9c7eb05 feat(brokeripc): credit flow control on broker logical streams · vev

M docs/protocol.md +18 -3


@@ -109,8 +109,8 @@ Timeout or reply loss after dispatch is outcome unknown and is never replayed.
109	109		## Broker negotiation
110	110
111	111		Broker connections are a separate conversation from the session protocol.
112		-	`internal/adapters/brokerwire` owns it: client tags 101-111 and server tags
113		-	201-209 are disjoint from every session tag, and each direction is its own
	112	+	`internal/adapters/brokerwire` owns it: client tags 101-114 and server tags
	113	+	201-211 are disjoint from every session tag, and each direction is its own
114	114		closed directional `oneof` union. A broker connection opens with exactly one
115	115		broker preamble (`PreambleRequest` client → server, `PreambleResponse` server
116	116		→ client) using broker roles 3/4. The preamble carries the same magic

@@ -127,7 +127,14 @@ connection dispatcher.
127	127
128	128		`internal/adapters/brokeripc` carries this conversation over `broker.sock`
129	129		in the per-user runtime directory, with same-user peer-credential admission
130		-	and bounded per-connection queues. The remote helpers `_broker-mux-stdio`,
	130	+	and bounded per-connection queues. Each logical stream is credit flow
	131	+	controlled in both directions: a sender spends `StreamChunkCredit` (payload
	132	+	plus 64 bytes) per data frame out of a 4 MiB window
	133	+	(`brokerwire.StreamWindowBytes`) and waits when it has too little, and the
	134	+	receiver returns the credit of frames its consumer has read in
	135	+	`StreamWindowUpdate` batches. A slow consumer therefore slows its own stream
	136	+	instead of losing it; data or credit beyond the window is a flow-control
	137	+	violation that settles only that stream. The remote helpers `_broker-mux-stdio`,
131	138		`_broker-mux-quic-bootstrap`, and `_broker-mux-quic-proxy` bridge a remote
132	139		daemonmux socket to stdio or to one freshly authenticated QUIC stream.
133	140

@@ -162,6 +169,12 @@ base. `ValidateOutput` enforces the epoch/base/new chain
162	169		claims its carriage's preferred window, or `MaxOutputWindow` when the
163	170		carriage states none, so output pipelines instead of waiting a round trip
164	171		per frame.
	172	+	- Unacknowledged Output data is also bounded by `MaxOutputWindowBytes`
	173	+	(2 MiB). State frames are charged to their own state, side effects to the
	174	+	next state, and a cumulative ACK releases what it covers. The next state
	175	+	frame waits when either window is full, except that a frame may always be
	176	+	sent while no state frame is in flight. Images share the remaining byte
	177	+	budget and wait for a later frame when it is too small.
165	178		- The client coalesces ACKs (`client.go:cumulativeAckQueue`) and keeps
166	179		applying + acknowledging daemon frames even while a picker lease owns
167	180		the terminal (see below) — admission without physical write.

@@ -247,6 +260,8 @@ than `KillResult` and `CommandResult`.
247	260		\| Queued envelopes per connection \| 8 messages, 32 MiB bytes (`streamframe` defaults), then backpressure; sync sends uncharged, async charged once \| `adapters/streamframe` \|
248	261		\| Encoding buffer \| bounded per-connection framing buffers owned by `streamframe` \| `adapters/streamframe` \|
249	262		\| Output states in flight \| 8 (`MaxOutputWindow`) preferred for QUIC/IPC/SSH \| daemon, negotiated down \|
	263	+	\| Unacknowledged Output bytes \| 2 MiB (`MaxOutputWindowBytes`); one frame always allowed when none is in flight \| daemon \|
	264	+	\| Broker stream window \| 4 MiB per stream and direction (`brokerwire.StreamWindowBytes`), returned by `StreamWindowUpdate` \| `adapters/brokeripc` \|
250	265		\| QUIC unauthenticated peers \| 4 connections, 3 s auth deadline, one bidirectional stream each; extra/unidirectional streams rejected \| `adapters/quic` \|
251	266		\| QUIC bootstrap \| 32-byte token + 16-byte nonce (base64), ≤4 KiB readiness (schema v1, host-independent port, SHA-256 pin, ≤15 s expiry), one bounded (512 B) auth record, atomic one-time consumption, token erasure on close \| `adapters/quic` bootstrap, `app/_broker-mux-quic-bootstrap` + `_broker-mux-quic-proxy` \|
252	267		\| Handshake, dial → first committed publication \| 15 s, single absolute deadline propagated unchanged, never reset \| both ends \|

 ## Broker negotiation
 Broker connections are a separate conversation from the session protocol.
-`internal/adapters/brokerwire` owns it: client tags 101-111 and server tags
+`internal/adapters/brokerwire` owns it: client tags 101-114 and server tags
-201-209 are disjoint from every session tag, and each direction is its own
+201-211 are disjoint from every session tag, and each direction is its own
 closed directional `oneof` union. A broker connection opens with exactly one
 broker preamble (`PreambleRequest` client → server, `PreambleResponse` server
 → client) using broker roles 3/4. The preamble carries the same magic
 `internal/adapters/brokeripc` carries this conversation over `broker.sock`
 in the per-user runtime directory, with same-user peer-credential admission
-and bounded per-connection queues. The remote helpers `_broker-mux-stdio`,
+and bounded per-connection queues. Each logical stream is credit flow
+controlled in both directions: a sender spends `StreamChunkCredit` (payload
+plus 64 bytes) per data frame out of a 4 MiB window
+(`brokerwire.StreamWindowBytes`) and waits when it has too little, and the
+receiver returns the credit of frames its consumer has read in
+`StreamWindowUpdate` batches. A slow consumer therefore slows its own stream
+instead of losing it; data or credit beyond the window is a flow-control
+violation that settles only that stream. The remote helpers `_broker-mux-stdio`,
 `_broker-mux-quic-bootstrap`, and `_broker-mux-quic-proxy` bridge a remote
 daemonmux socket to stdio or to one freshly authenticated QUIC stream.
   claims its carriage's preferred window, or `MaxOutputWindow` when the
   carriage states none, so output pipelines instead of waiting a round trip
   per frame.
+- Unacknowledged Output data is also bounded by `MaxOutputWindowBytes`
+  (2 MiB). State frames are charged to their own state, side effects to the
+  next state, and a cumulative ACK releases what it covers. The next state
+  frame waits when either window is full, except that a frame may always be
+  sent while no state frame is in flight. Images share the remaining byte
+  budget and wait for a later frame when it is too small.
 - The client coalesces ACKs (`client.go:cumulativeAckQueue`) and keeps
   applying + acknowledging daemon frames even while a picker lease owns
   the terminal (see below) — admission without physical write.
 | Queued envelopes per connection | 8 messages, 32 MiB bytes (`streamframe` defaults), then backpressure; sync sends uncharged, async charged once | `adapters/streamframe` |
 | Encoding buffer | bounded per-connection framing buffers owned by `streamframe` | `adapters/streamframe` |
 | Output states in flight | 8 (`MaxOutputWindow`) preferred for QUIC/IPC/SSH | daemon, negotiated down |
+| Unacknowledged Output bytes | 2 MiB (`MaxOutputWindowBytes`); one frame always allowed when none is in flight | daemon |
+| Broker stream window | 4 MiB per stream and direction (`brokerwire.StreamWindowBytes`), returned by `StreamWindowUpdate` | `adapters/brokeripc` |
 | QUIC unauthenticated peers | 4 connections, 3 s auth deadline, one bidirectional stream each; extra/unidirectional streams rejected | `adapters/quic` |
 | QUIC bootstrap | 32-byte token + 16-byte nonce (base64), ≤4 KiB readiness (schema v1, host-independent port, SHA-256 pin, ≤15 s expiry), one bounded (512 B) auth record, atomic one-time consumption, token erasure on close | `adapters/quic` bootstrap, `app/_broker-mux-quic-bootstrap` + `_broker-mux-quic-proxy` |
 | Handshake, dial → first committed publication | 15 s, single absolute deadline propagated unchanged, never reset | both ends |

M internal/adapters/brokeripc/client.go +18 -3


@@ -364,9 +364,24 @@ func (c *client) dispatch(message brokerwire.ServerMessage) error {
364	364		// lookup; its data is discarded, exactly like a retired stream.
365	365		return nil
366	366		}
367		-	if err := st.deliver(m.Data); err != nil {
368		-	if errors.Is(err, ErrStreamBackpressure) {
369		-	st.fail(ErrStreamBackpressure)
	367	+	if err := st.deliver(m.Data); errors.Is(err, ErrStreamCredit) {
	368	+	st.fail(ErrStreamCredit)
	369	+	}
	370	+	return nil
	371	+	case brokerwire.StreamWindowUpdate:
	372	+	if !c.scopeMatches(m.Epoch, m.Connection) {
	373	+	return errors.Join(ErrScopeMismatch, ErrProtocol)
	374	+	}
	375	+	disposition, err := c.conn.StreamWindowUpdate(m.Stream)
	376	+	if err != nil {
	377	+	return errors.Join(ErrProtocol, err)
	378	+	}
	379	+	if disposition == brokerwire.StreamDiscarded {
	380	+	return nil
	381	+	}
	382	+	if st := c.lookupStream(m.Stream); st != nil {
	383	+	if err := st.pipe.granted(m.Credit); err != nil {
	384	+	st.fail(err)
370	385		}
371	386		}
372	387		return nil


@@ -364,9 +364,24 @@ func (c *client) dispatch(message brokerwire.ServerMessage) error {
364		// lookup; its data is discarded, exactly like a retired stream.	364		// lookup; its data is discarded, exactly like a retired stream.
365		return nil	365		return nil
366		}	366		}
367	-	if err := st.deliver(m.Data); err != nil {	367	+	if err := st.deliver(m.Data); errors.Is(err, ErrStreamCredit) {
368	-	if errors.Is(err, ErrStreamBackpressure) {	368	+	st.fail(ErrStreamCredit)
369	-	st.fail(ErrStreamBackpressure)	369	+	}
			370	+	return nil
			371	+	case brokerwire.StreamWindowUpdate:
			372	+	if !c.scopeMatches(m.Epoch, m.Connection) {
			373	+	return errors.Join(ErrScopeMismatch, ErrProtocol)
			374	+	}
			375	+	disposition, err := c.conn.StreamWindowUpdate(m.Stream)
			376	+	if err != nil {
			377	+	return errors.Join(ErrProtocol, err)
			378	+	}
			379	+	if disposition == brokerwire.StreamDiscarded {
			380	+	return nil
			381	+	}
			382	+	if st := c.lookupStream(m.Stream); st != nil {
			383	+	if err := st.pipe.granted(m.Credit); err != nil {
			384	+	st.fail(err)
370		}	385		}
371		}	386		}
372		return nil	387		return nil

M internal/adapters/brokeripc/config.go +1 -23


@@ -15,13 +15,6 @@ const (
15	15		// listener. A listener acquires one slot before accepting, so the bound is
16	16		// enforced before a socket is admitted rather than after.
17	17		DefaultMaxClients = 64
18		-	// DefaultStreamInboundChunks bounds one logical stream's inbound chunk
19		-	// queue: frames already accepted from the wire and not yet consumed by the
20		-	// local session carriage.
21		-	DefaultStreamInboundChunks = 64
22		-	// DefaultStreamInboundBytes bounds one logical stream's inbound chunk queue
23		-	// in bytes (4 MiB).
24		-	DefaultStreamInboundBytes = 4 << 20
25	18		)
26	19
27	20		// Config bounds one endpoint. The zero value is valid and selects every

@@ -29,10 +22,6 @@ const (
29	22		type Config struct {
30	23		// MaxClients bounds concurrent accepted client connections.
31	24		MaxClients int
32		-	// StreamInboundChunks bounds one logical stream's inbound chunk queue.
33		-	StreamInboundChunks int
34		-	// StreamInboundBytes bounds one logical stream's inbound chunk bytes.
35		-	StreamInboundBytes uint64
36	25		// HandshakeTimeout bounds one accepted connection's broker preamble, broker
37	26		// admission, and the wait for its Register. The client dialer also bounds
38	27		// its whole setup (Unix dial, preamble, Register send, and wait for

@@ -62,12 +51,6 @@ func (c Config) withDefaults() Config {
62	51		if c.MaxClients <= 0 {
63	52		c.MaxClients = DefaultMaxClients
64	53		}
65		-	if c.StreamInboundChunks <= 0 {
66		-	c.StreamInboundChunks = DefaultStreamInboundChunks
67		-	}
68		-	if c.StreamInboundBytes == 0 {
69		-	c.StreamInboundBytes = DefaultStreamInboundBytes
70		-	}
71	54		if c.HandshakeTimeout <= 0 {
72	55		c.HandshakeTimeout = protocol.HandshakeTimeout
73	56		}

@@ -80,16 +63,11 @@ func (c Config) withDefaults() Config {
80	63		// validate refuses a configuration whose explicit bounds cannot be honored.
81	64		// The zero value is always valid because withDefaults has already been applied.
82	65		func (c Config) validate() error {
83		-	if c.MaxClients <= 0 \|\| c.StreamInboundChunks <= 0 \|\| c.StreamInboundBytes == 0 \|\| c.HandshakeTimeout <= 0 {
	66	+	if c.MaxClients <= 0 \|\| c.HandshakeTimeout <= 0 {
84	67		return ErrConfig
85	68		}
86	69		if c.MaxPendingOperations <= 0 \|\| c.MaxPendingOperations > brokerwire.MaxPendingOperations {
87	70		return ErrConfig
88	71		}
89		-	// A stream inbound byte bound below one maximum chunk can never accept a
90		-	// full stream frame, which would starve a legal peer.
91		-	if c.StreamInboundBytes < brokerwire.MaxStreamChunkBytes {
92		-	return ErrConfig
93		-	}
94	72		return nil
95	73		}

 	// listener. A listener acquires one slot before accepting, so the bound is
 	// enforced before a socket is admitted rather than after.
 	DefaultMaxClients = 64
-	// DefaultStreamInboundChunks bounds one logical stream's inbound chunk
-	// queue: frames already accepted from the wire and not yet consumed by the
-	// local session carriage.
-	DefaultStreamInboundChunks = 64
-	// DefaultStreamInboundBytes bounds one logical stream's inbound chunk queue
-	// in bytes (4 MiB).
-	DefaultStreamInboundBytes = 4 << 20
 )
 // Config bounds one endpoint. The zero value is valid and selects every
 type Config struct {
 	// MaxClients bounds concurrent accepted client connections.
 	MaxClients int
-	// StreamInboundChunks bounds one logical stream's inbound chunk queue.
-	StreamInboundChunks int
-	// StreamInboundBytes bounds one logical stream's inbound chunk bytes.
-	StreamInboundBytes uint64
 	// HandshakeTimeout bounds one accepted connection's broker preamble, broker
 	// admission, and the wait for its Register. The client dialer also bounds
 	// its whole setup (Unix dial, preamble, Register send, and wait for
 	if c.MaxClients <= 0 {
 		c.MaxClients = DefaultMaxClients
 	}
-	if c.StreamInboundChunks <= 0 {
-		c.StreamInboundChunks = DefaultStreamInboundChunks
-	}
-	if c.StreamInboundBytes == 0 {
-		c.StreamInboundBytes = DefaultStreamInboundBytes
-	}
 	if c.HandshakeTimeout <= 0 {
 		c.HandshakeTimeout = protocol.HandshakeTimeout
 	}
 // validate refuses a configuration whose explicit bounds cannot be honored.
 // The zero value is always valid because withDefaults has already been applied.
 func (c Config) validate() error {
-	if c.MaxClients <= 0 || c.StreamInboundChunks <= 0 || c.StreamInboundBytes == 0 || c.HandshakeTimeout <= 0 {
+	if c.MaxClients <= 0 || c.HandshakeTimeout <= 0 {
 		return ErrConfig
 	}
 	if c.MaxPendingOperations <= 0 || c.MaxPendingOperations > brokerwire.MaxPendingOperations {
 		return ErrConfig
 	}
-	// A stream inbound byte bound below one maximum chunk can never accept a
-	// full stream frame, which would starve a legal peer.
-	if c.StreamInboundBytes < brokerwire.MaxStreamChunkBytes {
-		return ErrConfig
-	}
 	return nil
 }

M internal/adapters/brokeripc/errors.go +4 -4


@@ -33,10 +33,10 @@ var (
33	33		// ordering: a duplicate Register, a frame for an unallocated stream, or
34	34		// stream data before the stream was established.
35	35		ErrProtocol = errors.New("brokeripc: broker protocol violation")
36		-	// ErrStreamBackpressure reports a logical stream whose local consumer is
37		-	// not draining its bounded inbound queue. The affected stream is settled
38		-	// alone; the connection and every sibling stream stay up.
39		-	ErrStreamBackpressure = errors.New("brokeripc: stream consumer is not keeping up")
	36	+	// ErrStreamCredit reports a peer that sent stream data beyond the credit it
	37	+	// was granted, or granted credit beyond one stream window. The affected
	38	+	// stream is settled alone; the connection and every sibling stream stay up.
	39	+	ErrStreamCredit = errors.New("brokeripc: stream flow-control violation")
40	40		// ErrStreamGone reports a stream the peer retired while this side was still
41	41		// starting or using it.
42	42		ErrStreamGone = errors.New("brokeripc: logical stream is gone")


@@ -33,10 +33,10 @@ var (
33		// ordering: a duplicate Register, a frame for an unallocated stream, or	33		// ordering: a duplicate Register, a frame for an unallocated stream, or
34		// stream data before the stream was established.	34		// stream data before the stream was established.
35		ErrProtocol = errors.New("brokeripc: broker protocol violation")	35		ErrProtocol = errors.New("brokeripc: broker protocol violation")
36	-	// ErrStreamBackpressure reports a logical stream whose local consumer is	36	+	// ErrStreamCredit reports a peer that sent stream data beyond the credit it
37	-	// not draining its bounded inbound queue. The affected stream is settled	37	+	// was granted, or granted credit beyond one stream window. The affected
38	-	// alone; the connection and every sibling stream stay up.	38	+	// stream is settled alone; the connection and every sibling stream stay up.
39	-	ErrStreamBackpressure = errors.New("brokeripc: stream consumer is not keeping up")	39	+	ErrStreamCredit = errors.New("brokeripc: stream flow-control violation")
40		// ErrStreamGone reports a stream the peer retired while this side was still	40		// ErrStreamGone reports a stream the peer retired while this side was still
41		// starting or using it.	41		// starting or using it.
42		ErrStreamGone = errors.New("brokeripc: logical stream is gone")	42		ErrStreamGone = errors.New("brokeripc: logical stream is gone")

M internal/adapters/brokeripc/limits_test.go +12 -44


@@ -147,71 +147,39 @@ func TestConfigDefaultsAndValidation(t *testing.T) {
147	147		cfg := Config{}.withDefaults()
148	148		require.NoError(t, cfg.validate())
149	149		require.Equal(t, DefaultMaxClients, cfg.MaxClients)
150		-	require.Equal(t, DefaultStreamInboundChunks, cfg.StreamInboundChunks)
151		-	require.Equal(t, uint64(DefaultStreamInboundBytes), cfg.StreamInboundBytes)
152	150		require.Equal(t, brokerwire.MaxPendingOperations, cfg.MaxPendingOperations)
153	151
154		-	require.ErrorIs(t, (Config{StreamInboundBytes: 1}).withDefaults().validate(), ErrConfig)
155	152		require.ErrorIs(t, (Config{MaxPendingOperations: brokerwire.MaxPendingOperations + 1}).withDefaults().validate(), ErrConfig)
156	153		// A negative explicit bound is replaced by its default rather than refused.
157		-	require.NoError(t, (Config{MaxClients: -1, StreamInboundChunks: -1}).withDefaults().validate())
	154	+	require.NoError(t, (Config{MaxClients: -1}).withDefaults().validate())
158	155		}
159	156
160		-	// TestStreamPipeBoundsAndClose proves the per-stream byte channel is bounded,
161		-	// reports backpressure instead of growing, and releases a parked reader on
162		-	// close.
163		-	func TestStreamPipeBoundsAndClose(t *testing.T) {
164		-	pipe := newStreamPipe(2, 4096, func([]byte) error { return nil })
165		-	require.NoError(t, pipe.deliver([]byte("one")))
166		-	require.NoError(t, pipe.deliver([]byte("two")))
167		-	require.ErrorIs(t, pipe.deliver([]byte("three")), ErrStreamBackpressure)
168		-
169		-	buf := make([]byte, 3)
170		-	n, err := pipe.Read(buf)
171		-	require.NoError(t, err)
172		-	require.Equal(t, "one", string(buf[:n]))
173		-	require.NoError(t, pipe.deliver([]byte("three")))
174		-
175		-	// An orderly Close keeps what is already queued ("two" and "three"): Read
176		-	// drains it before observing io.EOF, so a chunk delivered just ahead of an
177		-	// orderly close is never discarded underneath its reader (see
178		-	// TestStreamPipeCloseWithPreservesQueuedDataOnOrderlyClose for the focused
179		-	// coverage of this behavior).
180		-	require.NoError(t, pipe.Close())
181		-	require.ErrorIs(t, pipe.deliver([]byte("four")), ErrStreamGone)
182		-	drained := make([]byte, 8)
183		-	n, err = pipe.Read(drained)
184		-	require.NoError(t, err)
185		-	require.Equal(t, "two", string(drained[:n]))
186		-	n, err = pipe.Read(drained)
187		-	require.NoError(t, err)
188		-	require.Equal(t, "three", string(drained[:n]))
189		-	_, err = pipe.Read(drained)
190		-	require.ErrorIs(t, err, io.EOF)
191		-
192		-	// A reader parked on an empty pipe is released by closeWith with its cause.
193		-	parked := newStreamPipe(1, 4096, func([]byte) error { return nil })
	157	+	// TestStreamPipeCloseReleasesParkedReader proves a reader parked on an empty
	158	+	// pipe is released by closeWith with its cause.
	159	+	func TestStreamPipeCloseReleasesParkedReader(t *testing.T) {
	160	+	parked := newTestPipe()
194	161		done := make(chan error, 1)
195	162		go func() {
196		-	_, err := parked.Read(buf)
	163	+	_, err := parked.Read(make([]byte, 3))
197	164		done <- err
198	165		}()
199		-	time.Sleep(20 * time.Millisecond)
200		-	parked.closeWith(ErrStreamBackpressure)
	166	+	parked.closeWith(ErrStreamCredit)
201	167		select {
202	168		case err := <-done:
203		-	require.ErrorIs(t, err, ErrStreamBackpressure)
	169	+	require.ErrorIs(t, err, ErrStreamCredit)
204	170		case <-time.After(5 * time.Second):
205	171		t.Fatal("closeWith must release a parked reader")
206	172		}
	173	+	require.ErrorIs(t, parked.deliver([]byte("late")), ErrStreamGone)
207	174		}
208	175
209	176		// TestStreamPipeOutboundError proves a failing outbound hook surfaces instead of
210	177		// silently dropping bytes.
211	178		func TestStreamPipeOutboundError(t *testing.T) {
212		-	pipe := newStreamPipe(1, 4096, func([]byte) error { return ErrStreamBackpressure })
	179	+	failure := errors.New("outbound failed")
	180	+	pipe := newStreamPipe(func([]byte) error { return failure }, func(uint64) error { return nil })
213	181		_, err := pipe.Write([]byte("payload"))
214		-	require.ErrorIs(t, err, ErrStreamBackpressure)
	182	+	require.ErrorIs(t, err, failure)
215	183		require.NoError(t, pipe.Close())
216	184		_, err = pipe.Write([]byte("payload"))
217	185		require.ErrorIs(t, err, ErrStreamGone)

 	cfg := Config{}.withDefaults()
 	require.NoError(t, cfg.validate())
 	require.Equal(t, DefaultMaxClients, cfg.MaxClients)
-	require.Equal(t, DefaultStreamInboundChunks, cfg.StreamInboundChunks)
-	require.Equal(t, uint64(DefaultStreamInboundBytes), cfg.StreamInboundBytes)
 	require.Equal(t, brokerwire.MaxPendingOperations, cfg.MaxPendingOperations)
-	require.ErrorIs(t, (Config{StreamInboundBytes: 1}).withDefaults().validate(), ErrConfig)
 	require.ErrorIs(t, (Config{MaxPendingOperations: brokerwire.MaxPendingOperations + 1}).withDefaults().validate(), ErrConfig)
 	// A negative explicit bound is replaced by its default rather than refused.
-	require.NoError(t, (Config{MaxClients: -1, StreamInboundChunks: -1}).withDefaults().validate())
+	require.NoError(t, (Config{MaxClients: -1}).withDefaults().validate())
 }
-// TestStreamPipeBoundsAndClose proves the per-stream byte channel is bounded,
+// TestStreamPipeCloseReleasesParkedReader proves a reader parked on an empty
-// reports backpressure instead of growing, and releases a parked reader on
+// pipe is released by closeWith with its cause.
-// close.
+func TestStreamPipeCloseReleasesParkedReader(t *testing.T) {
-func TestStreamPipeBoundsAndClose(t *testing.T) {
+	parked := newTestPipe()
-	pipe := newStreamPipe(2, 4096, func([]byte) error { return nil })
-	require.NoError(t, pipe.deliver([]byte("one")))
-	require.NoError(t, pipe.deliver([]byte("two")))
-	require.ErrorIs(t, pipe.deliver([]byte("three")), ErrStreamBackpressure)
-	buf := make([]byte, 3)
-	n, err := pipe.Read(buf)
-	require.NoError(t, err)
-	require.Equal(t, "one", string(buf[:n]))
-	require.NoError(t, pipe.deliver([]byte("three")))
-	// An orderly Close keeps what is already queued ("two" and "three"): Read
-	// drains it before observing io.EOF, so a chunk delivered just ahead of an
-	// orderly close is never discarded underneath its reader (see
-	// TestStreamPipeCloseWithPreservesQueuedDataOnOrderlyClose for the focused
-	// coverage of this behavior).
-	require.NoError(t, pipe.Close())
-	require.ErrorIs(t, pipe.deliver([]byte("four")), ErrStreamGone)
-	drained := make([]byte, 8)
-	n, err = pipe.Read(drained)
-	require.NoError(t, err)
-	require.Equal(t, "two", string(drained[:n]))
-	n, err = pipe.Read(drained)
-	require.NoError(t, err)
-	require.Equal(t, "three", string(drained[:n]))
-	_, err = pipe.Read(drained)
-	require.ErrorIs(t, err, io.EOF)
-	// A reader parked on an empty pipe is released by closeWith with its cause.
-	parked := newStreamPipe(1, 4096, func([]byte) error { return nil })
 	done := make(chan error, 1)
 	go func() {
-		_, err := parked.Read(buf)
+		_, err := parked.Read(make([]byte, 3))
 		done <- err
 	}()
-	time.Sleep(20 * time.Millisecond)
+	parked.closeWith(ErrStreamCredit)
-	parked.closeWith(ErrStreamBackpressure)
 	select {
 	case err := <-done:
-		require.ErrorIs(t, err, ErrStreamBackpressure)
+		require.ErrorIs(t, err, ErrStreamCredit)
 	case <-time.After(5 * time.Second):
 		t.Fatal("closeWith must release a parked reader")
 	}
+	require.ErrorIs(t, parked.deliver([]byte("late")), ErrStreamGone)
 }
 // TestStreamPipeOutboundError proves a failing outbound hook surfaces instead of
 // silently dropping bytes.
 func TestStreamPipeOutboundError(t *testing.T) {
-	pipe := newStreamPipe(1, 4096, func([]byte) error { return ErrStreamBackpressure })
+	failure := errors.New("outbound failed")
+	pipe := newStreamPipe(func([]byte) error { return failure }, func(uint64) error { return nil })
 	_, err := pipe.Write([]byte("payload"))
-	require.ErrorIs(t, err, ErrStreamBackpressure)
+	require.ErrorIs(t, err, failure)
 	require.NoError(t, pipe.Close())
 	_, err = pipe.Write([]byte("payload"))
 	require.ErrorIs(t, err, ErrStreamGone)

