Struct DiskHeadroomGate 

pub struct DiskHeadroomGate { /* private fields */ }

The community gate. verdict is always Allow — this gate knows no plan; pack_quota refuses when the store root is under the floor, or when everything above the floor is already promised to transfers still landing.

It owns the data set’s SpaceLedger (crate::space): the same floor and the same measurement, so the door before the first byte and the receive loop after it cannot disagree about where the line is. gunnar serve hands Self::ledger to every door that writes.

Implementations

impl DiskHeadroomGate

pub fn new(root: impl Into<PathBuf>, floor: DiskFloor) -> Self

Guard the filesystem root lives on. root is the store root (/data on the appliance); the measurement is of its filesystem, so a path anywhere on the same mount reads the same.

pub fn over(ledger: Arc<SpaceLedger>) -> Self

The gate over an existing ledger — its root, its floor, its probe (a test’s fake disk measures through here too).

pub fn ledger(&self) -> &Arc<SpaceLedger>

The data set’s space ledger: what every writing door asks before each chunk it takes.

pub fn root(&self) -> &Path

The path this gate measures.

pub fn floor(&self) -> DiskFloor

The floor this gate was configured with.

pub fn headroom(&self) -> Result<Headroom>

Measure. One statvfs (the ledger’s probe); the error is the OS’s.

The RAW reading — what is on the disk, no promises subtracted. This is what Admin.Capacity reports and monetize’s growth trigger reads (used = total − servable): a promise is not a byte used, and a refused burst must not read as a full set (see crate::space).

pub fn refusal(&self) -> Option<String>

The one refusal, for every door. None is room; Some(line) is what the client is told, naming the free bytes and the floor. A measurement that fails is a refusal that says so.

Two lines, and the difference is the point: UNDER the floor is the floor’s line (final until space is reclaimed or grown); above it but with everything above it promised to transfers still landing is crate::space::FULL_NOW’s (try again in a moment).

Trait Implementations

impl Clone for DiskHeadroomGate

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DiskHeadroomGate

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PlanGate for DiskHeadroomGate

fn verdict(&self, _namespace: &str, _action: PlanAction) -> PlanVerdict

The ladder’s answer for namespace and action. An unknown namespace is Free, which is Allow.

fn pack_quota(&self, _namespace: &str) -> PlanVerdict

Is the namespace already at its caps["pack_bytes"]? Refuse names the cap, what is held and the URL; Allow for a namespace with no cap or room under it. Asked before a single pack byte is read, so a tenant at the ceiling learns it from the first line and not after the upload.

fn applies_to_machine(&self) -> bool

Does this gate also bind the primary’s replication push? A Machine principal is how a primary authenticates to its standby, and by default a gate is NOT asked about it: replication is the primary’s copy arriving, not a tenant growing their data, and a plan that refused it would make a lapsed tenant’s standby diverge from the primary. The disk gate answers true: a full standby must say so before the bytes, the same as a full primary — there is no plan to exempt a disk from.

fn name(&self) -> &'static str

How this gate names itself in Control’s Debug and in the boot log.

fn pack_ceiling(&self, _namespace: &str) -> Option<PackCeiling>

How many packfile bytes may this namespace still receive, right now? None — the default, and every gate’s answer until one has a reason — means no ceiling, and the pack is read to its end whatever its size.

fn lfs_allowance(&self, _namespace: &str) -> Option<Allowance>

How many LFS bytes may this namespace still receive? The same question PlanGate::pack_ceiling asks about a pack, one wire over, and None means the same thing: no cap, take what arrives.