Struct ParticipantConfig 

pub struct ParticipantConfig {

    pub wire_frame_limit: u64,
    pub attach_receipt_ttl_ms: u64,
    pub receipt_provenance_ttl_ms: u64,
    pub live_receipt_server_report_threshold: u64,
    pub max_live_attach_receipts_per_participant: u64,
    pub receipt_provenance_server_report_threshold: u64,
    pub receipt_provenance_per_conversation_report_threshold: u64,
    pub max_receipt_provenance_per_participant: u64,
    pub max_retired_identity_slots_server: u64,
    pub identity_slots: u64,
    pub observer_recovery_max_entries: u64,
    pub max_semantic_conversations_per_connection: u64,
    pub max_ordinary_record_entries: u64,
    pub max_ordinary_record_bytes: u64,
    pub max_generated_marker_entries: u64,
    pub max_generated_marker_bytes: u64,
    pub mandatory_transaction_bound_entries: u64,
    pub mandatory_transaction_bound_bytes: u64,
    pub full_recovery_claim_entries: u64,
    pub full_recovery_claim_bytes: u64,
    pub retained_capacity_entries: u64,
    pub retained_capacity_bytes: u64,
    pub max_retained_record_rows: u64,
    pub closure_episode_churn_limit: u64,
}

Participant lifecycle configuration ([participant]).

Present iff the deployment activates the participant protocol. Every field is required — serde carries no defaults here, so a missing field fails config loading with a typed error naming the field, and ParticipantConfig::collect_errors rejects semantically impossible values during the same accumulated validation pass as the rest of the config. All values are deployment-owner decisions (no assumed defaults).

Every field here is consumed by the live production handler. Frontier and retention limits are required inputs; there are no deployment defaults.

Fields

wire_frame_limit: u64

Complete participant wire-frame limit (WF) negotiated with every participant-capable connection. Must be at least the protocol’s minimum complete frame; enforced by the shared codec at service construction and pre-checked during config validation.

attach_receipt_ttl_ms: u64

Secret-bearing attach/enrollment receipt lifetime in milliseconds.

receipt_provenance_ttl_ms: u64

Non-secret receipt-provenance lifetime in milliseconds. Must be at least attach_receipt_ttl_ms (provenance explains the receipt and cannot expire first).

live_receipt_server_report_threshold: u64

Reporting threshold for server-wide live secret-bearing receipts (stage-8 shared scope LiveReceiptServer).

Lane p0-39: this scope is NOT an admission gate. It is where an honest third party would meet a number someone else’s churn consumed, and no configured refusal is tolerable there — retention is bounded by attach_receipt_ttl_ms alone. This number is a TRIPWIRE: when in-window occupancy reaches it, the server counts the observation and warns on the rising edge. Nothing is ever refused because of it. Setting it higher than the deployment’s plausible steady state is the point; a churn storm is what it is meant to disclose.

max_live_attach_receipts_per_participant: u64

Per-participant WINDOW SIZE for live secret-bearing receipts (stage-8 scope LiveReceiptParticipant).

Lane p0-39: this is a bound on retention, not a refusal threshold. At a full window the participant’s own oldest live receipt is displaced and the new one lands, so a rotation can never be refused by the very receipt it is about to end. Occupancy never exceeds this value.

receipt_provenance_server_report_threshold: u64

Reporting threshold for server-wide retained non-secret provenance fingerprints (stage-8 shared scope ProvenanceServer).

Lane p0-39: a tripwire, never a gate — see Self::live_receipt_server_report_threshold. Retention here is bounded by receipt_provenance_ttl_ms alone.

Board #37 (ruling 2026-08-12): a fingerprint occupies from the moment the client proves it possesses the secret its receipt minted through that receipt’s own provenance deadline — not from the minting commit. A receipt whose delivery was never observed classifies through its window but is never counted here, so an enrol-and-crash cycle leaves no provenance residue behind it.

receipt_provenance_per_conversation_report_threshold: u64

Reporting threshold for per-conversation provenance fingerprints (stage-8 shared scope ProvenanceConversation). A tripwire, never a gate: one participant’s churn must not refuse the next participant of the same conversation.

max_receipt_provenance_per_participant: u64

Per-participant WINDOW SIZE for provenance fingerprints (stage-8 scope ProvenanceParticipant).

Lane p0-39: the participant’s retained fingerprints — one per committed rotation, plus its proven enrollment fingerprint — are held to this many, oldest displaced first. Per-participant pressure is self-inflicted, so the number bounds memory without refusing: the (N+1)th honest fingerprint always lands, including on cold replay from durable state. Occupancy never exceeds this value.

max_retired_identity_slots_server: u64

Server-wide identity-slot limit (the contract’s max_retired_identity_slots server scope): the total number of participant identities — live or retired — mintable across ALL conversations. Enrollment refuses with server-scope IdentityCapacityExceeded (tested BEFORE the conversation scope) when every slot is reserved.

identity_slots: u64

Per-CONVERSATION identity limit I (the contract’s half-open 0..=I bound on permanent participant ordinals — the conversation scope of max_retired_identity_slots, NOT a per-participant reservation). Enrollment assigns monotone participant indices in 0..I within one conversation and refuses with conversation-scope IdentityCapacityExceeded when occupancy reaches this value; slots and ids are never reused. The server-wide companion is Self::max_retired_identity_slots_server.

observer_recovery_max_entries: u64

Maximum entries one observer-recovery handshake batch may name.

max_semantic_conversations_per_connection: u64

Semantic conversations one connection may track — the protocol’s signed connection-conversation limit. Consumed on BOTH of its contract paths: the stage-6 capacity gate every conversation-scoped semantic operation runs (register row 5641) and the observer-recovery batch preflight (register row 5642), over one shared per-connection dispatch map.

max_ordinary_record_entries: u64

Maximum canonical entries in one ordinary retained-record row.

max_ordinary_record_bytes: u64

Maximum canonical bytes in one ordinary retained-record row.

max_generated_marker_entries: u64

Maximum canonical entries in one generated marker row.

max_generated_marker_bytes: u64

Maximum canonical bytes in one generated marker row.

mandatory_transaction_bound_entries: u64

Entry component of the mandatory transaction envelope Q.

mandatory_transaction_bound_bytes: u64

Byte component of the mandatory transaction envelope Q.

full_recovery_claim_entries: u64

Entry component of the full recovery claim K.

full_recovery_claim_bytes: u64

Byte component of the full recovery claim K.

retained_capacity_entries: u64

Total retained durable entry capacity per conversation.

retained_capacity_bytes: u64

Total retained canonical-byte capacity per conversation.

max_retained_record_rows: u64

Maximum retained causal-record rows restored for one conversation.

closure_episode_churn_limit: u64

Maximum closure churn cycles in one episode.

Trait Implementations

impl Clone for ParticipantConfig

fn clone(&self) -> ParticipantConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ParticipantConfig

impl Debug for ParticipantConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ParticipantConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.