Struct SessionMessenger 

pub struct SessionMessenger { /* private fields */ }

Validates logical identity, atomically enqueues, then requests one runtime activation. The service owns no process-global registry.

Implementations

impl SessionMessenger

pub fn new( sessions: Arc<dyn Storage>, inbox: Arc<dyn SessionInboxPort>, activation: Arc<dyn SessionActivationPort>, ) -> Self

pub fn inbox(&self) -> &Arc<dyn SessionInboxPort>

pub fn activation(&self) -> &Arc<dyn SessionActivationPort>

pub fn metrics(&self) -> &Arc<SessionMessagingMetrics>

pub async fn list_peer_targets( &self, caller_session_id: &str, ) -> Result<SessionPeerTargets, SessionMessengerError>

Discover bounded logical peers in the caller’s current canonical tree. caller_session_id comes from the authenticated runtime context, never from model arguments. Every candidate is revalidated before disclosure.

pub async fn send_peer( &self, caller_session_id: &str, target_session_id: &str, operation_id: &str, message: &str, ) -> Result<SessionMessengerReceipt, SessionMessengerError>

Send an asynchronous peer instruction. Source identity and association fields are constructed by the runtime; callers provide no envelope. Reuse the same operation id and message after an uncertain result.

pub async fn send_peer_with_intent( &self, caller_session_id: &str, target_session_id: &str, operation_id: &str, message: &str, intent: SessionMessageDeliveryIntent, ) -> Result<SessionPeerDeliveryReceipt, SessionMessengerError>

Explicit scheduling over the same lifetime-fenced Inbox. Omission on the old send_peer API keeps legacy interrupt/activation behavior.

pub async fn send_peer_observed( &self, caller: &SessionCallerReference, target_session_id: &str, operation_id: &str, message: &str, intent: Option<SessionMessageDeliveryIntent>, ) -> Result<SessionPeerDeliveryReceipt, SessionMessengerError>

Canonical compatibility send from the original executing caller. The final Inbox retains a never-installed Host namespace plus the existing peer lifecycle/Project authority. An installed/revoked scope refuses this fallback; use the explicitly scoped sender for that namespace.

pub async fn send_host_scoped_peer( &self, token: &HostSessionScopeToken, caller: &SessionCallerReference, target_session_id: &str, operation_id: &str, message: &str, intent: SessionMessageDeliveryIntent, ) -> Result<SessionPeerDeliveryReceipt, SessionMessengerError>

One explicitly installed SendPeer grant, including independent Roots. No inspect right or public target read is needed to build this bounded envelope. The Inbox validates the original caller and token at its final retained authority boundary; these binding bytes are observations only.

pub async fn send_host_root_first_input( &self, token: &HostSessionScopeToken, caller: &SessionCallerReference, operation_id: Uuid, reserved_root: &Session, message: &str, ) -> Result<SessionPeerDeliveryReceipt, SessionMessengerError>

Admit the first input for one explicitly authorized Root creation. This is not the SendPeer port: no target grant or relationship is inferred. A known durable receipt survives a later activation failure unchanged.

pub async fn supervisor_root_first_input_observed( &self, caller: &SessionCallerReference, supervisor: &SupervisorReference, operation_id: Uuid, reserved_root: &Session, message: &str, ) -> Result<SessionPeerDeliveryReceipt, SessionMessengerError>

Canonical generic-caller Supervisor creation keeps its old wire but uses current pending state, unlike the independent legacy followup API.

pub async fn steer_peer( &self, caller_session_id: &str, target_session_id: &str, operation_id: &str, message: &str, expected_run_id: &str, ) -> Result<SessionInboxSteerReceipt, SessionMessengerError>

Active-run-only peer input. The Inbox owns exact retry recovery and retains its original authority through the runtime’s publication CAS. This never cancels a run, requests activation or reconstructs an owner.

pub async fn reply_peer( &self, caller_session_id: &str, received_message_id: &str, operation_id: &str, message: &str, ) -> Result<SessionMessengerReceipt, SessionMessengerError>

Reply only to a canonical received peer envelope in the caller’s saved transcript. Recipient and thread edges are never supplied by the model.

