pub struct DeltaBudget { /* private fields */ }Expand description
The derivation memory budget (design 306 D4) — what bounds a batch delta, in place of a row count.
A row count is not a memory bound: rows are variable-length Arc<[u8]>, so 1M rows
is ~190 MiB of 100-byte rows or ~1.2 GiB of 1 KiB rows, and the cap that protects
the first OOMs on the second. This tracks estimated bytes, charged as rows enter
the delta’s trees and released as they leave, so the ceiling means the same thing
for every schema.
One budget spans every table in the transaction. rindle-replica’s Engine hands
the same Rc<DeltaBudget> to each registered table’s delta, so a write touching 20
tables is bounded by the budget, not by 20× it. (Threads do not share: a cluster’s
worker engines each get their own, so a process ceiling is workers × max_bytes —
tune per-worker, not per-process.)
The number is an accounted upper bound, not a measurement. It sums, per delta:
row_bytes once per distinct row buffer the delta holds (in touched, the
superset — primary and the secondaries share those same Arcs), plus
TREE_ENTRY_BYTES per tree slot across touched, primary, and each secondary
index. It does not model allocator fragmentation or the connection’s own SQLite
pager, and it deliberately rounds against itself.
tests/delta_budget_alloc_probe.rs pins it against a live-bytes global allocator and
fails the build if it ever drops below what the heap actually retains.
Implementations§
Source§impl DeltaBudget
impl DeltaBudget
Sourcepub fn new(max_bytes: usize) -> DeltaBudget
pub fn new(max_bytes: usize) -> DeltaBudget
A budget of max_bytes, nothing charged against it yet.
Sourcepub fn set_max_bytes(&self, max_bytes: usize)
pub fn set_max_bytes(&self, max_bytes: usize)
Re-tune the ceiling. Takes effect at the next overflow check; safe on a live, shared budget — the limit is only ever read, never part of any structure.