Struct LiminalConnectionServices 

pub struct LiminalConnectionServices { /* private fields */ }

Default adapter from server wire frames to liminal channel/conversation APIs.

Implementations

impl LiminalConnectionServices

pub fn execute_agent_draft( &self, draft: &ApprovedDraft, ) -> Result<Execution, ServerError>

Executes a pulled agent draft and applies its runtime projection. The durable receipt is kept even when projection fails, so an explicit replay repairs projection without starting or creating anything twice.

Errors

Registry, Lys effect, roster or retained-subject failure.

pub fn agent_created(&self, name: &str) -> Result<(), ServerError>

Makes an approved station’s ordinary inbox available and seeds metadata. The draft executor calls this after its durable receipt; it grants nothing.

Errors

Missing configuration, unknown agent, roster bound, or metadata failure.

pub fn agent_topology_payload<'a>( &self, subject: &str, payload: &'a [u8], ) -> Result<Cow<'a, [u8]>, ConsoleError>

Keeps agent station metadata in the topology published by the ordinary hub.

Errors

A topology or registry record cannot be encoded.

impl LiminalConnectionServices

pub fn install_construction( &self, lifecycle: Arc<Lifecycle>, lys: &LysConfig, http: Arc<dyn LysHttp>, drafts: Arc<dyn SiteDraftHolder>, ) -> Result<(), SiteError>

Installs the lifecycle projection once, using the same channel scheduler and the configured agent watcher budgets. No second scheduler is built.

Errors

Missing construction bounds, machine pass, agent registry or issuer.

pub fn serve_site_tool( &self, session: Option<&dyn LysSession>, subject: &str, bytes: &[u8], at_ms: u64, ) -> Result<Value, SiteError>

Executes the ticket route using exactly the connection’s admitted session.

Errors

Unknown route, invalid boundary, grant refusal or target-store failure.

impl LiminalConnectionServices

pub fn finish_claims_resolve(&self) -> Result<(), ServerError>

Resolves the in-flight claims on the caller’s thread, or waits for the resolve already running behind the listening door, and answers its result. The store-count journeys call it beside Self::finish_participant_warm so their windows hold the whole start (a created store’s empty index start, DUR-023, is one compare-and-set) and never race that thread; the server itself never waits for it.

Errors

Returns the resolve’s error when the claims cannot be listed.

impl LiminalConnectionServices

pub fn from_config(config: &ServerConfig) -> Result<Self, ServerError>

Builds library-backed services from validated server configuration.

Durable-mode channels are backed by a shared haematite event store so their publishes are persisted and survive the graceful-shutdown flush; ephemeral channels carry no store.

Full-only: a config selecting the worker-front-door profile is rejected at entry (before any store is built), so this constructor can never build full services for a profile that forbids them. Profile-aware callers go through build_connection_services instead.

Errors

Returns ServerError when the config selects a non-full profile or a configured channel cannot be initialized.

pub fn from_config_with_store( config: &ServerConfig, durable_store: Arc<dyn DurableStore>, ) -> Result<Self, ServerError>

Builds services over a caller-provided durable store.

Used by tests that need to inspect persisted state through the same store handle the durable channels write to.

Full-only: rejects a worker-front-door profile at entry, exactly like Self::from_config.

Errors

Returns ServerError when the config selects a non-full profile or a configured channel cannot be initialized.

pub const fn ephemeral_sweep_counts(&self) -> Option<EphemeralSweepCounts>

The retained counts from the root’s one startup sweep.

pub const fn channel_cluster(&self) -> &ChannelCluster

The shared channel supervisor + cluster resolver backing this service.

The server runtime uses this to attach the cluster to the channel supervisor’s clustered scheduler (SRV-005).

pub fn durable_store(&self) -> Arc<dyn DurableStore>

Returns the shared durable store backing this service’s durable channels.

pub fn console(&self) -> &ConsoleHub

The console’s held topology and tap (SRV-012).

pub fn responder_subjects(&self) -> Result<Vec<String>, ServerError>

Conversation subjects with a registered responder, sorted. Read from the in-memory registry; touches no store.

Errors

Returns ServerError when the responder registry lock is poisoned.

pub fn finish_participant_warm(&self) -> Result<usize, ServerError>

Restores every participant conversation the warm has not yet reached, on the caller’s thread, and answers how many refused (DUR-020 R4). The store-count journeys call it so their windows do not race the warm thread; the server itself never waits for the warm.

