Module admission 

Request admission control: bounded parse concurrency + a byte-weighted memory budget + a coarse RSS circuit breaker.

Every parse handler acquires an AdmissionGuard BEFORE buffering the upload. Without this, N concurrent large uploads each buffer the full file and spawn blocking decode/mesh work whose working set is a multiple of the file size; nothing bounds N, so the container is OOM-killed (a full outage on the single-replica deployment). The byte-weighted semaphore is the load-bearing bound: total admitted upload bytes can never exceed the configured budget. The CPU semaphore keeps the blocking pool from thrashing, and the RSS breaker sheds load before the kernel does.

Explicit semaphores were chosen over tower::limit::GlobalConcurrencyLimit: the tower layer makes over-limit requests wait unboundedly with no 503/ Retry-After, wraps cheap GET routes too, and cannot express a byte budget.

Structs

Admission

Shared admission state (one per process, in AppState).

AdmissionCfg

Tuning knobs, derived from crate::config::Config at startup.

AdmissionGuard

RAII permit pair; drops release the slots.

Constants

BYTES_PER_PERMIT 🔒

One memory-budget permit spans this many upload bytes, so the semaphore’s permit count stays far below Semaphore::MAX_PERMITS even for multi-GB budgets.

Functions

resident_bytes_now

Resident set size of this process in bytes, or 0 when unknown.

spawn_rss_sampler

Background sampler: refreshes the shared RSS gauge every 500 ms so the admission breaker reads a cheap atomic, never the filesystem, per request.