The gauge reads 600 of 4096.

…
derive (throughput): a publish is one ETS insert and three atomics operations, near 0.5 to 1 us, and the apply side amortizes to nothing over batches -- so publish cost alone governs, and the end-to-end rate on one scheduler should land between 100,000 and 2,500,000 items per second, floor 80,000; mid-storm occupancy must sit strictly between zero and capacity and drain to exactly zero
G3 occupancy ok -- mid-storm the gauge read 600 of 4096 and drained to exactly 0; priced, the ring moved 100000 items in 99 ms -- 1005116 items per second end to end on one scheduler, inside the derived band, largest batch 200, nothing dropped
derive (full): with capacity 64 and the applier held inside its first apply, exactly 64 publishes are accepted and 136 are refused and counted; releasing the applier drains the 64, and the next publish lands -- the ring under storm refuses, recovers, and keeps serving
G4 full ok -- the bound held its shape: 64 accepted, 136 refused with :dropped and counted -- never blocked, never overwritten -- then the release drained all 64 and publish 201 landed and applied: a storm bends the lane's at-most-once contract no further than the contract already bends
…
PASS 6/6

The elided lines hold the header, the surface and order drills, and the storm and convergence drills — dive 1 and dive 3 read them, and the module hub freezes the record whole. The derive lines are part of the record: each measurement is bounded before it is taken, and the committed line then lands inside its own band.

Occupancy is tail minus head, readable by anyone at any time. The watching surface, verbatim from the chapter's How:

EchoCache.Ring.occupancy({:coh, :quotes})
# 0 in calm, a hill in a storm

EchoCache.Ring.stats({:coh, :quotes})
# %{published: ..., applied: ..., dropped: 0, wakes: ..., batches: ...,
#   max_batch: ..., occupancy: 0, capacity: 4096}

With application amortized over batches, publish cost governs — "a publish is one ETS insert and three atomics operations, near 0.5 to 1 us" — and the derive line prices the whole pipe before measuring it: "the end-to-end rate on one scheduler should land between 100,000 and 2,500,000 items per second, floor 80,000". The committed line lands inside the band: the ring moved 100000 items in 99 ms -- 1005116 items per second end to end on one scheduler, inside the derived band, largest batch 200, nothing dropped. The derivation note is part of the record (D-B4.3): "the first band's ceiling undercounted exactly because it priced the apply side that batching had already amortized away."

The boundary travels with the number: one scheduler, loopback-free, items of two names each — 1005116 items per second is this container's number; the shape of the curve travels, the magnitude does not.

Declare ring_capacity for the storm you expect, not the average you measure: capacity is the maximum burst the lane may absorb before drops begin, and at 29 bytes of meaning per slot a 4096-slot ring is cheap insurance. Watch occupancy, not only drops — a gauge that visits its ceiling is a storm survived; a dropped counter that moves is a storm that exceeded the declaration, and the TTL floor under the loss is the same floor 4.2 priced.

At capacity the publish answers :dropped and a counter moves — never a block, never an overwrite. The drill holds the applier inside its first apply with capacity 64, then publishes past the bound: "exactly 64 publishes are accepted and 136 are refused and counted; releasing the applier drains the 64, and the next publish lands". The committed gate: the bound held its shape: 64 accepted, 136 refused with :dropped and counted -- never blocked, never overwritten -- then the release drained all 64 and publish 201 landed and applied.

The policy is not a shrug; it is contract preservation. The broadcast lane this ring serves is at-most-once by its substrate's own definition — 4.2's gate F4 priced the loss — so a counted drop under storm bends the lane's contract no further than the contract already bends, where blocking would back the storm up into the push receiver, and overwriting would lose an arbitrary message silently. Surfaces that cannot accept a drop were never on this lane; "routing the job lane's at-least-once delivery through a dropping structure would launder a guarantee away." A dropped message is a real loss bounded by the TTL exactly as 4.2 priced it; the ring adds counting, not resurrection.