Public surface inventory

This inventory supports A13. #[doc(hidden)] changes Rustdoc display, not Rust visibility. The counts below are annotation sites in source, so a grouped re-export and its original declaration each count once. The current branch has 10 sites in crates/behavior/src and 22 in crates/actors/src; the earlier audit counted 25 and 89 before the documentation visibility review.

Hidden core declarations

ChildOccurrence::Resolution and DeclaredChildOccurrence are now visible because manually authored roles must name them. BirthProtocolProduct is visible because generic logical-host owners constrain and append that public product. Rustdoc lists both names and the caller suites exercise them. The private Recipient::new no longer carries an ineffective documentation marker. CreationSettlement, CreationSettlements, and CreationsSettled are now visible because external callers name them when retaining or returning exact child-creation custody. InterpretCreations is also visible: the real Bombay runtime names it in the bound for its action interpreter. This is a source witness for required port visibility, not yet an A17 integration verdict. CreateChild::into_parts is visible because external creation-interpreter tests and the inspected Bombay child host consume it to retain exact owned creation parts across acceptance or rejection. The method did not gain a new capability; its Rustdoc now describes the existing custody transfer. CreationCorrelation<P, Occurrence> is visible because external ActionItem implementations name it as an exact, non-authoritative creation prerequisite. Its occurrence parameter and private fields keep equal numeric IDs at different child positions distinct. CreationId::get is also visible because the actor catalogue derives shutdown and operation correlations from it, and external interpreter tests inspect those exact values. Its Rustdoc now states that the numeric projection is neither actor identity nor proof of a committed fresh child.

Hidden actor declarations

This table classifies ownership but does not by itself justify retaining each public spelling. In particular, an associated type that mentions one of these values is not proof that applications must name it. Closing A13 still requires caller-facing compile witnesses, a trait-implementor inventory, and a repeatable compile-cost comparison before changing visibility or bounds. The branch-level cold comparison below measures aggregate compiler impact; it does not replace a focused before/after comparison for a future individual bound.

AssignWorker::target and CustomerDelivery are now visible runtime ports. The interpreter obtains a clone of the exact recipient capability through target, then consumes settle to transfer the delivery while the request retains its receipt. A rejected keyed outcome retains the original customer route in the complete CustomerDelivery action. The former public receipt and into_parts assembly methods remain atomic-module-only.

ProxyDrain and WorkerStartResult are visible domain outcome sums because external supervisor and proxy callers match their concrete alternatives. ProxyOperation::creation is visible for trusted interpreters selecting the exact proxy; its numeric value remains creator-local correlation, not actor identity or installation evidence. ProxyEffects and ProxyEvent remain hidden structural products reachable through typed behavior projections and event ingress; their documentation status grants no extra authority.

WorkerRecovery and WorkerAttempt are visible opaque custody and correlation values. WorkerRecovery::into_retirement consumes the failed worker and untouched initialization actions together. WorkerAttempt::creation reveals only the creator-local correlation; both constructors and their fields remain private. The HostedInitialization alias still has no public crate-root spelling, so its external naming need remains open for the real host witness.

ObserveCreation<P, Occurrence> is now visible as the typed same-action creation-observation request. Its prerequisite remains exact CreationCorrelation<P, Occurrence>, and its creator-local numeric ID does not establish a child or substitute for the protocol and occurrence types.

The complete worker initialization and activation port is visible: the existing InitializeWorker, WorkerInitializationOutcome, WorkerInitializationReport, InitializationAttempt, ActivationPermit, BeginActivation, WorkerActivation, ActivationStartRejection, and WorkerInitializationFailure types and their already-public methods now have Rustdoc pages. The permit remains non-forgeable, and the host must admit Started before polling the activation plan. Exposing these pages adds no constructor, field, interpreter effect, or transition.

The P2 assignment custody witness narrowed two formerly public methods after external caller tests proved the consuming settle operation. Compile-fail fixtures reject receipt extraction and splitting the request with E0624, while a second settlement fails with E0382. The corresponding real FIFO and keyed caller suites, benchmark, and fuzz campaigns use actual exact-delivery admission. This closes those two spellings only; proxy assembly remains open.

The P2 proxy owner settlement also made the previously doc-hidden ProxyOperationId export unnecessary. External interpreters now receive the complete control through ProxyControlAdmission and return the exact actor or control; only the owner retains the ID. A dedicated external fixture rejects the ID name with E0603, while the receipt-constructor fixture independently rejects new with E0599. The ID remains available to private supervisor state and receipt settlement through a crate-private re-export.

The exact assignment and proxy interpreter products are now visible in the atomic Rustdoc index: AssignWorker, AssignmentReceipt, ProxyControl, ProxyOperation, ProxyInputReceipt, and ProxyInputResult. These were already public Rust names required by external InterpretItem and ProxyControlAdmission implementations. Their fields and owner-only receipt constructors remain private; hiding the item pages served no capability boundary. Six actor annotation sites were removed, leaving 75.

The worker-preparation interpreter path is also visible: PrepareWorkers, PendingWorkerPreparation, WorkerPreparation, and both request phases' source_and_role, accept, and reject methods. External fixed/FIFO tests and Bombay's inspected source already name this progression. The ticket, constructors, fields, and owner settlement remain private. Nine more actor annotation sites were removed, leaving 66.

