[ravi-pplx]

Summary

Apply shared message limits and weighted payload budgets to native execution calls. Reuse transport permits and retain capacity through owned cleanup. Add a daemon permit-handoff regression and require Kind smoke for spaced/shared-gRPC changes.

Implements admission from the embedding RFC. Wire and identity contracts are unchanged.

Validation

CI on this head, including Kind/Firecracker, is pending. Admission, cancellation, size boundaries and daemon permit handoff are covered by the affected suite validated at #833.

Severity and risk

Moderate: native calls could bypass transport payload limits. Risk is earlier capacity refusal under overload. Revert with dependent changes to roll back.

AI assistance: Codex contributed code, tests and this description.

[zibi-pplx]

Approving. I checked the admission model against the head:

• Transport and handler weights come from the same PAYLOAD_METHODS / START_PAYLOAD_SLOTS / BATCH_REQUEST_WEIGHT constants, and QueuedSlots wraps the same Arc<Semaphore> the handlers use, so the daemon path is not double-charged (the daemon's Process adapter forwards requests unchanged).
• RequestPermit::try_acquire only reuses a permit from the same budget (Arc::ptr_eq) with enough weight, and the semaphores are private to the service, so a native caller can't substitute capacity.
• Permits now live until owned work and cleanup settle, which matches the RFC. The red/green tests for mixed pressure, cancellation and exact size limits are good.

Non-blocking follow-ups:

1. Permit handoff through request extensions is an implicit contract (inline). It might be worth a guard.
2. Behaviour change worth watching: holding permits through cleanup keeps capacity reserved longer under cancellation-heavy load, so RESOURCE_EXHAUSTED rates may rise. That's more correct, and probably worth a counter.
3. The README could spell out the native error contract: OutOfRange for oversized messages, ResourceExhausted for capacity, and pplx_space_common_grpc::is_refused_before_start for retry decisions. That way embedders don't parse messages.
4. crates/libs/spaced/** and crates/libs/common/grpc/** aren't in ci/kind-pull-paths.txt, so PR CI never runs the Kind/Firecracker smoke for this series. Since this code runs in every guest, please run it before merging, or consider adding those paths.
5. By inspection the per-call overhead is negligible: an atomic check, encoded_len(), and one Arc per admitted call. A before/after run of the guest filesystem/process microbenchmarks across the stack would confirm it.

Review prepared with AI assistance (Claude Code); findings checked against the PR head.

[ravi-pplx]

For the remaining review notes:

• README now documents OutOfRange, ResourceExhausted and refusal-based retry classification.
• Added spaced/shared-gRPC paths to Kind selection. All four Kind/Firecracker shards passed on spaced: separate graceful closure from execution drain #827.
• spaced: separate graceful closure from execution drain #827 includes before/after native and UDS gRPC measurements against spaced: close operation admission consistently #790; this measures the drain change, not the whole stack against main.
• Admission-pressure and cancellation-held-capacity metrics remain a separate follow-up.