M internal/adapters/brokeripc/pipe.go +131 -50


@@ -3,53 +3,80 @@ package brokeripc
3	3		import (
4	4		"io"
5	5		"sync"
	6	+
	7	+	"github.com/bnema/vev/internal/adapters/brokerwire"
6	8		)
7	9
8		-	// streamPipe is the private ordered, bounded byte channel between one broker
9		-	// wire session and the sessionwire framing of one logical stream.
	10	+	// streamPipe is the private ordered, credit-controlled byte channel between one
	11	+	// broker wire session and the sessionwire framing of one logical stream.
10	12		//
11		-	// The wire reader never blocks on a slow consumer: a chunk the peer sent is
12		-	// appended to a bounded queue and refused with ErrStreamBackpressure once the
13		-	// bound is reached, so only that stream is settled and every sibling and the
14		-	// physical connection stay untouched. The consumer never blocks the writer:
15		-	// Read serves already-queued chunks or parks on the wake channel, and Close
16		-	// releases both ends promptly. Write hands each byte slice to the injected
17		-	// outbound hook, which owns chunking it under the negotiated stream chunk
18		-	// ceiling and enqueueing the frames on the connection.
	13	+	// Each direction of a stream has a brokerwire.StreamWindowBytes credit window.
	14	+	// The sender spends brokerwire.StreamChunkCredit per data frame before writing
	15	+	// it and waits while it has too little, so a slow consumer slows its own
	16	+	// sender instead of failing the stream. The receiver returns the credit of
	17	+	// every frame its consumer has fully read with one StreamWindowUpdate per
	18	+	// batch. Because a conforming peer never exceeds the window, the wire reader
	19	+	// never blocks: it appends each frame to the queue, and a frame beyond the
	20	+	// granted credit is a peer violation (ErrStreamCredit) that settles only that
	21	+	// stream. Close releases the reader, a writer waiting for credit, and the
	22	+	// writer's peer promptly.
19	23		type streamPipe struct {
20		-	mu sync.Mutex
21		-	queue [][]byte
22		-	queued int
23		-	closed bool
24		-	err error
25		-	maxChunk int
26		-	maxBytes int
	24	+	mu sync.Mutex
	25	+	queue []pipeChunk
	26	+	closed bool
	27	+	err error
	28	+
	29	+	// recvUsed is the credit held by queued frames, recvReturn the credit of
	30	+	// fully read frames not yet granted back, and returnAt the batch size.
	31	+	recvUsed uint64
	32	+	recvReturn uint64
	33	+	returnAt uint64
	34	+	// sendCredit is what the peer still allows this side to send.
	35	+	sendCredit uint64
	36	+	creditWake chan struct{}
27	37
28	38		wake chan struct{}
29	39		closedCh chan struct{}
30	40
31	41		outbound func([]byte) error
	42	+	grant func(uint64) error
32	43		}
33	44
34		-	// newStreamPipe builds one bounded stream carriage. outbound must not be nil.
35		-	func newStreamPipe(maxChunks int, maxBytes uint64, outbound func([]byte) error) *streamPipe {
36		-	if maxChunks <= 0 {
37		-	maxChunks = DefaultStreamInboundChunks
38		-	}
39		-	if maxBytes == 0 {
40		-	maxBytes = DefaultStreamInboundBytes
41		-	}
	45	+	// pipeChunk is one queued inbound frame and the credit it holds until it is
	46	+	// fully read.
	47	+	type pipeChunk struct {
	48	+	data []byte
	49	+	cost uint64
	50	+	}
	51	+
	52	+	// newStreamPipe builds one stream carriage. outbound writes one outbound byte
	53	+	// slice; grant returns consumed inbound credit to the peer. Neither may be nil.
	54	+	func newStreamPipe(outbound func([]byte) error, grant func(uint64) error) *streamPipe {
	55	+	window := brokerwire.StreamWindowBytes
42	56		return &streamPipe{
43		-	maxChunk: maxChunks,
44		-	maxBytes: int(maxBytes),
45		-	wake: make(chan struct{}, 1),
46		-	closedCh: make(chan struct{}),
47		-	outbound: outbound,
	57	+	returnAt: streamCreditReturnAt(window),
	58	+	sendCredit: window,
	59	+	creditWake: make(chan struct{}),
	60	+	wake: make(chan struct{}, 1),
	61	+	closedCh: make(chan struct{}),
	62	+	outbound: outbound,
	63	+	grant: grant,
48	64		}
49	65		}
50	66
51		-	// Read serves the next queued chunk, blocking until one arrives or the pipe
52		-	// closes. A partial copy retains the unread remainder for the next call.
	67	+	// streamCreditReturnAt is the consumed credit a receiver batches before it
	68	+	// grants it back: half the window, lowered so a sender blocked on a maximum
	69	+	// frame is always released. A sender waits only once more than
	70	+	// window-StreamChunkCredit(max) is unreturned, so granting at or below that
	71	+	// point can never deadlock.
	72	+	func streamCreditReturnAt(window uint64) uint64 {
	73	+	cost := brokerwire.StreamChunkCredit(int(brokerwire.MaxStreamChunkBytes))
	74	+	return max(min(window/2, window-cost+1), 1)
	75	+	}
	76	+
	77	+	// Read serves the next queued frame, blocking until one arrives or the pipe
	78	+	// closes. A partial copy retains the unread remainder for the next call. The
	79	+	// credit of each fully read frame is returned to the peer in batches.
53	80		func (p *streamPipe) Read(b []byte) (int, error) {
54	81		if len(b) == 0 {
55	82		return 0, nil

@@ -57,16 +84,26 @@ func (p *streamPipe) Read(b []byte) (int, error) {
57	84		for {
58	85		p.mu.Lock()
59	86		if len(p.queue) > 0 {
60		-	chunk := p.queue[0]
61		-	n := copy(b, chunk)
62		-	if n == len(chunk) {
63		-	p.queue[0] = nil
	87	+	chunk := &p.queue[0]
	88	+	n := copy(b, chunk.data)
	89	+	var grant uint64
	90	+	if n == len(chunk.data) {
	91	+	p.recvUsed -= chunk.cost
	92	+	p.recvReturn += chunk.cost
	93	+	p.queue[0] = pipeChunk{}
64	94		p.queue = p.queue[1:]
	95	+	if p.recvReturn >= p.returnAt && !p.closed {
	96	+	grant, p.recvReturn = p.recvReturn, 0
	97	+	}
65	98		} else {
66		-	p.queue[0] = chunk[n:]
	99	+	chunk.data = chunk.data[n:]
67	100		}
68		-	p.queued -= n
69	101		p.mu.Unlock()
	102	+	if grant > 0 {
	103	+	// A failed grant means the connection itself is failing; its
	104	+	// terminal path settles this stream, so there is nothing to retry.
	105	+	_ = p.grant(grant)
	106	+	}
70	107		return n, nil
71	108		}
72	109		if p.closed {

@@ -85,8 +122,9 @@ func (p *streamPipe) Read(b []byte) (int, error) {
85	122		}
86	123		}
87	124
88		-	// Write hands one byte slice to the outbound hook. It returns ErrClosed once the
89		-	// pipe reached its terminal outcome.
	125	+	// Write hands one byte slice to the outbound hook, which spends send credit
	126	+	// per frame through reserve. It returns ErrStreamGone once the pipe reached its
	127	+	// terminal outcome.
90	128		func (p *streamPipe) Write(b []byte) (int, error) {
91	129		p.mu.Lock()
92	130		closed := p.closed

@@ -100,25 +138,68 @@ func (p *streamPipe) Write(b []byte) (int, error) {
100	138		return len(b), nil
101	139		}
102	140
103		-	// deliver accepts one inbound chunk from the connection reader. It returns
104		-	// ErrStreamBackpressure when the bound is reached and ErrStreamGone once the
105		-	// pipe is closed; the caller settles the affected stream in both cases.
	141	+	// reserve spends the send credit of one outbound frame of n bytes, waiting for
	142	+	// the peer to grant more when it is short. It returns ErrStreamGone once the
	143	+	// pipe closes, so a writer waiting for credit is always released.
	144	+	func (p *streamPipe) reserve(n int) error {
	145	+	cost := brokerwire.StreamChunkCredit(n)
	146	+	for {
	147	+	p.mu.Lock()
	148	+	if p.closed {
	149	+	p.mu.Unlock()
	150	+	return ErrStreamGone
	151	+	}
	152	+	if p.sendCredit >= cost {
	153	+	p.sendCredit -= cost
	154	+	p.mu.Unlock()
	155	+	return nil
	156	+	}
	157	+	wake := p.creditWake
	158	+	p.mu.Unlock()
	159	+	select {
	160	+	case <-wake:
	161	+	case <-p.closedCh:
	162	+	}
	163	+	}
	164	+	}
	165	+
	166	+	// granted adds credit the peer returned. Credit beyond the window is a peer
	167	+	// flow-control violation.
	168	+	func (p *streamPipe) granted(credit uint64) error {
	169	+	p.mu.Lock()
	170	+	defer p.mu.Unlock()
	171	+	if p.closed {
	172	+	return nil
	173	+	}
	174	+	if credit > brokerwire.StreamWindowBytes-p.sendCredit {
	175	+	return ErrStreamCredit
	176	+	}
	177	+	p.sendCredit += credit
	178	+	close(p.creditWake)
	179	+	p.creditWake = make(chan struct{})
	180	+	return nil
	181	+	}
	182	+
	183	+	// deliver accepts one inbound frame from the connection reader. It returns
	184	+	// ErrStreamCredit when the peer sent beyond the credit it was granted and
	185	+	// ErrStreamGone once the pipe is closed; the caller settles the affected stream
	186	+	// in both cases.
106	187		func (p *streamPipe) deliver(chunk []byte) error {
107	188		if len(chunk) == 0 {
108	189		return nil
109	190		}
	191	+	cost := brokerwire.StreamChunkCredit(len(chunk))
110	192		p.mu.Lock()
111	193		if p.closed {
112	194		p.mu.Unlock()
113	195		return ErrStreamGone
114	196		}
115		-	if len(p.queue) >= p.maxChunk \|\| p.queued+len(chunk) > p.maxBytes {
	197	+	if p.recvUsed+p.recvReturn+cost > brokerwire.StreamWindowBytes {
116	198		p.mu.Unlock()
117		-	return ErrStreamBackpressure
	199	+	return ErrStreamCredit
118	200		}
119		-	owned := append([]byte(nil), chunk...)
120		-	p.queue = append(p.queue, owned)
121		-	p.queued += len(owned)
	201	+	p.queue = append(p.queue, pipeChunk{data: append([]byte(nil), chunk...), cost: cost})
	202	+	p.recvUsed += cost
122	203		p.mu.Unlock()
123	204		select {
124	205		case p.wake <- struct{}{}:

@@ -128,7 +209,7 @@ func (p *streamPipe) deliver(chunk []byte) error {
128	209		}
129	210
130	211		// closeWith settles the pipe exactly once with cause. A nil cause is an orderly
131		-	// close; every blocked Read observes it promptly. On a nil cause, any chunks
	212	+	// close; every blocked Read observes it promptly. On a nil cause, any frames
132	213		// already queued are kept: Read serves them first and only returns io.EOF once
133	214		// the queue is drained, so a reply that arrived just before an orderly peer
134	215		// close is never discarded underneath its reader. An error cause is a failure:

@@ -144,7 +225,7 @@ func (p *streamPipe) closeWith(cause error) {
144	225		p.err = cause
145	226		if cause != nil {
146	227		p.queue = nil
147		-	p.queued = 0
	228	+	p.recvUsed = 0
148	229		}
149	230		p.mu.Unlock()
150	231		close(p.closedCh)


@@ -3,53 +3,80 @@ package brokeripc
3		import (	3		import (
4		"io"	4		"io"
5		"sync"	5		"sync"
			6	+
			7	+	"github.com/bnema/vev/internal/adapters/brokerwire"
6		)	8		)
7			9
8	-	// streamPipe is the private ordered, bounded byte channel between one broker	10	+	// streamPipe is the private ordered, credit-controlled byte channel between one
9	-	// wire session and the sessionwire framing of one logical stream.	11	+	// broker wire session and the sessionwire framing of one logical stream.
10		//	12		//
11	-	// The wire reader never blocks on a slow consumer: a chunk the peer sent is	13	+	// Each direction of a stream has a brokerwire.StreamWindowBytes credit window.
12	-	// appended to a bounded queue and refused with ErrStreamBackpressure once the	14	+	// The sender spends brokerwire.StreamChunkCredit per data frame before writing
13	-	// bound is reached, so only that stream is settled and every sibling and the	15	+	// it and waits while it has too little, so a slow consumer slows its own
14	-	// physical connection stay untouched. The consumer never blocks the writer:	16	+	// sender instead of failing the stream. The receiver returns the credit of
15	-	// Read serves already-queued chunks or parks on the wake channel, and Close	17	+	// every frame its consumer has fully read with one StreamWindowUpdate per
16	-	// releases both ends promptly. Write hands each byte slice to the injected	18	+	// batch. Because a conforming peer never exceeds the window, the wire reader
17	-	// outbound hook, which owns chunking it under the negotiated stream chunk	19	+	// never blocks: it appends each frame to the queue, and a frame beyond the
18	-	// ceiling and enqueueing the frames on the connection.	20	+	// granted credit is a peer violation (ErrStreamCredit) that settles only that
			21	+	// stream. Close releases the reader, a writer waiting for credit, and the
			22	+	// writer's peer promptly.
19		type streamPipe struct {	23		type streamPipe struct {
20	-	mu sync.Mutex	24	+	mu sync.Mutex
21	-	queue [][]byte	25	+	queue []pipeChunk
22	-	queued int	26	+	closed bool
23	-	closed bool	27	+	err error
24	-	err error	28	+
25	-	maxChunk int	29	+	// recvUsed is the credit held by queued frames, recvReturn the credit of
26	-	maxBytes int	30	+	// fully read frames not yet granted back, and returnAt the batch size.
			31	+	recvUsed uint64
			32	+	recvReturn uint64
			33	+	returnAt uint64
			34	+	// sendCredit is what the peer still allows this side to send.
			35	+	sendCredit uint64
			36	+	creditWake chan struct{}
27			37
28		wake chan struct{}	38		wake chan struct{}
29		closedCh chan struct{}	39		closedCh chan struct{}
30			40
31		outbound func([]byte) error	41		outbound func([]byte) error
			42	+	grant func(uint64) error
32		}	43		}
33			44
34	-	// newStreamPipe builds one bounded stream carriage. outbound must not be nil.	45	+	// pipeChunk is one queued inbound frame and the credit it holds until it is
35	-	func newStreamPipe(maxChunks int, maxBytes uint64, outbound func([]byte) error) *streamPipe {	46	+	// fully read.
36	-	if maxChunks <= 0 {	47	+	type pipeChunk struct {
37	-	maxChunks = DefaultStreamInboundChunks	48	+	data []byte
38	-	}	49	+	cost uint64
39	-	if maxBytes == 0 {	50	+	}
40	-	maxBytes = DefaultStreamInboundBytes	51	+
41	-	}	52	+	// newStreamPipe builds one stream carriage. outbound writes one outbound byte
			53	+	// slice; grant returns consumed inbound credit to the peer. Neither may be nil.
			54	+	func newStreamPipe(outbound func([]byte) error, grant func(uint64) error) *streamPipe {
			55	+	window := brokerwire.StreamWindowBytes
42		return &streamPipe{	56		return &streamPipe{
43	-	maxChunk: maxChunks,	57	+	returnAt: streamCreditReturnAt(window),
44	-	maxBytes: int(maxBytes),	58	+	sendCredit: window,
45	-	wake: make(chan struct{}, 1),	59	+	creditWake: make(chan struct{}),
46	-	closedCh: make(chan struct{}),	60	+	wake: make(chan struct{}, 1),
47	-	outbound: outbound,	61	+	closedCh: make(chan struct{}),
			62	+	outbound: outbound,
			63	+	grant: grant,
48		}	64		}
49		}	65		}
50			66
51	-	// Read serves the next queued chunk, blocking until one arrives or the pipe	67	+	// streamCreditReturnAt is the consumed credit a receiver batches before it
52	-	// closes. A partial copy retains the unread remainder for the next call.	68	+	// grants it back: half the window, lowered so a sender blocked on a maximum
			69	+	// frame is always released. A sender waits only once more than
			70	+	// window-StreamChunkCredit(max) is unreturned, so granting at or below that
			71	+	// point can never deadlock.
			72	+	func streamCreditReturnAt(window uint64) uint64 {
			73	+	cost := brokerwire.StreamChunkCredit(int(brokerwire.MaxStreamChunkBytes))
			74	+	return max(min(window/2, window-cost+1), 1)
			75	+	}
			76	+
			77	+	// Read serves the next queued frame, blocking until one arrives or the pipe
			78	+	// closes. A partial copy retains the unread remainder for the next call. The
			79	+	// credit of each fully read frame is returned to the peer in batches.
53		func (p *streamPipe) Read(b []byte) (int, error) {	80		func (p *streamPipe) Read(b []byte) (int, error) {
54		if len(b) == 0 {	81		if len(b) == 0 {
55		return 0, nil	82		return 0, nil

@@ -57,16 +84,26 @@ func (p *streamPipe) Read(b []byte) (int, error) {
57		for {	84		for {
58		p.mu.Lock()	85		p.mu.Lock()
59		if len(p.queue) > 0 {	86		if len(p.queue) > 0 {
60	-	chunk := p.queue[0]	87	+	chunk := &p.queue[0]
61	-	n := copy(b, chunk)	88	+	n := copy(b, chunk.data)
62	-	if n == len(chunk) {	89	+	var grant uint64
63	-	p.queue[0] = nil	90	+	if n == len(chunk.data) {
			91	+	p.recvUsed -= chunk.cost
			92	+	p.recvReturn += chunk.cost
			93	+	p.queue[0] = pipeChunk{}
64		p.queue = p.queue[1:]	94		p.queue = p.queue[1:]
			95	+	if p.recvReturn >= p.returnAt && !p.closed {
			96	+	grant, p.recvReturn = p.recvReturn, 0
			97	+	}
65		} else {	98		} else {
66	-	p.queue[0] = chunk[n:]	99	+	chunk.data = chunk.data[n:]
67		}	100		}
68	-	p.queued -= n
69		p.mu.Unlock()	101		p.mu.Unlock()
			102	+	if grant > 0 {
			103	+	// A failed grant means the connection itself is failing; its
			104	+	// terminal path settles this stream, so there is nothing to retry.
			105	+	_ = p.grant(grant)
			106	+	}
70		return n, nil	107		return n, nil
71		}	108		}
72		if p.closed {	109		if p.closed {

@@ -85,8 +122,9 @@ func (p *streamPipe) Read(b []byte) (int, error) {
85		}	122		}
86		}	123		}
87			124
88	-	// Write hands one byte slice to the outbound hook. It returns ErrClosed once the	125	+	// Write hands one byte slice to the outbound hook, which spends send credit
89	-	// pipe reached its terminal outcome.	126	+	// per frame through reserve. It returns ErrStreamGone once the pipe reached its
			127	+	// terminal outcome.
90		func (p *streamPipe) Write(b []byte) (int, error) {	128		func (p *streamPipe) Write(b []byte) (int, error) {
91		p.mu.Lock()	129		p.mu.Lock()
92		closed := p.closed	130		closed := p.closed

@@ -100,25 +138,68 @@ func (p *streamPipe) Write(b []byte) (int, error) {
100		return len(b), nil	138		return len(b), nil
101		}	139		}
102			140
103	-	// deliver accepts one inbound chunk from the connection reader. It returns	141	+	// reserve spends the send credit of one outbound frame of n bytes, waiting for
104	-	// ErrStreamBackpressure when the bound is reached and ErrStreamGone once the	142	+	// the peer to grant more when it is short. It returns ErrStreamGone once the
105	-	// pipe is closed; the caller settles the affected stream in both cases.	143	+	// pipe closes, so a writer waiting for credit is always released.
			144	+	func (p *streamPipe) reserve(n int) error {
			145	+	cost := brokerwire.StreamChunkCredit(n)
			146	+	for {
			147	+	p.mu.Lock()
			148	+	if p.closed {
			149	+	p.mu.Unlock()
			150	+	return ErrStreamGone
			151	+	}
			152	+	if p.sendCredit >= cost {
			153	+	p.sendCredit -= cost
			154	+	p.mu.Unlock()
			155	+	return nil
			156	+	}
			157	+	wake := p.creditWake
			158	+	p.mu.Unlock()
			159	+	select {
			160	+	case <-wake:
			161	+	case <-p.closedCh:
			162	+	}
			163	+	}
			164	+	}
			165	+
			166	+	// granted adds credit the peer returned. Credit beyond the window is a peer
			167	+	// flow-control violation.
			168	+	func (p *streamPipe) granted(credit uint64) error {
			169	+	p.mu.Lock()
			170	+	defer p.mu.Unlock()
			171	+	if p.closed {
			172	+	return nil
			173	+	}
			174	+	if credit > brokerwire.StreamWindowBytes-p.sendCredit {
			175	+	return ErrStreamCredit
			176	+	}
			177	+	p.sendCredit += credit
			178	+	close(p.creditWake)
			179	+	p.creditWake = make(chan struct{})
			180	+	return nil
			181	+	}
			182	+
			183	+	// deliver accepts one inbound frame from the connection reader. It returns
			184	+	// ErrStreamCredit when the peer sent beyond the credit it was granted and
			185	+	// ErrStreamGone once the pipe is closed; the caller settles the affected stream
			186	+	// in both cases.
106		func (p *streamPipe) deliver(chunk []byte) error {	187		func (p *streamPipe) deliver(chunk []byte) error {
107		if len(chunk) == 0 {	188		if len(chunk) == 0 {
108		return nil	189		return nil
109		}	190		}
			191	+	cost := brokerwire.StreamChunkCredit(len(chunk))
110		p.mu.Lock()	192		p.mu.Lock()
111		if p.closed {	193		if p.closed {
112		p.mu.Unlock()	194		p.mu.Unlock()
113		return ErrStreamGone	195		return ErrStreamGone
114		}	196		}
115	-	if len(p.queue) >= p.maxChunk \|\| p.queued+len(chunk) > p.maxBytes {	197	+	if p.recvUsed+p.recvReturn+cost > brokerwire.StreamWindowBytes {
116		p.mu.Unlock()	198		p.mu.Unlock()
117	-	return ErrStreamBackpressure	199	+	return ErrStreamCredit
118		}	200		}
119	-	owned := append([]byte(nil), chunk...)	201	+	p.queue = append(p.queue, pipeChunk{data: append([]byte(nil), chunk...), cost: cost})
120	-	p.queue = append(p.queue, owned)	202	+	p.recvUsed += cost
121	-	p.queued += len(owned)
122		p.mu.Unlock()	203		p.mu.Unlock()
123		select {	204		select {
124		case p.wake <- struct{}{}:	205		case p.wake <- struct{}{}:

@@ -128,7 +209,7 @@ func (p *streamPipe) deliver(chunk []byte) error {
128		}	209		}
129			210
130		// closeWith settles the pipe exactly once with cause. A nil cause is an orderly	211		// closeWith settles the pipe exactly once with cause. A nil cause is an orderly
131	-	// close; every blocked Read observes it promptly. On a nil cause, any chunks	212	+	// close; every blocked Read observes it promptly. On a nil cause, any frames
132		// already queued are kept: Read serves them first and only returns io.EOF once	213		// already queued are kept: Read serves them first and only returns io.EOF once
133		// the queue is drained, so a reply that arrived just before an orderly peer	214		// the queue is drained, so a reply that arrived just before an orderly peer
134		// close is never discarded underneath its reader. An error cause is a failure:	215		// close is never discarded underneath its reader. An error cause is a failure:

@@ -144,7 +225,7 @@ func (p *streamPipe) closeWith(cause error) {
144		p.err = cause	225		p.err = cause
145		if cause != nil {	226		if cause != nil {
146		p.queue = nil	227		p.queue = nil
147	-	p.queued = 0	228	+	p.recvUsed = 0
148		}	229		}
149		p.mu.Unlock()	230		p.mu.Unlock()
150		close(p.closedCh)	231		close(p.closedCh)

M internal/adapters/brokeripc/pipe_test.go +98 -19


@@ -5,6 +5,7 @@ import (
5	5		"errors"
6	6		"io"
7	7		"testing"
	8	+	"time"
8	9
9	10		"github.com/bnema/vev/internal/adapters/brokerwire"
10	11		"github.com/bnema/vev/internal/protocol"

@@ -71,7 +72,7 @@ func TestStreamPipeCloseWithPreservesQueuedDataOnOrderlyClose(t *testing.T) {
71	72
72	73		for _, tt := range tests {
73	74		t.Run(tt.name, func(t *testing.T) {
74		-	p := newStreamPipe(0, 0, func([]byte) error { return nil })
	75	+	p := newTestPipe()
75	76		for _, chunk := range tt.chunks {
76	77		require.NoError(t, p.deliver(chunk))
77	78		}

