Struct AdmissionStats 

pub struct AdmissionStats {

    pub admitted: u64,
    pub refused_at_capacity: u64,
    pub refused_per_principal: u64,
    pub refused_memory: u64,
    pub refused_anonymous: u64,
    pub refused_keyed_reserve: u64,
    pub refused_paused: u64,
    pub in_flight: u64,
    pub peak_in_flight: u64,
    pub limit: usize,
    pub reserved_bytes: u64,
    pub admitted_after_wait: u64,
    pub waited_ms_total: u64,
    pub peak_wait_ms: u64,
    pub refused_after_wait: u64,
    pub refused_lane: u64,
    pub overdrawn: u64,
    pub grown_bytes: u64,
    pub handoff_ms_total: u64,
    pub peak_handoff_ms: u64,
    pub unmeasured_sojourn: u64,
}

A snapshot of the gate’s counters.

Taken atomically field by field rather than under a lock: these are a signal, and a signal that costs a mutex on the request path would be paid for by the thing it is measuring.

Fields

admitted: u64

Transfers let through since the server started.

refused_at_capacity: u64

Transfers refused because the server-wide limit was full.

refused_per_principal: u64

Transfers refused because one principal held its whole share.

refused_memory: u64

Transfers refused because the memory budget was spoken for (gate 2).

refused_anonymous: u64

Reads refused because the anonymous ceiling was full.

Deliberately not folded into refused_per_principal: that counter moving means a client gunnar knows about is being throttled, and this one moving means strangers are at their cap. A dashboard that added them together would show one number that can be entirely benign (a popular public repository, working exactly as designed) or entirely alarming (a keyed CI fleet starved of its share) with no way to tell which.

refused_keyed_reserve: u64

Reads refused because the slot they wanted was inside the keyed reserve (D23b).

Deliberately not folded into refused_anonymous, which is the other half of the same door and means the opposite thing. refused_anonymous moving on an otherwise quiet box is normal — a popular public repository, the ceiling doing its job — and the operator response is none. This counter moving means the box was over CONTENTION_PERCENT full of real work at the moment a stranger asked, which is a capacity signal: it is the public door being shut by load, and it will keep being shut until either the load falls or the box grows. Summed together the two would show one number that means “everything is fine” and “your public repositories are effectively offline” with no way to tell which.

refused_paused: u64

Transfers refused because the gate was paused (Pause): the data set was being grown. Its own counter, because this one moving is neither load nor strangers — it is a planned window, and an operator reading it wants to know how many clients met the window, not to raise any limit.

in_flight: u64

Transfers in flight right now.

peak_in_flight: u64

The most that were ever in flight at once. This is the number that says how close to the ceiling a server has actually been; in_flight alone never shows it, because a sampler always misses the peak.

limit: usize

The governed server-wide limit right now, i.e. where the CoDel controller has moved to inside its band. 0 when there is no limit.

Without this the shed is invisible: an operator seeing refusals against a configured 100 has no way to know the governor has taken it to 37, which is the same “the limit exists but produces no signal” the unbounded listener was written about.

reserved_bytes: u64

Bytes reserved by operations in flight, against memory_budget.

admitted_after_wait: u64

Operations that were admitted only after waiting for a slot (DEFAULT_ADMISSION_WAIT).

This is the queue made countable. It is not a failure count: every one of these was served, and every one of them would have been a refusal before 2026-08-30.

waited_ms_total: u64

Milliseconds spent waiting, summed over every operation that waited.

peak_wait_ms: u64

The longest single admission wait, in milliseconds. The number that says whether the bound is doing anything.

refused_after_wait: u64

Waits that ran out and became refusals.

refused_lane: u64

Refusals because the operation’s lane was at its ceiling while the other lanes’ floors held the rest.

overdrawn: u64

Transfers whose reservation grew past the memory budget while they ran. Nonzero means one transfer is now keeping new ones out — which is the budget working, not failing.

grown_bytes: u64

Bytes charged by running transfers over and above their admission reservations.

handoff_ms_total: u64

Milliseconds between admission and the transfer’s work actually starting, summed over every transfer that reported it.

Observed, not controlled. Until 2026-08-30 this gap was the CoDel controller’s input, and that was the defect: it is the tokio ready queue plus the blocking-pool handoff, which is set by how many clients are connected and doing crypto, not by how many transfers are admitted. A refused client reconnects, so shedding made this number worse and the controller shed until it hit its floor — the limit of 19 measured. It is kept as a counter because it is a real and useful symptom of a box that is out of CPU; it is no longer a control input.

peak_handoff_ms: u64

The longest single admission-to-work gap, in milliseconds.

unmeasured_sojourn: u64

Transfers that finished without ever reporting that their work started, so they contributed no sojourn sample.

A blindness counter, not a health one. The CoDel controller only sees what AdmissionGuard::entered_service files; a caller that forgets to call it leaves the controller with no samples at all, and a controller with no samples grows to the top of its band and stays there — a gate that looks like it is working and is not. This number must be 0 on any path that is actually governed.

Implementations

impl AdmissionStats

pub fn refused(&self) -> u64

Every refusal, however it was refused.

pub fn mean_wait_ms(&self) -> u64

The mean admission wait over the operations that waited, in milliseconds. 0 when nothing has ever waited.

Trait Implementations

impl Clone for AdmissionStats

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for AdmissionStats

impl Debug for AdmissionStats

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AdmissionStats

fn default() -> Self

Returns the “default value” for a type.

impl Eq for AdmissionStats

impl PartialEq for AdmissionStats

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for AdmissionStats