Struct ProducerCensus 

pub struct ProducerCensus(/* private fields */);

How many distinct producers hold durable watermark state — the growth signal design 306 §4 names as the mitigation for the one contract it cannot enforce server-side.

PRODUCER_OFFSETS_TABLE is bounded by distinct producer ids, not by write volume, which is why it needs no reclamation — but only while callers keep those ids stable and few. A caller minting a fresh id per process run reintroduces unbounded growth by another route, and nothing on the server can stop it. This is the series that says it is happening; there is no other signal, so a deployment without it discovers the growth as disk.

Counted incrementally, not scraped with a COUNT(*). The write-master’s /metrics never takes a writer connection by design (a long in-flight write must not stall a scrape) and rindled’s runs on the engine thread — where an unbounded scan of the very table whose unbounded growth is under suspicion would make the gauge slowest exactly when it matters. The Arc reads lock-free from either, and is shared (not re-seeded) across the master’s pooled writers so a commit on any connection counts once.

The increment rule is exact, not approximate. Admission applies a producer write only at stored + 1, so seq == 1 holds if and only if that producer had no row yet — every later sequence overwrites one. Replays absorb and gaps are refused, so neither reaches a commit.

Implementations

impl ProducerCensus

pub fn seed(&self, conn: &Connection) -> Result<(), BookkeepingError>

Read the census off the table. Required at open and after a restore: rows also arrive by paths that never run admission — a journal replay into a restored master, and a follower applying the master’s captured watermark rows — so a census that only ever counted local commits would report zero for state that is really there.

pub fn note_committed(&self, seq: u64)

Count a producer write that reached a durable commit. MUST be called only after the commit returns — counting beside the co-transactional upsert would over-count every rolled-back attempt (the master retries its commit tail under OCC), and the drift is one-directional, so it would never wash out.

pub fn get(&self) -> u64

The current count, for the scrape.

Trait Implementations

impl Clone for ProducerCensus

fn clone(&self) -> ProducerCensus

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProducerCensus

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for ProducerCensus

fn default() -> ProducerCensus

Returns the “default value” for a type.