Ports

A port is a named participation contract owned by a node. Its identity, protocol, payload and lifetime make a connection meaningful. A matching label alone does not establish compatibility.

Start with sending a message, background export, bounded downloads, live collaboration, stale saves and native frame ownership.

Protocols and independent dimensions

The twenty-four labels mix communication modes with reliability, control, ownership and payload roles. Those dimensions compose: an RPC can carry a capability descriptor; a credit-controlled stream can transfer owned frames; an inspection query can return versioned evidence. A single exclusive enum would lose those combinations or grow into many redundant cases.

A complete port contract

Compatibility requires a versioned protocol and payload schema, direction/role cardinality, error and deadline outcomes, delivery and ordering laws, capacity/overflow, concurrency authority, ownership/memory domain, principal/effect requirements, clock domain and implementation binding where relevant. Optional dimensions must be explicitly inapplicable rather than silently assumed.

The current DTO serializes id, profile, contract and polarity. A profile or contract string is a reference to those laws, not an inline proof of them. The structural validator checks nonempty values and endpoint integrity; it does not compare schemas, verify ABI, enforce a credit budget or authorize effects.

Consolidation without losing guarantees

Keep the seven communication modes distinct. Express P03 as call/event plus durable command identity, staged receipts and replay/idempotency policy; P09 as a call plus atomic revision comparison; P10 as a transaction participation profile. P16–P18 describe ownership independently of the communication mode. P19, P20, P22, P23 and P24 are typed payload/access profiles. Preserve their IDs for references and use their diagrams to state the extra law.

Kotlin structured concurrency supplies useful local lifetime composition, and cooperative cancellation explains why cancellation cannot promise remote rollback. Adapters must explicitly carry equivalent deadlines and lifecycle outcomes across processes and languages.

P01 · Value / immutable snapshot — Calculate a checkout total

Which immutable inputs determine the price?

Domains and use cases: all domains, data, computation.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: Cart, prices and tax policy supply versioned snapshots to a pure quote calculation. The result feeds preview and submission; server revalidation precedes any purchase. Value flow carries data without scheduling effects.

Concrete module/design guide · Definition JSON · revision 9907b42b7e95

Laws and limits:

• Schema, nullability, units and representation matter; value flow alone imposes no effect order.
• An immutable quote can become stale; value transport neither reserves stock nor authorizes payment.

P02 · Request / response — Send a message across client and server

Where are reply, timeout and rejection handled?

Domains and use cases: RPC, web, distributed systems.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: MessagingService binds a typed request/response through an HTTP adapter to a server handler. Server authorization precedes persistence. The caller distinguishes committed, rejected and unknown outcomes; timeout cannot prove no write occurred.

Concrete module/design guide · Definition JSON · revision 3b7e095abbdb

Laws and limits:

• Direction is a role; sync/async, error and timeout outcomes are part of compatibility.
• LOCAL and HTTP share a service contract but differ in serialization, failures and cancellation.

P03 · Durable command / receipt — Submit a background export

When is an export accepted, committed and finished?

Domains and use cases: workflows, messaging, commerce.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The job authority records a command ID durably and returns a stage receipt. A worker produces an artifact and updates job state. Status reads distinguish admission from completion; retrying submission resolves the same command.

Concrete module/design guide · Definition JSON · revision a791f9e31c91

Laws and limits:

• Receipt names the qualified completion stage, not simply receipt of bytes.
• Durable command is a reliability profile over calls/events and receipts, not a magic delivery primitive.

P04 · Push event — Notify views of a profile change

How do independent observers learn about a commit?

Domains and use cases: PubSub, IoT, telemetry.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A revisioned event updates a local header and a server activity projection independently. A missed revision can trigger an authoritative reread. Neither consumer borrows the other consumer's delivery receipt.

Concrete module/design guide · Definition JSON · revision e7ad0e87d2e0

Laws and limits:

• Declare ordering, overflow, replay and delivery guarantee; not implicitly durable.
• Every-occurrence delivery, overflow, replay and durability are independent contract choices.

P05 · Pull iterator / cursor — Page through a large audit log

Who decides when the next batch is read?

Domains and use cases: data, search, analytics.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The reader pulls the next cursor page after rendering or exporting the previous batch. The log supplies a stable cut and expiration; cancellation closes the cursor lease. Demand remains at the consumer.

Concrete module/design guide · Definition JSON · revision 8ccb96c3af89

Laws and limits:

• Cursor lifetime, backpressure, consistency cut and resume behavior are explicit.
• A cursor needs snapshot and expiration laws; it is not an infinitely reusable array index.

P06 · Credit-controlled stream — Download without exhausting memory

How much data may the producer send ahead?

Domains and use cases: media, telemetry, FFI.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A verifier forwards checked chunks to a bounded writer. Finished writes return capacity through a credit controller to the source. Cancellation stops new work and records the partial file explicitly.

Concrete module/design guide · Definition JSON · revision fd7b01e1230a

Laws and limits:

• Demand, buffer bounds, terminal events and cancellation must agree across the boundary.
• Credits, byte budgets and overflow must agree; a stream label does not enforce backpressure.

