Module mem_policy 

Memory-budget policy: the readers and the resolver that decide the admission byte budget at startup.

The byte-weighted admission semaphore (see crate::admission) is the load-bearing bound against OOM from concurrent large uploads, but it only engages when the budget is non-zero. Previously the budget was derived from the cgroup limit alone, so a bare VM / non-containerized deployment (no readable cgroup ceiling) resolved to 0 and silently degraded to a bare CPU-concurrency count - the exact failure the admission work set out to fix. This module adds a physical-RAM fallback so the memory gate stays active without a cgroup, and keeps the three ceilings + the 70% math in one place the resolver tests exercise.

No sysinfo/libc dependency: the readers parse /proc directly, matching crate::admission::resident_bytes_now; the release matrix includes a musl target where a heavy cross-platform crate is a known build risk.

Enums

CgroupLimit 🔒

Parsed outcome of one cgroup memory-limit file. Unlimited (max, or a v1 huge sentinel) stops the search - the ceiling is genuinely uncapped, so we must NOT fall back to another file. Invalid lets the caller try the next.

Constants

BUDGET_PCT_OF_CEILING 🔒

Fraction of the tightest readable memory ceiling to admit, leaving headroom for the allocator, the OS page cache, and non-parse allocations.

Functions

cgroup_memory_limit_bytes

Container memory limit from cgroups (v2 then v1), if readable.

parse_cgroup_limit 🔒

parse_meminfo_memtotal_kb 🔒

Extract MemTotal (in kB) from /proc/meminfo content, or None. Pure so the parse - the only place a wrong line/unit would size every bare-VM budget wrong - is unit-tested without a live /proc.

resolve_mem_budget_mb

Resolve the admission memory budget (MB) from the three inputs, in one place the tests exercise so it can never silently regress to 0-when-a-ceiling-is- readable.

total_physical_memory_bytes

Total physical RAM in bytes from /proc/meminfo MemTotal, if readable.