@@ -109,26 +110,104 @@ func TestStreamPipeCloseWithPreservesQueuedDataOnOrderlyClose(t *testing.T) {
109	110		}
110	111		}
111	112
112		-	// TestStreamPipeHoldsAFullOutputWindow pins the client pipe headroom for the
113		-	// session output window. A client claims protocol.MaxOutputWindow unacked
114		-	// Output frames; with a terminal that is not draining, all of them may sit in
115		-	// this pipe at once, and overflow fails the whole stream
116		-	// (ErrStreamBackpressure). The frame size is a typical text repaint: a
117		-	// near-full page of a 500x140 terminal measured about 70 KB. Uncompressed diff
118		-	// frames with per-cell truecolor SGR can be far larger (estimated near 1 MB at
119		-	// 300x80), and eight of those can still overflow the default 4 MiB bound.
120		-	func TestStreamPipeHoldsAFullOutputWindow(t *testing.T) {
121		-	const frameBytes = 72 << 10
	113	+	// newTestPipe is a pipe whose outbound writes and credit grants go nowhere.
	114	+	func newTestPipe() *streamPipe {
	115	+	return newStreamPipe(func([]byte) error { return nil }, func(uint64) error { return nil })
	116	+	}
	117	+
	118	+	// TestStreamWindowCoversTheSessionOutputWindow pins the invariant that lets a
	119	+	// broker stream carry a full session output window without the daemon ever
	120	+	// waiting on the stream instead of on its own ACK window: the daemon's
	121	+	// unacknowledged byte budget plus one maximum Output fits in one stream window.
	122	+	// When it does not, credit still keeps every stream correct, only slower.
	123	+	func TestStreamWindowCoversTheSessionOutputWindow(t *testing.T) {
	124	+	require.GreaterOrEqual(t, brokerwire.StreamWindowBytes, uint64(protocol.MaxOutputWindowBytes),
	125	+	"one stream window must hold the daemon's whole unacknowledged byte budget")
	126	+	}
	127	+
	128	+	// TestStreamPipeCredit covers the receive and send sides of stream credit:
	129	+	// a peer may send up to one window, the consumer's reads return credit in
	130	+	// batches, a sender waits instead of failing while it has none, and grants or
	131	+	// data beyond the window are flow-control violations.
	132	+	func TestStreamPipeCredit(t *testing.T) {
122	133		chunk := int(brokerwire.MaxStreamChunkBytes)
123		-	p := newStreamPipe(0, 0, func([]byte) error { return nil })
124		-	payload := bytes.Repeat([]byte{'x'}, frameBytes)
125		-	for frame := range protocol.MaxOutputWindow {
126		-	for data := payload; len(data) > 0; {
127		-	n := min(len(data), chunk)
128		-	require.NoError(t, p.deliver(data[:n]), "frame %d overflowed the client pipe", frame)
129		-	data = data[n:]
	134	+	cost := brokerwire.StreamChunkCredit(chunk)
	135	+	perWindow := int(brokerwire.StreamWindowBytes / cost)
	136	+
	137	+	t.Run("a full window is accepted and one more frame is a violation", func(t *testing.T) {
	138	+	p := newTestPipe()
	139	+	for range perWindow {
	140	+	require.NoError(t, p.deliver(make([]byte, chunk)))
130	141		}
131		-	}
	142	+	require.ErrorIs(t, p.deliver(make([]byte, chunk)), ErrStreamCredit)
	143	+	})
	144	+
	145	+	t.Run("reads return credit in batches", func(t *testing.T) {
	146	+	var grants []uint64
	147	+	p := newStreamPipe(func([]byte) error { return nil }, func(c uint64) error { grants = append(grants, c); return nil })
	148	+	for range perWindow {
	149	+	require.NoError(t, p.deliver(make([]byte, chunk)))
	150	+	}
	151	+	buf := make([]byte, chunk)
	152	+	for range perWindow {
	153	+	_, err := io.ReadFull(p, buf)
	154	+	require.NoError(t, err)
	155	+	}
	156	+	require.NotEmpty(t, grants)
	157	+	total := uint64(0)
	158	+	for _, g := range grants {
	159	+	require.GreaterOrEqual(t, g, streamCreditReturnAt(brokerwire.StreamWindowBytes))
	160	+	total += g
	161	+	}
	162	+	require.LessOrEqual(t, total, uint64(perWindow)*cost)
	163	+	// Once the returned credit reaches the peer, the window is open again.
	164	+	require.NoError(t, p.deliver(make([]byte, chunk)))
	165	+	})
	166	+
	167	+	t.Run("a sender waits for credit and resumes on a grant", func(t *testing.T) {
	168	+	p := newTestPipe()
	169	+	for range perWindow {
	170	+	require.NoError(t, p.reserve(chunk))
	171	+	}
	172	+	reserved := make(chan error, 1)
	173	+	go func() { reserved <- p.reserve(chunk) }()
	174	+	select {
	175	+	case err := <-reserved:
	176	+	t.Fatalf("reserve returned %v without credit", err)
	177	+	case <-time.After(20 * time.Millisecond):
	178	+	}
	179	+	require.NoError(t, p.granted(cost))
	180	+	select {
	181	+	case err := <-reserved:
	182	+	require.NoError(t, err)
	183	+	case <-time.After(5 * time.Second):
	184	+	t.Fatal("a grant must release a sender waiting for credit")
	185	+	}
	186	+	})
	187	+
	188	+	t.Run("close releases a sender waiting for credit", func(t *testing.T) {
	189	+	p := newTestPipe()
	190	+	for range perWindow {
	191	+	require.NoError(t, p.reserve(chunk))
	192	+	}
	193	+	reserved := make(chan error, 1)
	194	+	go func() { reserved <- p.reserve(chunk) }()
	195	+	p.closeWith(ErrStreamGone)
	196	+	select {
	197	+	case err := <-reserved:
	198	+	require.ErrorIs(t, err, ErrStreamGone)
	199	+	case <-time.After(5 * time.Second):
	200	+	t.Fatal("close must release a sender waiting for credit")
	201	+	}
	202	+	})
	203	+
	204	+	t.Run("a grant beyond the window is a violation", func(t *testing.T) {
	205	+	p := newTestPipe()
	206	+	require.ErrorIs(t, p.granted(1), ErrStreamCredit)
	207	+	require.NoError(t, p.reserve(chunk))
	208	+	require.NoError(t, p.granted(cost))
	209	+	require.ErrorIs(t, p.granted(1), ErrStreamCredit)
	210	+	})
132	211		}
133	212
134	213		// TestClientStreamPrefersTheFullOutputWindow pins what a real broker-routed


@@ -5,6 +5,7 @@ import (
5		"errors"	5		"errors"
6		"io"	6		"io"
7		"testing"	7		"testing"
			8	+	"time"
8			9
9		"github.com/bnema/vev/internal/adapters/brokerwire"	10		"github.com/bnema/vev/internal/adapters/brokerwire"
10		"github.com/bnema/vev/internal/protocol"	11		"github.com/bnema/vev/internal/protocol"

@@ -71,7 +72,7 @@ func TestStreamPipeCloseWithPreservesQueuedDataOnOrderlyClose(t *testing.T) {
71			72
72		for _, tt := range tests {	73		for _, tt := range tests {
73		t.Run(tt.name, func(t *testing.T) {	74		t.Run(tt.name, func(t *testing.T) {
74	-	p := newStreamPipe(0, 0, func([]byte) error { return nil })	75	+	p := newTestPipe()
75		for _, chunk := range tt.chunks {	76		for _, chunk := range tt.chunks {
76		require.NoError(t, p.deliver(chunk))	77		require.NoError(t, p.deliver(chunk))
77		}	78		}

@@ -109,26 +110,104 @@ func TestStreamPipeCloseWithPreservesQueuedDataOnOrderlyClose(t *testing.T) {
109		}	110		}
110		}	111		}
111			112
112	-	// TestStreamPipeHoldsAFullOutputWindow pins the client pipe headroom for the	113	+	// newTestPipe is a pipe whose outbound writes and credit grants go nowhere.
113	-	// session output window. A client claims protocol.MaxOutputWindow unacked	114	+	func newTestPipe() *streamPipe {
114	-	// Output frames; with a terminal that is not draining, all of them may sit in	115	+	return newStreamPipe(func([]byte) error { return nil }, func(uint64) error { return nil })
115	-	// this pipe at once, and overflow fails the whole stream	116	+	}
116	-	// (ErrStreamBackpressure). The frame size is a typical text repaint: a	117	+
117	-	// near-full page of a 500x140 terminal measured about 70 KB. Uncompressed diff	118	+	// TestStreamWindowCoversTheSessionOutputWindow pins the invariant that lets a
118	-	// frames with per-cell truecolor SGR can be far larger (estimated near 1 MB at	119	+	// broker stream carry a full session output window without the daemon ever
119	-	// 300x80), and eight of those can still overflow the default 4 MiB bound.	120	+	// waiting on the stream instead of on its own ACK window: the daemon's
120	-	func TestStreamPipeHoldsAFullOutputWindow(t *testing.T) {	121	+	// unacknowledged byte budget plus one maximum Output fits in one stream window.
121	-	const frameBytes = 72 << 10	122	+	// When it does not, credit still keeps every stream correct, only slower.
			123	+	func TestStreamWindowCoversTheSessionOutputWindow(t *testing.T) {
			124	+	require.GreaterOrEqual(t, brokerwire.StreamWindowBytes, uint64(protocol.MaxOutputWindowBytes),
			125	+	"one stream window must hold the daemon's whole unacknowledged byte budget")
			126	+	}
			127	+
			128	+	// TestStreamPipeCredit covers the receive and send sides of stream credit:
			129	+	// a peer may send up to one window, the consumer's reads return credit in
			130	+	// batches, a sender waits instead of failing while it has none, and grants or
			131	+	// data beyond the window are flow-control violations.
			132	+	func TestStreamPipeCredit(t *testing.T) {
122		chunk := int(brokerwire.MaxStreamChunkBytes)	133		chunk := int(brokerwire.MaxStreamChunkBytes)
123	-	p := newStreamPipe(0, 0, func([]byte) error { return nil })	134	+	cost := brokerwire.StreamChunkCredit(chunk)
124	-	payload := bytes.Repeat([]byte{'x'}, frameBytes)	135	+	perWindow := int(brokerwire.StreamWindowBytes / cost)
125	-	for frame := range protocol.MaxOutputWindow {	136	+
126	-	for data := payload; len(data) > 0; {	137	+	t.Run("a full window is accepted and one more frame is a violation", func(t *testing.T) {
127	-	n := min(len(data), chunk)	138	+	p := newTestPipe()
128	-	require.NoError(t, p.deliver(data[:n]), "frame %d overflowed the client pipe", frame)	139	+	for range perWindow {
129	-	data = data[n:]	140	+	require.NoError(t, p.deliver(make([]byte, chunk)))
130		}	141		}
131	-	}	142	+	require.ErrorIs(t, p.deliver(make([]byte, chunk)), ErrStreamCredit)
			143	+	})
			144	+
			145	+	t.Run("reads return credit in batches", func(t *testing.T) {
			146	+	var grants []uint64
			147	+	p := newStreamPipe(func([]byte) error { return nil }, func(c uint64) error { grants = append(grants, c); return nil })
			148	+	for range perWindow {
			149	+	require.NoError(t, p.deliver(make([]byte, chunk)))
			150	+	}
			151	+	buf := make([]byte, chunk)
			152	+	for range perWindow {
			153	+	_, err := io.ReadFull(p, buf)
			154	+	require.NoError(t, err)
			155	+	}
			156	+	require.NotEmpty(t, grants)
			157	+	total := uint64(0)
			158	+	for _, g := range grants {
			159	+	require.GreaterOrEqual(t, g, streamCreditReturnAt(brokerwire.StreamWindowBytes))
			160	+	total += g
			161	+	}
			162	+	require.LessOrEqual(t, total, uint64(perWindow)*cost)
			163	+	// Once the returned credit reaches the peer, the window is open again.
			164	+	require.NoError(t, p.deliver(make([]byte, chunk)))
			165	+	})
			166	+
			167	+	t.Run("a sender waits for credit and resumes on a grant", func(t *testing.T) {
			168	+	p := newTestPipe()
			169	+	for range perWindow {
			170	+	require.NoError(t, p.reserve(chunk))
			171	+	}
			172	+	reserved := make(chan error, 1)
			173	+	go func() { reserved <- p.reserve(chunk) }()
			174	+	select {
			175	+	case err := <-reserved:
			176	+	t.Fatalf("reserve returned %v without credit", err)
			177	+	case <-time.After(20 * time.Millisecond):
			178	+	}
			179	+	require.NoError(t, p.granted(cost))
			180	+	select {
			181	+	case err := <-reserved:
			182	+	require.NoError(t, err)
			183	+	case <-time.After(5 * time.Second):
			184	+	t.Fatal("a grant must release a sender waiting for credit")
			185	+	}
			186	+	})
			187	+
			188	+	t.Run("close releases a sender waiting for credit", func(t *testing.T) {
			189	+	p := newTestPipe()
			190	+	for range perWindow {
			191	+	require.NoError(t, p.reserve(chunk))
			192	+	}
			193	+	reserved := make(chan error, 1)
			194	+	go func() { reserved <- p.reserve(chunk) }()
			195	+	p.closeWith(ErrStreamGone)
			196	+	select {
			197	+	case err := <-reserved:
			198	+	require.ErrorIs(t, err, ErrStreamGone)
			199	+	case <-time.After(5 * time.Second):
			200	+	t.Fatal("close must release a sender waiting for credit")
			201	+	}
			202	+	})
			203	+
			204	+	t.Run("a grant beyond the window is a violation", func(t *testing.T) {
			205	+	p := newTestPipe()
			206	+	require.ErrorIs(t, p.granted(1), ErrStreamCredit)
			207	+	require.NoError(t, p.reserve(chunk))
			208	+	require.NoError(t, p.granted(cost))
			209	+	require.ErrorIs(t, p.granted(1), ErrStreamCredit)
			210	+	})
132		}	211		}
133			212
134		// TestClientStreamPrefersTheFullOutputWindow pins what a real broker-routed	213		// TestClientStreamPrefersTheFullOutputWindow pins what a real broker-routed

M internal/adapters/brokeripc/server.go +5 -0


@@ -763,6 +763,11 @@ func (s *serverSession) dispatch(message brokerwire.ClientMessage) error {
763	763		}
764	764		s.closeStreamByPeer(m.Stream)
765	765		return nil
	766	+	case brokerwire.StreamWindowUpdate:
	767	+	if !s.scopeMatches(m.Epoch, m.Connection) {
	768	+	return s.refuseScope()
	769	+	}
	770	+	return s.grantStreamCredit(m)
766	771		case brokerwire.StartPreview:
767	772		if !s.scopeMatches(m.Epoch, m.Connection) {
768	773		return s.refuseScope()


@@ -763,6 +763,11 @@ func (s *serverSession) dispatch(message brokerwire.ClientMessage) error {
763	}	763		}
764	s.closeStreamByPeer(m.Stream)	764		s.closeStreamByPeer(m.Stream)
765	return nil	765		return nil
		766	+	case brokerwire.StreamWindowUpdate:
		767	+	if !s.scopeMatches(m.Epoch, m.Connection) {
		768	+	return s.refuseScope()
		769	+	}
		770	+	return s.grantStreamCredit(m)
766	case brokerwire.StartPreview:	771		case brokerwire.StartPreview:
767	if !s.scopeMatches(m.Epoch, m.Connection) {	772		if !s.scopeMatches(m.Epoch, m.Connection) {
768	return s.refuseScope()	773		return s.refuseScope()

M internal/adapters/brokeripc/session_test.go +47 -22


@@ -856,43 +856,68 @@ func TestStalledSubscriberDoesNotBlockOtherClients(t *testing.T) {
856	856		requireConnectionDelegates(t, active)
857	857		}
858	858
859		-	// TestClientStreamBackpressureSettlesOnlyThatStream proves a local consumer that
860		-	// stops draining a stream's bounded inbound queue settles exactly that stream:
861		-	// the peer is told, the stream reports backpressure, and the connection and its
862		-	// operations stay up.
863		-	func TestClientStreamBackpressureSettlesOnlyThatStream(t *testing.T) {
	859	+	// TestStalledClientStreamWaitsForCredit proves a local consumer that stops
	860	+	// reading slows the broker relay instead of losing its stream: the daemon's
	861	+	// messages beyond one stream window wait at the broker, every one is delivered
	862	+	// in order once the consumer reads again, and the connection stays usable
	863	+	// meanwhile.
	864	+	func TestStalledClientStreamWaitsForCredit(t *testing.T) {
864	865		e := startEndpoint(t, Config{MaxClients: 2})
865		-	client := e.dialWith(Config{StreamInboundChunks: 1})
	866	+	client := e.dial()
866	867		_ = e.accept()
867	868		core := e.authority.last()
868	869
869		-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
	870	+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
870	871		defer cancel()
871	872		stream, err := client.OpenStream(ctx, openRequest(nextStreamID(t, client)))
872	873		require.NoError(t, err)
	874	+	t.Cleanup(func() { _ = stream.Close() })
873	875		conn := core.logicalConn(1)
874	876		require.NotNil(t, conn)
	877	+	// Complete the session preamble before the daemon speaks.
	878	+	require.NoError(t, stream.SendClient(protocol.Ping{}))
	879	+	select {
	880	+	case <-conn.fromClient:
	881	+	case <-ctx.Done():
	882	+	t.Fatal("client message never reached the broker core")
	883	+	}
875	884
876		-	// Two daemon messages arrive while the local consumer never reads: the
877		-	// bounded capacity-one queue refuses the second one.
878		-	conn.toClient <- protocol.Pong{}
879		-	conn.toClient <- protocol.Pong{}
	885	+	// Well over one stream window of daemon output while nothing reads. Side
	886	+	// effect Outputs need no view context; random-looking data defeats
	887	+	// compression so every byte crosses the stream.
	888	+	const messages = 24
	889	+	data := make([]byte, 512<<10)
	890	+	for i := range data {
	891	+	data[i] = byte(i*131 + i/7)
	892	+	}
	893	+	go func() {
	894	+	for i := range messages {
	895	+	payload := append([]byte{byte(i)}, data...)
	896	+	select {
	897	+	case conn.toClient <- protocol.Output{Epoch: 1, Size: domain.Size{Cols: 80, Rows: 24}, Data: payload}:
	898	+	case <-ctx.Done():
	899	+	return
	900	+	}
	901	+	}
	902	+	}()
880	903
	904	+	// The relay is blocked on credit, not failed: the stream stays open and the
	905	+	// connection keeps serving other work.
881	906		select {
882	907		case <-stream.Done():
883		-	case <-time.After(5 * time.Second):
884		-	t.Fatal("a stalled stream consumer must settle the stream")
	908	+	t.Fatalf("a stalled consumer must not settle its stream: %v", stream.Err())
	909	+	case <-time.After(200 * time.Millisecond):
885	910		}
886		-	require.ErrorIs(t, stream.(*clientStream).Err(), ErrStreamBackpressure)
887		-
888		-	require.Eventually(t, func() bool {
889		-	core.mu.Lock()
890		-	defer core.mu.Unlock()
891		-	return len(core.closedIDs) > 0
892		-	}, 5time.Second, 10time.Millisecond, "the broker must be told to retire the stalled stream")
893		-
894		-	// The connection survives a stream-local stall.
895	911		requireConnectionDelegates(t, client)
	912	+
	913	+	for i := range messages {
	914	+	message, err := stream.ReceiveServer()
	915	+	require.NoError(t, err)
	916	+	got, ok := message.(protocol.Output)
	917	+	require.True(t, ok, "message %d is %T", i, message)
	918	+	require.Len(t, got.Data, len(data)+1)
	919	+	require.Equal(t, byte(i), got.Data[0], "messages arrive in order")
	920	+	}
896	921		}
897	922
898	923		// TestOrderlyStreamCloseReportsNoError proves a local close is an orderly end:

 	requireConnectionDelegates(t, active)
 }
-// TestClientStreamBackpressureSettlesOnlyThatStream proves a local consumer that
+// TestStalledClientStreamWaitsForCredit proves a local consumer that stops
-// stops draining a stream's bounded inbound queue settles exactly that stream:
+// reading slows the broker relay instead of losing its stream: the daemon's
-// the peer is told, the stream reports backpressure, and the connection and its
+// messages beyond one stream window wait at the broker, every one is delivered
-// operations stay up.
+// in order once the consumer reads again, and the connection stays usable
-func TestClientStreamBackpressureSettlesOnlyThatStream(t *testing.T) {
+// meanwhile.
+func TestStalledClientStreamWaitsForCredit(t *testing.T) {
 	e := startEndpoint(t, Config{MaxClients: 2})
-	client := e.dialWith(Config{StreamInboundChunks: 1})
+	client := e.dial()
 	_ = e.accept()
 	core := e.authority.last()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 	stream, err := client.OpenStream(ctx, openRequest(nextStreamID(t, client)))
 	require.NoError(t, err)
+	t.Cleanup(func() { _ = stream.Close() })
 	conn := core.logicalConn(1)
 	require.NotNil(t, conn)
+	// Complete the session preamble before the daemon speaks.
+	require.NoError(t, stream.SendClient(protocol.Ping{}))
+	select {
+	case <-conn.fromClient:
+	case <-ctx.Done():
+		t.Fatal("client message never reached the broker core")
+	}
-	// Two daemon messages arrive while the local consumer never reads: the
+	// Well over one stream window of daemon output while nothing reads. Side
-	// bounded capacity-one queue refuses the second one.
+	// effect Outputs need no view context; random-looking data defeats
-	conn.toClient <- protocol.Pong{}
+	// compression so every byte crosses the stream.
-	conn.toClient <- protocol.Pong{}
+	const messages = 24
+	data := make([]byte, 512<<10)
+	for i := range data {
+		data[i] = byte(i*131 + i/7)
+	}
+	go func() {
+		for i := range messages {
+			payload := append([]byte{byte(i)}, data...)
+			select {
+			case conn.toClient <- protocol.Output{Epoch: 1, Size: domain.Size{Cols: 80, Rows: 24}, Data: payload}:
+			case <-ctx.Done():
+				return
+			}
+		}
+	}()
+	// The relay is blocked on credit, not failed: the stream stays open and the
+	// connection keeps serving other work.
 	select {
 	case <-stream.Done():
-	case <-time.After(5 * time.Second):
+		t.Fatalf("a stalled consumer must not settle its stream: %v", stream.Err())
-		t.Fatal("a stalled stream consumer must settle the stream")
+	case <-time.After(200 * time.Millisecond):
 	}
-	require.ErrorIs(t, stream.(*clientStream).Err(), ErrStreamBackpressure)
-	require.Eventually(t, func() bool {
-		core.mu.Lock()
-		defer core.mu.Unlock()
-		return len(core.closedIDs) > 0
-	}, 5*time.Second, 10*time.Millisecond, "the broker must be told to retire the stalled stream")
-	// The connection survives a stream-local stall.
 	requireConnectionDelegates(t, client)
+	for i := range messages {
+		message, err := stream.ReceiveServer()
+		require.NoError(t, err)
+		got, ok := message.(protocol.Output)
+		require.True(t, ok, "message %d is %T", i, message)
+		require.Len(t, got.Data, len(data)+1)
+		require.Equal(t, byte(i), got.Data[0], "messages arrive in order")
+	}
 }
 // TestOrderlyStreamCloseReportsNoError proves a local close is an orderly end:

M internal/adapters/brokeripc/stream.go +64 -29


@@ -42,13 +42,15 @@ func newServerStream(s *serverSession, id ports.BrokerStreamID, core ports.Broke
42	42		return nil, ErrConfig
43	43		}
44	44		st := &serverStream{session: s, id: id, core: core, done: make(chan struct{})}
45		-	st.pipe = newStreamPipe(s.cfg.StreamInboundChunks, s.cfg.StreamInboundBytes, st.sendChunk)
	45	+	st.pipe = newStreamPipe(st.sendChunk, st.grantCredit)
46	46		st.carriage = newCarriage(st.pipe)
47	47		return st, nil
48	48		}
49	49
50	50		// sendChunk splits one outbound byte slice under the negotiated stream chunk
51		-	// ceiling and writes each frame in order.
	51	+	// ceiling and writes each frame in order, waiting for the client's credit
	52	+	// before each one: a client that is not reading slows this relay, and through
	53	+	// the daemon link the daemon, instead of losing its stream.
52	54		func (st *serverStream) sendChunk(data []byte) error {
53	55		ceiling := int(st.session.ceilings.StreamChunkLimit)
54	56		if ceiling <= 0 {

@@ -56,6 +58,9 @@ func (st *serverStream) sendChunk(data []byte) error {
56	58		}
57	59		for len(data) > 0 {
58	60		n := min(len(data), ceiling)
	61	+	if err := st.pipe.reserve(n); err != nil {
	62	+	return err
	63	+	}
59	64		if err := st.session.send(brokerwire.ServerStreamData{
60	65		Epoch: st.session.epoch, Connection: st.session.scope.Connection, Stream: st.id, Data: data[:n],
61	66		}); err != nil {

@@ -66,6 +71,13 @@ func (st *serverStream) sendChunk(data []byte) error {
66	71		return nil
67	72		}
68	73
	74	+	// grantCredit returns consumed inbound credit to the client.
	75	+	func (st *serverStream) grantCredit(credit uint64) error {
	76	+	return st.session.send(brokerwire.StreamWindowUpdate{
	77	+	Epoch: st.session.epoch, Connection: st.session.scope.Connection, Stream: st.id, Credit: credit,
	78	+	})
	79	+	}
	80	+
69	81		// deliver accepts one inbound chunk from the connection reader.
70	82		func (st *serverStream) deliver(chunk []byte) error { return st.pipe.deliver(chunk) }
71	83

@@ -347,36 +359,47 @@ func (s *serverSession) closeStreamByPeer(id ports.BrokerStreamID) {
347	359		_ = s.core.CloseStream(s.scope.Connection, id)
348	360		}
349	361
350		-	// deliverStreamData routes one inbound client chunk to its bridge. Backpressure
351		-	// settles only that stream; a chunk for an identity the peer never opened is a
352		-	// protocol violation.
	362	+	// deliverStreamData routes one inbound client chunk to its bridge. Data beyond
	363	+	// the granted credit settles only that stream; a chunk for an identity the peer
	364	+	// never opened is a protocol violation.
353	365		func (s *serverSession) deliverStreamData(m brokerwire.ClientStreamData) error {
354		-	disposition, err := s.conn.StreamData(m.Stream)
355		-	if err != nil {
356		-	// Stream data for a stream that was never allocated, or before it was
357		-	// confirmed open, is a peer protocol violation.
358		-	return errors.Join(ErrProtocol, err)
	366	+	st, err := s.streamFor(m.Stream)
	367	+	if st == nil \|\| err != nil {
	368	+	return err
359	369		}
360		-	if disposition == brokerwire.StreamDiscarded {
361		-	return nil
	370	+	if err := st.deliver(m.Data); errors.Is(err, ErrStreamCredit) {
	371	+	s.settleStream(st, ErrStreamCredit)
362	372		}
363		-	st := s.lookupStream(m.Stream)
364		-	if st == nil {
365		-	// The bridge was settled between the tracker check and the lookup (a
366		-	// stream-local failure won the race); the chunk is discarded with it.
367		-	return nil
	373	+	// Any other error means the stream already reached its terminal outcome;
	374	+	// its data is discarded.
	375	+	return nil
	376	+	}
	377	+
	378	+	// grantStreamCredit applies one client credit grant to its bridge.
	379	+	func (s *serverSession) grantStreamCredit(m brokerwire.StreamWindowUpdate) error {
	380	+	st, err := s.streamFor(m.Stream)
	381	+	if st == nil \|\| err != nil {
	382	+	return err
368	383		}
369		-	switch err := st.deliver(m.Data); {
370		-	case err == nil:
371		-	return nil
372		-	case errors.Is(err, ErrStreamBackpressure):
373		-	s.settleStream(st, ErrStreamBackpressure)
374		-	return nil
375		-	default:
376		-	// The stream already reached its terminal outcome; its data is
377		-	// discarded.
378		-	return nil
	384	+	if err := st.pipe.granted(m.Credit); err != nil {
	385	+	s.settleStream(st, err)
	386	+	}
	387	+	return nil
	388	+	}
	389	+
	390	+	// streamFor classifies one stream-scoped frame and returns its live bridge. A
	391	+	// frame for a retired stream, or one settled between the tracker check and the
	392	+	// lookup, yields no bridge and no error; a frame for a stream that was never
	393	+	// allocated, or before it was confirmed open, is a peer protocol violation.
	394	+	func (s serverSession) streamFor(id ports.BrokerStreamID) (serverStream, error) {
	395	+	disposition, err := s.conn.StreamData(id)
	396	+	if err != nil {
	397	+	return nil, errors.Join(ErrProtocol, err)
	398	+	}
	399	+	if disposition == brokerwire.StreamDiscarded {
	400	+	return nil, nil
379	401		}
	402	+	return s.lookupStream(id), nil
380	403		}
381	404
382	405		// clientStream is the client-side half of one logical stream: the sessionwire

