pub(super) fn admit_rejection_log() -> Option<u64>
Reserves one rejection log and returns the count suppressed since the last log.
The budget covers both rejected upgrades and authentication failures.