Module backpressure 

Per-tenant keyed backpressure at the outbox claim (Control-Plane Phase 2, P2-Q2). Per-tenant keyed backpressure at the outbox claim (Control-Plane Phase 2, P2-Q2).

What this is

The non-replayed OutboxDispatcher normally claims one unscoped batch of pending rows per sweep. With backpressure attached it instead claims per-namespace, round-robin, headroom-capped: a tenant at its concurrency ceiling has its excess Pending rows held (left durable, NOT dropped, reconsidered next sweep), and a bursty tenant cannot starve a quiet one.

Fairness is per-NAMESPACE, not per-route

The batch budget is allocated PER NAMESPACE first: every active namespace (one with claimable pending work) gets a guaranteed slice — batch_size ÷ active (rounded up, ≥1), capped by that namespace’s headroom — BEFORE any single tenant can consume the whole batch. A bursty tenant spread across many task_queues can therefore never exhaust the sweep budget on its own routes and starve a quiet single-route tenant: each namespace’s slice is reserved up front, and only within a namespace is that slice distributed round-robin across its own routes. Any budget left after every namespace has had its guaranteed slice is offered in a second pass to namespaces with more pending work — fairness first, utilization second.

The three load-bearing semantics

1. CLAIMED-only headroom. The ceiling caps concurrent executing activities — Claimed rows — never Pending + Claimed. Counting the Pending backlog would wedge a tenant against its own backlog (it could never claim the rows that make up the count). So headroom = per_node_ceiling − claimed, fed by [OutboxStore::count_claimed_outbox_rows], never count_inflight_* (CP-Phase-2 §3.1 as corrected).
2. Proportional per-node ceiling. The tenant’s quota is a cluster-wide contract; each node enforces ceil(quota × owned_shard_fraction) where the fraction is |owned shards| / shard_count. Rows scatter by dispatch_key hash uniformly across shards and a node claims only rows on shards it owns, so the per-node ceilings sum to ≈quota cluster-wide with NO central counter (CP-Phase-2 §3.6).
3. Exactly-once preserved. Backpressure only shapes the limit and scope of the existing atomic [OutboxStore::claim_outbox_rows_scoped]; a smaller limit is already first-class (the backoff/visibility machinery defers claims routinely). It touches no dedup (dispatch_key UNIQUE / INSERT OR IGNORE) and no ack/settle path — a held row stays exactly Pending.

Structs

Backpressure

Keyed backpressure over the outbox claim: resolves per-namespace ceilings and plans a round-robin, headroom-capped, fair-shared claim per sweep.

OwnedShardFraction

This node’s owned-shard fraction of the cluster’s virtual shard space.