Struct BoundServer 

pub struct BoundServer { /* private fields */ }

A bound, running listener.

Implementations

impl BoundServer

pub fn local_addr(&self) -> SocketAddr

The address actually bound, with the kernel’s choice of port filled in.

pub fn admission(&self) -> AdmissionStats

What the admission gate has done since this listener started.

This is the visibility half of the fix. A limit whose saturation cannot be read is the same undiagnosable “git is slow” the accidental 512-thread ceiling produced; admitted, refused_* and peak_in_flight are what an operator, or a test, looks at instead.

pub fn admission_gate(&self) -> Arc<Admission>

The admission gate itself, so a second transport can route through the SAME one (one implementation).

gunnar-http is a second front door onto the same server, and a git transfer over HTTP has to count against the same server-wide and per-principal ceilings — and the same memory budget — as one over SSH, or an appliance’s real concurrency is silently twice the number written on the box. Handing out the Arc (rather than rebuilding a gate from the same numbers) is what makes it one gate with one set of counters, not two that happen to agree: on 2026-08-31 the HTTP front was found with no gate at all, and two gates would have been the next-worst answer.

pub fn metrics(&self) -> MetricsSnapshot

The server-wide counters.

pub fn metrics_handle(&self) -> &Arc<ServerMetrics>

The counter block itself, for a caller that wants to keep reading it after this listener is consumed by BoundServer::shutdown.

pub async fn shutdown(self, reason: &str) -> Result<()>

Ask every session to disconnect, then wait for the accept loop to stop — for at most SSH_SHUTDOWN_GRACE.

Bounded, the way the gRPC half already is (GRPC_SHUTDOWN_GRACE in gunnar-server): the accept loop only ends when its sessions do, and a session whose peer never answers the disconnect — MEASURED 2026-09-28 on loki, a primary’s replication session into a standby being stopped, 1 run in 17 under a parallel test binary — held shutdown for an hour. A shutdown that can hang forever is a restart, a drain or a growth that can hang forever. Past the grace the listener task is aborted and the reason is logged; the sessions go with the process.

pub async fn shutdown_within(self, reason: &str, grace: Duration) -> Result<()>

Self::shutdown with an explicit grace (tests use a short one).