@@ -407,7 +430,7 @@ func newClientStream(c client, id ports.BrokerStreamID) (clientStream, error)
407	430		opened: make(chan error, 1),
408	431		done: make(chan struct{}),
409	432		}
410		-	st.pipe = newStreamPipe(c.cfg.StreamInboundChunks, c.cfg.StreamInboundBytes, st.sendChunk)
	433	+	st.pipe = newStreamPipe(st.sendChunk, st.grantCredit)
411	434		st.carriage = newCarriage(st.pipe)
412	435		st.ClientConnection = sessionwire.NewClientConnection(st.carriage)
413	436		if st.ClientConnection == nil {

@@ -417,7 +440,7 @@ func newClientStream(c client, id ports.BrokerStreamID) (clientStream, error)
417	440		}
418	441
419	442		// sendChunk splits one outbound client byte slice under the negotiated stream
420		-	// chunk ceiling.
	443	+	// chunk ceiling, waiting for the broker's credit before each frame.
421	444		func (st *clientStream) sendChunk(data []byte) error {
422	445		ceiling := int(st.client.ceilings.StreamChunkLimit)
423	446		if ceiling <= 0 {

@@ -425,6 +448,9 @@ func (st *clientStream) sendChunk(data []byte) error {
425	448		}
426	449		for len(data) > 0 {
427	450		n := min(len(data), ceiling)
	451	+	if err := st.pipe.reserve(n); err != nil {
	452	+	return err
	453	+	}
428	454		if err := st.client.send(brokerwire.ClientStreamData{
429	455		Epoch: st.client.scope.Epoch, Connection: st.client.scope.Connection, Stream: st.id, Data: data[:n],
430	456		}); err != nil {

@@ -435,6 +461,15 @@ func (st *clientStream) sendChunk(data []byte) error {
435	461		return nil
436	462		}
437	463
	464	+	// grantCredit returns consumed inbound credit to the broker. It is written
	465	+	// synchronously because a dropped grant would stall the stream forever; the
	466	+	// write never waits long, since the broker's reader never blocks on a stream.
	467	+	func (st *clientStream) grantCredit(credit uint64) error {
	468	+	return st.client.send(brokerwire.StreamWindowUpdate{
	469	+	Epoch: st.client.scope.Epoch, Connection: st.client.scope.Connection, Stream: st.id, Credit: credit,
	470	+	})
	471	+	}
	472	+
438	473		// deliver accepts one inbound server chunk.
439	474		func (st *clientStream) deliver(chunk []byte) error { return st.pipe.deliver(chunk) }
440	475


@@ -42,13 +42,15 @@ func newServerStream(s *serverSession, id ports.BrokerStreamID, core ports.Broke
42		return nil, ErrConfig	42		return nil, ErrConfig
43		}	43		}
44		st := &serverStream{session: s, id: id, core: core, done: make(chan struct{})}	44		st := &serverStream{session: s, id: id, core: core, done: make(chan struct{})}
45	-	st.pipe = newStreamPipe(s.cfg.StreamInboundChunks, s.cfg.StreamInboundBytes, st.sendChunk)	45	+	st.pipe = newStreamPipe(st.sendChunk, st.grantCredit)
46		st.carriage = newCarriage(st.pipe)	46		st.carriage = newCarriage(st.pipe)
47		return st, nil	47		return st, nil
48		}	48		}
49			49
50		// sendChunk splits one outbound byte slice under the negotiated stream chunk	50		// sendChunk splits one outbound byte slice under the negotiated stream chunk
51	-	// ceiling and writes each frame in order.	51	+	// ceiling and writes each frame in order, waiting for the client's credit
			52	+	// before each one: a client that is not reading slows this relay, and through
			53	+	// the daemon link the daemon, instead of losing its stream.
52		func (st *serverStream) sendChunk(data []byte) error {	54		func (st *serverStream) sendChunk(data []byte) error {
53		ceiling := int(st.session.ceilings.StreamChunkLimit)	55		ceiling := int(st.session.ceilings.StreamChunkLimit)
54		if ceiling <= 0 {	56		if ceiling <= 0 {

@@ -56,6 +58,9 @@ func (st *serverStream) sendChunk(data []byte) error {
56		}	58		}
57		for len(data) > 0 {	59		for len(data) > 0 {
58		n := min(len(data), ceiling)	60		n := min(len(data), ceiling)
			61	+	if err := st.pipe.reserve(n); err != nil {
			62	+	return err
			63	+	}
59		if err := st.session.send(brokerwire.ServerStreamData{	64		if err := st.session.send(brokerwire.ServerStreamData{
60		Epoch: st.session.epoch, Connection: st.session.scope.Connection, Stream: st.id, Data: data[:n],	65		Epoch: st.session.epoch, Connection: st.session.scope.Connection, Stream: st.id, Data: data[:n],
61		}); err != nil {	66		}); err != nil {

@@ -66,6 +71,13 @@ func (st *serverStream) sendChunk(data []byte) error {
66		return nil	71		return nil
67		}	72		}
68			73
			74	+	// grantCredit returns consumed inbound credit to the client.
			75	+	func (st *serverStream) grantCredit(credit uint64) error {
			76	+	return st.session.send(brokerwire.StreamWindowUpdate{
			77	+	Epoch: st.session.epoch, Connection: st.session.scope.Connection, Stream: st.id, Credit: credit,
			78	+	})
			79	+	}
			80	+
69		// deliver accepts one inbound chunk from the connection reader.	81		// deliver accepts one inbound chunk from the connection reader.
70		func (st *serverStream) deliver(chunk []byte) error { return st.pipe.deliver(chunk) }	82		func (st *serverStream) deliver(chunk []byte) error { return st.pipe.deliver(chunk) }
71			83

@@ -347,36 +359,47 @@ func (s *serverSession) closeStreamByPeer(id ports.BrokerStreamID) {
347		_ = s.core.CloseStream(s.scope.Connection, id)	359		_ = s.core.CloseStream(s.scope.Connection, id)
348		}	360		}
349			361
350	-	// deliverStreamData routes one inbound client chunk to its bridge. Backpressure	362	+	// deliverStreamData routes one inbound client chunk to its bridge. Data beyond
351	-	// settles only that stream; a chunk for an identity the peer never opened is a	363	+	// the granted credit settles only that stream; a chunk for an identity the peer
352	-	// protocol violation.	364	+	// never opened is a protocol violation.
353		func (s *serverSession) deliverStreamData(m brokerwire.ClientStreamData) error {	365		func (s *serverSession) deliverStreamData(m brokerwire.ClientStreamData) error {
354	-	disposition, err := s.conn.StreamData(m.Stream)	366	+	st, err := s.streamFor(m.Stream)
355	-	if err != nil {	367	+	if st == nil \|\| err != nil {
356	-	// Stream data for a stream that was never allocated, or before it was	368	+	return err
357	-	// confirmed open, is a peer protocol violation.
358	-	return errors.Join(ErrProtocol, err)
359		}	369		}
360	-	if disposition == brokerwire.StreamDiscarded {	370	+	if err := st.deliver(m.Data); errors.Is(err, ErrStreamCredit) {
361	-	return nil	371	+	s.settleStream(st, ErrStreamCredit)
362		}	372		}
363	-	st := s.lookupStream(m.Stream)	373	+	// Any other error means the stream already reached its terminal outcome;
364	-	if st == nil {	374	+	// its data is discarded.
365	-	// The bridge was settled between the tracker check and the lookup (a	375	+	return nil
366	-	// stream-local failure won the race); the chunk is discarded with it.	376	+	}
367	-	return nil	377	+
			378	+	// grantStreamCredit applies one client credit grant to its bridge.
			379	+	func (s *serverSession) grantStreamCredit(m brokerwire.StreamWindowUpdate) error {
			380	+	st, err := s.streamFor(m.Stream)
			381	+	if st == nil \|\| err != nil {
			382	+	return err
368		}	383		}
369	-	switch err := st.deliver(m.Data); {	384	+	if err := st.pipe.granted(m.Credit); err != nil {
370	-	case err == nil:	385	+	s.settleStream(st, err)
371	-	return nil	386	+	}
372	-	case errors.Is(err, ErrStreamBackpressure):	387	+	return nil
373	-	s.settleStream(st, ErrStreamBackpressure)	388	+	}
374	-	return nil	389	+
375	-	default:	390	+	// streamFor classifies one stream-scoped frame and returns its live bridge. A
376	-	// The stream already reached its terminal outcome; its data is	391	+	// frame for a retired stream, or one settled between the tracker check and the
377	-	// discarded.	392	+	// lookup, yields no bridge and no error; a frame for a stream that was never
378	-	return nil	393	+	// allocated, or before it was confirmed open, is a peer protocol violation.
			394	+	func (s serverSession) streamFor(id ports.BrokerStreamID) (serverStream, error) {
			395	+	disposition, err := s.conn.StreamData(id)
			396	+	if err != nil {
			397	+	return nil, errors.Join(ErrProtocol, err)
			398	+	}
			399	+	if disposition == brokerwire.StreamDiscarded {
			400	+	return nil, nil
379		}	401		}
			402	+	return s.lookupStream(id), nil
380		}	403		}
381			404
382		// clientStream is the client-side half of one logical stream: the sessionwire	405		// clientStream is the client-side half of one logical stream: the sessionwire

@@ -407,7 +430,7 @@ func newClientStream(c client, id ports.BrokerStreamID) (clientStream, error)
407		opened: make(chan error, 1),	430		opened: make(chan error, 1),
408		done: make(chan struct{}),	431		done: make(chan struct{}),
409		}	432		}
410	-	st.pipe = newStreamPipe(c.cfg.StreamInboundChunks, c.cfg.StreamInboundBytes, st.sendChunk)	433	+	st.pipe = newStreamPipe(st.sendChunk, st.grantCredit)
411		st.carriage = newCarriage(st.pipe)	434		st.carriage = newCarriage(st.pipe)
412		st.ClientConnection = sessionwire.NewClientConnection(st.carriage)	435		st.ClientConnection = sessionwire.NewClientConnection(st.carriage)
413		if st.ClientConnection == nil {	436		if st.ClientConnection == nil {

@@ -417,7 +440,7 @@ func newClientStream(c client, id ports.BrokerStreamID) (clientStream, error)
417		}	440		}
418			441
419		// sendChunk splits one outbound client byte slice under the negotiated stream	442		// sendChunk splits one outbound client byte slice under the negotiated stream
420	-	// chunk ceiling.	443	+	// chunk ceiling, waiting for the broker's credit before each frame.
421		func (st *clientStream) sendChunk(data []byte) error {	444		func (st *clientStream) sendChunk(data []byte) error {
422		ceiling := int(st.client.ceilings.StreamChunkLimit)	445		ceiling := int(st.client.ceilings.StreamChunkLimit)
423		if ceiling <= 0 {	446		if ceiling <= 0 {

@@ -425,6 +448,9 @@ func (st *clientStream) sendChunk(data []byte) error {
425		}	448		}
426		for len(data) > 0 {	449		for len(data) > 0 {
427		n := min(len(data), ceiling)	450		n := min(len(data), ceiling)
			451	+	if err := st.pipe.reserve(n); err != nil {
			452	+	return err
			453	+	}
428		if err := st.client.send(brokerwire.ClientStreamData{	454		if err := st.client.send(brokerwire.ClientStreamData{
429		Epoch: st.client.scope.Epoch, Connection: st.client.scope.Connection, Stream: st.id, Data: data[:n],	455		Epoch: st.client.scope.Epoch, Connection: st.client.scope.Connection, Stream: st.id, Data: data[:n],
430		}); err != nil {	456		}); err != nil {

@@ -435,6 +461,15 @@ func (st *clientStream) sendChunk(data []byte) error {
435		return nil	461		return nil
436		}	462		}
437			463
			464	+	// grantCredit returns consumed inbound credit to the broker. It is written
			465	+	// synchronously because a dropped grant would stall the stream forever; the
			466	+	// write never waits long, since the broker's reader never blocks on a stream.
			467	+	func (st *clientStream) grantCredit(credit uint64) error {
			468	+	return st.client.send(brokerwire.StreamWindowUpdate{
			469	+	Epoch: st.client.scope.Epoch, Connection: st.client.scope.Connection, Stream: st.id, Credit: credit,
			470	+	})
			471	+	}
			472	+
438		// deliver accepts one inbound server chunk.	473		// deliver accepts one inbound server chunk.
439		func (st *clientStream) deliver(chunk []byte) error { return st.pipe.deliver(chunk) }	474		func (st *clientStream) deliver(chunk []byte) error { return st.pipe.deliver(chunk) }
440			475

M internal/adapters/brokerwire/codec.go +53 -0


@@ -241,6 +241,17 @@ func encodeClientEnvelope(message ClientMessage, maxChunkBytes uint64) (*wire.Br
241	241		return nil, ErrInvalidMessage
242	242		}
243	243		return encodeClientEnvelope(*m, maxChunkBytes)
	244	+	case StreamWindowUpdate:
	245	+	converted, err := streamWindowUpdateToWire(m)
	246	+	if err != nil {
	247	+	return nil, err
	248	+	}
	249	+	return &wire.BrokerClientEnvelope{Payload: &wire.BrokerClientEnvelope_StreamWindowUpdate{StreamWindowUpdate: converted}}, nil
	250	+	case *StreamWindowUpdate:
	251	+	if m == nil {
	252	+	return nil, ErrInvalidMessage
	253	+	}
	254	+	return encodeClientEnvelope(*m, maxChunkBytes)
244	255		case StartPreview:
245	256		converted, err := startPreviewToWire(m)
246	257		if err != nil {

@@ -308,6 +319,8 @@ func decodeClientEnvelope(envelope *wire.BrokerClientEnvelope, maxChunkBytes uin
308	319		return nil, ErrInvalidMessage
309	320		}
310	321		return CloseStream{Epoch: epoch, Connection: connection, Stream: stream}, nil
	322	+	case *wire.BrokerClientEnvelope_StreamWindowUpdate:
	323	+	return streamWindowUpdateFromWire(payload.StreamWindowUpdate)
311	324		case *wire.BrokerClientEnvelope_StartPreview:
312	325		return startPreviewFromWire(payload.StartPreview)
313	326		case *wire.BrokerClientEnvelope_CancelPreview:

@@ -707,6 +720,33 @@ func openStreamFromWire(message *wire.OpenStream) (OpenStream, error) {
707	720		return candidate, nil
708	721		}
709	722
	723	+	// streamWindowUpdateToWire refuses a zero or above-window grant: credit is
	724	+	// returned only for consumed data, so a valid grant never exceeds one window.
	725	+	func streamWindowUpdateToWire(m StreamWindowUpdate) (*wire.StreamWindowUpdate, error) {
	726	+	if m.Epoch == 0 \|\| m.Connection.Validate() != nil \|\| m.Stream.Validate() != nil {
	727	+	return nil, ErrInvalidMessage
	728	+	}
	729	+	if m.Credit == 0 \|\| m.Credit > StreamWindowBytes {
	730	+	return nil, ErrInvalidMessage
	731	+	}
	732	+	return &wire.StreamWindowUpdate{Ref: refToWire(m.Epoch, m.Connection, m.Stream), Credit: m.Credit}, nil
	733	+	}
	734	+
	735	+	func streamWindowUpdateFromWire(message *wire.StreamWindowUpdate) (StreamWindowUpdate, error) {
	736	+	if message == nil {
	737	+	return StreamWindowUpdate{}, ErrInvalidMessage
	738	+	}
	739	+	epoch, connection, stream, err := refFromWire(message.GetRef())
	740	+	if err != nil {
	741	+	return StreamWindowUpdate{}, ErrInvalidMessage
	742	+	}
	743	+	credit := message.GetCredit()
	744	+	if credit == 0 \|\| credit > StreamWindowBytes {
	745	+	return StreamWindowUpdate{}, ErrInvalidMessage
	746	+	}
	747	+	return StreamWindowUpdate{Epoch: epoch, Connection: connection, Stream: stream, Credit: credit}, nil
	748	+	}
	749	+
710	750		func clientStreamDataToWire(m ClientStreamData, maxChunkBytes uint64) (*wire.ClientStreamData, error) {
711	751		if m.Epoch == 0 {
712	752		return nil, ErrInvalidMessage

@@ -828,6 +868,17 @@ func encodeServerEnvelope(message ServerMessage, maxChunkBytes uint64) (*wire.Br
828	868		return nil, ErrInvalidMessage
829	869		}
830	870		return encodeServerEnvelope(*m, maxChunkBytes)
	871	+	case StreamWindowUpdate:
	872	+	converted, err := streamWindowUpdateToWire(m)
	873	+	if err != nil {
	874	+	return nil, err
	875	+	}
	876	+	return &wire.BrokerServerEnvelope{Payload: &wire.BrokerServerEnvelope_StreamWindowUpdate{StreamWindowUpdate: converted}}, nil
	877	+	case *StreamWindowUpdate:
	878	+	if m == nil {
	879	+	return nil, ErrInvalidMessage
	880	+	}
	881	+	return encodeServerEnvelope(*m, maxChunkBytes)
831	882		case StreamClosed:
832	883		converted, err := streamClosedToWire(m)
833	884		if err != nil {

@@ -929,6 +980,8 @@ func decodeServerEnvelope(envelope *wire.BrokerServerEnvelope, maxChunkBytes uin
929	980		return serverStreamDataFromWire(payload.ServerStreamData, maxChunkBytes)
930	981		case *wire.BrokerServerEnvelope_StreamClosed:
931	982		return streamClosedFromWire(payload.StreamClosed)
	983	+	case *wire.BrokerServerEnvelope_StreamWindowUpdate:
	984	+	return streamWindowUpdateFromWire(payload.StreamWindowUpdate)
932	985		case *wire.BrokerServerEnvelope_Progress:
933	986		return progressFromWire(payload.Progress)
934	987		case *wire.BrokerServerEnvelope_BrokerErrorMessage:


@@ -241,6 +241,17 @@ func encodeClientEnvelope(message ClientMessage, maxChunkBytes uint64) (*wire.Br
241	return nil, ErrInvalidMessage	241		return nil, ErrInvalidMessage
242	}	242		}
243	return encodeClientEnvelope(*m, maxChunkBytes)	243		return encodeClientEnvelope(*m, maxChunkBytes)
		244	+	case StreamWindowUpdate:
		245	+	converted, err := streamWindowUpdateToWire(m)
		246	+	if err != nil {
		247	+	return nil, err
		248	+	}
		249	+	return &wire.BrokerClientEnvelope{Payload: &wire.BrokerClientEnvelope_StreamWindowUpdate{StreamWindowUpdate: converted}}, nil
		250	+	case *StreamWindowUpdate:
		251	+	if m == nil {
		252	+	return nil, ErrInvalidMessage
		253	+	}
		254	+	return encodeClientEnvelope(*m, maxChunkBytes)
244	case StartPreview:	255		case StartPreview:
245	converted, err := startPreviewToWire(m)	256		converted, err := startPreviewToWire(m)
246	if err != nil {	257		if err != nil {

@@ -308,6 +319,8 @@ func decodeClientEnvelope(envelope *wire.BrokerClientEnvelope, maxChunkBytes uin
308	return nil, ErrInvalidMessage	319		return nil, ErrInvalidMessage
309	}	320		}
310	return CloseStream{Epoch: epoch, Connection: connection, Stream: stream}, nil	321		return CloseStream{Epoch: epoch, Connection: connection, Stream: stream}, nil
		322	+	case *wire.BrokerClientEnvelope_StreamWindowUpdate:
		323	+	return streamWindowUpdateFromWire(payload.StreamWindowUpdate)
311	case *wire.BrokerClientEnvelope_StartPreview:	324		case *wire.BrokerClientEnvelope_StartPreview:
312	return startPreviewFromWire(payload.StartPreview)	325		return startPreviewFromWire(payload.StartPreview)
313	case *wire.BrokerClientEnvelope_CancelPreview:	326		case *wire.BrokerClientEnvelope_CancelPreview:

@@ -707,6 +720,33 @@ func openStreamFromWire(message *wire.OpenStream) (OpenStream, error) {
707	return candidate, nil	720		return candidate, nil
708	}	721		}
709		722
		723	+	// streamWindowUpdateToWire refuses a zero or above-window grant: credit is
		724	+	// returned only for consumed data, so a valid grant never exceeds one window.
		725	+	func streamWindowUpdateToWire(m StreamWindowUpdate) (*wire.StreamWindowUpdate, error) {
		726	+	if m.Epoch == 0 \|\| m.Connection.Validate() != nil \|\| m.Stream.Validate() != nil {
		727	+	return nil, ErrInvalidMessage
		728	+	}
		729	+	if m.Credit == 0 \|\| m.Credit > StreamWindowBytes {
		730	+	return nil, ErrInvalidMessage
		731	+	}
		732	+	return &wire.StreamWindowUpdate{Ref: refToWire(m.Epoch, m.Connection, m.Stream), Credit: m.Credit}, nil
		733	+	}
		734	+
		735	+	func streamWindowUpdateFromWire(message *wire.StreamWindowUpdate) (StreamWindowUpdate, error) {
		736	+	if message == nil {
		737	+	return StreamWindowUpdate{}, ErrInvalidMessage
		738	+	}
		739	+	epoch, connection, stream, err := refFromWire(message.GetRef())
		740	+	if err != nil {
		741	+	return StreamWindowUpdate{}, ErrInvalidMessage
		742	+	}
		743	+	credit := message.GetCredit()
		744	+	if credit == 0 \|\| credit > StreamWindowBytes {
		745	+	return StreamWindowUpdate{}, ErrInvalidMessage
		746	+	}
		747	+	return StreamWindowUpdate{Epoch: epoch, Connection: connection, Stream: stream, Credit: credit}, nil
		748	+	}
		749	+
710	func clientStreamDataToWire(m ClientStreamData, maxChunkBytes uint64) (*wire.ClientStreamData, error) {	750		func clientStreamDataToWire(m ClientStreamData, maxChunkBytes uint64) (*wire.ClientStreamData, error) {
711	if m.Epoch == 0 {	751		if m.Epoch == 0 {
712	return nil, ErrInvalidMessage	752		return nil, ErrInvalidMessage

@@ -828,6 +868,17 @@ func encodeServerEnvelope(message ServerMessage, maxChunkBytes uint64) (*wire.Br
828	return nil, ErrInvalidMessage	868		return nil, ErrInvalidMessage
829	}	869		}
830	return encodeServerEnvelope(*m, maxChunkBytes)	870		return encodeServerEnvelope(*m, maxChunkBytes)
		871	+	case StreamWindowUpdate:
		872	+	converted, err := streamWindowUpdateToWire(m)
		873	+	if err != nil {
		874	+	return nil, err
		875	+	}
		876	+	return &wire.BrokerServerEnvelope{Payload: &wire.BrokerServerEnvelope_StreamWindowUpdate{StreamWindowUpdate: converted}}, nil
		877	+	case *StreamWindowUpdate:
		878	+	if m == nil {
		879	+	return nil, ErrInvalidMessage
		880	+	}
		881	+	return encodeServerEnvelope(*m, maxChunkBytes)
831	case StreamClosed:	882		case StreamClosed:
832	converted, err := streamClosedToWire(m)	883		converted, err := streamClosedToWire(m)
833	if err != nil {	884		if err != nil {

@@ -929,6 +980,8 @@ func decodeServerEnvelope(envelope *wire.BrokerServerEnvelope, maxChunkBytes uin
929	return serverStreamDataFromWire(payload.ServerStreamData, maxChunkBytes)	980		return serverStreamDataFromWire(payload.ServerStreamData, maxChunkBytes)
930	case *wire.BrokerServerEnvelope_StreamClosed:	981		case *wire.BrokerServerEnvelope_StreamClosed:
931	return streamClosedFromWire(payload.StreamClosed)	982		return streamClosedFromWire(payload.StreamClosed)
		983	+	case *wire.BrokerServerEnvelope_StreamWindowUpdate:
		984	+	return streamWindowUpdateFromWire(payload.StreamWindowUpdate)
932	case *wire.BrokerServerEnvelope_Progress:	985		case *wire.BrokerServerEnvelope_Progress:
933	return progressFromWire(payload.Progress)	986		return progressFromWire(payload.Progress)
934	case *wire.BrokerServerEnvelope_BrokerErrorMessage:	987		case *wire.BrokerServerEnvelope_BrokerErrorMessage:

M internal/adapters/brokerwire/limits.go +14 -0


@@ -39,8 +39,22 @@ const (
39	39		// MaxStreamChunkBytes is the largest legal stream chunk ceiling:
40	40		// 64 KiB per opaque stream frame.
41	41		MaxStreamChunkBytes uint64 = 64 << 10
	42	+
	43	+	// StreamWindowBytes is the stream-data credit each side of one logical
	44	+	// stream grants its peer per direction. A sender spends StreamChunkCredit
	45	+	// per data frame and waits when it has too little, so the receiver never
	46	+	// queues more than this per stream; StreamWindowUpdate returns the credit
	47	+	// of consumed frames.
	48	+	StreamWindowBytes uint64 = 4 << 20
	49	+	// StreamChunkCreditOverhead is the fixed credit one data frame costs on top
	50	+	// of its payload, so a burst of tiny frames is bounded in count as well.
	51	+	StreamChunkCreditOverhead uint64 = 64
42	52		)
43	53
	54	+	// StreamChunkCredit is the flow-control cost of one stream data frame of n
	55	+	// payload bytes.
	56	+	func StreamChunkCredit(n int) uint64 { return uint64(n) + StreamChunkCreditOverhead }
	57	+
44	58		// Ceilings are the immutable per-connection ceilings negotiated once by the
45	59		// broker preamble. MaxReceiveEnvelopeBytes bounds every envelope this side
46	60		// accepts; StreamChunkLimit bounds one opaque stream data frame in either


@@ -39,8 +39,22 @@ const (
39	// MaxStreamChunkBytes is the largest legal stream chunk ceiling:	39		// MaxStreamChunkBytes is the largest legal stream chunk ceiling:
40	// 64 KiB per opaque stream frame.	40		// 64 KiB per opaque stream frame.
41	MaxStreamChunkBytes uint64 = 64 << 10	41		MaxStreamChunkBytes uint64 = 64 << 10
		42	+
		43	+	// StreamWindowBytes is the stream-data credit each side of one logical
		44	+	// stream grants its peer per direction. A sender spends StreamChunkCredit
		45	+	// per data frame and waits when it has too little, so the receiver never
		46	+	// queues more than this per stream; StreamWindowUpdate returns the credit
		47	+	// of consumed frames.
		48	+	StreamWindowBytes uint64 = 4 << 20
		49	+	// StreamChunkCreditOverhead is the fixed credit one data frame costs on top
		50	+	// of its payload, so a burst of tiny frames is bounded in count as well.
		51	+	StreamChunkCreditOverhead uint64 = 64
42	)	52		)
43		53
		54	+	// StreamChunkCredit is the flow-control cost of one stream data frame of n
		55	+	// payload bytes.
		56	+	func StreamChunkCredit(n int) uint64 { return uint64(n) + StreamChunkCreditOverhead }
		57	+
44	// Ceilings are the immutable per-connection ceilings negotiated once by the	58		// Ceilings are the immutable per-connection ceilings negotiated once by the
45	// broker preamble. MaxReceiveEnvelopeBytes bounds every envelope this side	59		// broker preamble. MaxReceiveEnvelopeBytes bounds every envelope this side
46	// accepts; StreamChunkLimit bounds one opaque stream data frame in either	60		// accepts; StreamChunkLimit bounds one opaque stream data frame in either

