Function check_build_fits_budget 

pub fn check_build_fits_budget(
    n_elems: impl FnOnce() -> usize,
    elem_size: usize,
    temp_storage: &RowArena,
) -> Result<(), EvalError>

Refuses an input-scaled transient the arena’s budget cannot afford, before it is built.

A function that gathers n_elems of elem_size bytes into its own Vec before packing them holds that allocation on the stack, where the arena never sees it. The evaluator’s post-call check counts arena bytes only, so a transient wider than the result it becomes can slip past a budget the packed result fits under. A Vec<&str> of split chunks is one: a 16-byte fat pointer per chunk against the ~2 bytes an empty chunk packs to. Pair this with check_datums_fit_budget, which bounds the packed result.

n_elems is a closure so an unbudgeted arena, which is every arena in a dataflow, never pays for a count that can cost a pass over the input.

NOTE: the reformatters (jsonb_pretty, pretty_sql, redact_sql) are the known exception. Sizing their output needs the same walk that produces it, so only the post-call check bounds them.