Errors

Returns ServerError when the pending-restore lock is poisoned.

pub fn store_counts(&self) -> StoreCountsHandle

Reads the store work these services have done since they were built, across every store they built.

Empty (every snapshot zero) when the durable store was supplied by the caller and does not count.

pub fn unloadable_conversation_record( &self, ) -> Option<UnloadableConversationRecord>

The production participant handler’s refused-load record, when a participant is configured.

The server’s startup path publishes this onto the health endpoint so GET /unloadable-conversations answers from the same record the handler writes. None means no participant is configured at all, which the surface reports as a distinct state from “nothing was refused”.

pub fn credential_reissuer(&self) -> Option<Arc<dyn OperatorCredentialReissuer>>

The A7 operator credential-re-issue authority, when a participant is configured (§0.18).

The startup path publishes this onto the health endpoint so POST /operator/credential-reissue reaches the SAME serialized participant-state point every wire operation does. None means no participant is configured, which the route reports as a distinct state from an unknown identity.

pub fn conversation_supervisor(&self) -> Arc<ConversationSupervisor>

Returns the conversation supervisor backing supervised conversations.

Tests use this to reach the underlying beamr scheduler so they can spawn or terminate participant processes and exercise crash detection.

pub fn register_responder( &self, subject: impl Into<String>, behaviour: Arc<dyn ParticipantBehaviour>, ) -> Result<Option<Arc<dyn ParticipantBehaviour>>, ServerError>

Registers a conversation responder for a routing subject.

A later conversation on this exact subject runs the registered behaviour as a supervised linked participant. A registration replaces the previous behaviour and returns it to the caller.

Errors

Returns ServerError when the responder registry lock is poisoned.

pub fn unregister_responder( &self, subject: &str, ) -> Result<Option<Arc<dyn ParticipantBehaviour>>, ServerError>

Removes the custom responder registered for subject, if any.

After removal local calls on the subject are refused with no_server. Returns the removed behaviour when one was registered.

Errors

Returns ServerError when the responder registry lock is poisoned.

impl LiminalConnectionServices

The runtime channel-registration surface.

Reachability: a test seam today, not a production capability

Production channels come exclusively from boot configuration; no production code path calls register_channel (caller census at c381f01, G2 in docs/design/wire-durability-gaps-20260831.md — the only callers are services_registry_tests.rs and apply_admission_tests.rs). The method is kept because its semantics — cap gating, typed identity refusals, idempotent re-registration — are the contract a future runtime admission path must satisfy, and the tests below pin that contract now. Wiring an actual runtime admission route (an operator endpoint, a wire frame) is a product decision that has NOT been taken; nothing here implies it. Reading this method as an existing operator capability is the false-affordance mistake this paragraph exists to prevent.

Inherent methods, not trait methods, and deliberately so: this is authority-moving vocabulary that belongs to the ONE adapter owning a channel roster. Putting register/quiesce on the public ConnectionServices trait would break every external implementor and would hand register/quiesce words to a profile that serves no channels at all.

The same seam as the existing runtime-mutation API on this type (register_responder/unregister_responder): &self, interior mutability, typed Result.

pub fn register_channel( &self, spec: &ChannelRegistration, ) -> Result<Registered, ChannelRegistryError>

Registers spec on the live roster.

Test seam today: see the reachability note on this impl block — no production path reaches this method.

Idempotent when an entry of that name already has an IDENTICAL configuration — mode, protocol schema id, and schema document, all three — and refuses typed, naming the first differing field, otherwise. An identical registration against a boot-configured entry answers Registered::AlreadyIdentical and leaves its origin alone: flipping it would make the entry lie about its restart fate and would move it into the counted population without a channel having been created.

The cap is consulted first, in two steps with different reach. An absent limits.max_channels refuses EVERY call, identical or not, before the roster is read at all: a deployment that has declared no bound has not said what it admits, and unbounded-by-default is not a bound. A REACHED cap refuses only a call that would create an entry — it gates the insert, which is the population it bounds. An identical re-registration inserts nothing and so is answered AlreadyIdentical even at a full roster; refusing it would break idempotency at exactly the boundary a projector re-projecting its record crosses.

