Struct PixSessionTelemetry 

pub struct PixSessionTelemetry {
    gate: Arc<ServiceGate>,
    state: Mutex<Published>,
    released: AtomicBool,
}

One PIX Session’s share of the node-level aggregates, and the bookkeeping that keeps it exact.

Created with its supervisor worker and carried on SessionPixSupervisorHandle, so it reaches both the worker (which publishes) and close_session (which releases) without a new SessionSlot field.

Why release is explicit rather than only Drop

The same reason CycleBudgetReservation gives: a SessionSlot lives in a moka cache that drops its own clone during a later maintenance pass, and the supervisor worker is spawned detached and exits only when the last cmd_tx goes with it. A purely refcount-driven release would therefore zero these gauges at an unpredictable time, and until then the node would report Sessions and cycles that no longer exist. The flag is what lets both the explicit call and Drop run without decrementing twice.

Fields

gate: Arc<ServiceGate>

The gate this Session’s egress passes through, read for its served split.

Held rather than passed in, because the two callers do not both have it at the moment they need it: release runs from close_session, which does have the gate, but Drop runs from wherever the last Arc happens to go.

state: Mutex<Published>

released: AtomicBool

Implementations

impl PixSessionTelemetry

pub fn new(gate: Arc<ServiceGate>) -> Self

A handle that has published nothing yet, reading egress from gate.

pub fn publish(&self, snapshot: PixSessionSnapshot, events: PixTurnEvents)

Publishes the difference between snapshot and what was last published, and drains events.

The census half is a no-op once release has run, so a worker still draining its command channel after its Session was torn down cannot re-inflate a gauge that has already been returned to zero. The events are a different matter: the worker took them out of the supervisor’s latch before calling this, so they exist nowhere else, and a released handle emits what it safely can of them rather than dropping the batch on the floor. EventScope draws that line.

pub fn release(&self)

Returns every gauge this Session holds to zero, and flushes its last egress. Idempotent.

Cycles still live in the last published census are counted as Failed, which is what keeps requested = recovered + failed exact for a Session that ends with cycles in flight. on_unverifiable_shares does exactly that on purpose — it closes the Session outright rather than retiring each cycle — and so does any close that arrives from outside the supervisor.

The egress flush is why close_session poisons the gate before calling this: a poisoned gate admits nothing further, so the split read here is final rather than a moving target.

If a publish is racing this, one census applies and the other is suppressed, and either ordering counts each live cycle exactly once: a publish that wins first shrinks the census this then charges, and a publish that loses leaves the older census for this to charge instead. What the losing publish carried is not thrown away with it — it emits the part of its batch this does not account for, which EventScope defines.

fn flush_egress(&self, state: &mut Published) -> (u64, u64)

Packets admitted since the last flush, and advances the watermark.

Returned rather than emitted so the caller can release the lock first: these are cumulative counters, and holding this Session’s lock across a global instrument would serialize every other Session’s publish behind it for no benefit.

Trait Implementations

impl Drop for PixSessionTelemetry

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.