The storage queue writer channel is unbounded, so the write-behind path has no memory ceiling during a burst.
crates/mqtt5/src/broker/storage/client_queue.rs:21 — pub type QueueWriter = mpsc::UnboundedSender<QueueOp>;crates/mqtt5/src/broker/storage/file_backend.rs:224 — mpsc::unbounded_channel()
Every queue push enqueues a QueueOp::Write holding an Arc<QueuedMessage>. The per-client queue itself is bounded (enforce_limits_dir sheds on both count and bytes), but the ops in flight to the writer are not: if the writer task cannot drain as fast as messages arrive, the channel grows until it does. The effective ceiling is "however fast the disk keeps up" rather than anything configured.
Suggested change
Make the channel bounded with an explicit overflow policy — backpressure on the producer, or coalesce/drop with a counter — so the write-behind path has a predictable ceiling that relates to the configured queue limits.
Not a correctness defect: under the floods measured so far the writer kept up well enough that memory plateaued rather than growing without bound. This is about making the bound explicit instead of incidental.
The storage queue writer channel is unbounded, so the write-behind path has no memory ceiling during a burst.
crates/mqtt5/src/broker/storage/client_queue.rs:21—pub type QueueWriter = mpsc::UnboundedSender<QueueOp>;crates/mqtt5/src/broker/storage/file_backend.rs:224—mpsc::unbounded_channel()Every queue push enqueues a
QueueOp::Writeholding anArc<QueuedMessage>. The per-client queue itself is bounded (enforce_limits_dirsheds on both count and bytes), but the ops in flight to the writer are not: if the writer task cannot drain as fast as messages arrive, the channel grows until it does. The effective ceiling is "however fast the disk keeps up" rather than anything configured.Suggested change
Make the channel bounded with an explicit overflow policy — backpressure on the producer, or coalesce/drop with a counter — so the write-behind path has a predictable ceiling that relates to the configured queue limits.
Not a correctness defect: under the floods measured so far the writer kept up well enough that memory plateaued rather than growing without bound. This is about making the bound explicit instead of incidental.