id(world): per-world total memory budget — contract + restore enforcement (#557 slice 1) by dezren39 · Pull Request #4628 · developing-today/code

dezren39 · 2026-11-02T22:35:32Z

Summary

Task 4827, slice 1 of #557 (design: pkgs/id/doc/2026-11-01_design_id557.md, merged in PR #3877). Two phases land together because the branch already carried the Phase 1 WIP:

Phase 1 — budget contract (preserved WIP, commit eabb537)

RuntimeLimits.total_memory_bytes server ceiling (default 64 MiB) + optional lower per-world WorldExecutionProfile.total_memory_bytes, validated and resolved (lower-only) in world_limits.rs; --world-total-memory-mib CLI flag.
Journal version 4 gating: a persisted profile/checkpoint budget bumps the header so older binaries refuse it instead of silently ignoring the budget (Define rollback compatibility for world profile journal entries #227 contract).

Phase 2 — ledger + restore enforcement (commit 2b22aac)

WorldMemoryBudget ledger in id-core: deterministic logical charges, atomic refusal via the typed WorldMemoryBudgetRefusal (distinct from a guest trap / open-world ceiling / storage failure), release + retry, high-water and refusal counts. Exact-boundary, refusal-atomicity, release/retry, and overflow unit tests.
WorldCore::restore charges the fixed core charge plus every materialized journal entry (serialized length + structural allowance) against the last persisted profile budget (or the 64 MiB default) before applying any entry. An over-budget journal refuses open whole; restore never modifies the durable journal, so the same journal reopens once the budget allows it. Restore refusal/retry + accounting tests in world/tests.rs.

Deliberately out of scope (named #557 remainder)

Runtime growth charge sites, program (Wasm/native) reservations, per-world session charges, transient journal/compaction peak reservations, program-ceiling clamping beneath the budget (design Phase 3/4), stats surfacing, and the 1,000-idle / 100-active measurement (the separate measurement packet, enqueued after this lands). id(world): F12.12 many worlds per node: 1,000 idle / 100 active with a per-world memory budget #557 stays open.

Tests

CI runs the id suites. New tests: ledger boundary/refusal/release/overflow in world_limits.rs; restore charging, typed refusal, and retry-after-raise in world/tests.rs; Phase 1 resolution/CLI/journal-version tests from the WIP commit.

Refs #557 (does not close it).

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

…unting seam (task 4827, preserved from prior lane)

…memory-budget

…phase 2, task 4827) WorldMemoryBudget ledger in id-core (typed WorldMemoryBudgetRefusal, atomic refusal, release/retry, high-water + refusal counts) and WorldCore::restore charges the fixed core charge plus every materialized journal entry (serialized length + structural allowance) against the last persisted profile budget (or the 64 MiB default) before applying any entry. An over-budget journal refuses open whole; the durable journal is untouched and reopens once the budget allows. Runtime growth, program reservations, session charges, and transient peaks remain the named #557 remainder.

coderabbitai · 2026-11-02T22:35:41Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 32 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 7c330094-66d8-4926-8776-1c96a69cdb59

Commits

Reviewing files that changed from the base of the PR and between 0400795 and b3ade6a.

Files selected for processing: 7

pkgs/id/crates/id-core/src/world_limits.rs
pkgs/id/src/cli.rs
pkgs/id/src/commands/world.rs
pkgs/id/src/world/core.rs
pkgs/id/src/world/mod.rs
pkgs/id/src/world/tests.rs
pkgs/id/src/world_store.rs

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

CodeRabbit Verify

Run CodeRabbit Verify to test the changes in this pull request.

chatgpt-codex-connector · 2026-11-02T22:35:43Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T00:03:01.862669Z	`b3ade6a`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2b22aac6a3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-11-02T22:37:42Z

+        let mut limit = crate::world_limits::DEFAULT_WORLD_TOTAL_MEMORY_BYTES;
+        for entry in &entries {
+            let persisted = match entry {
+                JournalEntry::ExecutionProfile { profile } => profile.total_memory_bytes,


Enforce the current server ceiling during restore

When the server uses a nondefault --world-total-memory-mib, restore still enforces either 64 MiB or the raw persisted request. world_store::open_world receives the configured RuntimeLimits but calls this method without them; moreover, WorldService::set_execution_profile explicitly persists the unclamped request, contrary to the assumption above this block. Consequently, lowering the server ceiling does not constrain restore, while raising it cannot reopen a budgetless journal exceeding 64 MiB. Pass the current runtime ceiling into restore and resolve the persisted profile against it before charging.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-11-02T22:37:42Z

+            if let Some(total) = persisted {
+                limit = total;
+            }


Honor budget resets in subsequent execution profiles

If a journal contains a profile with total_memory_bytes: Some(...) followed by a replacement profile with total_memory_bytes: None, this scan retains the earlier budget. However, replay replaces the entire execution profile, and None means inherit the server ceiling. Clearing a previously low budget can therefore still refuse the next reopen; clearing a high budget leaves the stale allowance enforced instead. Track the final profile, including an unset budget, rather than the last nonempty budget value.

