Module load_shed 

Load-shedding: content-agnostic overload protection for the paid serve path.

When the node is saturated it refuses NEW serves — regardless of blob or price — so in-flight streams stay fast. A refusal reuses the delivery path’s NotFound-shaped reject, so the client re-routes (ADR 037 / #1174) at only a latency cost; it is not slashable and carries no reputation penalty. The decision is a pluggable LoadShedPolicy; the node wiring layer selects the implementation from config, mirroring the ADR 040 eviction/admission policy split.

Structs

AlwaysAdmit

The no-op policy: never sheds. A valid operator choice for a node that wants no heuristic shedding. It is UNWISE under a real flood — the OS OOM-killer becomes the only backstop — but physical limits bind regardless, and the ConnectionLimiter task caps still apply beneath it, so the choice stays available.

EgressMeter

Cumulative delivered bytes plus the last computed EWMA rate. All state is atomic, so record stays off any lock on the hot delivery path.

LoadShedController

The serve path’s load-shed handle: a swappable policy over live meters.

PressureSnapshot

One immutable read of live node pressure, sampled per admission. New signals are added as fields; a policy ignores fields it does not read, so the seam is additive.

ResourcePressure

Sheds the miss tier under concurrency pressure and any class under egress saturation, while capping a single client’s share only during real contention. Holds one bit of hysteresis state.

ResourcePressureParams

Tunable thresholds, resolved from node config (see ResolvedLoadShed).

ShedSlot

RAII place for one admitted serve. Drop releases the node-wide and per-client counts on every exit path, so a finished stream always frees its slot; the count is owned here, never decremented by hand.

ShedState

Node-wide and per-client in-flight serve counts. Held in an Arc so a ShedSlot can outlive the borrow that created it.

Enums

RequestClass

Which serve tier a request falls into, resolved where cache.has is known. A hit is local — zero upstream cost, pure margin — so it is shed last; a miss fronts origin egress / upstream USDC and stresses disk and CPU, so it is shed first.

ShedDecision

What a policy decided about one request.

ShedReason

Why a request was shed. Metrics/observability granularity only — every reason is NotFound on the wire.

Traits

LoadShedPolicy

A pluggable overload-protection policy. decide is pure over the snapshot so it is unit-testable without a running node; the node wiring layer selects the implementation from config.