The ops module's state substrate under feature `ops`, no op handlers
yet (they land with ops-json-ops/ops-fetch/ops-put):
- `OpsContext` — the context type the handler pairs capture: the
`Arc<Store>`, the module config, the token registry, the per-
namespace converter bindings, the fanout registry (re-exported
from lib.rs)
- The pin-token layer (ADR-010 §4 / ADR-012 §2): CSPRNG `PinToken`
(32 bytes, `getrandom 0.4` — the decided minting form; counter and
derivable forms rejected as guessable capabilities), the
token↔(key, owner) mapping with process lifetime (retirement at
conversion-confirmed or process end; no expiry machinery), the
validity domain = the minting node (peers refuse unknown tokens
with present: false, never an error)
- The guard-custody split: `mint_fleet` (mapping only; the put
handler's guard drops at response completion — its own act; the
fleet-declaration and owner-instance checks ride the mint) vs
`mint_custodial` (the registry holds the guard; nothing expires;
refused under a fleet declaration)
- The namespace→liveness-source binding: per-namespace `PinConverter`
registration; the conversion trigger decided as the embedder-called
confirm verb (probe-triggered conversion rejected: a read-gated op
never mutates protection), riding `RegistryCore::convert`'s
ordered step under the arbitration lock
- The crate-internal store-core renewal access:
`Store::ops_pin_renew`/`Store::ops_pin_check` (pub(crate), cfg all
(ops, postgres)) routed through the fleet host — the W6-3 named
consumer; the probe composition decided as
verify-the-mapping-then-renew; no public-API widening, no backend
side-door
- The fanout registry (POC #3 finding A3): per-digest broadcasts,
bounded subscriber channels, the late-joiner degrade signal
(subscribe → None, channel end → verified get), and the
Stall/Drop slow-subscriber policies
- Dependency posture: serde/serde_json/getrandom enter as ops-gated
optional deps; the default build's dependency tree verified
unchanged; gc.rs's allow-scope notes updated to the landed state
Verification: cargo test (default 73/19/3, module compiled out),
cargo test --features ops (84/19/3, 11 new ops unit tests),
cargo test --all-features (237/125/4); clippy --all-targets
-D warnings across the default/ops/all-features/pg-pure variants;
cargo fmt; cargo doc --no-deps zero warnings on the default and
gated-ops builds (the all-features count at the pre-existing
baseline).
glm-5.3-flash
6feaa2ac72