Module mount 

The mount fact: which door admitted a connection.

The hardened face-substrate draft (r2 §5) requires that every append admitted through the in-process transport carry a mount attestation from the admitting door. The record being attested is the consumer’s, and the admitting door for those appends is the consumer’s participant machinery riding on liminal, so liminal’s obligation is to supply the unforgeable fact — not to stamp its own rows (docs/design/IN-PROCESS-TRANSPORT.md §10).

Unforgeable means exactly this: the server stamps a MountKind at spawn, from its own knowledge of which spawn path it is executing. The value is not negotiated, is carried in no frame, is not derived from anything a client sends, and no inbound byte can move it. A client that presents any frame content whatsoever reaches apply_frame with the mount its door already stamped.

Liminal’s own durable op-log rows carry NO mount field. That absence is load-bearing: it is what keeps the design’s discriminating test exact, so that liminal record outcomes stay byte-identical across mounts and the mount fact lives only on the context surface where the consumer’s door reads it. If the consume side ever needs the fact somewhere other than the handler context, that is a declaration-time conversation — never a silent widening.

Enums

MountKind

Which transport door admitted a connection.