M internal/adapters/brokerwire/messages.go +13 -0


@@ -165,6 +165,19 @@ type CloseStream struct {
165	165
166	166		func (CloseStream) brokerClientMessage() {}
167	167
	168	+	// StreamWindowUpdate grants the peer Credit more stream-data bytes on one
	169	+	// logical stream after the receiver consumed them. It travels in both
	170	+	// directions: each side grants credit for the data it receives.
	171	+	type StreamWindowUpdate struct {
	172	+	Epoch ports.BrokerEpoch
	173	+	Connection ports.BrokerConnectionID
	174	+	Stream ports.BrokerStreamID
	175	+	Credit uint64
	176	+	}
	177	+
	178	+	func (StreamWindowUpdate) brokerClientMessage() {}
	179	+	func (StreamWindowUpdate) brokerServerMessage() {}
	180	+
168	181		// StartPreview starts or replaces one connection-scoped live preview.
169	182		// Generation is the connection-scoped preview authority; Route names the
170	183		// observed daemon (the broker allocates the stream) and Preview is the bounded


@@ -165,6 +165,19 @@ type CloseStream struct {
165		165
166	func (CloseStream) brokerClientMessage() {}	166		func (CloseStream) brokerClientMessage() {}
167		167
		168	+	// StreamWindowUpdate grants the peer Credit more stream-data bytes on one
		169	+	// logical stream after the receiver consumed them. It travels in both
		170	+	// directions: each side grants credit for the data it receives.
		171	+	type StreamWindowUpdate struct {
		172	+	Epoch ports.BrokerEpoch
		173	+	Connection ports.BrokerConnectionID
		174	+	Stream ports.BrokerStreamID
		175	+	Credit uint64
		176	+	}
		177	+
		178	+	func (StreamWindowUpdate) brokerClientMessage() {}
		179	+	func (StreamWindowUpdate) brokerServerMessage() {}
		180	+
168	// StartPreview starts or replaces one connection-scoped live preview.	181		// StartPreview starts or replaces one connection-scoped live preview.
169	// Generation is the connection-scoped preview authority; Route names the	182		// Generation is the connection-scoped preview authority; Route names the
170	// observed daemon (the broker allocates the stream) and Preview is the bounded	183		// observed daemon (the broker allocates the stream) and Preview is the bounded

M internal/adapters/brokerwire/state.go +7 -0


@@ -486,6 +486,13 @@ func (c *Connection) StreamData(stream ports.BrokerStreamID) (StreamDisposition,
486	486		return c.streams.Data(c.scope, stream)
487	487		}
488	488
	489	+	// StreamWindowUpdate classifies one credit grant for a stream exactly like
	490	+	// stream data: legal while open, discarded once retired. The ready check and
	491	+	// the tracker lookup share one connection lock.
	492	+	func (c *Connection) StreamWindowUpdate(stream ports.BrokerStreamID) (StreamDisposition, error) {
	493	+	return c.StreamData(stream)
	494	+	}
	495	+
489	496		// StreamProgress reports one phase of an in-flight stream operation. The
490	497		// ready check and the tracker mutation share one connection lock.
491	498		func (c *Connection) StreamProgress(stream ports.BrokerStreamID) (StreamDisposition, error) {


@@ -486,6 +486,13 @@ func (c *Connection) StreamData(stream ports.BrokerStreamID) (StreamDisposition,
486	return c.streams.Data(c.scope, stream)	486		return c.streams.Data(c.scope, stream)
487	}	487		}
488		488
		489	+	// StreamWindowUpdate classifies one credit grant for a stream exactly like
		490	+	// stream data: legal while open, discarded once retired. The ready check and
		491	+	// the tracker lookup share one connection lock.
		492	+	func (c *Connection) StreamWindowUpdate(stream ports.BrokerStreamID) (StreamDisposition, error) {
		493	+	return c.StreamData(stream)
		494	+	}
		495	+
489	// StreamProgress reports one phase of an in-flight stream operation. The	496		// StreamProgress reports one phase of an in-flight stream operation. The
490	// ready check and the tracker mutation share one connection lock.	497		// ready check and the tracker mutation share one connection lock.
491	func (c *Connection) StreamProgress(stream ports.BrokerStreamID) (StreamDisposition, error) {	498		func (c *Connection) StreamProgress(stream ports.BrokerStreamID) (StreamDisposition, error) {

M internal/protocol/session.go +1 -1


@@ -17,7 +17,7 @@ import (
17	17		// daemonmux physical preamble conversation (multiplex.proto), whose
18	18		// negotiated ceilings and accepted daemon binding ride the same wire
19	19		// version as the session and broker conversations.
20		-	const Version uint16 = 65
	20	+	const Version uint16 = 66
21	21
22	22		// HandshakeTimeout bounds every transport handshake from connect through the
23	23		// first committed publication. It excludes the preceding client-local


@@ -17,7 +17,7 @@ import (
17		// daemonmux physical preamble conversation (multiplex.proto), whose	17		// daemonmux physical preamble conversation (multiplex.proto), whose
18		// negotiated ceilings and accepted daemon binding ride the same wire	18		// negotiated ceilings and accepted daemon binding ride the same wire
19		// version as the session and broker conversations.	19		// version as the session and broker conversations.
20	-	const Version uint16 = 65	20	+	const Version uint16 = 66
21			21
22		// HandshakeTimeout bounds every transport handshake from connect through the	22		// HandshakeTimeout bounds every transport handshake from connect through the
23		// first committed publication. It excludes the preceding client-local	23		// first committed publication. It excludes the preceding client-local

M internal/protocol/session_test.go +1 -1


@@ -10,7 +10,7 @@ import (
10	10		)
11	11
12	12		func TestVersionRemainsWireCompatible(t *testing.T) {
13		-	require.Equal(t, uint16(65), Version)
	13	+	require.Equal(t, uint16(66), Version)
14	14		require.Equal(t, (16<<20)-407, MaxOutputDataLen)
15	15		}
16	16


@@ -10,7 +10,7 @@ import (
10		)	10		)
11			11
12		func TestVersionRemainsWireCompatible(t *testing.T) {	12		func TestVersionRemainsWireCompatible(t *testing.T) {
13	-	require.Equal(t, uint16(65), Version)	13	+	require.Equal(t, uint16(66), Version)
14		require.Equal(t, (16<<20)-407, MaxOutputDataLen)	14		require.Equal(t, (16<<20)-407, MaxOutputDataLen)
15		}	15		}
16			16

M internal/protocol/wire/broker.pb.go +262 -163


@@ -390,6 +390,7 @@ type BrokerClientEnvelope struct {
390	390		// *BrokerClientEnvelope_UpdateHostPolicy
391	391		// *BrokerClientEnvelope_StartPreview
392	392		// *BrokerClientEnvelope_CancelPreview
	393	+	// *BrokerClientEnvelope_StreamWindowUpdate
393	394		Payload isBrokerClientEnvelope_Payload `protobuf_oneof:"payload"`
394	395		unknownFields protoimpl.UnknownFields
395	396		sizeCache protoimpl.SizeCache

@@ -549,6 +550,15 @@ func (x BrokerClientEnvelope) GetCancelPreview() CancelPreview {
549	550		return nil
550	551		}
551	552
	553	+	func (x BrokerClientEnvelope) GetStreamWindowUpdate() StreamWindowUpdate {
	554	+	if x != nil {
	555	+	if x, ok := x.Payload.(*BrokerClientEnvelope_StreamWindowUpdate); ok {
	556	+	return x.StreamWindowUpdate
	557	+	}
	558	+	}
	559	+	return nil
	560	+	}
	561	+
552	562		type isBrokerClientEnvelope_Payload interface {
553	563		isBrokerClientEnvelope_Payload()
554	564		}

@@ -605,6 +615,10 @@ type BrokerClientEnvelope_CancelPreview struct {
605	615		CancelPreview *CancelPreview `protobuf:"bytes,113,opt,name=cancel_preview,json=cancelPreview,proto3,oneof"`
606	616		}
607	617
	618	+	type BrokerClientEnvelope_StreamWindowUpdate struct {
	619	+	StreamWindowUpdate *StreamWindowUpdate `protobuf:"bytes,114,opt,name=stream_window_update,json=streamWindowUpdate,proto3,oneof"`
	620	+	}
	621	+
608	622		func (*BrokerClientEnvelope_Register) isBrokerClientEnvelope_Payload() {}
609	623
610	624		func (*BrokerClientEnvelope_Subscribe) isBrokerClientEnvelope_Payload() {}

@@ -631,6 +645,8 @@ func (*BrokerClientEnvelope_StartPreview) isBrokerClientEnvelope_Payload() {}
631	645
632	646		func (*BrokerClientEnvelope_CancelPreview) isBrokerClientEnvelope_Payload() {}
633	647
	648	+	func (*BrokerClientEnvelope_StreamWindowUpdate) isBrokerClientEnvelope_Payload() {}
	649	+
634	650		// BrokerServerEnvelope is the closed server-to-client broker union. Exactly
635	651		// one variant must be set per envelope.
636	652		type BrokerServerEnvelope struct {

@@ -647,6 +663,7 @@ type BrokerServerEnvelope struct {
647	663		// *BrokerServerEnvelope_BrokerErrorMessage
648	664		// *BrokerServerEnvelope_Shutdown
649	665		// *BrokerServerEnvelope_PreviewPublication
	666	+	// *BrokerServerEnvelope_StreamWindowUpdate
650	667		Payload isBrokerServerEnvelope_Payload `protobuf_oneof:"payload"`
651	668		unknownFields protoimpl.UnknownFields
652	669		sizeCache protoimpl.SizeCache

@@ -779,6 +796,15 @@ func (x BrokerServerEnvelope) GetPreviewPublication() PreviewPublication {
779	796		return nil
780	797		}
781	798
	799	+	func (x BrokerServerEnvelope) GetStreamWindowUpdate() StreamWindowUpdate {
	800	+	if x != nil {
	801	+	if x, ok := x.Payload.(*BrokerServerEnvelope_StreamWindowUpdate); ok {
	802	+	return x.StreamWindowUpdate
	803	+	}
	804	+	}
	805	+	return nil
	806	+	}
	807	+
782	808		type isBrokerServerEnvelope_Payload interface {
783	809		isBrokerServerEnvelope_Payload()
784	810		}

@@ -823,6 +849,10 @@ type BrokerServerEnvelope_PreviewPublication struct {
823	849		PreviewPublication *PreviewPublication `protobuf:"bytes,210,opt,name=preview_publication,json=previewPublication,proto3,oneof"`
824	850		}
825	851
	852	+	type BrokerServerEnvelope_StreamWindowUpdate struct {
	853	+	StreamWindowUpdate *StreamWindowUpdate `protobuf:"bytes,211,opt,name=stream_window_update,json=streamWindowUpdate,proto3,oneof"`
	854	+	}
	855	+
826	856		func (*BrokerServerEnvelope_Registered) isBrokerServerEnvelope_Payload() {}
827	857
828	858		func (*BrokerServerEnvelope_SnapshotPart) isBrokerServerEnvelope_Payload() {}

@@ -843,6 +873,8 @@ func (*BrokerServerEnvelope_Shutdown) isBrokerServerEnvelope_Payload() {}
843	873
844	874		func (*BrokerServerEnvelope_PreviewPublication) isBrokerServerEnvelope_Payload() {}
845	875
	876	+	func (*BrokerServerEnvelope_StreamWindowUpdate) isBrokerServerEnvelope_Payload() {}
	877	+
846	878		// Register opens one client connection to the broker.
847	879		type Register struct {
848	880		state protoimpl.MessageState `protogen:"open.v1"`

@@ -1563,6 +1595,62 @@ func (x CloseStream) GetRef() BrokerStreamRef {
1563	1595		return nil
1564	1596		}
1565	1597
	1598	+	// StreamWindowUpdate grants the peer credit to send more stream data on one
	1599	+	// logical stream: the receiver consumed that much of its stream window. Each
	1600	+	// direction of a stream has its own window, so a client grants credit for
	1601	+	// ServerStreamData and the server grants credit for ClientStreamData.
	1602	+	type StreamWindowUpdate struct {
	1603	+	state protoimpl.MessageState `protogen:"open.v1"`
	1604	+	Ref *BrokerStreamRef `protobuf:"bytes,1,opt,name=ref,proto3" json:"ref,omitempty"`
	1605	+	Credit uint64 `protobuf:"varint,2,opt,name=credit,proto3" json:"credit,omitempty"`
	1606	+	unknownFields protoimpl.UnknownFields
	1607	+	sizeCache protoimpl.SizeCache
	1608	+	}
	1609	+
	1610	+	func (x *StreamWindowUpdate) Reset() {
	1611	+	*x = StreamWindowUpdate{}
	1612	+	mi := &file_broker_proto_msgTypes[18]
	1613	+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	1614	+	ms.StoreMessageInfo(mi)
	1615	+	}
	1616	+
	1617	+	func (x *StreamWindowUpdate) String() string {
	1618	+	return protoimpl.X.MessageStringOf(x)
	1619	+	}
	1620	+
	1621	+	func (*StreamWindowUpdate) ProtoMessage() {}
	1622	+
	1623	+	func (x *StreamWindowUpdate) ProtoReflect() protoreflect.Message {
	1624	+	mi := &file_broker_proto_msgTypes[18]
	1625	+	if x != nil {
	1626	+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	1627	+	if ms.LoadMessageInfo() == nil {
	1628	+	ms.StoreMessageInfo(mi)
	1629	+	}
	1630	+	return ms
	1631	+	}
	1632	+	return mi.MessageOf(x)
	1633	+	}
	1634	+
	1635	+	// Deprecated: Use StreamWindowUpdate.ProtoReflect.Descriptor instead.
	1636	+	func (*StreamWindowUpdate) Descriptor() ([]byte, []int) {
	1637	+	return file_broker_proto_rawDescGZIP(), []int{18}
	1638	+	}
	1639	+
	1640	+	func (x StreamWindowUpdate) GetRef() BrokerStreamRef {
	1641	+	if x != nil {
	1642	+	return x.Ref
	1643	+	}
	1644	+	return nil
	1645	+	}
	1646	+
	1647	+	func (x *StreamWindowUpdate) GetCredit() uint64 {
	1648	+	if x != nil {
	1649	+	return x.Credit
	1650	+	}
	1651	+	return 0
	1652	+	}
	1653	+
1566	1654		// Registered confirms one accepted client connection and its assigned scope.
1567	1655		type Registered struct {
1568	1656		state protoimpl.MessageState `protogen:"open.v1"`

@@ -1575,7 +1663,7 @@ type Registered struct {
1575	1663
1576	1664		func (x *Registered) Reset() {
1577	1665		*x = Registered{}
1578		-	mi := &file_broker_proto_msgTypes[18]
	1666	+	mi := &file_broker_proto_msgTypes[19]
1579	1667		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1580	1668		ms.StoreMessageInfo(mi)
1581	1669		}

@@ -1587,7 +1675,7 @@ func (x *Registered) String() string {
1587	1675		func (*Registered) ProtoMessage() {}
1588	1676
1589	1677		func (x *Registered) ProtoReflect() protoreflect.Message {
1590		-	mi := &file_broker_proto_msgTypes[18]
	1678	+	mi := &file_broker_proto_msgTypes[19]
1591	1679		if x != nil {
1592	1680		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1593	1681		if ms.LoadMessageInfo() == nil {

@@ -1600,7 +1688,7 @@ func (x *Registered) ProtoReflect() protoreflect.Message {
1600	1688
1601	1689		// Deprecated: Use Registered.ProtoReflect.Descriptor instead.
1602	1690		func (*Registered) Descriptor() ([]byte, []int) {
1603		-	return file_broker_proto_rawDescGZIP(), []int{18}
	1691	+	return file_broker_proto_rawDescGZIP(), []int{19}
1604	1692		}
1605	1693
1606	1694		func (x Registered) GetScope() BrokerScope {

@@ -1647,7 +1735,7 @@ type SnapshotPart struct {
1647	1735
1648	1736		func (x *SnapshotPart) Reset() {
1649	1737		*x = SnapshotPart{}
1650		-	mi := &file_broker_proto_msgTypes[19]
	1738	+	mi := &file_broker_proto_msgTypes[20]
1651	1739		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1652	1740		ms.StoreMessageInfo(mi)
1653	1741		}

@@ -1659,7 +1747,7 @@ func (x *SnapshotPart) String() string {
1659	1747		func (*SnapshotPart) ProtoMessage() {}
1660	1748
1661	1749		func (x *SnapshotPart) ProtoReflect() protoreflect.Message {
1662		-	mi := &file_broker_proto_msgTypes[19]
	1750	+	mi := &file_broker_proto_msgTypes[20]
1663	1751		if x != nil {
1664	1752		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1665	1753		if ms.LoadMessageInfo() == nil {

@@ -1672,7 +1760,7 @@ func (x *SnapshotPart) ProtoReflect() protoreflect.Message {
1672	1760
1673	1761		// Deprecated: Use SnapshotPart.ProtoReflect.Descriptor instead.
1674	1762		func (*SnapshotPart) Descriptor() ([]byte, []int) {
1675		-	return file_broker_proto_rawDescGZIP(), []int{19}
	1763	+	return file_broker_proto_rawDescGZIP(), []int{20}
1676	1764		}
1677	1765
1678	1766		func (x SnapshotPart) GetScope() BrokerScope {

@@ -1805,7 +1893,7 @@ type SnapshotBegin struct {
1805	1893
1806	1894		func (x *SnapshotBegin) Reset() {
1807	1895		*x = SnapshotBegin{}
1808		-	mi := &file_broker_proto_msgTypes[20]
	1896	+	mi := &file_broker_proto_msgTypes[21]
1809	1897		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1810	1898		ms.StoreMessageInfo(mi)
1811	1899		}

@@ -1817,7 +1905,7 @@ func (x *SnapshotBegin) String() string {
1817	1905		func (*SnapshotBegin) ProtoMessage() {}
1818	1906
1819	1907		func (x *SnapshotBegin) ProtoReflect() protoreflect.Message {
1820		-	mi := &file_broker_proto_msgTypes[20]
	1908	+	mi := &file_broker_proto_msgTypes[21]
1821	1909		if x != nil {
1822	1910		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1823	1911		if ms.LoadMessageInfo() == nil {

@@ -1830,7 +1918,7 @@ func (x *SnapshotBegin) ProtoReflect() protoreflect.Message {
1830	1918
1831	1919		// Deprecated: Use SnapshotBegin.ProtoReflect.Descriptor instead.
1832	1920		func (*SnapshotBegin) Descriptor() ([]byte, []int) {
1833		-	return file_broker_proto_rawDescGZIP(), []int{20}
	1921	+	return file_broker_proto_rawDescGZIP(), []int{21}
1834	1922		}
1835	1923
1836	1924		func (x *SnapshotBegin) GetHostCount() uint32 {

@@ -1905,7 +1993,7 @@ type SnapshotDaemon struct {
1905	1993
1906	1994		func (x *SnapshotDaemon) Reset() {
1907	1995		*x = SnapshotDaemon{}
1908		-	mi := &file_broker_proto_msgTypes[21]
	1996	+	mi := &file_broker_proto_msgTypes[22]
1909	1997		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1910	1998		ms.StoreMessageInfo(mi)
1911	1999		}

@@ -1917,7 +2005,7 @@ func (x *SnapshotDaemon) String() string {
1917	2005		func (*SnapshotDaemon) ProtoMessage() {}
1918	2006
1919	2007		func (x *SnapshotDaemon) ProtoReflect() protoreflect.Message {
1920		-	mi := &file_broker_proto_msgTypes[21]
	2008	+	mi := &file_broker_proto_msgTypes[22]
1921	2009		if x != nil {
1922	2010		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
1923	2011		if ms.LoadMessageInfo() == nil {

@@ -1930,7 +2018,7 @@ func (x *SnapshotDaemon) ProtoReflect() protoreflect.Message {
1930	2018
1931	2019		// Deprecated: Use SnapshotDaemon.ProtoReflect.Descriptor instead.
1932	2020		func (*SnapshotDaemon) Descriptor() ([]byte, []int) {
1933		-	return file_broker_proto_rawDescGZIP(), []int{21}
	2021	+	return file_broker_proto_rawDescGZIP(), []int{22}
1934	2022		}
1935	2023
1936	2024		func (x *SnapshotDaemon) GetHostIndex() uint32 {

@@ -2095,7 +2183,7 @@ type SnapshotSession struct {
2095	2183
2096	2184		func (x *SnapshotSession) Reset() {
2097	2185		*x = SnapshotSession{}
2098		-	mi := &file_broker_proto_msgTypes[22]
	2186	+	mi := &file_broker_proto_msgTypes[23]
2099	2187		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2100	2188		ms.StoreMessageInfo(mi)
2101	2189		}

@@ -2107,7 +2195,7 @@ func (x *SnapshotSession) String() string {
2107	2195		func (*SnapshotSession) ProtoMessage() {}
2108	2196
2109	2197		func (x *SnapshotSession) ProtoReflect() protoreflect.Message {
2110		-	mi := &file_broker_proto_msgTypes[22]
	2198	+	mi := &file_broker_proto_msgTypes[23]
2111	2199		if x != nil {
2112	2200		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2113	2201		if ms.LoadMessageInfo() == nil {

@@ -2120,7 +2208,7 @@ func (x *SnapshotSession) ProtoReflect() protoreflect.Message {
2120	2208
2121	2209		// Deprecated: Use SnapshotSession.ProtoReflect.Descriptor instead.
2122	2210		func (*SnapshotSession) Descriptor() ([]byte, []int) {
2123		-	return file_broker_proto_rawDescGZIP(), []int{22}
	2211	+	return file_broker_proto_rawDescGZIP(), []int{23}
2124	2212		}
2125	2213
2126	2214		func (x *SnapshotSession) GetHostIndex() uint32 {

@@ -2164,7 +2252,7 @@ type SnapshotTombstone struct {
2164	2252
2165	2253		func (x *SnapshotTombstone) Reset() {
2166	2254		*x = SnapshotTombstone{}
2167		-	mi := &file_broker_proto_msgTypes[23]
	2255	+	mi := &file_broker_proto_msgTypes[24]
2168	2256		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2169	2257		ms.StoreMessageInfo(mi)
2170	2258		}

@@ -2176,7 +2264,7 @@ func (x *SnapshotTombstone) String() string {
2176	2264		func (*SnapshotTombstone) ProtoMessage() {}
2177	2265
2178	2266		func (x *SnapshotTombstone) ProtoReflect() protoreflect.Message {
2179		-	mi := &file_broker_proto_msgTypes[23]
	2267	+	mi := &file_broker_proto_msgTypes[24]
2180	2268		if x != nil {
2181	2269		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2182	2270		if ms.LoadMessageInfo() == nil {

@@ -2189,7 +2277,7 @@ func (x *SnapshotTombstone) ProtoReflect() protoreflect.Message {
2189	2277
2190	2278		// Deprecated: Use SnapshotTombstone.ProtoReflect.Descriptor instead.
2191	2279		func (*SnapshotTombstone) Descriptor() ([]byte, []int) {
2192		-	return file_broker_proto_rawDescGZIP(), []int{23}
	2280	+	return file_broker_proto_rawDescGZIP(), []int{24}
2193	2281		}
2194	2282
2195	2283		func (x *SnapshotTombstone) GetTombstoneIndex() uint32 {

@@ -2222,7 +2310,7 @@ type SnapshotEnd struct {
2222	2310
2223	2311		func (x *SnapshotEnd) Reset() {
2224	2312		*x = SnapshotEnd{}
2225		-	mi := &file_broker_proto_msgTypes[24]
	2313	+	mi := &file_broker_proto_msgTypes[25]
2226	2314		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2227	2315		ms.StoreMessageInfo(mi)
2228	2316		}

@@ -2234,7 +2322,7 @@ func (x *SnapshotEnd) String() string {
2234	2322		func (*SnapshotEnd) ProtoMessage() {}
2235	2323
2236	2324		func (x *SnapshotEnd) ProtoReflect() protoreflect.Message {
2237		-	mi := &file_broker_proto_msgTypes[24]
	2325	+	mi := &file_broker_proto_msgTypes[25]
2238	2326		if x != nil {
2239	2327		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2240	2328		if ms.LoadMessageInfo() == nil {

@@ -2247,7 +2335,7 @@ func (x *SnapshotEnd) ProtoReflect() protoreflect.Message {
2247	2335
2248	2336		// Deprecated: Use SnapshotEnd.ProtoReflect.Descriptor instead.
2249	2337		func (*SnapshotEnd) Descriptor() ([]byte, []int) {
2250		-	return file_broker_proto_rawDescGZIP(), []int{24}
	2338	+	return file_broker_proto_rawDescGZIP(), []int{25}
2251	2339		}
2252	2340
2253	2341		// OperationResult is exactly one completion for one admitted mutating

@@ -2270,7 +2358,7 @@ type OperationResult struct {
2270	2358
2271	2359		func (x *OperationResult) Reset() {
2272	2360		*x = OperationResult{}
2273		-	mi := &file_broker_proto_msgTypes[25]
	2361	+	mi := &file_broker_proto_msgTypes[26]
2274	2362		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2275	2363		ms.StoreMessageInfo(mi)
2276	2364		}

@@ -2282,7 +2370,7 @@ func (x *OperationResult) String() string {
2282	2370		func (*OperationResult) ProtoMessage() {}
2283	2371
2284	2372		func (x *OperationResult) ProtoReflect() protoreflect.Message {
2285		-	mi := &file_broker_proto_msgTypes[25]
	2373	+	mi := &file_broker_proto_msgTypes[26]
2286	2374		if x != nil {
2287	2375		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2288	2376		if ms.LoadMessageInfo() == nil {

@@ -2295,7 +2383,7 @@ func (x *OperationResult) ProtoReflect() protoreflect.Message {
2295	2383
2296	2384		// Deprecated: Use OperationResult.ProtoReflect.Descriptor instead.
2297	2385		func (*OperationResult) Descriptor() ([]byte, []int) {
2298		-	return file_broker_proto_rawDescGZIP(), []int{25}
	2386	+	return file_broker_proto_rawDescGZIP(), []int{26}
2299	2387		}
2300	2388
2301	2389		func (x OperationResult) GetScope() BrokerScope {

@@ -2350,7 +2438,7 @@ type StreamOpened struct {
2350	2438
2351	2439		func (x *StreamOpened) Reset() {
2352	2440		*x = StreamOpened{}
2353		-	mi := &file_broker_proto_msgTypes[26]
	2441	+	mi := &file_broker_proto_msgTypes[27]
2354	2442		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2355	2443		ms.StoreMessageInfo(mi)
2356	2444		}

@@ -2362,7 +2450,7 @@ func (x *StreamOpened) String() string {
2362	2450		func (*StreamOpened) ProtoMessage() {}
2363	2451
2364	2452		func (x *StreamOpened) ProtoReflect() protoreflect.Message {
2365		-	mi := &file_broker_proto_msgTypes[26]
	2453	+	mi := &file_broker_proto_msgTypes[27]
2366	2454		if x != nil {
2367	2455		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2368	2456		if ms.LoadMessageInfo() == nil {

