feat(nodedb-mem): add over-release counter to Budget and Governor

Budget.release() saturates the allocated counter to zero on over-release,
which hides accounting drift from Budget.allocated(). The new
over_release_count atomic tracks every event where released > allocated so
call-sites can be identified after the fact. Governor.total_over_release_count()
aggregates the counter across all per-engine budgets.

Author: farhan-syah

nodedb-mem/src/budget.rs

@@ -26,6 +26,13 @@ pub struct Budget {
 
     /// Number of times an allocation was rejected due to budget exhaustion.
     rejection_count: AtomicUsize,
+
+    /// Number of `release(size)` calls where `size > current` — the
+    /// accounting-drift symptom. Saturating the per-engine counter
+    /// to zero hides the drift from `allocated()`, so this counter
+    /// is the only observable signal that the call-site is
+    /// over-releasing.
+    over_release_count: AtomicUsize,
 }
 
 impl Budget {
@@ -36,6 +43,7 @@ impl Budget {
             allocated: Arc::new(AtomicUsize::new(0)),
             peak: AtomicUsize::new(0),
             rejection_count: AtomicUsize::new(0),
+            over_release_count: AtomicUsize::new(0),
         }
     }
 
@@ -110,6 +118,7 @@ impl Budget {
             ) {
                 Ok(_) => {
                     if size > current {
+                        self.over_release_count.fetch_add(1, Ordering::Relaxed);
                         tracing::warn!(
                             released = size,
                             allocated = current,
@@ -133,6 +142,15 @@ impl Budget {
         self.limit.load(Ordering::Relaxed)
     }
 
+    /// Number of over-release events observed on this budget. A
+    /// non-zero value is the smoking-gun signal that some call-site
+    /// is releasing more bytes than it reserved. Per-engine
+    /// `allocated()` saturates to zero on over-release, so this
+    /// counter is the only post-hoc observable.
+    pub fn over_release_count(&self) -> usize {
+        self.over_release_count.load(Ordering::Relaxed)
+    }
+
     /// Remaining bytes available.
     pub fn available(&self) -> usize {
         let limit = self.limit();

nodedb-mem/src/governor.rs

@@ -399,6 +399,16 @@ impl MemoryGovernor {
         self.budgets.values().map(|b| b.allocated()).sum()
     }
 
+    /// Total number of over-release events observed across all
+    /// per-engine budgets. A non-zero value signals at least one
+    /// call-site is releasing more bytes than it reserved — the
+    /// "memory release exceeds allocation" warning class. Per-engine
+    /// `allocated()` saturates to zero on over-release, so this
+    /// counter is the only post-hoc observable for the bug.
+    pub fn total_over_release_count(&self) -> usize {
+        self.budgets.values().map(|b| b.over_release_count()).sum()
+    }
+
     /// Global utilization as a percentage (0-100).
     pub fn global_utilization_percent(&self) -> u8 {
         if self.global_ceiling == 0 {