Errors

Returns ChannelRegistryError when no cap is configured, the cap is reached, the name exists with a different configuration, the schema bytes do not parse or compile, durable initialization over the shared store fails, or the roster lock is poisoned.

pub fn quiesce_channel( &self, name: &str, reason: impl Into<String>, ) -> Result<(), ChannelRegistryError>

Moves name from active to quiesced with a named reason. ONE-WAY.

New publishes and new subscribes are refused afterwards, carrying the reason. Existing subscriptions are UNTOUCHED: nothing revokes a subscription handle, the actor’s subscriber list is not walked, no EXIT is sent, and the channel actor keeps running. Quiesce is a roster-level admission decision, not an actor command.

Re-quiescing under the IDENTICAL reason is Ok(()); a DIFFERENT reason refuses, carrying the reason already on record.

The return does NOT mean “no new subscriber can appear”. A subscribe that has already passed admission completes and gets its stream — the linearisation point is the admission read, not the subscribe’s completion. A consumer that needs “nobody is attached” must observe attachment directly.

Errors

Returns ChannelRegistryError when the name is not registered, is already quiesced under a different reason, or the roster lock is poisoned.

pub fn channel_status( &self, name: &str, ) -> Result<ChannelStatus, ChannelRegistryError>

Cheap typed probe: one roster read plus one atomic load.

Touches no actor and therefore CANNOT spawn one. Every handle accessor that could answer a question about a channel’s activity routes through the lazy-spawn path, so a probe built on one would materialise the actor of the idle channel it was asked about — turning a read into a side effect. This reads the roster entry’s own recorded fields and nothing else.

Errors

Returns ChannelRegistryError::RosterUnavailable only.

pub fn channel_census( &self, ) -> Result<Vec<(String, ChannelStatus)>, ChannelRegistryError>

Every roster entry with its status, sorted by name, from ONE roster read (SRV-012 R7: the console’s topology snapshot).

Errors

Returns ChannelRegistryError::RosterUnavailable when the roster lock is poisoned.

pub fn registered_channels( &self, ) -> Result<Vec<ChannelDescriptor>, ChannelRegistryError>

The whole roster: one minimal descriptor per entry, sorted by name.

The census companion to Self::channel_status. A by-name probe answers about a name the caller already suspects; only an enumeration can reveal a name the caller does not know to ask about, and a verification sweep with no population denominator is an instrument shape this estate forbids. Touches no actor, under the same constraint as the probe.

Errors

Returns ChannelRegistryError::RosterUnavailable only.

impl LiminalConnectionServices

pub fn publish_embedded( &self, host: &str, channel: &str, envelope: &MessageEnvelope, idempotency_key: Option<&str>, ) -> Result<PublishOutcome, ServerError>

Publishes on an ordinary channel for an application embedding the server.

The live and durable publisher identity is liminal.. Reserved self streams and console channels retain the same refusal as connection publishes. An idempotency key has the same delivery semantics as a connection publish.

Errors

Returns a configuration error for an empty or whitespace-only host name, a namespace refusal for a reserved channel, or the existing admission, durability, and publication error.

Trait Implementations

impl AgentProjection for LiminalConnectionServices

fn apply(&self, draft: &ApprovedDraft) -> Result<(), DraftError>

Applies the native roster and state projection after durable execution.

impl ConnectionServices for LiminalConnectionServices

fn admit_channel( &self, operation: ChannelOperation, channel: &str, ) -> Result<(), ChannelAccessError>

The roster’s admission decision, exposed across the trait boundary as the permission alone.

Two methods share the name admit_channel on this type: this trait method, and the private inherent funnel it delegates to. They are the same decision at two different boundaries — the funnel returns the ENTRY the decision was made on, because its in-crate callers go on to publish or subscribe through it, and this one returns (), because a caller outside the crate is asking whether it MAY, not for the thing itself. Handing the entry out here would make [ConfiguredChannel] public surface and hand a frame-level caller a channel handle it has no business holding. Rust resolves an inherent method ahead of a trait method of the same name, so the funnel’s existing callers — and the Self:: call below — reach the funnel, not this method; the trait form is reached only through a dyn ConnectionServices, which is exactly the caller it exists for. an_admitted_operation_the_service_then_refuses_stays_undifferentiated is the instrument that would catch this delegation turning into a recursion.