@@ -2375,7 +2463,7 @@ func (x *StreamOpened) ProtoReflect() protoreflect.Message {
2375	2463
2376	2464		// Deprecated: Use StreamOpened.ProtoReflect.Descriptor instead.
2377	2465		func (*StreamOpened) Descriptor() ([]byte, []int) {
2378		-	return file_broker_proto_rawDescGZIP(), []int{26}
	2466	+	return file_broker_proto_rawDescGZIP(), []int{27}
2379	2467		}
2380	2468
2381	2469		func (x StreamOpened) GetRef() BrokerStreamRef {

@@ -2396,7 +2484,7 @@ type ServerStreamData struct {
2396	2484
2397	2485		func (x *ServerStreamData) Reset() {
2398	2486		*x = ServerStreamData{}
2399		-	mi := &file_broker_proto_msgTypes[27]
	2487	+	mi := &file_broker_proto_msgTypes[28]
2400	2488		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2401	2489		ms.StoreMessageInfo(mi)
2402	2490		}

@@ -2408,7 +2496,7 @@ func (x *ServerStreamData) String() string {
2408	2496		func (*ServerStreamData) ProtoMessage() {}
2409	2497
2410	2498		func (x *ServerStreamData) ProtoReflect() protoreflect.Message {
2411		-	mi := &file_broker_proto_msgTypes[27]
	2499	+	mi := &file_broker_proto_msgTypes[28]
2412	2500		if x != nil {
2413	2501		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2414	2502		if ms.LoadMessageInfo() == nil {

@@ -2421,7 +2509,7 @@ func (x *ServerStreamData) ProtoReflect() protoreflect.Message {
2421	2509
2422	2510		// Deprecated: Use ServerStreamData.ProtoReflect.Descriptor instead.
2423	2511		func (*ServerStreamData) Descriptor() ([]byte, []int) {
2424		-	return file_broker_proto_rawDescGZIP(), []int{27}
	2512	+	return file_broker_proto_rawDescGZIP(), []int{28}
2425	2513		}
2426	2514
2427	2515		func (x ServerStreamData) GetRef() BrokerStreamRef {

@@ -2450,7 +2538,7 @@ type StreamClosed struct {
2450	2538
2451	2539		func (x *StreamClosed) Reset() {
2452	2540		*x = StreamClosed{}
2453		-	mi := &file_broker_proto_msgTypes[28]
	2541	+	mi := &file_broker_proto_msgTypes[29]
2454	2542		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2455	2543		ms.StoreMessageInfo(mi)
2456	2544		}

@@ -2462,7 +2550,7 @@ func (x *StreamClosed) String() string {
2462	2550		func (*StreamClosed) ProtoMessage() {}
2463	2551
2464	2552		func (x *StreamClosed) ProtoReflect() protoreflect.Message {
2465		-	mi := &file_broker_proto_msgTypes[28]
	2553	+	mi := &file_broker_proto_msgTypes[29]
2466	2554		if x != nil {
2467	2555		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2468	2556		if ms.LoadMessageInfo() == nil {

@@ -2475,7 +2563,7 @@ func (x *StreamClosed) ProtoReflect() protoreflect.Message {
2475	2563
2476	2564		// Deprecated: Use StreamClosed.ProtoReflect.Descriptor instead.
2477	2565		func (*StreamClosed) Descriptor() ([]byte, []int) {
2478		-	return file_broker_proto_rawDescGZIP(), []int{28}
	2566	+	return file_broker_proto_rawDescGZIP(), []int{29}
2479	2567		}
2480	2568
2481	2569		func (x StreamClosed) GetRef() BrokerStreamRef {

@@ -2504,7 +2592,7 @@ type Progress struct {
2504	2592
2505	2593		func (x *Progress) Reset() {
2506	2594		*x = Progress{}
2507		-	mi := &file_broker_proto_msgTypes[29]
	2595	+	mi := &file_broker_proto_msgTypes[30]
2508	2596		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2509	2597		ms.StoreMessageInfo(mi)
2510	2598		}

@@ -2516,7 +2604,7 @@ func (x *Progress) String() string {
2516	2604		func (*Progress) ProtoMessage() {}
2517	2605
2518	2606		func (x *Progress) ProtoReflect() protoreflect.Message {
2519		-	mi := &file_broker_proto_msgTypes[29]
	2607	+	mi := &file_broker_proto_msgTypes[30]
2520	2608		if x != nil {
2521	2609		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2522	2610		if ms.LoadMessageInfo() == nil {

@@ -2529,7 +2617,7 @@ func (x *Progress) ProtoReflect() protoreflect.Message {
2529	2617
2530	2618		// Deprecated: Use Progress.ProtoReflect.Descriptor instead.
2531	2619		func (*Progress) Descriptor() ([]byte, []int) {
2532		-	return file_broker_proto_rawDescGZIP(), []int{29}
	2620	+	return file_broker_proto_rawDescGZIP(), []int{30}
2533	2621		}
2534	2622
2535	2623		func (x Progress) GetRef() BrokerStreamRef {

@@ -2564,7 +2652,7 @@ type BrokerErrorMessage struct {
2564	2652
2565	2653		func (x *BrokerErrorMessage) Reset() {
2566	2654		*x = BrokerErrorMessage{}
2567		-	mi := &file_broker_proto_msgTypes[30]
	2655	+	mi := &file_broker_proto_msgTypes[31]
2568	2656		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2569	2657		ms.StoreMessageInfo(mi)
2570	2658		}

@@ -2576,7 +2664,7 @@ func (x *BrokerErrorMessage) String() string {
2576	2664		func (*BrokerErrorMessage) ProtoMessage() {}
2577	2665
2578	2666		func (x *BrokerErrorMessage) ProtoReflect() protoreflect.Message {
2579		-	mi := &file_broker_proto_msgTypes[30]
	2667	+	mi := &file_broker_proto_msgTypes[31]
2580	2668		if x != nil {
2581	2669		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2582	2670		if ms.LoadMessageInfo() == nil {

@@ -2589,7 +2677,7 @@ func (x *BrokerErrorMessage) ProtoReflect() protoreflect.Message {
2589	2677
2590	2678		// Deprecated: Use BrokerErrorMessage.ProtoReflect.Descriptor instead.
2591	2679		func (*BrokerErrorMessage) Descriptor() ([]byte, []int) {
2592		-	return file_broker_proto_rawDescGZIP(), []int{30}
	2680	+	return file_broker_proto_rawDescGZIP(), []int{31}
2593	2681		}
2594	2682
2595	2683		func (x BrokerErrorMessage) GetScope() BrokerScope {

@@ -2619,7 +2707,7 @@ type Shutdown struct {
2619	2707
2620	2708		func (x *Shutdown) Reset() {
2621	2709		*x = Shutdown{}
2622		-	mi := &file_broker_proto_msgTypes[31]
	2710	+	mi := &file_broker_proto_msgTypes[32]
2623	2711		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2624	2712		ms.StoreMessageInfo(mi)
2625	2713		}

@@ -2631,7 +2719,7 @@ func (x *Shutdown) String() string {
2631	2719		func (*Shutdown) ProtoMessage() {}
2632	2720
2633	2721		func (x *Shutdown) ProtoReflect() protoreflect.Message {
2634		-	mi := &file_broker_proto_msgTypes[31]
	2722	+	mi := &file_broker_proto_msgTypes[32]
2635	2723		if x != nil {
2636	2724		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2637	2725		if ms.LoadMessageInfo() == nil {

@@ -2644,7 +2732,7 @@ func (x *Shutdown) ProtoReflect() protoreflect.Message {
2644	2732
2645	2733		// Deprecated: Use Shutdown.ProtoReflect.Descriptor instead.
2646	2734		func (*Shutdown) Descriptor() ([]byte, []int) {
2647		-	return file_broker_proto_rawDescGZIP(), []int{31}
	2735	+	return file_broker_proto_rawDescGZIP(), []int{32}
2648	2736		}
2649	2737
2650	2738		func (x Shutdown) GetScope() BrokerScope {

@@ -2683,7 +2771,7 @@ type PreviewRoute struct {
2683	2771
2684	2772		func (x *PreviewRoute) Reset() {
2685	2773		*x = PreviewRoute{}
2686		-	mi := &file_broker_proto_msgTypes[32]
	2774	+	mi := &file_broker_proto_msgTypes[33]
2687	2775		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2688	2776		ms.StoreMessageInfo(mi)
2689	2777		}

@@ -2695,7 +2783,7 @@ func (x *PreviewRoute) String() string {
2695	2783		func (*PreviewRoute) ProtoMessage() {}
2696	2784
2697	2785		func (x *PreviewRoute) ProtoReflect() protoreflect.Message {
2698		-	mi := &file_broker_proto_msgTypes[32]
	2786	+	mi := &file_broker_proto_msgTypes[33]
2699	2787		if x != nil {
2700	2788		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2701	2789		if ms.LoadMessageInfo() == nil {

@@ -2708,7 +2796,7 @@ func (x *PreviewRoute) ProtoReflect() protoreflect.Message {
2708	2796
2709	2797		// Deprecated: Use PreviewRoute.ProtoReflect.Descriptor instead.
2710	2798		func (*PreviewRoute) Descriptor() ([]byte, []int) {
2711		-	return file_broker_proto_rawDescGZIP(), []int{32}
	2799	+	return file_broker_proto_rawDescGZIP(), []int{33}
2712	2800		}
2713	2801
2714	2802		func (x *PreviewRoute) GetLocal() bool {

@@ -2756,7 +2844,7 @@ type StartPreview struct {
2756	2844
2757	2845		func (x *StartPreview) Reset() {
2758	2846		*x = StartPreview{}
2759		-	mi := &file_broker_proto_msgTypes[33]
	2847	+	mi := &file_broker_proto_msgTypes[34]
2760	2848		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2761	2849		ms.StoreMessageInfo(mi)
2762	2850		}

@@ -2768,7 +2856,7 @@ func (x *StartPreview) String() string {
2768	2856		func (*StartPreview) ProtoMessage() {}
2769	2857
2770	2858		func (x *StartPreview) ProtoReflect() protoreflect.Message {
2771		-	mi := &file_broker_proto_msgTypes[33]
	2859	+	mi := &file_broker_proto_msgTypes[34]
2772	2860		if x != nil {
2773	2861		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2774	2862		if ms.LoadMessageInfo() == nil {

@@ -2781,7 +2869,7 @@ func (x *StartPreview) ProtoReflect() protoreflect.Message {
2781	2869
2782	2870		// Deprecated: Use StartPreview.ProtoReflect.Descriptor instead.
2783	2871		func (*StartPreview) Descriptor() ([]byte, []int) {
2784		-	return file_broker_proto_rawDescGZIP(), []int{33}
	2872	+	return file_broker_proto_rawDescGZIP(), []int{34}
2785	2873		}
2786	2874
2787	2875		func (x StartPreview) GetScope() BrokerScope {

@@ -2823,7 +2911,7 @@ type CancelPreview struct {
2823	2911
2824	2912		func (x *CancelPreview) Reset() {
2825	2913		*x = CancelPreview{}
2826		-	mi := &file_broker_proto_msgTypes[34]
	2914	+	mi := &file_broker_proto_msgTypes[35]
2827	2915		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2828	2916		ms.StoreMessageInfo(mi)
2829	2917		}

@@ -2835,7 +2923,7 @@ func (x *CancelPreview) String() string {
2835	2923		func (*CancelPreview) ProtoMessage() {}
2836	2924
2837	2925		func (x *CancelPreview) ProtoReflect() protoreflect.Message {
2838		-	mi := &file_broker_proto_msgTypes[34]
	2926	+	mi := &file_broker_proto_msgTypes[35]
2839	2927		if x != nil {
2840	2928		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2841	2929		if ms.LoadMessageInfo() == nil {

@@ -2848,7 +2936,7 @@ func (x *CancelPreview) ProtoReflect() protoreflect.Message {
2848	2936
2849	2937		// Deprecated: Use CancelPreview.ProtoReflect.Descriptor instead.
2850	2938		func (*CancelPreview) Descriptor() ([]byte, []int) {
2851		-	return file_broker_proto_rawDescGZIP(), []int{34}
	2939	+	return file_broker_proto_rawDescGZIP(), []int{35}
2852	2940		}
2853	2941
2854	2942		func (x CancelPreview) GetScope() BrokerScope {

@@ -2882,7 +2970,7 @@ type PreviewPublication struct {
2882	2970
2883	2971		func (x *PreviewPublication) Reset() {
2884	2972		*x = PreviewPublication{}
2885		-	mi := &file_broker_proto_msgTypes[35]
	2973	+	mi := &file_broker_proto_msgTypes[36]
2886	2974		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2887	2975		ms.StoreMessageInfo(mi)
2888	2976		}

@@ -2894,7 +2982,7 @@ func (x *PreviewPublication) String() string {
2894	2982		func (*PreviewPublication) ProtoMessage() {}
2895	2983
2896	2984		func (x *PreviewPublication) ProtoReflect() protoreflect.Message {
2897		-	mi := &file_broker_proto_msgTypes[35]
	2985	+	mi := &file_broker_proto_msgTypes[36]
2898	2986		if x != nil {
2899	2987		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2900	2988		if ms.LoadMessageInfo() == nil {

@@ -2907,7 +2995,7 @@ func (x *PreviewPublication) ProtoReflect() protoreflect.Message {
2907	2995
2908	2996		// Deprecated: Use PreviewPublication.ProtoReflect.Descriptor instead.
2909	2997		func (*PreviewPublication) Descriptor() ([]byte, []int) {
2910		-	return file_broker_proto_rawDescGZIP(), []int{35}
	2998	+	return file_broker_proto_rawDescGZIP(), []int{36}
2911	2999		}
2912	3000
2913	3001		func (x PreviewPublication) GetScope() BrokerScope {

@@ -2987,7 +3075,7 @@ type BrokerCatalogSession struct {
2987	3075
2988	3076		func (x *BrokerCatalogSession) Reset() {
2989	3077		*x = BrokerCatalogSession{}
2990		-	mi := &file_broker_proto_msgTypes[36]
	3078	+	mi := &file_broker_proto_msgTypes[37]
2991	3079		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
2992	3080		ms.StoreMessageInfo(mi)
2993	3081		}

@@ -2999,7 +3087,7 @@ func (x *BrokerCatalogSession) String() string {
2999	3087		func (*BrokerCatalogSession) ProtoMessage() {}
3000	3088
3001	3089		func (x *BrokerCatalogSession) ProtoReflect() protoreflect.Message {
3002		-	mi := &file_broker_proto_msgTypes[36]
	3090	+	mi := &file_broker_proto_msgTypes[37]
3003	3091		if x != nil {
3004	3092		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
3005	3093		if ms.LoadMessageInfo() == nil {

@@ -3012,7 +3100,7 @@ func (x *BrokerCatalogSession) ProtoReflect() protoreflect.Message {
3012	3100
3013	3101		// Deprecated: Use BrokerCatalogSession.ProtoReflect.Descriptor instead.
3014	3102		func (*BrokerCatalogSession) Descriptor() ([]byte, []int) {
3015		-	return file_broker_proto_rawDescGZIP(), []int{36}
	3103	+	return file_broker_proto_rawDescGZIP(), []int{37}
3016	3104		}
3017	3105
3018	3106		func (x *BrokerCatalogSession) GetLifecycleId() []byte {

@@ -3092,7 +3180,7 @@ type BrokerCatalogTab struct {
3092	3180
3093	3181		func (x *BrokerCatalogTab) Reset() {
3094	3182		*x = BrokerCatalogTab{}
3095		-	mi := &file_broker_proto_msgTypes[37]
	3183	+	mi := &file_broker_proto_msgTypes[38]
3096	3184		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
3097	3185		ms.StoreMessageInfo(mi)
3098	3186		}

@@ -3104,7 +3192,7 @@ func (x *BrokerCatalogTab) String() string {
3104	3192		func (*BrokerCatalogTab) ProtoMessage() {}
3105	3193
3106	3194		func (x *BrokerCatalogTab) ProtoReflect() protoreflect.Message {
3107		-	mi := &file_broker_proto_msgTypes[37]
	3195	+	mi := &file_broker_proto_msgTypes[38]
3108	3196		if x != nil {
3109	3197		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
3110	3198		if ms.LoadMessageInfo() == nil {

@@ -3117,7 +3205,7 @@ func (x *BrokerCatalogTab) ProtoReflect() protoreflect.Message {
3117	3205
3118	3206		// Deprecated: Use BrokerCatalogTab.ProtoReflect.Descriptor instead.
3119	3207		func (*BrokerCatalogTab) Descriptor() ([]byte, []int) {
3120		-	return file_broker_proto_rawDescGZIP(), []int{37}
	3208	+	return file_broker_proto_rawDescGZIP(), []int{38}
3121	3209		}
3122	3210
3123	3211		func (x *BrokerCatalogTab) GetId() string {

@@ -3181,7 +3269,7 @@ const file_broker_proto_rawDesc = "" +
3181	3269		"\ffailure_kind\x18\x04 \x01(\rR\vfailureKind\"A\n" +
3182	3270		"\x0fBrokerTimestamp\x12\x18\n" +
3183	3271		"\aseconds\x18\x01 \x01(\x03R\aseconds\x12\x14\n" +
3184		-	"\x05nanos\x18\x02 \x01(\x05R\x05nanos\"\xc2\x06\n" +
	3272	+	"\x05nanos\x18\x02 \x01(\x05R\x05nanos\"\x97\a\n" +
3185	3273		"\x14BrokerClientEnvelope\x123\n" +
3186	3274		"\bregister\x18e \x01(\v2\x15.vev.wire.v1.RegisterH\x00R\bregister\x126\n" +
3187	3275		"\tsubscribe\x18f \x01(\v2\x16.vev.wire.v1.SubscribeH\x00R\tsubscribe\x12-\n" +

@@ -3197,8 +3285,9 @@ const file_broker_proto_rawDesc = "" +
3197	3285		"\fclose_stream\x18n \x01(\v2\x18.vev.wire.v1.CloseStreamH\x00R\vcloseStream\x12M\n" +
3198	3286		"\x12update_host_policy\x18o \x01(\v2\x1d.vev.wire.v1.UpdateHostPolicyH\x00R\x10updateHostPolicy\x12@\n" +
3199	3287		"\rstart_preview\x18p \x01(\v2\x19.vev.wire.v1.StartPreviewH\x00R\fstartPreview\x12C\n" +
3200		-	"\x0ecancel_preview\x18q \x01(\v2\x1a.vev.wire.v1.CancelPreviewH\x00R\rcancelPreviewB\t\n" +
3201		-	"\apayload\"\xd9\x05\n" +
	3288	+	"\x0ecancel_preview\x18q \x01(\v2\x1a.vev.wire.v1.CancelPreviewH\x00R\rcancelPreview\x12S\n" +
	3289	+	"\x14stream_window_update\x18r \x01(\v2\x1f.vev.wire.v1.StreamWindowUpdateH\x00R\x12streamWindowUpdateB\t\n" +
	3290	+	"\apayload\"\xaf\x06\n" +
3202	3291		"\x14BrokerServerEnvelope\x12:\n" +
3203	3292		"\n" +
3204	3293		"registered\x18\xc9\x01 \x01(\v2\x17.vev.wire.v1.RegisteredH\x00R\n" +

@@ -3211,7 +3300,8 @@ const file_broker_proto_rawDesc = "" +
3211	3300		"\bprogress\x18\xcf\x01 \x01(\v2\x15.vev.wire.v1.ProgressH\x00R\bprogress\x12T\n" +
3212	3301		"\x14broker_error_message\x18\xd0\x01 \x01(\v2\x1f.vev.wire.v1.BrokerErrorMessageH\x00R\x12brokerErrorMessage\x124\n" +
3213	3302		"\bshutdown\x18\xd1\x01 \x01(\v2\x15.vev.wire.v1.ShutdownH\x00R\bshutdown\x12S\n" +
3214		-	"\x13preview_publication\x18\xd2\x01 \x01(\v2\x1f.vev.wire.v1.PreviewPublicationH\x00R\x12previewPublicationB\t\n" +
	3303	+	"\x13preview_publication\x18\xd2\x01 \x01(\v2\x1f.vev.wire.v1.PreviewPublicationH\x00R\x12previewPublication\x12T\n" +
	3304	+	"\x14stream_window_update\x18\xd3\x01 \x01(\v2\x1f.vev.wire.v1.StreamWindowUpdateH\x00R\x12streamWindowUpdateB\t\n" +
3215	3305		"\apayload\" \n" +
3216	3306		"\bRegister\x12\x14\n" +
3217	3307		"\x05build\x18\x01 \x01(\tR\x05build\"u\n" +

@@ -3268,7 +3358,10 @@ const file_broker_proto_rawDesc = "" +
3268	3358		"\x03ref\x18\x01 \x01(\v2\x1c.vev.wire.v1.BrokerStreamRefR\x03ref\x12\x12\n" +
3269	3359		"\x04data\x18\x02 \x01(\fR\x04data\"=\n" +
3270	3360		"\vCloseStream\x12.\n" +
3271		-	"\x03ref\x18\x01 \x01(\v2\x1c.vev.wire.v1.BrokerStreamRefR\x03ref\"n\n" +
	3361	+	"\x03ref\x18\x01 \x01(\v2\x1c.vev.wire.v1.BrokerStreamRefR\x03ref\"\\\n" +
	3362	+	"\x12StreamWindowUpdate\x12.\n" +
	3363	+	"\x03ref\x18\x01 \x01(\v2\x1c.vev.wire.v1.BrokerStreamRefR\x03ref\x12\x16\n" +
	3364	+	"\x06credit\x18\x02 \x01(\x04R\x06credit\"n\n" +
3272	3365		"\n" +
3273	3366		"Registered\x12.\n" +
3274	3367		"\x05scope\x18\x01 \x01(\v2\x18.vev.wire.v1.BrokerScopeR\x05scope\x12\x14\n" +

@@ -3409,7 +3502,7 @@ func file_broker_proto_rawDescGZIP() []byte {
3409	3502		return file_broker_proto_rawDescData
3410	3503		}
3411	3504
3412		-	var file_broker_proto_msgTypes = make([]protoimpl.MessageInfo, 38)
	3505	+	var file_broker_proto_msgTypes = make([]protoimpl.MessageInfo, 39)
3413	3506		var file_broker_proto_goTypes = []any{
3414	3507		(*BrokerScope)(nil), // 0: vev.wire.v1.BrokerScope
3415	3508		(*BrokerStreamRef)(nil), // 1: vev.wire.v1.BrokerStreamRef

@@ -3429,30 +3522,31 @@ var file_broker_proto_goTypes = []any{
3429	3522		(*OpenStream)(nil), // 15: vev.wire.v1.OpenStream
3430	3523		(*ClientStreamData)(nil), // 16: vev.wire.v1.ClientStreamData
3431	3524		(*CloseStream)(nil), // 17: vev.wire.v1.CloseStream
3432		-	(*Registered)(nil), // 18: vev.wire.v1.Registered
3433		-	(*SnapshotPart)(nil), // 19: vev.wire.v1.SnapshotPart
3434		-	(*SnapshotBegin)(nil), // 20: vev.wire.v1.SnapshotBegin
3435		-	(*SnapshotDaemon)(nil), // 21: vev.wire.v1.SnapshotDaemon
3436		-	(*SnapshotSession)(nil), // 22: vev.wire.v1.SnapshotSession
3437		-	(*SnapshotTombstone)(nil), // 23: vev.wire.v1.SnapshotTombstone
3438		-	(*SnapshotEnd)(nil), // 24: vev.wire.v1.SnapshotEnd
3439		-	(*OperationResult)(nil), // 25: vev.wire.v1.OperationResult
3440		-	(*StreamOpened)(nil), // 26: vev.wire.v1.StreamOpened
3441		-	(*ServerStreamData)(nil), // 27: vev.wire.v1.ServerStreamData
3442		-	(*StreamClosed)(nil), // 28: vev.wire.v1.StreamClosed
3443		-	(*Progress)(nil), // 29: vev.wire.v1.Progress
3444		-	(*BrokerErrorMessage)(nil), // 30: vev.wire.v1.BrokerErrorMessage
3445		-	(*Shutdown)(nil), // 31: vev.wire.v1.Shutdown
3446		-	(*PreviewRoute)(nil), // 32: vev.wire.v1.PreviewRoute
3447		-	(*StartPreview)(nil), // 33: vev.wire.v1.StartPreview
3448		-	(*CancelPreview)(nil), // 34: vev.wire.v1.CancelPreview
3449		-	(*PreviewPublication)(nil), // 35: vev.wire.v1.PreviewPublication
3450		-	(*BrokerCatalogSession)(nil), // 36: vev.wire.v1.BrokerCatalogSession
3451		-	(*BrokerCatalogTab)(nil), // 37: vev.wire.v1.BrokerCatalogTab
3452		-	(*RemoteRegistration)(nil), // 38: vev.wire.v1.RemoteRegistration
3453		-	(*ExactTarget)(nil), // 39: vev.wire.v1.ExactTarget
3454		-	(*RemotePreviewRequest)(nil), // 40: vev.wire.v1.RemotePreviewRequest
3455		-	(*RemotePreview)(nil), // 41: vev.wire.v1.RemotePreview
	3525	+	(*StreamWindowUpdate)(nil), // 18: vev.wire.v1.StreamWindowUpdate
	3526	+	(*Registered)(nil), // 19: vev.wire.v1.Registered
	3527	+	(*SnapshotPart)(nil), // 20: vev.wire.v1.SnapshotPart
	3528	+	(*SnapshotBegin)(nil), // 21: vev.wire.v1.SnapshotBegin
	3529	+	(*SnapshotDaemon)(nil), // 22: vev.wire.v1.SnapshotDaemon
	3530	+	(*SnapshotSession)(nil), // 23: vev.wire.v1.SnapshotSession
	3531	+	(*SnapshotTombstone)(nil), // 24: vev.wire.v1.SnapshotTombstone
	3532	+	(*SnapshotEnd)(nil), // 25: vev.wire.v1.SnapshotEnd
	3533	+	(*OperationResult)(nil), // 26: vev.wire.v1.OperationResult
	3534	+	(*StreamOpened)(nil), // 27: vev.wire.v1.StreamOpened
	3535	+	(*ServerStreamData)(nil), // 28: vev.wire.v1.ServerStreamData
	3536	+	(*StreamClosed)(nil), // 29: vev.wire.v1.StreamClosed
	3537	+	(*Progress)(nil), // 30: vev.wire.v1.Progress
	3538	+	(*BrokerErrorMessage)(nil), // 31: vev.wire.v1.BrokerErrorMessage
	3539	+	(*Shutdown)(nil), // 32: vev.wire.v1.Shutdown
	3540	+	(*PreviewRoute)(nil), // 33: vev.wire.v1.PreviewRoute
	3541	+	(*StartPreview)(nil), // 34: vev.wire.v1.StartPreview
	3542	+	(*CancelPreview)(nil), // 35: vev.wire.v1.CancelPreview
	3543	+	(*PreviewPublication)(nil), // 36: vev.wire.v1.PreviewPublication
	3544	+	(*BrokerCatalogSession)(nil), // 37: vev.wire.v1.BrokerCatalogSession
	3545	+	(*BrokerCatalogTab)(nil), // 38: vev.wire.v1.BrokerCatalogTab
	3546	+	(*RemoteRegistration)(nil), // 39: vev.wire.v1.RemoteRegistration
	3547	+	(*ExactTarget)(nil), // 40: vev.wire.v1.ExactTarget
	3548	+	(*RemotePreviewRequest)(nil), // 41: vev.wire.v1.RemotePreviewRequest
	3549	+	(*RemotePreview)(nil), // 42: vev.wire.v1.RemotePreview
3456	3550		}
3457	3551		var file_broker_proto_depIdxs = []int32{
3458	3552		0, // 0: vev.wire.v1.BrokerStreamRef.scope:type_name -> vev.wire.v1.BrokerScope