pub async fn reply_peer_with_intent( &self, caller_session_id: &str, received_message_id: &str, operation_id: &str, message: &str, intent: SessionMessageDeliveryIntent, ) -> Result<SessionPeerDeliveryReceipt, SessionMessengerError>

Derive recipient/thread from the canonical received peer message while opting into explicit scheduling. Reply observations never grant authority.

pub async fn supervisor_loop_control( &self, supervisor: &SupervisorReference, target_session_id: &str, expected_link_revision: Option<u64>, command: &LoopControlRequest, receipt_operation_id: Option<&str>, ) -> Result<Value, SessionMessengerError>

Original executing Supervisor control over one separately host-granted live Root. Enqueue/notification is never a configuration application receipt. Reads use a fresh canonical target snapshot under both fences.

pub async fn supervisor_current_user_followup( &self, caller: &SessionCallerReference, supervisor: &SupervisorReference, target: &SupervisorCurrentUserTarget, operation_id: &str, message: &str, ) -> Result<SessionMessengerReceipt, SessionMessengerError>

Current-user management always retains the immutable selected target and full original caller through the existing physical Inbox writer.

pub async fn supervisor_followup( &self, supervisor: &SupervisorReference, target: &Session, operation_id: &str, message: &str, ) -> Result<SessionMessengerReceipt, SessionMessengerError>

Follow an originally observed Session from the canonical Supervisor. Retain its birth across retries. The concrete Inbox revalidates all authority under physical locks; a fresh ID lookup cannot replace it.

pub async fn supervisor_followup_observed( &self, caller: &SessionCallerReference, supervisor: &SupervisorReference, target: &Session, operation_id: &str, message: &str, ) -> Result<SessionMessengerReceipt, SessionMessengerError>

Canonical sender fallback only. Its Inbox holds a real never-installed namespace guard and the complete original caller through admission.

pub async fn admit( &self, envelope: SessionMessageEnvelope, ) -> Result<SessionMessengerAdmission, SessionMessengerError>

pub async fn admit_with_gate( &self, envelope: SessionMessageEnvelope, gate: Option<&AdmissionGate>, ) -> Result<SessionMessengerAdmission, SessionMessengerError>

pub async fn admit_with_activation_intent( &self, envelope: SessionMessageEnvelope, policy: SessionActivationPolicy, gate: Option<&AdmissionGate>, ) -> Result<SessionMessengerAdmission, SessionMessengerError>

Commit this specific message’s immediate permission together with the envelope. Coordinators continue to use staged admit.

pub async fn activate( &self, admission: &SessionMessengerAdmission, ) -> Result<SessionMessengerReceipt, SessionMessengerError>

pub async fn activate_with_policy( &self, admission: &SessionMessengerAdmission, policy: SessionActivationPolicy, ) -> Result<SessionMessengerReceipt, SessionMessengerError>

pub async fn activate_prepared( &self, admission: &SessionMessengerAdmission, ) -> Result<SessionMessengerReceipt, SessionMessengerError>

Request execution for an admission whose activation policy was already durably recorded by a coordinator.

pub async fn prepare_activation( &self, admission: &SessionMessengerAdmission, ) -> Result<(), SessionMessengerError>

Durably authorize the admitted queue prefix before a related control-plane transition is committed.

Coordinators call this while their specific wait is still armed, then checkpoint the wait clear, and finally call activate. A crash in either gap is recoverable: startup sees the watermark, while the real reservation adapter refuses to run until the specific wait has been durably cleared.

pub async fn prepare_message_activation( &self, admission: &SessionMessengerAdmission, policy: SessionActivationPolicy, ) -> Result<(), SessionMessengerError>

Authorize one staged delivery, preserving its immutable delivery intent and every sibling’s existing execution permission.

pub async fn send( &self, envelope: SessionMessageEnvelope, ) -> Result<SessionMessengerReceipt, SessionMessengerError>

pub async fn send_with_gate( &self, envelope: SessionMessageEnvelope, gate: Option<&AdmissionGate>, ) -> Result<SessionMessengerReceipt, SessionMessengerError>

pub async fn send_with_policy( &self, envelope: SessionMessageEnvelope, policy: SessionActivationPolicy, ) -> Result<SessionMessengerReceipt, SessionMessengerError>