Why a transfer was turned away, in the three words an operator can act
on differently.
Deliberately three and not the gate’s six. gunnar_ssh::Refusal has six
variants because the admission gate has six ceilings, and which of them was
hit is an operator’s question about the BOX. A tenant’s question is a
different one — is the server busy, am I over my plan, or am I not allowed
— and those are three answers. The six-way detail stays where it is, on the
gate’s own AdmissionStats and in the admission-* reason on the log line.
The box was full. Every gunnar_ssh::Refusal variant: the gate is at
capacity, the principal’s share is spent, a lane is full, the anonymous
ceiling is reached, the keyed reserve is held, the memory budget is
spent. Nothing about the tenant is wrong; the server said “not now”.
The plan said no before a byte.PlanGate::pack_quota refusing a
namespace already at its pack_bytes cap, and the LFS allowance
refusing an upload past lfs_bytes. This is the one an invoice can fix.
The push gate said no. A protected ref, a required review, a
signature that did not verify — gunnar_policy’s verdict. Nothing an
invoice can fix and nothing the operator should page about.
admission | cap | policy — the wire spelling, one writer. The same
idiom as Scope::name and Growth::name on monetize’s side: a word,
never an enum’s ordinal, because an ordinal is an encoding of the
meaning rather than the meaning.