Expand description
Who is connected now — the roster presence() reads.
docs/10-decisions.md D6: “Presence (who is connected
now) ships v1 as a first-class non-durable Signal — it is both the natural demo of per-session
fanout and its permanent stress test.”
The compiler’s half is a source in the signal graph
([beck_core::signal::Op::Presence]); this is the fact that source reads. It is deliberately
small, and everything interesting about it is a consequence of one sentence: this is the only
input to a view that moves without an event. A session is not in the log either, and it is
fixed for the life of a subscription; the accumulator moves only when the log does.
§What that sentence forbids
Nothing here is appended, snapshotted or replayed. A process that restarts comes back with an
empty roster and fills it as clients reconnect, which is correct rather than lossy: who is
connected to a process that no longer exists is nobody. The checker keeps this from mattering
anywhere it would — presence cannot reach the chokepoint (B0515), so no event’s existence
ever depended on it.
§The bound, and why it is here rather than in a later hardening pass
The obvious implementation is a map from actor to a count, and that map is unbounded memory
keyed by a string the client chooses — which is
docs/82 §82.5’s finding
exactly, one subsystem over. Under crate::identity::DevIdentity the actor is whatever the
connection said it was, so a client opening sockets under fresh names would grow this table
until the process died.
crate::quota answers the same problem by sharding into a fixed table, and that answer is not
available here: a quota needs a number per actor and may share buckets, while a roster needs
the actor’s name and would be nonsense if two names collided. So the bound is a capacity:
past Config::capacity distinct actors, a new one is not recorded and
Registry::refused counts it. Presence then under-reports rather than growing, which is the
failure this direction should have — a page that says “127 here” when 200 are connected is
wrong in a way that costs nothing, and the opposite is a process that dies.
An actor already in the roster is never refused, whatever the capacity: the bound is on how many names are held, not on how many connections one of them may open.