glm-5.3-flash
6feaa2ac72
The ops module's state substrate under feature `ops`, no op handlers yet (they land with ops-json-ops/ops-fetch/ops-put): - `OpsContext` — the context type the handler pairs capture: the `Arc<Store>`, the module config, the token registry, the per- namespace converter bindings, the fanout registry (re-exported from lib.rs) - The pin-token layer (ADR-010 §4 / ADR-012 §2): CSPRNG `PinToken` (32 bytes, `getrandom 0.4` — the decided minting form; counter and derivable forms rejected as guessable capabilities), the token↔(key, owner) mapping with process lifetime (retirement at conversion-confirmed or process end; no expiry machinery), the validity domain = the minting node (peers refuse unknown tokens with present: false, never an error) - The guard-custody split: `mint_fleet` (mapping only; the put handler's guard drops at response completion — its own act; the fleet-declaration and owner-instance checks ride the mint) vs `mint_custodial` (the registry holds the guard; nothing expires; refused under a fleet declaration) - The namespace→liveness-source binding: per-namespace `PinConverter` registration; the conversion trigger decided as the embedder-called confirm verb (probe-triggered conversion rejected: a read-gated op never mutates protection), riding `RegistryCore::convert`'s ordered step under the arbitration lock - The crate-internal store-core renewal access: `Store::ops_pin_renew`/`Store::ops_pin_check` (pub(crate), cfg all (ops, postgres)) routed through the fleet host — the W6-3 named consumer; the probe composition decided as verify-the-mapping-then-renew; no public-API widening, no backend side-door - The fanout registry (POC #3 finding A3): per-digest broadcasts, bounded subscriber channels, the late-joiner degrade signal (subscribe → None, channel end → verified get), and the Stall/Drop slow-subscriber policies - Dependency posture: serde/serde_json/getrandom enter as ops-gated optional deps; the default build's dependency tree verified unchanged; gc.rs's allow-scope notes updated to the landed state Verification: cargo test (default 73/19/3, module compiled out), cargo test --features ops (84/19/3, 11 new ops unit tests), cargo test --all-features (237/125/4); clippy --all-targets -D warnings across the default/ops/all-features/pg-pure variants; cargo fmt; cargo doc --no-deps zero warnings on the default and gated-ops builds (the all-features count at the pre-existing baseline).