What is measured
Two different meters
Data written is a monthly flow meter for durable event payloads and metadata, state snapshots, and tool-execution bodies accepted during the billing month. Retained data is the current logical payload still stored: event bodies, all retained state versions including fork copies, and tool parameters/results/errors. It is not PostgreSQL physical disk usage.
How enforcement works
For hosted installations, the SaaS control plane resolves the customer entitlement and the hosted worker starts the runtime with the corresponding event, ingress, durable-written, retained-data, and retention settings. PostgreSQL triggers and shared accounting functions enforce those limits in the same transaction as the event, state, or tool write.
- A transition either commits its event, state, outbox, and usage counters together, or none of them commit.
- Fork-generated state copies count toward retained capacity but not the customer's monthly upload meter.
- Self-hosted installations can configure the same environment variables directly; zero means unlimited.
Approaching and reaching a cap
The portal shows progress bars and records warning thresholds at 80%, 90%, and 100%. At 100%, the runtime returns HTTP 429 quota_exceeded and rolls back the attempted write atomically. There is no partial event, state snapshot, tool result, or outbox record.
- Monthly data-written cap: new durable writes resume when the next billing month begins, or sooner after an entitlement-backed plan upgrade.
- Retained-data cap: new writes remain blocked until retention/deletion releases logical capacity, or the plan is upgraded to a larger retained allowance.
- Operational response: customers can see the exhausted metric in the portal and choose an upgrade or contact support; large artifacts should live in object storage with only references stored in Actae.
Why this is safe under concurrency
Usage is accounted with idempotent delivery records and database-side counters. Concurrent requests cannot race past a limit, and a rejected transaction cannot leave the application with a committed event but a missing usage charge.