) instead of a full-file rewrite. Accepted-risk in SECURITY.md.