Module store 

usage_events Postgres store (enterprise#17, baseline fields enterprise#18).

One row per measured LLM turn: who (person/team/project, enterprise#11), what (provider/model/tokens), what it cost (priced with the shared ModelPricing table) and the counterfactual-baseline inputs that make the success fee provable (uncompressed_input_tokens, reference_model, reference_cost_usd, is_local — Doc 08 §2).

Schema management follows the repo rule: init_schema is idempotent batch_execute DDL (CREATE TABLE IF NOT EXISTS …), no migration files.

The writer consumes the proxy::usage_sink stream: bounded channel, spawned task, INSERT per event. Fail-open (enterprise#12): insert errors are logged and counted, never propagated to the request path.

Structs

UsageEvent

One usage_events row, fully derived from a finalized RealUsage.

Constants

POOL_MAX_SIZE_ENV

Env var overriding the store pool’s max_size (chart: database.poolMaxSize).

WRITER_QUEUE

Buffered events between the proxy choke-point and the Postgres writer. Sized for bursts (a full channel drops events, counted in usage_sink).

Functions

budget_window_sums

Current-window spend sums for the budget gate (enterprise#25): per-person spend for the running UTC day and per-project spend for the running UTC month, straight from usage_events.

delete_person_events

Deletes all events of person_keys (GDPR Art. 17). Returns rows removed.

evidence_rows

Daily evidence aggregates for the export window (enterprise#36): bounded output regardless of event volume, yet fine-grained enough for an EU-AI-Act usage-evidence audit (per day × person × project × model).

init_schema

Applies the usage-store DDL. Safe to run on every start (idempotent).

insert_event

Inserts one event. Errors bubble to the writer loop, which logs and moves on.

person_events

All events attributed to one of person_keys (raw + pseudonym, GDPR Art. 15 export), as self-describing JSON rows.

pool_from_database_url

Builds the store pool from a DATABASE_URL, honoring sslmode (#54/#58).

purge_events_older_than

Deletes usage_events rows older than days (enterprise#36). Returns the number of purged rows. days == 0 is rejected by the caller (retention disabled), never here — this function always deletes what it is told.

spawn_writer

Wires the usage stream into Postgres: installs the process-wide sink (proxy::usage_sink) and spawns the writer task. Call once at gateway startup, after init_schema.