Struct ResponsePermit 

pub struct ResponsePermit { /* private fields */ }

Reservation for the downstream response-capture worker job. Draws from a distinct capacity semaphore so operators can tell via av_events_dropped_total{stage="response_slot"} vs stage="worker_queue" which class of admission is the bottleneck.

Unlike WorkerPermit, the response permit only holds the capacity semaphore — the mpsc queue slot is re-acquired at submit time via Self::submit. This keeps the initial admission cheap (one semaphore acquire instead of two mpsc reservations that would otherwise compete for the same shard’s slot with the worker permit) and lets the response job land whenever worker capacity and the shard have room, which is the common case since response capture happens tens-of-seconds after the initial worker job has drained.

Held by the streaming-response wrapper in routes.rs (AbortFinalizingStream) for the lifetime of the forwarded response; drops on stream completion or client abort.

Implementations

impl ResponsePermit

pub fn submit( self, worker: &WorkerHandle, job: WorkerJob, ) -> Result<(), SubmitError>

Commit a response-capture job. The capacity slot reserved at admission travels INTO the envelope: the submission never contends on the main worker semaphore, so a backlog of new admissions cannot starve the capture job of an already-admitted stream — the guarantee try_reserve_pair’s acquire-both-or-fail exists to provide. (A previous revision dropped this permit and drew a fresh slot from the WORKER semaphore, which both forfeited the reservation under load and charged the resulting drop to stage="response_slot" when the exhausted budget was actually worker capacity.) The only remaining failure mode is the shard’s bounded mpsc queue being momentarily full, which returns SubmitError::Full and bumps av_events_dropped_total{stage="response_slot"}.