Useful? React with 👍 / 👎.

… restore (#557, task 4827) Codex P1 (PR #4628): open_world now passes its configured RuntimeLimits into the new WorldCore::restore_with_runtime; restore resolves the persisted profile against the current ceiling before charging, instead of trusting the journaled (unclamped) request or the 64MiB default. Codex P2: the restore scan tracks the FINAL profile, including an unset budget — replay replaces the whole profile, so a later total_memory_bytes: None resets an earlier budget to inherit the current ceiling. Also fixes three pre-existing compile errors on this branch: explicit WorldExecutionProfile initializers missing the total_memory_bytes field added in Phase 1 (two sandbox-gated id-core tests, one in commands/world.rs). Tests: cargo test --lib restore_ (17+4 pass, incl. two new regression tests), world_limits (19 pass), world_store (30 pass) on the laptop.

…memory-budget # Conflicts: # pkgs/id/src/world/core.rs

dezren39 · 2026-11-03T00:05:43Z

Codex findings disposition (task 4827, lane code-k) — Both Codex findings on head 2b22aac6a are FIXED in 4b48f9877 (thread replies returned GitHub 422 abuse errors, so disposition is recorded here and in the commit message). P1: open_world passes its configured RuntimeLimits into the new WorldCore::restore_with_runtime; restore resolves the persisted profile against the CURRENT ceiling before charging; regression test restore_resolves_the_persisted_budget_against_the_current_server_ceiling. P2: the restore scan tracks the FINAL profile-bearing entry including an unset (None) budget reset; regression test restore_tracks_the_final_profile_including_a_budget_reset. Also fixed three pre-existing branch compile errors (initializers missing total_memory_bytes). Verified on laptop after merging main (b3ade6a91): restore_ 19+4, world_limits 19, world_store 30 — all pass.

dezren39 added 3 commits November 2, 2026 16:23

wip(id): #557 phase-1 per-world memory budget contract + journal acco…

eabb537

…unting seam (task 4827, preserved from prior lane)

Merge remote-tracking branch 'origin/main' into queue/4827-557-world-…

87c52ec

…memory-budget

dezren39 requested a review from a team as a code owner November 2, 2026 22:35

chatgpt-codex-connector Bot reviewed Nov 2, 2026

View reviewed changes

dezren39 added 2 commits November 2, 2026 17:56

Merge remote-tracking branch 'origin/main' into queue/4827-557-world-…

b3ade6a

…memory-budget # Conflicts: # pkgs/id/src/world/core.rs

github-actions Bot assigned dezren39 Nov 3, 2026

dezren39 merged commit e225912 into main Nov 3, 2026
2 checks passed

dezren39 deleted the queue/4827-557-world-memory-budget branch November 3, 2026 00:32

Navigation Menu

Repository navigation

id(world): per-world total memory budget — contract + restore enforcement (#557 slice 1) - #4628

id(world): per-world total memory budget — contract + restore enforcement (#557 slice 1)#4628
dezren39 merged 5 commits into
mainfrom
queue/4827-557-world-memory-budget

dezren39 commented Nov 2, 2026 •

edited by blacksmith-sh Bot

Loading

Uh oh!

coderabbitai Bot commented Nov 2, 2026 •

edited

Loading

Review limit reached

Uh oh!

chatgpt-codex-connector Bot commented Nov 2, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Nov 2, 2026

Uh oh!

chatgpt-codex-connector Bot Nov 2, 2026

Uh oh!

dezren39 commented Nov 3, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dezren39 commented Nov 2, 2026 • edited by blacksmith-sh Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Deliberately out of scope (named #557 remainder)

Tests

Uh oh!

coderabbitai Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

CodeRabbit Verify

Uh oh!

chatgpt-codex-connector Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

dezren39 commented Nov 3, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dezren39 commented Nov 2, 2026 •

edited by blacksmith-sh Bot

Loading

coderabbitai Bot commented Nov 2, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Nov 2, 2026 •

edited

Loading