operation is where the answers part: absence and quiesce refuse publishes and subscribes alike, but the console namespace refuses only a connection’s publish (a console reads console.* as an ordinary subscriber, and only the server may write there), and a tap target refuses only a subscribe. Both are checked before the roster, so a client is told the same thing whether or not the subject is registered yet.

fn construction_request( &self, session: Option<&dyn LysSession>, subject: &str, bytes: &[u8], at_ms: u64, ) -> Option<Result<Value, ServerError>>

Construction built-ins are dispatched before ordinary worker routing.

fn prepare_site_trial( &self, connection: u64, session: Option<&dyn LysSession>, registration: &WorkerRegistration, process: Option<&ProcessGrant>, at_ms: u64, ) -> Result<Option<TrialPermit>, ServerError>

Reserves the completion barrier before storing a trial registration.

fn admit_site_call( &self, session: Option<&dyn LysSession>, subject: &str, at_ms: u64, ) -> Result<bool, ServerError>

Checks a Building subject before routing and before releasing a reply.

fn site_registration_closed(&self, connection: u64) -> Result<(), ServerError>

Removes trial barriers when the directory removes a connection.

fn publish_identified( &self, connection: u64, session: Option<&dyn LysSession>, channel: &str, envelope: &MessageEnvelope, key: Option<&str>, ) -> Result<PublishOutcome, ServerError>

Publishes with the identity proved at Connect; it adds no authority.

fn agents(&self) -> Option<&Arc<Agents>>

Agent station state, when configured.

fn subscribe_identified( &self, connection: u64, session: Option<&dyn LysSession>, channel: &str, schemas: &[ProtocolSchemaId], install: Option<InboxInstall>, ) -> Result<ConnectionSubscription, ServerError>

Subscribes using the identity proved at Connect; it adds no authority.

fn participant_service(&self) -> Option<InstalledParticipantService>

Returns the complete participant service installed on this adapter.

fn publish( &self, connection: u64, channel: &str, envelope: &MessageEnvelope, idempotency_key: Option<&str>, ) -> Result<PublishOutcome, ServerError>

Delegates a publish request to the liminal library.

fn subscribe( &self, channel: &str, accepted_schemas: &[ProtocolSchemaId], install: Option<InboxInstall>, ) -> Result<ConnectionSubscription, ServerError>

Delegates a subscribe request to the liminal library.

fn unsubscribe( &self, subscription: ConnectionSubscription, ) -> Result<(), ServerError>

Delegates unsubscribe to the liminal library.

fn open_conversation( &self, conversation_id: u64, subject: &str, ) -> Result<ConnectionConversation, ServerError>

Delegates conversation open to the liminal library.

fn conversation_message( &self, conversation: &ConnectionConversation, envelope: &MessageEnvelope, op_id: Option<u64>, ) -> Result<(), ServerError>

Delegates a conversation message to the liminal library.

fn close_conversation( &self, conversation: ConnectionConversation, ) -> Result<(), ServerError>

Delegates conversation close to the liminal library.

fn listening(self: Arc<Self>) -> Option<JoinHandle<()>>

The listener is bound: whatever the start reads that no admission needs before it is judged runs from here, behind the listening door. An adapter with nothing to read does nothing. Answers the thread it started, which the listener leaves to run and a test may join.

fn stop_participant_warm(&self)

Stops the participant warm and records the clean stop’s capacity snapshot (DUR-020 R3, R5). Called once, by the shutdown sequence, before the final flush; an adapter with no participant does nothing.

fn finish_background_store_work(&self) -> Result<(), ServerError>

Joins background work that can still write to the store.

fn release_store_holders(&self) -> Result<(), ServerError>

Stops store-owning service workers after the final flush.

fn flush_durable_state(&self) -> Result<(), ServerError>

Flushes the shared durable store after channel publications have settled.

fn supports_channel_operations(&self) -> bool

Whether this adapter backs ordinary channel and conversation operations.

impl Debug for LiminalConnectionServices

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ServerPublisher for LiminalConnectionServices

fn publish_console( &self, subject: &str, payload: &[u8], ) -> Result<(), ConsoleError>

The server’s own record on the one publish path, with a server origin: attributed to liminal.<device>, and never counted as a connection’s work by the cost tick.

fn retire_console_channel(&self, subject: &str) -> Result<(), ConsoleError>

Takes a console.tap.<target> channel off the roster (SRV-012 R6). Only a console subject is ever removed here.