Custodian memory limit accounting varies by Racket backend

Backend Accounting Differences

Memory accounting for custodian-limit-memory is not identical across Racket backends. The primary difference lies in the granularity and precision of heap tracking between the Chez Scheme and BC backends:

• Chez Scheme: Provides more precise heap accounting, generally including all allocations made directly in Scheme code.
• BC Backend: Uses a coarser approximation. It may undercount temporary allocations or shared objects (such as globals or closures captured by multiple custodians), leading to lower reported usage than Chez for the same workload.

Allocation Constraints

Regardless of the backend, there are documented constraints on what is charged to a custodian's memory limit:

• Included: Standard Scheme-level heap allocations.
• Excluded: Memory allocated via foreign function interfaces (FFI) or C objects that are not referenced by Scheme roots. These allocations do not count toward the custodian limit and can potentially exhaust host memory without triggering a custodian OOM exception.
• Timing: Enforcement is approximate. An allocation may succeed even if it technically exceeds the limit if the backend's accounting lags; the exception is typically triggered on the subsequent allocation attempt.

Strategy for Consistent Guardrails

Because the BC backend tends to underestimate usage and Chez is more stringent, a single limit value will behave differently across environments. To provide consistent protection, follow these steps:

1. Empirical Calibration: Run a representative workload on both backends. Record the reported memory usage at the moment the out-of-memory (OOM) exception is raised.
2. Set a Safety Margin: Identify the backend that reports the highest peak usage before failure. Set your production limit 10–20% higher than this observed peak to account for fragmentation and accounting lag.
3. Host-Level Protection: Since FFI allocations are excluded from custodian accounting, do not rely solely on custodian-limit-memory for total process safety. Use OS-level limits (e.g., cgroups or ulimit) to protect the host process from foreign memory exhaustion.

Verification Command

You can verify the threshold behavior by running a script that allocates large vectors until failure:

(define cust (make-custodian))
(custodian-limit-memory cust 10485760) ; 10MB limit
(custodian-set-current-custodian cust)
(let loop ([acc '()])
  (loop (cons (make-vector 1000000) acc)))

Diagnostic Note: To refine this recommendation, please specify if the contained computations rely heavily on ffi calls or if they primarily perform pure Racket heap allocations.