# Binder Serving
`binder::serve` is the server side of Core's direct-bind protocol — the other
side of the client `transact_write` helpers in `binder::sys`. It owns a binder
class whose `on_transact` dispatches to a user handler.
## Types
- `ServeCall<'a>` — one dispatched transaction: the transaction code, the
caller's uid/pid, and borrowed read/write cursors over the framework-owned
request and reply parcels. `request` is a `ParcelReader`, `reply` is an
`Option<ParcelWriter>` (`None` for one-way inbound transactions).
- `ServeHandler` — `Box<dyn FnMut(ServeCall) -> Result<(), CoreError> + Send>`,
the user closure invoked for each transaction.
- `ServingBinder` — owns a class + binder:
- `open(descriptor, handler)` / `open_bounded(descriptor, handler, max_inflight)`
— register the binder. `open` delegates with `max_inflight = 4`.
- `as_raw()` — the underlying `*mut c_void` binder pointer.
- `push_oneway(...)` — one-way update to a client observer.
- `associate(target)` — pin the class on a read observer proxy.
- `death_recipient(on_died)` / `DeathRecipient::{link,unlink}` — peer-death
observation.
- `oneway_sender()` → `OnewaySender` — a reusable one-way push handle.
## Caller identity
The uid/pid are **captured at entry**: read once, synchronously, at the top of
`on_transact`, where the thread-local binder context is still valid, and passed
in the `ServeCall`. They are **not** valid after the transaction returns — the
framework tears the context down. This is a deliberate capture-at-entry
primitive so handlers cannot hold stale identity.
## Concurrency
`serve` dispatch serializes handlers through a per-`ServingBinder` mutex (a
shared handler is not safe across binder pool threads), and applies an
**admission gate**: a counting semaphore caps concurrent in-handler work at
`max_inflight`, and over-capacity transactions are rejected up front with
`STATUS_OUT_OF_RESOURCES` (`-7`) before touching the handler lock. A handler
`Err` (or a panic, caught via `catch_unwind`) maps to
`STATUS_UNKNOWN_TRANSACTION` (`-2`); a panic never unwinds the `extern "C"`
frame. UID/PID are captured before the lock; the lock is dropped before the
kernel reply is transmitted; a poisoned mutex is recovered in place.
## Integration
`ServingBinder` runs on the process-global binder pool thread (see
`ARCHITECTURE.md` guarantees). There is **no eventfd to integrate** — `serve`
returns no fds. Peer death is delivered through the `DeathRecipient` callback
(`on_died` runs on a binder pool thread), not through the reactor. The binder
is never registered with `AServiceManager`; it is handed off via direct bind and
lives for the process lifetime.