Function impairment_leg 

pub(crate) fn impairment_leg(
    kind: &ImpairmentKind,
    arrived_on: ProxySide,
) -> Option<Leg>

The connection an ImpairmentKind is about, given the side the task that raised it was forwarding from.

The whole mapping lives here, in one exhaustive match, rather than at the twenty-odd sites that raise these reports. Two reasons, and the second is the one that matters.

A raising site knows only the direction it reads from. Working out that a queue it could not flush belongs to the other connection is a turn each site would have to make for itself, and a site that got it wrong would produce a number that is correct under a wrong label — the failure this whole surface is written to avoid, and one no test at that site would notice, because the event would still arrive and still carry a plausible leg.

And the turn is a property of the kind, not of the site. Whether a report is about what came in or about what could not go out is decided by what the report says, so the decision belongs beside the enum that says it. A variant added to ImpairmentKind stops this function compiling — the match has no catch-all on purpose — which is the one place a new report reliably gets asked which leg it means.

arrived_on must be an ingress side

Every Reporter in this crate is built with the side its pipe reads from, so arrived_on is ClientToProxy or RelayToProxy in practice. The function is still total over all four, because ProxySide has four variants and a panicking forwarding path is worse than a defensible answer: an egress side is read as naming its own connection, which is what it does.