DiagnosticRoute, DiagnosticAction, DiagnosticAccepted, and their four existing constructors are now visible in Rustdoc. External actor and interpreter-contract suites already name these products to settle routed and route-free diagnostics, while the sealed route trait still limits its implementors. Removing eight documentation annotations changes no Rust visibility, constructor, or transition; 58 actor annotations remained at that checkpoint, with 56 after exposing the customer-delivery ports. The proxy outcome and correlation documentation repair leaves 54 sites. The returned-worker custody repair leaves 50 actor sites. The worker initialization and activation port repair leaves 23 actor sites. The creation-observation port repair leaves 22 actor sites.

WorkQueue now keeps worker-route cloning and equality on construction and transition operations, where queue inspection and duplicate availability use them. Its protocol identity accepts a lawful ReplyRoute without PartialEq. The external protocol-only caller failed on the previous aggregate bound with only E0277 and passes after the bound move; the FIFO transition suite still exercises the comparable route used by a running queue.

Twelve unwrapped catalogue actors now expose BehaviorBase<Base = Self> for opaque domain types without inheriting bounds used only by construction or transition: Acknowledgements, Resolver, Configuration, Readiness, Machine, Topic, PubSub, Presence, Lease, Barrier, Workflow, and OrderGate. The external caller test failed on their former Clone, Eq, Copy, PartialEq, or Ord bounds and passes after removing only those impl-level bounds. Their stored state, protocol, and transition contracts are unchanged. Router remains structurally bound by its route and strategy policy and needs a separate owner review.

Deduplicator and OrderGate now also expose protocol identity for an opaque key. Deduplicator exposes its read-only base projection on the same terms. The key comparison bounds remain on the operations that actually deduplicate or order messages. A focused caller failed before the change only on these three impl-level bounds and passed afterward; the routing transition suite remained green.

PriorityQueue now also accepts an opaque priority type at protocol identity and base projection. Its Ord proof remains required where construction and transition use the heap. The external caller failed on the old aggregate bound and passes after this move; the stable-priority selection trace remains green.

A source scan after these batches found Router as the only catalogue Protocol or BehaviorBase impl whose header still carries a copying, comparison, or ordering bound. Its route equality is used for membership and its current RoutingStrategy<Route> contract requires Clone + PartialEq. The aggregate review retained those bounds: construction deduplicates by route identity, Add/Remove compare exact members, and a route attempt clones its policy candidate for rollback on rejection. A type-level router with an uncomparable route would have no lawful construction or transition, so removing only a repeated header bound would add no usable protocol contract.

Public trait implementors

The source declares 77 top-level public traits: 55 in behavior and 22 in behavior-actors (counted with rg '^pub trait '). The following inventory accounts for every declaration. “Author” means an application defining its own typed actor, effect, or child protocol; “interpreter” means the code that settles an exact typed request. A structural proof may be public because a generated or manually authored product must implement it, even if ordinary applications should not mention it directly.

The table identifies implementor roles, not proof that every spelling should stay public. In particular, the structural rows still need external compile witnesses before visibility can be reduced. StashStatus already has multiple real wrapper implementations, so treating it as a redundant one-implementation trait would be incorrect. Any further bound change needs a new caller diagnostic and focused compile-cost comparison for that particular edit.

Canonical export ownership

The crate roots are the canonical export lists. This table classifies their complete groups by the owner that justifies the public names; mixed groups are further split by the hidden-item and trait tables above. No public spelling is retained merely because a private associated type mentions it.

All 77 top-level public traits have implementor roles in the preceding table. The 10 remaining hidden core sites are sealed or generated birth/occurrence proofs. The 22 remaining hidden actor sites are structural event/effect products, sealed generated proof traits and their grouped re-exports, plus the internal HostedInitialization type alias. The CustomerDelivery re-export from atomic::pool remains hidden because the canonical atomic::CustomerDelivery page is visible. External interpreters can name the actual request, outcome, receipt, and rejection values without naming those hidden structural products. A further visibility reduction would need its own caller witness; it is not part of this release review.

Cold actor-library compile comparison

On aarch64-darwin, the Nix shell at 1aeaed1 supplied Cargo 1.95.0 for both revisions. Each run used a newly absent CARGO_TARGET_DIR, the same command shape (cargo check --manifest-path REV/Cargo.toml -p bombay-behavior-actors --lib --locked --offline -q), and ran sequentially. The actor crate's Cargo fingerprint recorded the same feature list, profile, compiler configuration, and dependency identities in both revisions.

The measured command checks the actor library only, not tests, downstream applications, or release builds. The revisions differ in many source files, including macro and actor implementations; the observation cannot attribute the difference to any one A13 bound or predict downstream compile time. It does show that this branch's actor-library metadata and cold check cost did not grow under this controlled comparison.

Exact observation surface migration

Two owners represent distinct laws: ObservationAuthority<P> owns one exact protocol-matched cancellation attempt, and ObservationRelationship<P> owns cloneable nonauthorizing accepted identity. ObserveEstablished::new(id, recipient) owns fresh private correlation without another public issuer, key, or error type; construction occurs outside Behavior folds. CancelObservation::new consumes authority and loses its former Copy/Clone API. The established report sum returns whole rejected requests, so it requires the owning RecipientAddress capability contract. Its Started, Stopped and Cancelled variants no longer carry a separately forgeable numeric identity. The sealed target request port is mutable one-shot emission, the public monitor constructor consumes a prepared Observe, and consuming monitor/target/shutdown access recovers whole owned values. These existing-signature and variant changes are breaking even though there are only three new public nominal types.