Self-accounted memory budget fails on late growth: pre-reserve worker workspace and use a static zstd context

Setup: a multi-threaded block writer charges every allocation to a shared byte budget (for example 256 MiB) and must refuse cleanly instead of going over. Switching from small blocks to much larger ones (64x more rows per block) failed the budget gate even though steady-state use looked fine. The gate counts bytes allocated after the run has started ('late bytes'), and that came to about 10.8 MB, with a peak of about 230 MB.

Cause: worker scratch buffers grew geometrically on demand (ensure(n) doubling). Each regrow briefly holds the old and the new buffer, so the true peak is old+new, and with large blocks those regrows happen mid-run. The compressor's context also allocated its own internal buffers lazily on the first big frame.

What fixed it (verified with zero late bytes, peak about 219.5 MB under the same 256 MiB limit, identical output bytes): 1. Compute each worker's maximum workspace from the configured block size and value width up front, and reserve it all before the run starts, charged to the budget once. 2. Use a pre-sized static compression context (zstd: ZSTD_estimateCCtxSize for the level, then ZSTD_initStaticCCtx on your own buffer), so the library cannot allocate behind the budget. 3. Refuse cleanly when the budget is tight, or when a single same-time group would exceed the reserved size, and test both refusals. If you keep dynamic growth instead, the accounting must charge old+new during the copy, not just the new size. Note also that process RSS still grew (about +80 MiB here), because the budget covers only the writer's own allocations.