Struct TokenLedger 

pub struct TokenLedger { /* private fields */ }

One execution’s reservations against its own ceiling and the shared aggregate together.

Both reservations are taken together and both unwound if either fails, so a refused reservation leaves neither counter charged.

Releasing on drop is what makes the aggregate usable for execution lifetime: an execution ends by having its budget holder dropped, not by reconciling every reservation first, so without this the reservation of every ended execution would be held forever and the aggregate would ratchet to its cap.

Held reserve is the deliberate exception. It releases from the per-execution ledger, which is over, but stays charged against the aggregate. Releasing indeterminate spend from the aggregate would let it escape the server-wide ceiling entirely: a caller who can reliably induce null usage pays real money the aggregate forgets at execution end, so N executions each under the per-execution ceiling could exceed the server-wide one without ever tripping it.

Implementations

impl TokenLedger

pub fn new(limits: LedgerLimits, aggregate: SharedTokenBudget) -> Self

pub fn used(&self) -> u64

Tokens this execution currently holds against its ceiling.

pub fn held(&self) -> u64

The part of Self::used held for unreported usage.

pub fn reserve(&self, tokens: u64) -> Result<(), LedgerRefusal>

Reserve tokens against this execution and the aggregate.

pub fn reconcile(&self, reserved: u64, reported: u64, indeterminate: u64)

Reconcile a completed dispatch down from its reserved estimate to what the provider actually reported.

reported is the summed usage of the elements the provider gave counts for; indeterminate is the reserve belonging to elements it reported nothing for. The indeterminate part is not released — None means indeterminate, not free, since a throttled call may still have been billed — and is instead carried as held reserve, bounded by LedgerLimits::max_held_tokens.

impl TokenLedger

pub fn settle_held(&self, held_estimate: u64, reported: u64, indeterminate: u64)

Settle a sub-batch whose held_estimate was already moved to held (via Self::reconcile with the whole estimate indeterminate) now that its outcome is known.

The estimate leaves held; reported stays charged as spend, indeterminate goes back to held, and the rest is released to this execution and the aggregate. A reported above the estimate is spend that already happened: the excess is charged (saturating, never refused) even if that passes a cap, and the next reservation is then refused.

Trait Implementations

impl Debug for TokenLedger

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for TokenLedger

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.