Function handle_subscription_socket 

pub async fn handle_subscription_socket(
    socket: WebSocket,
    state: &ServerState,
    caller: &CallerIdentity,
    request: &SubscriptionRequest,
) -> Result<(), ServerError>

Authorize a wire subscription request and forward it on an accepted socket.

The per-connection buffer bound and the namespace-gate verdict-cache bound are read from runtime config, not defaulted in the transport loop.

A subscription rejected before streaming (namespace authorization failure, per-workflow target failure, or resume-cursor validation failure) is never a silent drop: the rejection is sent to the client as one terminal {"error": <WireError>} frame followed by a close frame, so SDKs can branch on the stable code instead of reconnecting against a deterministic denial.

Errors

Returns ServerError when namespace authorization, engine subscription, frame serialization, or bounded-buffer forwarding fails.