Struct Budget 

pub struct Budget { /* private fields */ }

One connection’s send and receive allowance, refilling each window.

A RATE, not a lifetime total. The thing worth bounding is a peer flooding the kernel — how fast bytes arrive, and how fast the kernel is asked to produce them. A running total bounds that, but it bounds every legitimate use with it: a subscription is meant to run for days and a blob read moves as many bytes as the blob holds, so under a total both die at a threshold that says nothing about whether they misbehaved.

Exceeding the allowance therefore WAITS rather than failing. “Too fast” is answered by going slower; a connection is only killed when it has done something a slower version of would still be wrong. The one exception is a frame larger than a whole window’s allowance, which no amount of waiting would ever admit — that is a misconfiguration, and it fails loudly instead of hanging forever.

Both directions are charged the FULL frame — prefix, kind byte, and body — because that is what the connection actually costs to move. Charging only the body would let a peer spend the allowance on a million one-byte frames and be told it had used a megabyte.

ponytail: a fixed window, so a peer can spend a full allowance at the end of one and again at the start of the next — a 2x burst across the boundary. For a flood guard that is immaterial; a token bucket if smoothing ever matters.

Implementations

impl Budget

pub fn new(ingress: usize, egress: usize) -> Self

pub fn with_window(ingress: usize, egress: usize, window: Duration) -> Self

The same allowance over a caller-chosen window. Tests use a short one so a refill is observable; nothing in the daemon does.

Trait Implementations

impl Debug for Budget

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.