@@ -3467,76 +3561,79 @@ var file_broker_proto_depIdxs = []int32{
3467	3561		16, // 9: vev.wire.v1.BrokerClientEnvelope.client_stream_data:type_name -> vev.wire.v1.ClientStreamData
3468	3562		17, // 10: vev.wire.v1.BrokerClientEnvelope.close_stream:type_name -> vev.wire.v1.CloseStream
3469	3563		13, // 11: vev.wire.v1.BrokerClientEnvelope.update_host_policy:type_name -> vev.wire.v1.UpdateHostPolicy
3470		-	33, // 12: vev.wire.v1.BrokerClientEnvelope.start_preview:type_name -> vev.wire.v1.StartPreview
3471		-	34, // 13: vev.wire.v1.BrokerClientEnvelope.cancel_preview:type_name -> vev.wire.v1.CancelPreview
3472		-	18, // 14: vev.wire.v1.BrokerServerEnvelope.registered:type_name -> vev.wire.v1.Registered
3473		-	19, // 15: vev.wire.v1.BrokerServerEnvelope.snapshot_part:type_name -> vev.wire.v1.SnapshotPart
3474		-	25, // 16: vev.wire.v1.BrokerServerEnvelope.operation_result:type_name -> vev.wire.v1.OperationResult
3475		-	26, // 17: vev.wire.v1.BrokerServerEnvelope.stream_opened:type_name -> vev.wire.v1.StreamOpened
3476		-	27, // 18: vev.wire.v1.BrokerServerEnvelope.server_stream_data:type_name -> vev.wire.v1.ServerStreamData
3477		-	28, // 19: vev.wire.v1.BrokerServerEnvelope.stream_closed:type_name -> vev.wire.v1.StreamClosed
3478		-	29, // 20: vev.wire.v1.BrokerServerEnvelope.progress:type_name -> vev.wire.v1.Progress
3479		-	30, // 21: vev.wire.v1.BrokerServerEnvelope.broker_error_message:type_name -> vev.wire.v1.BrokerErrorMessage
3480		-	31, // 22: vev.wire.v1.BrokerServerEnvelope.shutdown:type_name -> vev.wire.v1.Shutdown
3481		-	35, // 23: vev.wire.v1.BrokerServerEnvelope.preview_publication:type_name -> vev.wire.v1.PreviewPublication
3482		-	0, // 24: vev.wire.v1.Subscribe.scope:type_name -> vev.wire.v1.BrokerScope
3483		-	0, // 25: vev.wire.v1.Resync.scope:type_name -> vev.wire.v1.BrokerScope
3484		-	0, // 26: vev.wire.v1.Unsubscribe.scope:type_name -> vev.wire.v1.BrokerScope
3485		-	0, // 27: vev.wire.v1.AddHost.scope:type_name -> vev.wire.v1.BrokerScope
3486		-	2, // 28: vev.wire.v1.AddHost.policy:type_name -> vev.wire.v1.BrokerWirePolicy
3487		-	0, // 29: vev.wire.v1.RemoveHost.scope:type_name -> vev.wire.v1.BrokerScope
3488		-	38, // 30: vev.wire.v1.RemoveHost.registration:type_name -> vev.wire.v1.RemoteRegistration
3489		-	0, // 31: vev.wire.v1.UpdateHostPolicy.scope:type_name -> vev.wire.v1.BrokerScope
3490		-	38, // 32: vev.wire.v1.UpdateHostPolicy.registration:type_name -> vev.wire.v1.RemoteRegistration
3491		-	2, // 33: vev.wire.v1.UpdateHostPolicy.policy:type_name -> vev.wire.v1.BrokerWirePolicy
3492		-	0, // 34: vev.wire.v1.Reconcile.scope:type_name -> vev.wire.v1.BrokerScope
3493		-	38, // 35: vev.wire.v1.Reconcile.registration:type_name -> vev.wire.v1.RemoteRegistration
3494		-	1, // 36: vev.wire.v1.OpenStream.ref:type_name -> vev.wire.v1.BrokerStreamRef
3495		-	38, // 37: vev.wire.v1.OpenStream.registration:type_name -> vev.wire.v1.RemoteRegistration
3496		-	39, // 38: vev.wire.v1.OpenStream.target:type_name -> vev.wire.v1.ExactTarget
3497		-	2, // 39: vev.wire.v1.OpenStream.policy:type_name -> vev.wire.v1.BrokerWirePolicy
3498		-	1, // 40: vev.wire.v1.ClientStreamData.ref:type_name -> vev.wire.v1.BrokerStreamRef
3499		-	1, // 41: vev.wire.v1.CloseStream.ref:type_name -> vev.wire.v1.BrokerStreamRef
3500		-	0, // 42: vev.wire.v1.Registered.scope:type_name -> vev.wire.v1.BrokerScope
3501		-	0, // 43: vev.wire.v1.SnapshotPart.scope:type_name -> vev.wire.v1.BrokerScope
3502		-	20, // 44: vev.wire.v1.SnapshotPart.begin:type_name -> vev.wire.v1.SnapshotBegin
3503		-	21, // 45: vev.wire.v1.SnapshotPart.daemon:type_name -> vev.wire.v1.SnapshotDaemon
3504		-	22, // 46: vev.wire.v1.SnapshotPart.session:type_name -> vev.wire.v1.SnapshotSession
3505		-	23, // 47: vev.wire.v1.SnapshotPart.tombstone:type_name -> vev.wire.v1.SnapshotTombstone
3506		-	24, // 48: vev.wire.v1.SnapshotPart.end:type_name -> vev.wire.v1.SnapshotEnd
3507		-	38, // 49: vev.wire.v1.SnapshotDaemon.registration:type_name -> vev.wire.v1.RemoteRegistration
3508		-	2, // 50: vev.wire.v1.SnapshotDaemon.policy:type_name -> vev.wire.v1.BrokerWirePolicy
3509		-	4, // 51: vev.wire.v1.SnapshotDaemon.last_attempt:type_name -> vev.wire.v1.BrokerTimestamp
3510		-	4, // 52: vev.wire.v1.SnapshotDaemon.last_success:type_name -> vev.wire.v1.BrokerTimestamp
3511		-	4, // 53: vev.wire.v1.SnapshotDaemon.next_due:type_name -> vev.wire.v1.BrokerTimestamp
3512		-	36, // 54: vev.wire.v1.SnapshotSession.session:type_name -> vev.wire.v1.BrokerCatalogSession
3513		-	38, // 55: vev.wire.v1.SnapshotTombstone.registration:type_name -> vev.wire.v1.RemoteRegistration
3514		-	0, // 56: vev.wire.v1.OperationResult.scope:type_name -> vev.wire.v1.BrokerScope
3515		-	3, // 57: vev.wire.v1.OperationResult.error:type_name -> vev.wire.v1.BrokerErrorDetail
3516		-	38, // 58: vev.wire.v1.OperationResult.registration:type_name -> vev.wire.v1.RemoteRegistration
3517		-	1, // 59: vev.wire.v1.StreamOpened.ref:type_name -> vev.wire.v1.BrokerStreamRef
3518		-	1, // 60: vev.wire.v1.ServerStreamData.ref:type_name -> vev.wire.v1.BrokerStreamRef
3519		-	1, // 61: vev.wire.v1.StreamClosed.ref:type_name -> vev.wire.v1.BrokerStreamRef
3520		-	3, // 62: vev.wire.v1.StreamClosed.error:type_name -> vev.wire.v1.BrokerErrorDetail
3521		-	1, // 63: vev.wire.v1.Progress.ref:type_name -> vev.wire.v1.BrokerStreamRef
3522		-	0, // 64: vev.wire.v1.BrokerErrorMessage.scope:type_name -> vev.wire.v1.BrokerScope
3523		-	3, // 65: vev.wire.v1.BrokerErrorMessage.error:type_name -> vev.wire.v1.BrokerErrorDetail
3524		-	0, // 66: vev.wire.v1.Shutdown.scope:type_name -> vev.wire.v1.BrokerScope
3525		-	38, // 67: vev.wire.v1.PreviewRoute.registration:type_name -> vev.wire.v1.RemoteRegistration
3526		-	2, // 68: vev.wire.v1.PreviewRoute.policy:type_name -> vev.wire.v1.BrokerWirePolicy
3527		-	0, // 69: vev.wire.v1.StartPreview.scope:type_name -> vev.wire.v1.BrokerScope
3528		-	40, // 70: vev.wire.v1.StartPreview.preview:type_name -> vev.wire.v1.RemotePreviewRequest
3529		-	32, // 71: vev.wire.v1.StartPreview.route:type_name -> vev.wire.v1.PreviewRoute
3530		-	0, // 72: vev.wire.v1.CancelPreview.scope:type_name -> vev.wire.v1.BrokerScope
3531		-	0, // 73: vev.wire.v1.PreviewPublication.scope:type_name -> vev.wire.v1.BrokerScope
3532		-	41, // 74: vev.wire.v1.PreviewPublication.preview:type_name -> vev.wire.v1.RemotePreview
3533		-	3, // 75: vev.wire.v1.PreviewPublication.error:type_name -> vev.wire.v1.BrokerErrorDetail
3534		-	37, // 76: vev.wire.v1.BrokerCatalogSession.tabs:type_name -> vev.wire.v1.BrokerCatalogTab
3535		-	77, // [77:77] is the sub-list for method output_type
3536		-	77, // [77:77] is the sub-list for method input_type
3537		-	77, // [77:77] is the sub-list for extension type_name
3538		-	77, // [77:77] is the sub-list for extension extendee
3539		-	0, // [0:77] is the sub-list for field type_name
	3564	+	34, // 12: vev.wire.v1.BrokerClientEnvelope.start_preview:type_name -> vev.wire.v1.StartPreview
	3565	+	35, // 13: vev.wire.v1.BrokerClientEnvelope.cancel_preview:type_name -> vev.wire.v1.CancelPreview
	3566	+	18, // 14: vev.wire.v1.BrokerClientEnvelope.stream_window_update:type_name -> vev.wire.v1.StreamWindowUpdate
	3567	+	19, // 15: vev.wire.v1.BrokerServerEnvelope.registered:type_name -> vev.wire.v1.Registered
	3568	+	20, // 16: vev.wire.v1.BrokerServerEnvelope.snapshot_part:type_name -> vev.wire.v1.SnapshotPart
	3569	+	26, // 17: vev.wire.v1.BrokerServerEnvelope.operation_result:type_name -> vev.wire.v1.OperationResult
	3570	+	27, // 18: vev.wire.v1.BrokerServerEnvelope.stream_opened:type_name -> vev.wire.v1.StreamOpened
	3571	+	28, // 19: vev.wire.v1.BrokerServerEnvelope.server_stream_data:type_name -> vev.wire.v1.ServerStreamData
	3572	+	29, // 20: vev.wire.v1.BrokerServerEnvelope.stream_closed:type_name -> vev.wire.v1.StreamClosed
	3573	+	30, // 21: vev.wire.v1.BrokerServerEnvelope.progress:type_name -> vev.wire.v1.Progress
	3574	+	31, // 22: vev.wire.v1.BrokerServerEnvelope.broker_error_message:type_name -> vev.wire.v1.BrokerErrorMessage
	3575	+	32, // 23: vev.wire.v1.BrokerServerEnvelope.shutdown:type_name -> vev.wire.v1.Shutdown
	3576	+	36, // 24: vev.wire.v1.BrokerServerEnvelope.preview_publication:type_name -> vev.wire.v1.PreviewPublication
	3577	+	18, // 25: vev.wire.v1.BrokerServerEnvelope.stream_window_update:type_name -> vev.wire.v1.StreamWindowUpdate
	3578	+	0, // 26: vev.wire.v1.Subscribe.scope:type_name -> vev.wire.v1.BrokerScope
	3579	+	0, // 27: vev.wire.v1.Resync.scope:type_name -> vev.wire.v1.BrokerScope
	3580	+	0, // 28: vev.wire.v1.Unsubscribe.scope:type_name -> vev.wire.v1.BrokerScope
	3581	+	0, // 29: vev.wire.v1.AddHost.scope:type_name -> vev.wire.v1.BrokerScope
	3582	+	2, // 30: vev.wire.v1.AddHost.policy:type_name -> vev.wire.v1.BrokerWirePolicy
	3583	+	0, // 31: vev.wire.v1.RemoveHost.scope:type_name -> vev.wire.v1.BrokerScope
	3584	+	39, // 32: vev.wire.v1.RemoveHost.registration:type_name -> vev.wire.v1.RemoteRegistration
	3585	+	0, // 33: vev.wire.v1.UpdateHostPolicy.scope:type_name -> vev.wire.v1.BrokerScope
	3586	+	39, // 34: vev.wire.v1.UpdateHostPolicy.registration:type_name -> vev.wire.v1.RemoteRegistration
	3587	+	2, // 35: vev.wire.v1.UpdateHostPolicy.policy:type_name -> vev.wire.v1.BrokerWirePolicy
	3588	+	0, // 36: vev.wire.v1.Reconcile.scope:type_name -> vev.wire.v1.BrokerScope
	3589	+	39, // 37: vev.wire.v1.Reconcile.registration:type_name -> vev.wire.v1.RemoteRegistration
	3590	+	1, // 38: vev.wire.v1.OpenStream.ref:type_name -> vev.wire.v1.BrokerStreamRef
	3591	+	39, // 39: vev.wire.v1.OpenStream.registration:type_name -> vev.wire.v1.RemoteRegistration
	3592	+	40, // 40: vev.wire.v1.OpenStream.target:type_name -> vev.wire.v1.ExactTarget
	3593	+	2, // 41: vev.wire.v1.OpenStream.policy:type_name -> vev.wire.v1.BrokerWirePolicy
	3594	+	1, // 42: vev.wire.v1.ClientStreamData.ref:type_name -> vev.wire.v1.BrokerStreamRef
	3595	+	1, // 43: vev.wire.v1.CloseStream.ref:type_name -> vev.wire.v1.BrokerStreamRef
	3596	+	1, // 44: vev.wire.v1.StreamWindowUpdate.ref:type_name -> vev.wire.v1.BrokerStreamRef
	3597	+	0, // 45: vev.wire.v1.Registered.scope:type_name -> vev.wire.v1.BrokerScope
	3598	+	0, // 46: vev.wire.v1.SnapshotPart.scope:type_name -> vev.wire.v1.BrokerScope
	3599	+	21, // 47: vev.wire.v1.SnapshotPart.begin:type_name -> vev.wire.v1.SnapshotBegin
	3600	+	22, // 48: vev.wire.v1.SnapshotPart.daemon:type_name -> vev.wire.v1.SnapshotDaemon
	3601	+	23, // 49: vev.wire.v1.SnapshotPart.session:type_name -> vev.wire.v1.SnapshotSession
	3602	+	24, // 50: vev.wire.v1.SnapshotPart.tombstone:type_name -> vev.wire.v1.SnapshotTombstone
	3603	+	25, // 51: vev.wire.v1.SnapshotPart.end:type_name -> vev.wire.v1.SnapshotEnd
	3604	+	39, // 52: vev.wire.v1.SnapshotDaemon.registration:type_name -> vev.wire.v1.RemoteRegistration
	3605	+	2, // 53: vev.wire.v1.SnapshotDaemon.policy:type_name -> vev.wire.v1.BrokerWirePolicy
	3606	+	4, // 54: vev.wire.v1.SnapshotDaemon.last_attempt:type_name -> vev.wire.v1.BrokerTimestamp
	3607	+	4, // 55: vev.wire.v1.SnapshotDaemon.last_success:type_name -> vev.wire.v1.BrokerTimestamp
	3608	+	4, // 56: vev.wire.v1.SnapshotDaemon.next_due:type_name -> vev.wire.v1.BrokerTimestamp
	3609	+	37, // 57: vev.wire.v1.SnapshotSession.session:type_name -> vev.wire.v1.BrokerCatalogSession
	3610	+	39, // 58: vev.wire.v1.SnapshotTombstone.registration:type_name -> vev.wire.v1.RemoteRegistration
	3611	+	0, // 59: vev.wire.v1.OperationResult.scope:type_name -> vev.wire.v1.BrokerScope
	3612	+	3, // 60: vev.wire.v1.OperationResult.error:type_name -> vev.wire.v1.BrokerErrorDetail
	3613	+	39, // 61: vev.wire.v1.OperationResult.registration:type_name -> vev.wire.v1.RemoteRegistration
	3614	+	1, // 62: vev.wire.v1.StreamOpened.ref:type_name -> vev.wire.v1.BrokerStreamRef
	3615	+	1, // 63: vev.wire.v1.ServerStreamData.ref:type_name -> vev.wire.v1.BrokerStreamRef
	3616	+	1, // 64: vev.wire.v1.StreamClosed.ref:type_name -> vev.wire.v1.BrokerStreamRef
	3617	+	3, // 65: vev.wire.v1.StreamClosed.error:type_name -> vev.wire.v1.BrokerErrorDetail
	3618	+	1, // 66: vev.wire.v1.Progress.ref:type_name -> vev.wire.v1.BrokerStreamRef
	3619	+	0, // 67: vev.wire.v1.BrokerErrorMessage.scope:type_name -> vev.wire.v1.BrokerScope
	3620	+	3, // 68: vev.wire.v1.BrokerErrorMessage.error:type_name -> vev.wire.v1.BrokerErrorDetail
	3621	+	0, // 69: vev.wire.v1.Shutdown.scope:type_name -> vev.wire.v1.BrokerScope
	3622	+	39, // 70: vev.wire.v1.PreviewRoute.registration:type_name -> vev.wire.v1.RemoteRegistration
	3623	+	2, // 71: vev.wire.v1.PreviewRoute.policy:type_name -> vev.wire.v1.BrokerWirePolicy
	3624	+	0, // 72: vev.wire.v1.StartPreview.scope:type_name -> vev.wire.v1.BrokerScope
	3625	+	41, // 73: vev.wire.v1.StartPreview.preview:type_name -> vev.wire.v1.RemotePreviewRequest
	3626	+	33, // 74: vev.wire.v1.StartPreview.route:type_name -> vev.wire.v1.PreviewRoute
	3627	+	0, // 75: vev.wire.v1.CancelPreview.scope:type_name -> vev.wire.v1.BrokerScope
	3628	+	0, // 76: vev.wire.v1.PreviewPublication.scope:type_name -> vev.wire.v1.BrokerScope
	3629	+	42, // 77: vev.wire.v1.PreviewPublication.preview:type_name -> vev.wire.v1.RemotePreview
	3630	+	3, // 78: vev.wire.v1.PreviewPublication.error:type_name -> vev.wire.v1.BrokerErrorDetail
	3631	+	38, // 79: vev.wire.v1.BrokerCatalogSession.tabs:type_name -> vev.wire.v1.BrokerCatalogTab
	3632	+	80, // [80:80] is the sub-list for method output_type
	3633	+	80, // [80:80] is the sub-list for method input_type
	3634	+	80, // [80:80] is the sub-list for extension type_name
	3635	+	80, // [80:80] is the sub-list for extension extendee
	3636	+	0, // [0:80] is the sub-list for field type_name
3540	3637		}
3541	3638
3542	3639		func init() { file_broker_proto_init() }

@@ -3560,6 +3657,7 @@ func file_broker_proto_init() {
3560	3657		(*BrokerClientEnvelope_UpdateHostPolicy)(nil),
3561	3658		(*BrokerClientEnvelope_StartPreview)(nil),
3562	3659		(*BrokerClientEnvelope_CancelPreview)(nil),
	3660	+	(*BrokerClientEnvelope_StreamWindowUpdate)(nil),
3563	3661		}
3564	3662		file_broker_proto_msgTypes[6].OneofWrappers = []any{
3565	3663		(*BrokerServerEnvelope_Registered)(nil),

@@ -3572,15 +3670,16 @@ func file_broker_proto_init() {
3572	3670		(*BrokerServerEnvelope_BrokerErrorMessage)(nil),
3573	3671		(*BrokerServerEnvelope_Shutdown)(nil),
3574	3672		(*BrokerServerEnvelope_PreviewPublication)(nil),
	3673	+	(*BrokerServerEnvelope_StreamWindowUpdate)(nil),
3575	3674		}
3576		-	file_broker_proto_msgTypes[19].OneofWrappers = []any{
	3675	+	file_broker_proto_msgTypes[20].OneofWrappers = []any{
3577	3676		(*SnapshotPart_Begin)(nil),
3578	3677		(*SnapshotPart_Daemon)(nil),
3579	3678		(*SnapshotPart_Session)(nil),
3580	3679		(*SnapshotPart_Tombstone)(nil),
3581	3680		(*SnapshotPart_End)(nil),
3582	3681		}
3583		-	file_broker_proto_msgTypes[35].OneofWrappers = []any{
	3682	+	file_broker_proto_msgTypes[36].OneofWrappers = []any{
3584	3683		(*PreviewPublication_Preview)(nil),
3585	3684		(*PreviewPublication_Error)(nil),
3586	3685		}

@@ -3590,7 +3689,7 @@ func file_broker_proto_init() {
3590	3689		GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
3591	3690		RawDescriptor: unsafe.Slice(unsafe.StringData(file_broker_proto_rawDesc), len(file_broker_proto_rawDesc)),
3592	3691		NumEnums: 0,
3593		-	NumMessages: 38,
	3692	+	NumMessages: 39,
3594	3693		NumExtensions: 0,
3595	3694		NumServices: 0,
3596	3695		},

