Bound external collector queue growth

2026-07-23 22:14:32 +02:00
parent a6167384a1
commit 92e0ba117d
40 changed files with 1419 additions and 22 deletions
@@ -32,6 +32,19 @@ consuming the filesystem's final space. Per-user Store quota is separate: a
 full mailbox defers or rejects that recipient without corrupting other
 recipient state.

+Collector backpressure is also separate from the byte reserve. The
+`collector` document limits globally pending and per-user pending external
+messages. Queue counts only entries carrying its durable collected-message
+flag, including entries currently owned by a Queue worker. Once a limit is
+reached, the collector does not download or delete the next source message.
+`bongo-queuetool collected-count [user]` exposes the global count and,
+optionally, the selected user's count.
+
+JSON integral configuration values and the generic agent loader preserve
+signed 64-bit values. In particular, a large `minimumfreespace` value is not
+truncated into a negative 32-bit number while Store configuration is mirrored
+to disk.
+
 A scanner outage is a delivery-policy decision, not permission to silently
 bypass inspection. ClamAV and SpamAssassin failures leave the message queued
 for the configured retry path. Likewise, a per-recipient LMTP temporary error