Struct ComposeBudget 

pub struct ComposeBudget {
    pub max_children: usize,
    pub max_bytes_per_child: usize,
    pub max_total_bytes: usize,
    pub max_depth: usize,
    pub max_total_nodes: usize,
    pub max_total_fb_bytes: usize,
    pub max_fb_bytes_per_child: usize,
}

Resource caps for a composition — the security gate that stops an attacker-authored or runaway compose graph from exhausting the host (linear memory) or the sponsor (per-mount fees). The adversarial critique flagged ALL three frontier designs as leaving these uncapped (its #2 top risk: “sponsor-key drain… uncapped in all three designs”). Checked when a spawn is requested, BEFORE any fetch/instantiate/settle.

Fields

max_children: usize

Immediate children of ONE node.

max_bytes_per_child: usize

max_total_bytes: usize

Wasm bytes across the WHOLE tree (every level), not per node.

max_depth: usize

Deepest spawnable node. Root = depth 0; a node at this depth gets an inert compose api (its spawn_module returns -1) — the recursion stop.

max_total_nodes: usize

Live nodes across the WHOLE tree — the fork-bomb backstop independent of the per-node child cap (a balanced tree could otherwise explode).

max_total_fb_bytes: usize

Framebuffer bytes (w*h*4) across the WHOLE tree. The wasm-byte caps don’t bound this: a tiny (16 KB) cartridge can declare dims()=1024x1024 and allocate a 4 MB framebuffer, so 24 such nodes = 96 MB+ of host memory while staying inside every byte/node cap. This is the per-child FB ceiling AND the tree-wide aggregate that closes that hole.

max_fb_bytes_per_child: usize

Per-child framebuffer bytes ceiling — a single composed panel can’t allocate a fullscreen-sized surface (the worker’s FB_MAX=1024 allows a 4 MB child standalone; composited, a child is far smaller).

Implementations

impl ComposeBudget

pub fn v1() -> Self

v1 caps. Composition is RECURSIVE (the fractal): a child gets its own table and may spawn grandchildren, bounded by depth + global node/byte caps. 16 children/node, 16 KB each, 256 KB total, depth 5, 24 nodes total, 1 MB framebuffer per child, 16 MB framebuffer across the whole tree. (16, not 8: a common 3×3 or 4×4 grid needs 9–16 immediate children — the old 8-cap silently refused the 9th, so a 9-cell grid’s last cell never spawned, read as “the bottom-right cartridge doesn’t work”, telemetry #87. The tree is still bounded by max_total_nodes + the total-FB cap.)

pub fn admit( &self, count: usize, total_bytes: usize, child_bytes: usize, ) -> Result<(), String>

Whether a new child of child_bytes may be admitted given the count children and total_bytes already mounted. Err carries the reason so the host can log WHY a spawn was refused (silent caps read as “worked”).

pub fn admit_fb( &self, total_fb_bytes: usize, child_fb_bytes: usize, ) -> Result<(), String>

Whether a child whose declared surface is child_fb_bytes (w*h*4) may be admitted given the total_fb_bytes of framebuffers already mounted across the tree. Checked AFTER instantiate (a child’s dims() needs a live instance), the same way the wasm-byte caps in [admit] are. Err carries the reason so a refused mount logs WHY (a silent cap reads as “worked”). This is the cap the wasm-byte budget can’t enforce: a 16 KB cartridge declaring dims()=1024x1024 wants a 4 MB framebuffer.

pub fn may_spawn( &self, parent_depth: usize, total_nodes: usize, ) -> Result<(), String>

Whether a node at parent_depth may spawn another child given total_nodes already live across the tree — the recursion-specific gate (depth + global node count) checked at spawn time, before the byte caps in [admit]. Err says which cap stopped the fractal.

Trait Implementations

impl Clone for ComposeBudget

fn clone(&self) -> ComposeBudget

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ComposeBudget

impl Debug for ComposeBudget

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.