Struct PackCeiling 

pub struct PackCeiling {
    pub bytes: u64,
    pub refusal: String,
    pub ledger: Option<Arc<dyn PackLedger>>,
}

How many packfile bytes this push may send, and what the client is told when it sends more.

Why a ceiling exists at all

git-receive-pack’s pack header carries an object count, not a byte count, so the size of a push is not knowable at the moment it is authorised. A quota asked before the pack (gunnar_ssh::PlanGate::pack_quota) refuses a tenant who is already at the ceiling, and a limit asked after it (gunnar_policy::gates::limits, whose own header says so plainly) refuses a pack that has already been received — so between those two there was nothing at all in front of one enormous push. A tenant one byte under a 10 GiB cap could send 400 GiB and the box would take every byte of it before anything looked.

This is that missing thing. It is enforced in the receive loop itself ([Counting]), so an unbounded push costs the server the ceiling and not the push.

It is a backstop, not a meter

The polite refusal is pack_quota’s, before a byte moves. This fires only for a push that was under the cap when it started and crossed it in flight, which is why whoever sets it is expected to have added slack to it: the bytes on the wire are not the bytes that land (a thin pack is completed with bases the client never sent; the engine stores compressed), and a ceiling with no room refuses a push that would have fitted. gunnar-wire does not choose that number — it does not know what a plan is — it enforces the one it is handed.

…and it is one number shared by everything pushing at once

PackCeiling::bytes is measured for ONE push, and two pushes that arrive together get the same measurement — so before PackCeiling::ledger each of N simultaneous pushes was held to the whole of the namespace’s remaining room, and the room was spent N times. tests/concurrent_pack_ceiling.rs measured it at eight packs of 41016 bytes into 65536 bytes of room. The ledger is what makes the number a shared budget rather than a per-connection allowance.

Fields

bytes: u64

Packfile bytes past which the read is aborted. A push of exactly this many bytes is accepted; the next byte cuts it.

refusal: String

The line the client is told, verbatim, in place of whatever the ingest made of the truncated stream. Composed by whoever set the ceiling — the metered appliance names the plan, the cap and the billing URL, the same shape every other entitlement refusal uses — because this crate knows nothing about plans, caps or money.

ledger: Option<Arc<dyn PackLedger>>

Who else is spending Self::bytes right now. None — the default, and what a build with no byte cap installs — means the number is this push’s alone, which is what every gunnar before 2026-09-08 did and is correct exactly as long as one push is the only push.

Some makes the ceiling a budget the namespace shares: the receive loop asks before every chunk it hands to the ingest, and takes what it is granted. See PackLedger.

PartialEq/Eq came off this struct when the field arrived. Two ceilings are not comparable any more, because a shared standing in a counter is not a value — and nothing compared them: the equality the tests use is gunnar_ssh::PackCeiling’s, which is the plain twin the gates return and still derives both.

Trait Implementations

impl Clone for PackCeiling

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PackCeiling

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.