Struct ResponsePermit 

pub struct ResponsePermit { /* private fields */ }

Reservation for the downstream response-capture worker job. Draws from a distinct capacity semaphore so operators can tell via av_events_dropped_total{stage="response_slot"} vs stage="worker_queue" which class of admission is the bottleneck.

Unlike WorkerPermit, the response permit only holds the capacity semaphore — the mpsc queue slot is re-acquired at submit time via Self::submit. This keeps the initial admission cheap (one semaphore acquire instead of two mpsc reservations that would otherwise compete for the same shard’s slot with the worker permit) and lets the response job land whenever worker capacity and the shard have room, which is the common case since response capture happens tens-of-seconds after the initial worker job has drained.

Held by the streaming-response wrapper in routes.rs (AbortFinalizingStream) for the lifetime of the forwarded response; drops on stream completion or client abort.

Implementations

impl ResponsePermit

pub fn submit( self, worker: &WorkerHandle, job: WorkerJob, ) -> Result<(), SubmitError>

Commit a response-capture job. Consumes the response permit’s capacity slot and races for a shard’s mpsc slot; if the shard is momentarily full, returns a SubmitError::Full and bumps av_events_dropped_total{stage="response_slot"} — NOT the worker_queue counter. That distinction is the whole point of the split: operators need to see which class of exhaustion is producing drops.