Group-commit batcher, one process per partition. Requests hand it an envelope and block on the reply. The batcher buffers callers, then flushes the whole batch to the queue in one enqueue, which the queue writer merges with the batches of the other partitions into one group commit (one fsync). Every blocked caller is replied to after the commit returns — that is what makes the ack honest.

The append itself runs in a Task, so the batcher keeps accepting requests while commits are in flight, up to batcher.max_commits of them (64 by default): a request that finds a free slot is handed to the writer at once, one that does not accumulates behind the commits ahead and goes the instant one finishes. Keeping a second commit queued at the writer is what lets it merge the batches of every partition into one group, and what keeps a caller waiting for one commit rather than for the one ahead of it and then its own. Nothing waits on a commit except the callers whose own records are in it — with max_delay_ms: 0 that is the steady state, and the batch is naturally as large as concurrency allows.

The queue is bounded, and the bound counts buffered and in-flight records. When it is reached the batcher sheds load: the caller gets {:error, :overload}, which the edge turns into a 503 with Retry-After. Never ack what you haven't saved.

The bound is the partition's, so on its own one tenant could fill it and every other tenant would be shed with it. A tenant whose limit sets max_queue or max_queue_bytes (Ankusa.Edge.RateLimiter) is counted by commit/4 across this node's partitions before the call reaches a partition, and is refused {:error, {:tenant_overload, retry_after_ms}} (a 429) past its share: the partition is never asked, and the global 503 is left to the tenants still within theirs.

Deadlines

Every record carries a deadline: the latest moment its batch may start committing. A record still buffered at its deadline (a commit ahead of it is stalled) is answered {:error, :store_unavailable} and dropped, and the writer refuses a batch whose earliest deadline passed while it queued behind other work (Ankusa.Queue.enqueue/3). A batch the writer has started is never abandoned: its callers wait for the commit's outcome, however long the disk takes. A stall therefore never turns into a 503 for a hook that is then committed. The one way a 503 can still cover a durable hook is a process dying while the writer is mid-commit (the commit task killed, the batcher crashing and taking its tasks down, or the writer crashing after the sync but before it replies); the provider's retry then stores the hook a second time. The commit task is supervised, not linked: a task that dies takes only its own batch's callers with it, never the batcher or the records buffered behind it.