--- product_area: platform module: data-job-engine revision: 1 status: draft owned_by: MOD-PFM-DJE synonyms: - capacity state - capacity sentinel - admission budget supersedes: [] id: CON-PFM-DJE-006 name: Workload Capacity feature: FEAT-PFM-DJE-06 product_intent: proposed implementation_evidence: observed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 macroservice-libraries: 54536a441935c6e09fdb7f96f0bec71c52ba4e03 services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69 definition: >- Workload capacity is the observed protection state and derived processing budgets used to share database room between background jobs and ordinary work. not_to_be_confused_with: - Licensing controls permitted product use rather than current database room. - Gateway rate limits concern request admission and are only one possible protection mechanism. facets: - name: Protection state meaning: Signal windows and transition memory classify current database pressure. used_for: Choosing protection appropriate to sustained pressure. - name: Workload factors meaning: 'Each state supplies separate multipliers for bulk, heavy, write and read budgets.' used_for: Reducing selected classes of admitted work. - name: Staff override meaning: A reasoned pin holds a selected state until its bounded expiry. used_for: Managing incident protection under staff authority. - name: Emergency stage limits meaning: Enabled sustained-emergency handling can alter declared API throttle targets. used_for: Applying a further operational load reduction. - name: Batch budgets and service shares meaning: 'Job, workspace and service ceilings limit bulk admission alongside capacity factors.' used_for: Sharing processing across competing imports. - name: History maintenance meaning: Scheduled partition work prepares and retires storage for registered history tables. used_for: Supporting bounded storage housekeeping within the assigned scope. relationships: - to: CON-PFM-DJE-001 statement: The published bulk factor adjusts admission of bulk-job batches. provenance: documented source: 'macroservice-libraries:packages/data-jobs/README.md#The bulk lane' acted_on_by: - CAP-PFM-DJE-014 - CAP-PFM-DJE-019 - CAP-PFM-DJE-020 visible_to: - ACT-PFM-038 - ACT-PFM-012 evidence: - >- Reviewed evidence: services-platform (ad3f6a65): docs/workload-governance.md (Capacity sentinel); modules/capacity/**; docs/partitions.md; modules/partitions/**. - >- Reviewed evidence: macroservice-libraries (54536a44): packages/data-jobs/README.md (The bulk lane); src/bulk-batch-budget.ts, admission-budget.ts, admission-planner.ts. - >- Reviewed evidence: services-crm (a8d1364f): docs/data-jobs.md (The bulk lane); modules/data-jobs/services/jobs/bulk-admission.ts. --- # Workload Capacity ## What It Is Workload capacity describes how much processing room Rhythm currently chooses to make available under observed database pressure. It connects operational signals with admission decisions so a large background import does not simply consume every slot it can request. The concept includes the current protection state, its workload factors and the budgets that shape shared processing. The sentinel reads signal windows and remembers its previous decision. That history matters: a momentary spike and sustained pressure should not cause the same operational response. Its named states provide a common vocabulary for staff and consumers. Publication makes the decision available to services, while their own admission contracts determine how they use it. Capacity is therefore an operational judgment rather than a customer record. Staff can inspect and temporarily override it, but ordinary users usually encounter its effects through the pace of their work. ## What It Is Not A customer’s licensed entitlement does not establish current database room. Licensing and capacity answer different questions. A capacity state is also not a promise about completion time or a diagnosis of every slow request. Gateway throttles provide one protection mechanism; batch admission supplies another. Neither should be mistaken for the whole protection policy. ## How It Is Used Bulk jobs consult their admission budgets as they make batches available for processing. Staff operators inspect pressure and may pin a state during an incident. The pin records both a reason and an expiry so an override can be understood and bounded rather than becoming an unexplained permanent setting. Good use considers the evidence behind a protection decision and the work affected by it. Holding a severe state can delay customers, while holding normal under pressure can remove useful protection. Signal failures have explicit fallback behavior, so a normal state alone does not establish that fresh measurements show a healthy database. Operators need that context when investigating an import that waits or slows. ## Its Facets **Protection state.** Named levels communicate the sentinel’s current response to sustained readings, with transition memory preventing rapid oscillation. **Workload factors.** Separate factors allow bulk and heavy work to yield room before ordinary work is reduced. Consumers apply them through their own budget contracts. **Staff override.** A pin can intentionally hold a selected response during an incident and is inspectable through staff controls and audit evidence. **Emergency stage limits.** A separate enablement choice and declared targets govern this additional protection step. Its existence does not mean every service publishes suitable targets. **Batch budgets and service shares.** These combine with the capacity factor to distribute admission across jobs and workspaces. Fairness is about available grants, not identical completion time for different inputs. **History maintenance.** Partition housekeeping supports the assigned operational scope, but it is not a pressure signal and does not partition job outcome evidence. ## How It Relates Data jobs use the bulk factor while admitting file batches. Workload profiles contribute workspace ceilings, and service shares bound local admission. Partition maintenance currently sits alongside this work by registry assignment while serving other modules’ history. Those owners retain responsibility for their records and retention contracts. ## What It Could Become The proposed thresholds and production budgets need load evidence before being treated as settled product policy. Product could make capacity waits clearer in job inspection. The long-term home of partition maintenance remains an open boundary decision. Broader operational coverage must also establish consumer behavior rather than assuming that publishing a state means every service enforces it.