P07 · Duplex session — Collaborate on a live document

How do edits, acknowledgements and reconnects share a session?

Domains and use cases: games, messaging, collaboration.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A duplex session carries edits and receipts with sequence and resume rules. The document authority linearizes edits, while presence is ephemeral. Reconnect resolves the last accepted cut before replaying pending operation IDs.

Concrete module/design guide · Definition JSON · revision 8a1007d90263

Laws and limits:

• Both endpoints follow the protocol; pin session version and handoff semantics.
• Duplex transport does not choose conflict resolution, consistency or user authority.

P08 · Signal / reactive state — Keep a cart badge current

Why is state different from event history?

Domains and use cases: Compose, mobile, web.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: Header and checkout render the current cart state; analytics receives the separate event sequence. A late state subscriber receives the latest snapshot without replaying every historical mutation.

Concrete module/design guide · Definition JSON · revision 24db7b4d8676

Laws and limits:

• Distinguish latest-value conflation from delivery of every historical change.
• State conflation may discard intermediate values; every-occurrence consumers need an event/log profile.

P09 · Mutation / conditional update — Detect a stale document save

How is a conflicting edit rejected?

Domains and use cases: data, commerce, agents.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A save names its base revision. The authority atomically compares before writing; conflict supplies a three-way merge input for review. Only a new accepted candidate becomes a successful save.

Concrete module/design guide · Definition JSON · revision 6fd493578e5b

Laws and limits:

• The authority checks predicates and authorization; local write locks are not distributed CAS.
• Conditional mutation is a call profile with a linearization law; a version field alone is insufficient.

P10 · Transaction participant — Commit a balanced ledger transfer

Which participants share one authority?

Domains and use cases: data, transactions, ledgers.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The ledger transaction coordinates debit and credit under one database authority and invariant check. A notification follows commit but stays outside its atomic scope.

Concrete module/design guide · Definition JSON · revision 0387fceca5d5

Laws and limits:

• Only qualified participants enlist; a transaction token is not universal ACID.
• Transaction profile names isolation, authority and failure law; external services do not join by diagram membership.

P11 · Execution / continuation — Back up before migrating

What establishes operation precedence?

Domains and use cases: navigation, workflows, composition.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A verified backup receipt enables the migration continuation. Migration readiness then enables the route switch. Artifact data and control completion remain separate contracts.

Concrete module/design guide · Definition JSON · revision 64ba78fabe58

Laws and limits:

• Defines effect order within one execution profile; not a generic network message.
• Control precedence does not itself authorize either operation.

P12 · Branch / guarded transition — Require step-up authentication

Which branch may release a sensitive command?

Domains and use cases: navigation, auth, workflows.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: Policy chooses allow, step-up or deny from principal and action context. Successful step-up returns evidence for policy reevaluation. Only the allowed branch reaches execution.

Concrete module/design guide · Definition JSON · revision 3e2b88f26e39

Laws and limits:

• Exhaustiveness and guard purity are checked; branch choice is separate from data encoding.
• Predicates and precedence must be explicit; authentication evidence is not an authorization grant.

P13 · Completion / join token — Finalize a chunked upload

What does a completion token certify?

Domains and use cases: parallel work, media, workflows.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The finalizer joins receipts for the expected chunk identities, sizes and digests. It then commits a complete manifest. Progress may be partial while the finalization claim requires the entire accepted set.

Concrete module/design guide · Definition JSON · revision 7b55778612ca

Laws and limits:

• Join rule defines required contributors and treatment of failure/cancellation.
• Completion certifies a named stage; three arbitrary tokens do not prove all expected chunks exist.

P14 · Cancellation / deadline — Cancel obsolete search work

What does leaving a screen stop?

Domains and use cases: RPC, media, workflows.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: Route lifetime and deadline cancel local search work and suppress stale rendering. A remote request may already be accepted; its identity and any effect receipt remain inspectable.

Concrete module/design guide · Definition JSON · revision 4ce26cadd074

Laws and limits:

• Cancellation is cooperative unless stated otherwise; reconcile already-committed effects.
• Cancellation is cooperative and target-dependent; it is not distributed rollback.

P15 · Clock / tick / timer — Retry delivery with bounded backoff

What prevents an endless retry loop?

Domains and use cases: games, IoT, Shadow.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: Retry state records next-at time and attempt budget for one command ID. A clock candidate triggers revalidation before sending. Exhaustion produces a failure record instead of unlimited retries.

Concrete module/design guide · Definition JSON · revision d86af91e7a01

Laws and limits:

• Specify event-time versus processing-time semantics; clocks are dependencies for replay.
• Timer delivery does not prove the command is still pending or the authority deadline is due.

P16 · Owned resource transfer — Transfer a camera frame to a native encoder

When may the producer reuse memory?

Domains and use cases: FFI, media, robotics.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The encoder owns a transferred frame until it releases that allocation or transfers ownership onward. The pool makes it available again only after the declared lifetime ends. Ownership composes with call or stream protocols.

