Module declared_shape 

phase-457 W5 (issue 1522) — which registration entry point a DECLARED subscription reaches, as ONE value.

The hole this fills

W3 made [[endpoint]] registration_path’s third row an OBSERVATION: SubscriptionRequest::in_place_capable is stated at each of the executor’s eleven subscription entry points, read at Executor::open_subscription, and reported from there through registration_observer. A row nobody observed REFUSES, and every consumer then budgets the receive region — the safe direction.

The Rust producer observes nothing. nros::record_node_metadata::<C> runs a component’s register() against a recording NodeContext and opens no executor at all, so no registration happens in the probe and every Rust endpoint’s row refuses. That is issue 1522.

Why a classifier is allowed here, when W3 deleted one

W3 deleted an inference: the sizing descriptor composed the in-place row from the entry’s LANGUAGE, which is wrong for nine of the eleven entry points. That was a SECOND OPINION — a table in the CLI about code it cannot see.

The declarative road is not that shape. Its registrar is ONE function — nros::node_runtime’s EntityKind::Subscription arm — and it lowers every declared subscription to exactly one of two entry points. So the shape a declared endpoint takes is a FUNCTION OF THE DECLARATION, computed in one place, and this enum is that function’s codomain.

It stays one opinion only because of the two rules below, both gated by check-declared-subscription-shape:

1. The registrar branches on it. The subscription arm does not test the declaration’s safety flag itself; it asks for a DeclaredSubscriptionShape and dispatches on the answer. A variant it does not name is a gate failure, not a silent fall-through.

2. The entry point takes its value from here. Each entry point’s SubscriptionRequest::in_place_capable is spelled DeclaredSubscriptionShape::<V>.in_place_capable(), so there is exactly one bool per shape in the tree, and the entry point and the probe move together when it changes — which is what makes this cheaper than teaching the probe to register.

   Moving together is necessary, not sufficient. Issue 1340 flipped BufferedRaw to true, and this doc used to call that “a one-line change here”. It was not, and the one-line version is UNSAFE: the probe would state in_place, the build would price the row at no receive region, and the executor — which then ignored SubscriptionOpen::in_place on this path — would still build a buffered entry and claim the full region. That is the under-size direction, BufferTooSmall at boot. The flip is safe only because register_subscription_buffered_raw_on now BRANCHES on the report; a true here is a promise that the entry point acts on it. a_generic_subscription_on_an_in_place_backend_claims_no_ receive_region fails first on a flip without the branch.

Enums

DeclaredSubscriptionShape

Which of the executor’s registration entry points a DECLARED subscription lowers to.