Module ring_contract 

RingContract - the declared operation envelope for a ring.

A RingContract is the USER OVERRIDE on the otherwise fully automatic ring: peer-count ceilings, an ordering contract, and a capacity bound, declared as one validated artifact every attaching party agrees on. An AdaptiveRing WITHOUT a declared contract is unbounded - peers grow the ring on demand and registration never fails; declaring a contract is the only thing that makes TooManyProducers / TooManyConsumers possible.

(Lineage: path expressions - Campbell & Habermann, 1974 - declare the legal operation histories of a shared type, with enforcement derived rather than hand-written. This module is the counter-compilable fragment of that idea, expressed entirely as data the rings already track.)

Two jobs:

1. One validated pin. The peer ceilings (from_counts) and the ordering / capacity constraints live in a single declared artifact instead of scattered flags.
2. Give the adaptive policy a feasible-region filter. A policy proposes a candidate (shape, capacity); permits_config rejects any move that would violate the declared envelope, so an aggressive auto-morph cannot break the contract by construction.

Enforcement cost on the hot path is zero - the contract is consulted only at attach time and at policy-tick time. The ordering-contract-to-shape rule is where it earns its keep: the sharded Mpmc shape (per-producer lanes) delivers only per-producer FIFO, so it is illegal under a Fifo (global-total-order) contract - which is exactly the GlobalFifo -> Vyukov rule the QoS shape policy also applies, derived here from the declared contract.

Structs

RingContract

Declared operation envelope for a ring. The two count bounds use 0 to mean “unbounded”.

Enums

OrderingContract

The ordering envelope a ring’s consumers may observe.