Andrés Gutiérrez Ramírez

CPU and memory are sampled on a dedicated OS thread, because reading /proc is blocking work that does not belong on the async runtime. Each reading goes into a bounded mpsc channel with try_send, and a Tokio task drains it.

On TrySendError::Full the event is dropped with a warning and the sampler keeps its cadence. Memory stays flat no matter how slow the consumer gets, and a dedicated test fills the channel on purpose to prove the sampler never panics or stalls.

Ctrl-C flips an AtomicBool. The sampler exits its loop and drops its Sender, which closes the channel, which ends the consumer once the queue is drained. The final processed count is a real drain, not an estimate.

Polling a flag means stopping can take one sample interval, an accepted cost until a later phase brings proper cancellation. The same rigor applies to the data: Linux exposes cumulative counters in /proc/stat, so the first CPU reading is an average since boot, and the next slice primes and discards it instead of reporting it.

The worker folds events into a Snapshot whose histories are VecDeques preallocated to a fixed length: push at the back, evict at the front, never reallocate. Readers share it through Arc<Mutex<Snapshot>>.

ArcSwap or a triple buffer were considered and rejected for now: with one writer and two readers at 5 Hz, a lock held for a single push_back wins, while publish-latest primitives would clone the whole snapshot per event. The trigger to revisit is written down: many concurrent metrics scrapers, and if the lock gets hot first, batching with recv_many comes before a new primitive.

Open questions live in a deferred decisions register, each with the event that forces it and whether its window is soft or hard. Adding #[non_exhaustive] to public enums, for example, must happen before the first cargo publish, or a new variant silently becomes a breaking change.

The same discipline covers quality gates: cargo fmt, clippy with -D warnings, nextest and cargo doc with -D warnings run identically in a pre-push hook and in CI, because a local gate that disagrees with CI teaches you to trust a result that does not bind.