Concrete module/design guide · Definition JSON · revision b68e06e8f2e4

Laws and limits:

• Exactly one accepted owner after transfer; reject duplication and invalid module epoch.
• Allocator, deallocator and alias rules must be concrete; JSON ownership labels do not transfer native allocations.

P17 · Borrowed buffer / view — Decode a borrowed message buffer

How can a parser avoid retaining invalid memory?

Domains and use cases: FFI, codecs, local compute.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: Decoder and validator borrow bounded views during an explicit lease. Their copied results outlive the buffer, but retained views require an extended lease. Failure paths release the borrow too.

Concrete module/design guide · Definition JSON · revision 4631fa5b36c5

Laws and limits:

• Cannot escape its declared scope; async and cross-address-space use require a qualified lease/copy.
• Borrowed access retains bounds, alignment and lifetime requirements even when no copy occurs.

P18 · Shared read lease — Share an immutable model between workers

When can the mapped model be unloaded?

Domains and use cases: media, FFI, analytics.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: Workers acquire read leases for one immutable model revision. The lifecycle owner waits for them to drain before unmapping. A replacement revision receives a separate identity instead of mutating active readers' bytes.

Concrete module/design guide · Definition JSON · revision 5c0557b4259f

Laws and limits:

• Reference counting alone does not make concurrent mutation safe; memory rules stay explicit.
• Shared read does not permit mutation and must cover asynchronous/native use.

P19 · Capability descriptor — Resolve a rendering backend

Does this target meet the feature requirement?

Domains and use cases: platforms, AI, composition.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The resolver compares native and browser offers with the required formats and interactions. It returns an explicit selected binding or unavailable outcome. Adapter qualification and activation remain separate.

Concrete module/design guide · Definition JSON · revision 7f3b2c7c17ab

Laws and limits:

• Metadata for selection, not an authorization bearer; no implied access to the capability.
• Capability descriptor is a payload role; discovery grants neither authority nor operational health.

P20 · Authorization request / grant — Grant access to one documentation cut

What may this agent read?

Domains and use cases: RBAC, agents, tenancy.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: Policy evaluates principal, workspace, collection and operation. Retrieval enforces the bounded grant before returning sections. Answer generation receives only that cut; unrestricted backlink expansion would bypass authorization.

Concrete module/design guide · Definition JSON · revision d078123c9994

Laws and limits:

• Bind principal, scope, expiry and issuer; recheck at use and never serialize raw credentials.
• Grant scope and validity carry authority; a selected subgraph is a projection of that decision.

P21 · Lifecycle management — Close a session when its route leaves

Which resources share the feature lifetime?

Domains and use cases: actors, FFI, code push.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The route scope owns a realtime subscription, decoder and file handle. Drain stops new work before release. Host death may skip callbacks, so server leases and durable safety cannot rely only on local cleanup.

Concrete module/design guide · Definition JSON · revision a0508cb0c7f1

Laws and limits:

• Calls may fail or be skipped on host death; required persistence cannot rely on cleanup.
• Lifecycle is a control profile; it does not prove cleanup occurs after process death.

P22 · Checkpoint / migration — Restore state into a candidate actor

How does new code accept old state?

Domains and use cases: code push, data, Shadow.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A fenced checkpoint identifies its schema and cut. A migration transform validates and converts it before candidate restoration. Route admission names the old/new activation epochs; reverse state compatibility remains a separate question.

Concrete module/design guide · Definition JSON · revision 843265d39ab4

Laws and limits:

• Migration is versioned and staged; rollback depends on state compatibility, not old code availability.
• Checkpoint is a state-transfer profile; old code availability does not prove safe rollback.

P23 · Artifact / schema reference — Load a trusted plugin by digest

How does a reference become executable bytes?

Domains and use cases: build, FFI, releases.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: The plugin reference binds digest, ABI and access policy. Fetch verifies bytes and compatibility evidence before host admission. A filename or URL alone cannot identify or qualify a plugin.

Concrete module/design guide · Definition JSON · revision 771bdafc3738

Laws and limits:

• A reference is not a raw pointer; loading verifies integrity, provenance and access.
• References are typed payloads; loading, verification and activation are distinct admitted operations.

P24 · Inspection / evidence — Explain a slow product flow

Which latency segments were observed?

Domains and use cases: visitors, telemetry, debugging.

Diagram legend. Frames are named graph regions. Left/right pins show required/offered participation, not a universal schedule. Filled pins are connected; hollow pins are unbound. A junction card preserves one relation's role slots.

Reaktor mapping: A bounded visitor reads client, RPC-boundary and server evidence. Its finding records missing segments and source links. A captured capsule can seed Shadow replay through separate authority.

Concrete module/design guide · Definition JSON · revision 592ad148c9c7

Laws and limits:

• Carries coverage and provenance; observational access does not confer mutation authority.
• Inspection is a payload/access profile over a query protocol; observation grants no mutation authority.