Struct MemoryGovernor 

pub struct MemoryGovernor { /* private fields */ }

The central memory governor.

Thread-safe: global, database, and tenant counters use atomics. The budget map itself is behind an RwLock; reads (common) take a shared lock, writes (rare — only when quotas change) take an exclusive lock.

Implementations

impl MemoryGovernor

pub fn new(config: GovernorConfig) -> Result<MemoryGovernor, MemError>

Create a new governor with the given configuration.

pub fn budget(&self, engine: EngineId) -> &Budget

Get the budget for a specific engine.

pub fn global_ceiling(&self) -> usize

Get the global ceiling.

impl MemoryGovernor

pub fn total_allocated(&self) -> usize

Total memory allocated across all engines (engine-layer sum). A separate aggregate from global_utilization_percent, which reads the global counter admission enforces the ceiling against.

pub fn total_over_release_count(&self) -> usize

Total number of over-release events observed across every layer (global, database, tenant, engine). A non-zero value signals at least one call site is releasing more bytes than it reserved — the “memory release exceeds allocation” warning class. A saturating release clamps the affected counter to zero, so this is the only post-hoc observable for the bug.

pub fn global_over_release_count(&self) -> usize

Over-release events recorded against the global ceiling counter.

pub fn database_over_release_count(&self) -> usize

Over-release events recorded against any per-database counter.

pub fn tenant_over_release_count(&self) -> usize

Over-release events recorded against any per-tenant counter.

pub fn engine_over_release_count(&self) -> usize

Over-release events recorded against any per-engine counter.

pub fn global_utilization_percent(&self) -> u8

Global utilization as a percentage (0-100). Reads the global counter directly — the same quantity admission enforces the ceiling against — computed in u128 so a corrupted count clamps to 100 % instead of overflowing.

pub fn engine_pressure(&self, engine: EngineId) -> PressureLevel

Current pressure level for a specific engine.

pub fn global_pressure(&self) -> PressureLevel

Current global pressure level.

pub fn worst_engine_pressure(&self) -> PressureLevel

Worst-case (highest) pressure level across every engine. Cheap: iterates the in-memory budget array and allocates nothing — meant to be called once per Data-Plane core-loop tick, unlike snapshot which materialises a Vec.

pub fn set_thresholds(&mut self, thresholds: PressureThresholds)

Set custom pressure thresholds.

pub fn snapshot(&self) -> Vec<EngineSnapshot>

Snapshot of all engine budget states (for metrics/debugging).

impl MemoryGovernor

pub fn set_database_budget(&self, db: DatabaseId, max_bytes: usize)

Install or replace the memory ceiling for a database.

Called by the catalog apply path when ALTER DATABASE … SET QUOTA is executed. Takes effect for all subsequent try_reserve calls; in-flight tokens already issued are not recalled.

pub fn clear_database_budget(&self, db: DatabaseId)

Remove the per-database budget ceiling, making that database uncapped.

pub fn set_tenant_budget( &self, db: DatabaseId, tenant: TenantId, max_bytes: usize, )

Install or replace the memory ceiling for a tenant within a database.

pub fn clear_tenant_budget(&self, db: DatabaseId, tenant: TenantId)

Remove the per-tenant budget ceiling.

pub fn clear_database_scope(&self, db: DatabaseId)

Remove every memory budget of a dropped database, tenants included. A dropped scope is never re-capped, so live tokens keep no entry alive.

pub fn clear_tenant_scope(&self, tenant: TenantId)

Remove a dropped tenant’s memory budgets in every database. A dropped scope is never re-capped, so live tokens keep no entry alive.

impl MemoryGovernor

pub fn try_reserve( &self, db: DatabaseId, tenant: TenantId, engine: EngineId, size: usize, ) -> Result<ReservationToken, MemError>

Reserve size bytes for one (database, tenant, engine) triple.

Checks global, database, tenant, then engine. Widest scope first fails fast, leaving the fewest layers to roll back.

Databases and tenants without a budget are uncapped and skipped. A zero engine limit denies with MemError::BudgetExhausted.

Errors

Names the exhausted layer. Every partial credit rolls back.

pub fn charge( &self, db: DatabaseId, tenant: TenantId, engine: EngineId, size: usize, ) -> ReservationToken

Account size bytes already resident across all four layers.

Denying a charge hides allocated memory, it never frees it. Ignores every limit and never fails. The token releases all four layers on drop, as try_reserve’s does.

Trait Implementations

impl Debug for MemoryGovernor

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.