 	//	*BrokerClientEnvelope_UpdateHostPolicy
 	//	*BrokerClientEnvelope_StartPreview
 	//	*BrokerClientEnvelope_CancelPreview
+	//	*BrokerClientEnvelope_StreamWindowUpdate
 	Payload       isBrokerClientEnvelope_Payload `protobuf_oneof:"payload"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 	return nil
 }
+func (x *BrokerClientEnvelope) GetStreamWindowUpdate() *StreamWindowUpdate {
+	if x != nil {
+		if x, ok := x.Payload.(*BrokerClientEnvelope_StreamWindowUpdate); ok {
+			return x.StreamWindowUpdate
+		}
+	}
+	return nil
+}
 type isBrokerClientEnvelope_Payload interface {
 	isBrokerClientEnvelope_Payload()
 }
 	CancelPreview *CancelPreview `protobuf:"bytes,113,opt,name=cancel_preview,json=cancelPreview,proto3,oneof"`
 }
+type BrokerClientEnvelope_StreamWindowUpdate struct {
+	StreamWindowUpdate *StreamWindowUpdate `protobuf:"bytes,114,opt,name=stream_window_update,json=streamWindowUpdate,proto3,oneof"`
+}
 func (*BrokerClientEnvelope_Register) isBrokerClientEnvelope_Payload() {}
 func (*BrokerClientEnvelope_Subscribe) isBrokerClientEnvelope_Payload() {}
 func (*BrokerClientEnvelope_CancelPreview) isBrokerClientEnvelope_Payload() {}
+func (*BrokerClientEnvelope_StreamWindowUpdate) isBrokerClientEnvelope_Payload() {}
 // BrokerServerEnvelope is the closed server-to-client broker union. Exactly
 // one variant must be set per envelope.
 type BrokerServerEnvelope struct {
 	//	*BrokerServerEnvelope_BrokerErrorMessage
 	//	*BrokerServerEnvelope_Shutdown
 	//	*BrokerServerEnvelope_PreviewPublication
+	//	*BrokerServerEnvelope_StreamWindowUpdate
 	Payload       isBrokerServerEnvelope_Payload `protobuf_oneof:"payload"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 	return nil
 }
+func (x *BrokerServerEnvelope) GetStreamWindowUpdate() *StreamWindowUpdate {
+	if x != nil {
+		if x, ok := x.Payload.(*BrokerServerEnvelope_StreamWindowUpdate); ok {
+			return x.StreamWindowUpdate
+		}
+	}
+	return nil
+}
 type isBrokerServerEnvelope_Payload interface {
 	isBrokerServerEnvelope_Payload()
 }
 	PreviewPublication *PreviewPublication `protobuf:"bytes,210,opt,name=preview_publication,json=previewPublication,proto3,oneof"`
 }
+type BrokerServerEnvelope_StreamWindowUpdate struct {
+	StreamWindowUpdate *StreamWindowUpdate `protobuf:"bytes,211,opt,name=stream_window_update,json=streamWindowUpdate,proto3,oneof"`
+}
 func (*BrokerServerEnvelope_Registered) isBrokerServerEnvelope_Payload() {}
 func (*BrokerServerEnvelope_SnapshotPart) isBrokerServerEnvelope_Payload() {}
 func (*BrokerServerEnvelope_PreviewPublication) isBrokerServerEnvelope_Payload() {}
+func (*BrokerServerEnvelope_StreamWindowUpdate) isBrokerServerEnvelope_Payload() {}
 // Register opens one client connection to the broker.
 type Register struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	return nil
 }
+// StreamWindowUpdate grants the peer credit to send more stream data on one
+// logical stream: the receiver consumed that much of its stream window. Each
+// direction of a stream has its own window, so a client grants credit for
+// ServerStreamData and the server grants credit for ClientStreamData.
+type StreamWindowUpdate struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Ref           *BrokerStreamRef       `protobuf:"bytes,1,opt,name=ref,proto3" json:"ref,omitempty"`
+	Credit        uint64                 `protobuf:"varint,2,opt,name=credit,proto3" json:"credit,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+func (x *StreamWindowUpdate) Reset() {
+	*x = StreamWindowUpdate{}
+	mi := &file_broker_proto_msgTypes[18]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+func (x *StreamWindowUpdate) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+func (*StreamWindowUpdate) ProtoMessage() {}
+func (x *StreamWindowUpdate) ProtoReflect() protoreflect.Message {
+	mi := &file_broker_proto_msgTypes[18]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+// Deprecated: Use StreamWindowUpdate.ProtoReflect.Descriptor instead.
+func (*StreamWindowUpdate) Descriptor() ([]byte, []int) {
+	return file_broker_proto_rawDescGZIP(), []int{18}
+}
+func (x *StreamWindowUpdate) GetRef() *BrokerStreamRef {
+	if x != nil {
+		return x.Ref
+	}
+	return nil
+}
+func (x *StreamWindowUpdate) GetCredit() uint64 {
+	if x != nil {
+		return x.Credit
+	}
+	return 0
+}
 // Registered confirms one accepted client connection and its assigned scope.
 type Registered struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 func (x *Registered) Reset() {
 	*x = Registered{}
-	mi := &file_broker_proto_msgTypes[18]
+	mi := &file_broker_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*Registered) ProtoMessage() {}
 func (x *Registered) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[18]
+	mi := &file_broker_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use Registered.ProtoReflect.Descriptor instead.
 func (*Registered) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{18}
+	return file_broker_proto_rawDescGZIP(), []int{19}
 }
 func (x *Registered) GetScope() *BrokerScope {
 func (x *SnapshotPart) Reset() {
 	*x = SnapshotPart{}
-	mi := &file_broker_proto_msgTypes[19]
+	mi := &file_broker_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*SnapshotPart) ProtoMessage() {}
 func (x *SnapshotPart) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[19]
+	mi := &file_broker_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use SnapshotPart.ProtoReflect.Descriptor instead.
 func (*SnapshotPart) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{19}
+	return file_broker_proto_rawDescGZIP(), []int{20}
 }
 func (x *SnapshotPart) GetScope() *BrokerScope {
 func (x *SnapshotBegin) Reset() {
 	*x = SnapshotBegin{}
-	mi := &file_broker_proto_msgTypes[20]
+	mi := &file_broker_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*SnapshotBegin) ProtoMessage() {}
 func (x *SnapshotBegin) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[20]
+	mi := &file_broker_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use SnapshotBegin.ProtoReflect.Descriptor instead.
 func (*SnapshotBegin) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{20}
+	return file_broker_proto_rawDescGZIP(), []int{21}
 }
 func (x *SnapshotBegin) GetHostCount() uint32 {
 func (x *SnapshotDaemon) Reset() {
 	*x = SnapshotDaemon{}
-	mi := &file_broker_proto_msgTypes[21]
+	mi := &file_broker_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*SnapshotDaemon) ProtoMessage() {}
 func (x *SnapshotDaemon) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[21]
+	mi := &file_broker_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use SnapshotDaemon.ProtoReflect.Descriptor instead.
 func (*SnapshotDaemon) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{21}
+	return file_broker_proto_rawDescGZIP(), []int{22}
 }
 func (x *SnapshotDaemon) GetHostIndex() uint32 {
 func (x *SnapshotSession) Reset() {
 	*x = SnapshotSession{}
-	mi := &file_broker_proto_msgTypes[22]
+	mi := &file_broker_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*SnapshotSession) ProtoMessage() {}
 func (x *SnapshotSession) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[22]
+	mi := &file_broker_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use SnapshotSession.ProtoReflect.Descriptor instead.
 func (*SnapshotSession) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{22}
+	return file_broker_proto_rawDescGZIP(), []int{23}
 }
 func (x *SnapshotSession) GetHostIndex() uint32 {
 func (x *SnapshotTombstone) Reset() {
 	*x = SnapshotTombstone{}
-	mi := &file_broker_proto_msgTypes[23]
+	mi := &file_broker_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*SnapshotTombstone) ProtoMessage() {}
 func (x *SnapshotTombstone) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[23]
+	mi := &file_broker_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use SnapshotTombstone.ProtoReflect.Descriptor instead.
 func (*SnapshotTombstone) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{23}
+	return file_broker_proto_rawDescGZIP(), []int{24}
 }
 func (x *SnapshotTombstone) GetTombstoneIndex() uint32 {
 func (x *SnapshotEnd) Reset() {
 	*x = SnapshotEnd{}
-	mi := &file_broker_proto_msgTypes[24]
+	mi := &file_broker_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*SnapshotEnd) ProtoMessage() {}
 func (x *SnapshotEnd) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[24]
+	mi := &file_broker_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use SnapshotEnd.ProtoReflect.Descriptor instead.
 func (*SnapshotEnd) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{24}
+	return file_broker_proto_rawDescGZIP(), []int{25}
 }
 // OperationResult is exactly one completion for one admitted mutating
 func (x *OperationResult) Reset() {
 	*x = OperationResult{}
-	mi := &file_broker_proto_msgTypes[25]
+	mi := &file_broker_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*OperationResult) ProtoMessage() {}
 func (x *OperationResult) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[25]
+	mi := &file_broker_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use OperationResult.ProtoReflect.Descriptor instead.
 func (*OperationResult) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{25}
+	return file_broker_proto_rawDescGZIP(), []int{26}
 }
 func (x *OperationResult) GetScope() *BrokerScope {
 func (x *StreamOpened) Reset() {
 	*x = StreamOpened{}
-	mi := &file_broker_proto_msgTypes[26]
+	mi := &file_broker_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*StreamOpened) ProtoMessage() {}
 func (x *StreamOpened) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[26]
+	mi := &file_broker_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use StreamOpened.ProtoReflect.Descriptor instead.
 func (*StreamOpened) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{26}
+	return file_broker_proto_rawDescGZIP(), []int{27}
 }
 func (x *StreamOpened) GetRef() *BrokerStreamRef {
 func (x *ServerStreamData) Reset() {
 	*x = ServerStreamData{}
-	mi := &file_broker_proto_msgTypes[27]
+	mi := &file_broker_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*ServerStreamData) ProtoMessage() {}
 func (x *ServerStreamData) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[27]
+	mi := &file_broker_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use ServerStreamData.ProtoReflect.Descriptor instead.
 func (*ServerStreamData) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{27}
+	return file_broker_proto_rawDescGZIP(), []int{28}
 }
 func (x *ServerStreamData) GetRef() *BrokerStreamRef {
 func (x *StreamClosed) Reset() {
 	*x = StreamClosed{}
-	mi := &file_broker_proto_msgTypes[28]
+	mi := &file_broker_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*StreamClosed) ProtoMessage() {}
 func (x *StreamClosed) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[28]
+	mi := &file_broker_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use StreamClosed.ProtoReflect.Descriptor instead.
 func (*StreamClosed) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{28}
+	return file_broker_proto_rawDescGZIP(), []int{29}
 }
 func (x *StreamClosed) GetRef() *BrokerStreamRef {
 func (x *Progress) Reset() {
 	*x = Progress{}
-	mi := &file_broker_proto_msgTypes[29]
+	mi := &file_broker_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*Progress) ProtoMessage() {}
 func (x *Progress) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[29]
+	mi := &file_broker_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use Progress.ProtoReflect.Descriptor instead.
 func (*Progress) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{29}
+	return file_broker_proto_rawDescGZIP(), []int{30}
 }
 func (x *Progress) GetRef() *BrokerStreamRef {
 func (x *BrokerErrorMessage) Reset() {
 	*x = BrokerErrorMessage{}
-	mi := &file_broker_proto_msgTypes[30]
+	mi := &file_broker_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*BrokerErrorMessage) ProtoMessage() {}
 func (x *BrokerErrorMessage) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[30]
+	mi := &file_broker_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use BrokerErrorMessage.ProtoReflect.Descriptor instead.
 func (*BrokerErrorMessage) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{30}
+	return file_broker_proto_rawDescGZIP(), []int{31}
 }
 func (x *BrokerErrorMessage) GetScope() *BrokerScope {
 func (x *Shutdown) Reset() {
 	*x = Shutdown{}
-	mi := &file_broker_proto_msgTypes[31]
+	mi := &file_broker_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*Shutdown) ProtoMessage() {}
 func (x *Shutdown) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[31]
+	mi := &file_broker_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use Shutdown.ProtoReflect.Descriptor instead.
 func (*Shutdown) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{31}
+	return file_broker_proto_rawDescGZIP(), []int{32}
 }
 func (x *Shutdown) GetScope() *BrokerScope {
 func (x *PreviewRoute) Reset() {
 	*x = PreviewRoute{}
-	mi := &file_broker_proto_msgTypes[32]
+	mi := &file_broker_proto_msgTypes[33]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*PreviewRoute) ProtoMessage() {}
 func (x *PreviewRoute) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[32]
+	mi := &file_broker_proto_msgTypes[33]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use PreviewRoute.ProtoReflect.Descriptor instead.
 func (*PreviewRoute) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{32}
+	return file_broker_proto_rawDescGZIP(), []int{33}
 }
 func (x *PreviewRoute) GetLocal() bool {
 func (x *StartPreview) Reset() {
 	*x = StartPreview{}
-	mi := &file_broker_proto_msgTypes[33]
+	mi := &file_broker_proto_msgTypes[34]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*StartPreview) ProtoMessage() {}
 func (x *StartPreview) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[33]
+	mi := &file_broker_proto_msgTypes[34]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use StartPreview.ProtoReflect.Descriptor instead.
 func (*StartPreview) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{33}
+	return file_broker_proto_rawDescGZIP(), []int{34}
 }
 func (x *StartPreview) GetScope() *BrokerScope {
 func (x *CancelPreview) Reset() {
 	*x = CancelPreview{}
-	mi := &file_broker_proto_msgTypes[34]
+	mi := &file_broker_proto_msgTypes[35]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*CancelPreview) ProtoMessage() {}
 func (x *CancelPreview) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[34]
+	mi := &file_broker_proto_msgTypes[35]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use CancelPreview.ProtoReflect.Descriptor instead.
 func (*CancelPreview) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{34}
+	return file_broker_proto_rawDescGZIP(), []int{35}
 }
 func (x *CancelPreview) GetScope() *BrokerScope {
 func (x *PreviewPublication) Reset() {
 	*x = PreviewPublication{}
-	mi := &file_broker_proto_msgTypes[35]
+	mi := &file_broker_proto_msgTypes[36]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*PreviewPublication) ProtoMessage() {}
 func (x *PreviewPublication) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[35]
+	mi := &file_broker_proto_msgTypes[36]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use PreviewPublication.ProtoReflect.Descriptor instead.
 func (*PreviewPublication) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{35}
+	return file_broker_proto_rawDescGZIP(), []int{36}
 }
 func (x *PreviewPublication) GetScope() *BrokerScope {
 func (x *BrokerCatalogSession) Reset() {
 	*x = BrokerCatalogSession{}
-	mi := &file_broker_proto_msgTypes[36]
+	mi := &file_broker_proto_msgTypes[37]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*BrokerCatalogSession) ProtoMessage() {}
 func (x *BrokerCatalogSession) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[36]
+	mi := &file_broker_proto_msgTypes[37]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use BrokerCatalogSession.ProtoReflect.Descriptor instead.
 func (*BrokerCatalogSession) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{36}
+	return file_broker_proto_rawDescGZIP(), []int{37}
 }
 func (x *BrokerCatalogSession) GetLifecycleId() []byte {
 func (x *BrokerCatalogTab) Reset() {
 	*x = BrokerCatalogTab{}
-	mi := &file_broker_proto_msgTypes[37]
+	mi := &file_broker_proto_msgTypes[38]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
 func (*BrokerCatalogTab) ProtoMessage() {}
 func (x *BrokerCatalogTab) ProtoReflect() protoreflect.Message {
-	mi := &file_broker_proto_msgTypes[37]
+	mi := &file_broker_proto_msgTypes[38]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 // Deprecated: Use BrokerCatalogTab.ProtoReflect.Descriptor instead.
 func (*BrokerCatalogTab) Descriptor() ([]byte, []int) {
-	return file_broker_proto_rawDescGZIP(), []int{37}
+	return file_broker_proto_rawDescGZIP(), []int{38}
 }
 func (x *BrokerCatalogTab) GetId() string {
 	"\ffailure_kind\x18\x04 \x01(\rR\vfailureKind\"A\n" +
 	"\x0fBrokerTimestamp\x12\x18\n" +
 	"\aseconds\x18\x01 \x01(\x03R\aseconds\x12\x14\n" +
-	"\x05nanos\x18\x02 \x01(\x05R\x05nanos\"\xc2\x06\n" +
+	"\x05nanos\x18\x02 \x01(\x05R\x05nanos\"\x97\a\n" +
 	"\x14BrokerClientEnvelope\x123\n" +
 	"\bregister\x18e \x01(\v2\x15.vev.wire.v1.RegisterH\x00R\bregister\x126\n" +
 	"\tsubscribe\x18f \x01(\v2\x16.vev.wire.v1.SubscribeH\x00R\tsubscribe\x12-\n" +
 	"\fclose_stream\x18n \x01(\v2\x18.vev.wire.v1.CloseStreamH\x00R\vcloseStream\x12M\n" +
 	"\x12update_host_policy\x18o \x01(\v2\x1d.vev.wire.v1.UpdateHostPolicyH\x00R\x10updateHostPolicy\x12@\n" +
 	"\rstart_preview\x18p \x01(\v2\x19.vev.wire.v1.StartPreviewH\x00R\fstartPreview\x12C\n" +
-	"\x0ecancel_preview\x18q \x01(\v2\x1a.vev.wire.v1.CancelPreviewH\x00R\rcancelPreviewB\t\n" +
+	"\x0ecancel_preview\x18q \x01(\v2\x1a.vev.wire.v1.CancelPreviewH\x00R\rcancelPreview\x12S\n" +
-	"\apayload\"\xd9\x05\n" +
+	"\x14stream_window_update\x18r \x01(\v2\x1f.vev.wire.v1.StreamWindowUpdateH\x00R\x12streamWindowUpdateB\t\n" +
+	"\apayload\"\xaf\x06\n" +
 	"\x14BrokerServerEnvelope\x12:\n" +
 	"\n" +
 	"registered\x18\xc9\x01 \x01(\v2\x17.vev.wire.v1.RegisteredH\x00R\n" +
 	"\bprogress\x18\xcf\x01 \x01(\v2\x15.vev.wire.v1.ProgressH\x00R\bprogress\x12T\n" +
 	"\x14broker_error_message\x18\xd0\x01 \x01(\v2\x1f.vev.wire.v1.BrokerErrorMessageH\x00R\x12brokerErrorMessage\x124\n" +
 	"\bshutdown\x18\xd1\x01 \x01(\v2\x15.vev.wire.v1.ShutdownH\x00R\bshutdown\x12S\n" +
-	"\x13preview_publication\x18\xd2\x01 \x01(\v2\x1f.vev.wire.v1.PreviewPublicationH\x00R\x12previewPublicationB\t\n" +
+	"\x13preview_publication\x18\xd2\x01 \x01(\v2\x1f.vev.wire.v1.PreviewPublicationH\x00R\x12previewPublication\x12T\n" +
+	"\x14stream_window_update\x18\xd3\x01 \x01(\v2\x1f.vev.wire.v1.StreamWindowUpdateH\x00R\x12streamWindowUpdateB\t\n" +
 	"\apayload\" \n" +
 	"\bRegister\x12\x14\n" +
 	"\x05build\x18\x01 \x01(\tR\x05build\"u\n" +
 	"\x03ref\x18\x01 \x01(\v2\x1c.vev.wire.v1.BrokerStreamRefR\x03ref\x12\x12\n" +
 	"\x04data\x18\x02 \x01(\fR\x04data\"=\n" +
 	"\vCloseStream\x12.\n" +
-	"\x03ref\x18\x01 \x01(\v2\x1c.vev.wire.v1.BrokerStreamRefR\x03ref\"n\n" +
+	"\x03ref\x18\x01 \x01(\v2\x1c.vev.wire.v1.BrokerStreamRefR\x03ref\"\\\n" +
+	"\x12StreamWindowUpdate\x12.\n" +
+	"\x03ref\x18\x01 \x01(\v2\x1c.vev.wire.v1.BrokerStreamRefR\x03ref\x12\x16\n" +
+	"\x06credit\x18\x02 \x01(\x04R\x06credit\"n\n" +
 	"\n" +
 	"Registered\x12.\n" +
 	"\x05scope\x18\x01 \x01(\v2\x18.vev.wire.v1.BrokerScopeR\x05scope\x12\x14\n" +
 	return file_broker_proto_rawDescData
 }
-var file_broker_proto_msgTypes = make([]protoimpl.MessageInfo, 38)
+var file_broker_proto_msgTypes = make([]protoimpl.MessageInfo, 39)
 var file_broker_proto_goTypes = []any{
 	(*BrokerScope)(nil),          // 0: vev.wire.v1.BrokerScope
 	(*BrokerStreamRef)(nil),      // 1: vev.wire.v1.BrokerStreamRef
 	(*OpenStream)(nil),           // 15: vev.wire.v1.OpenStream
 	(*ClientStreamData)(nil),     // 16: vev.wire.v1.ClientStreamData
 	(*CloseStream)(nil),          // 17: vev.wire.v1.CloseStream
-	(*Registered)(nil),           // 18: vev.wire.v1.Registered
+	(*StreamWindowUpdate)(nil),   // 18: vev.wire.v1.StreamWindowUpdate
-	(*SnapshotPart)(nil),         // 19: vev.wire.v1.SnapshotPart
+	(*Registered)(nil),           // 19: vev.wire.v1.Registered
-	(*SnapshotBegin)(nil),        // 20: vev.wire.v1.SnapshotBegin
+	(*SnapshotPart)(nil),         // 20: vev.wire.v1.SnapshotPart
-	(*SnapshotDaemon)(nil),       // 21: vev.wire.v1.SnapshotDaemon
+	(*SnapshotBegin)(nil),        // 21: vev.wire.v1.SnapshotBegin
-	(*SnapshotSession)(nil),      // 22: vev.wire.v1.SnapshotSession
+	(*SnapshotDaemon)(nil),       // 22: vev.wire.v1.SnapshotDaemon
-	(*SnapshotTombstone)(nil),    // 23: vev.wire.v1.SnapshotTombstone
+	(*SnapshotSession)(nil),      // 23: vev.wire.v1.SnapshotSession
-	(*SnapshotEnd)(nil),          // 24: vev.wire.v1.SnapshotEnd
+	(*SnapshotTombstone)(nil),    // 24: vev.wire.v1.SnapshotTombstone
-	(*OperationResult)(nil),      // 25: vev.wire.v1.OperationResult
+	(*SnapshotEnd)(nil),          // 25: vev.wire.v1.SnapshotEnd
-	(*StreamOpened)(nil),         // 26: vev.wire.v1.StreamOpened
+	(*OperationResult)(nil),      // 26: vev.wire.v1.OperationResult
-	(*ServerStreamData)(nil),     // 27: vev.wire.v1.ServerStreamData
+	(*StreamOpened)(nil),         // 27: vev.wire.v1.StreamOpened
-	(*StreamClosed)(nil),         // 28: vev.wire.v1.StreamClosed
+	(*ServerStreamData)(nil),     // 28: vev.wire.v1.ServerStreamData
-	(*Progress)(nil),             // 29: vev.wire.v1.Progress
+	(*StreamClosed)(nil),         // 29: vev.wire.v1.StreamClosed
-	(*BrokerErrorMessage)(nil),   // 30: vev.wire.v1.BrokerErrorMessage
+	(*Progress)(nil),             // 30: vev.wire.v1.Progress
-	(*Shutdown)(nil),             // 31: vev.wire.v1.Shutdown
+	(*BrokerErrorMessage)(nil),   // 31: vev.wire.v1.BrokerErrorMessage
-	(*PreviewRoute)(nil),         // 32: vev.wire.v1.PreviewRoute
+	(*Shutdown)(nil),             // 32: vev.wire.v1.Shutdown
-	(*StartPreview)(nil),         // 33: vev.wire.v1.StartPreview
+	(*PreviewRoute)(nil),         // 33: vev.wire.v1.PreviewRoute
-	(*CancelPreview)(nil),        // 34: vev.wire.v1.CancelPreview
+	(*StartPreview)(nil),         // 34: vev.wire.v1.StartPreview
-	(*PreviewPublication)(nil),   // 35: vev.wire.v1.PreviewPublication
+	(*CancelPreview)(nil),        // 35: vev.wire.v1.CancelPreview
-	(*BrokerCatalogSession)(nil), // 36: vev.wire.v1.BrokerCatalogSession
+	(*PreviewPublication)(nil),   // 36: vev.wire.v1.PreviewPublication
-	(*BrokerCatalogTab)(nil),     // 37: vev.wire.v1.BrokerCatalogTab
+	(*BrokerCatalogSession)(nil), // 37: vev.wire.v1.BrokerCatalogSession
-	(*RemoteRegistration)(nil),   // 38: vev.wire.v1.RemoteRegistration
+	(*BrokerCatalogTab)(nil),     // 38: vev.wire.v1.BrokerCatalogTab
-	(*ExactTarget)(nil),          // 39: vev.wire.v1.ExactTarget
+	(*RemoteRegistration)(nil),   // 39: vev.wire.v1.RemoteRegistration
-	(*RemotePreviewRequest)(nil), // 40: vev.wire.v1.RemotePreviewRequest
+	(*ExactTarget)(nil),          // 40: vev.wire.v1.ExactTarget
-	(*RemotePreview)(nil),        // 41: vev.wire.v1.RemotePreview
+	(*RemotePreviewRequest)(nil), // 41: vev.wire.v1.RemotePreviewRequest
+	(*RemotePreview)(nil),        // 42: vev.wire.v1.RemotePreview
 }
 var file_broker_proto_depIdxs = []int32{
 	0,  // 0: vev.wire.v1.BrokerStreamRef.scope:type_name -> vev.wire.v1.BrokerScope
 	16, // 9: vev.wire.v1.BrokerClientEnvelope.client_stream_data:type_name -> vev.wire.v1.ClientStreamData
 	17, // 10: vev.wire.v1.BrokerClientEnvelope.close_stream:type_name -> vev.wire.v1.CloseStream
 	13, // 11: vev.wire.v1.BrokerClientEnvelope.update_host_policy:type_name -> vev.wire.v1.UpdateHostPolicy
-	33, // 12: vev.wire.v1.BrokerClientEnvelope.start_preview:type_name -> vev.wire.v1.StartPreview
+	34, // 12: vev.wire.v1.BrokerClientEnvelope.start_preview:type_name -> vev.wire.v1.StartPreview
-	34, // 13: vev.wire.v1.BrokerClientEnvelope.cancel_preview:type_name -> vev.wire.v1.CancelPreview
+	35, // 13: vev.wire.v1.BrokerClientEnvelope.cancel_preview:type_name -> vev.wire.v1.CancelPreview
-	18, // 14: vev.wire.v1.BrokerServerEnvelope.registered:type_name -> vev.wire.v1.Registered
+	18, // 14: vev.wire.v1.BrokerClientEnvelope.stream_window_update:type_name -> vev.wire.v1.StreamWindowUpdate
-	19, // 15: vev.wire.v1.BrokerServerEnvelope.snapshot_part:type_name -> vev.wire.v1.SnapshotPart
+	19, // 15: vev.wire.v1.BrokerServerEnvelope.registered:type_name -> vev.wire.v1.Registered
-	25, // 16: vev.wire.v1.BrokerServerEnvelope.operation_result:type_name -> vev.wire.v1.OperationResult
+	20, // 16: vev.wire.v1.BrokerServerEnvelope.snapshot_part:type_name -> vev.wire.v1.SnapshotPart
-	26, // 17: vev.wire.v1.BrokerServerEnvelope.stream_opened:type_name -> vev.wire.v1.StreamOpened
+	26, // 17: vev.wire.v1.BrokerServerEnvelope.operation_result:type_name -> vev.wire.v1.OperationResult
-	27, // 18: vev.wire.v1.BrokerServerEnvelope.server_stream_data:type_name -> vev.wire.v1.ServerStreamData
+	27, // 18: vev.wire.v1.BrokerServerEnvelope.stream_opened:type_name -> vev.wire.v1.StreamOpened
-	28, // 19: vev.wire.v1.BrokerServerEnvelope.stream_closed:type_name -> vev.wire.v1.StreamClosed
+	28, // 19: vev.wire.v1.BrokerServerEnvelope.server_stream_data:type_name -> vev.wire.v1.ServerStreamData
-	29, // 20: vev.wire.v1.BrokerServerEnvelope.progress:type_name -> vev.wire.v1.Progress
+	29, // 20: vev.wire.v1.BrokerServerEnvelope.stream_closed:type_name -> vev.wire.v1.StreamClosed
-	30, // 21: vev.wire.v1.BrokerServerEnvelope.broker_error_message:type_name -> vev.wire.v1.BrokerErrorMessage
+	30, // 21: vev.wire.v1.BrokerServerEnvelope.progress:type_name -> vev.wire.v1.Progress
-	31, // 22: vev.wire.v1.BrokerServerEnvelope.shutdown:type_name -> vev.wire.v1.Shutdown
+	31, // 22: vev.wire.v1.BrokerServerEnvelope.broker_error_message:type_name -> vev.wire.v1.BrokerErrorMessage
-	35, // 23: vev.wire.v1.BrokerServerEnvelope.preview_publication:type_name -> vev.wire.v1.PreviewPublication
+	32, // 23: vev.wire.v1.BrokerServerEnvelope.shutdown:type_name -> vev.wire.v1.Shutdown
-	0,  // 24: vev.wire.v1.Subscribe.scope:type_name -> vev.wire.v1.BrokerScope
+	36, // 24: vev.wire.v1.BrokerServerEnvelope.preview_publication:type_name -> vev.wire.v1.PreviewPublication
-	0,  // 25: vev.wire.v1.Resync.scope:type_name -> vev.wire.v1.BrokerScope
+	18, // 25: vev.wire.v1.BrokerServerEnvelope.stream_window_update:type_name -> vev.wire.v1.StreamWindowUpdate
-	0,  // 26: vev.wire.v1.Unsubscribe.scope:type_name -> vev.wire.v1.BrokerScope
+	0,  // 26: vev.wire.v1.Subscribe.scope:type_name -> vev.wire.v1.BrokerScope
-	0,  // 27: vev.wire.v1.AddHost.scope:type_name -> vev.wire.v1.BrokerScope
+	0,  // 27: vev.wire.v1.Resync.scope:type_name -> vev.wire.v1.BrokerScope
-	2,  // 28: vev.wire.v1.AddHost.policy:type_name -> vev.wire.v1.BrokerWirePolicy
+	0,  // 28: vev.wire.v1.Unsubscribe.scope:type_name -> vev.wire.v1.BrokerScope
-	0,  // 29: vev.wire.v1.RemoveHost.scope:type_name -> vev.wire.v1.BrokerScope
+	0,  // 29: vev.wire.v1.AddHost.scope:type_name -> vev.wire.v1.BrokerScope
-	38, // 30: vev.wire.v1.RemoveHost.registration:type_name -> vev.wire.v1.RemoteRegistration
+	2,  // 30: vev.wire.v1.AddHost.policy:type_name -> vev.wire.v1.BrokerWirePolicy
-	0,  // 31: vev.wire.v1.UpdateHostPolicy.scope:type_name -> vev.wire.v1.BrokerScope
+	0,  // 31: vev.wire.v1.RemoveHost.scope:type_name -> vev.wire.v1.BrokerScope
-	38, // 32: vev.wire.v1.UpdateHostPolicy.registration:type_name -> vev.wire.v1.RemoteRegistration
+	39, // 32: vev.wire.v1.RemoveHost.registration:type_name -> vev.wire.v1.RemoteRegistration
-	2,  // 33: vev.wire.v1.UpdateHostPolicy.policy:type_name -> vev.wire.v1.BrokerWirePolicy
+	0,  // 33: vev.wire.v1.UpdateHostPolicy.scope:type_name -> vev.wire.v1.BrokerScope
-	0,  // 34: vev.wire.v1.Reconcile.scope:type_name -> vev.wire.v1.BrokerScope
+	39, // 34: vev.wire.v1.UpdateHostPolicy.registration:type_name -> vev.wire.v1.RemoteRegistration
-	38, // 35: vev.wire.v1.Reconcile.registration:type_name -> vev.wire.v1.RemoteRegistration
+	2,  // 35: vev.wire.v1.UpdateHostPolicy.policy:type_name -> vev.wire.v1.BrokerWirePolicy
-	1,  // 36: vev.wire.v1.OpenStream.ref:type_name -> vev.wire.v1.BrokerStreamRef
+	0,  // 36: vev.wire.v1.Reconcile.scope:type_name -> vev.wire.v1.BrokerScope
-	38, // 37: vev.wire.v1.OpenStream.registration:type_name -> vev.wire.v1.RemoteRegistration
+	39, // 37: vev.wire.v1.Reconcile.registration:type_name -> vev.wire.v1.RemoteRegistration
-	39, // 38: vev.wire.v1.OpenStream.target:type_name -> vev.wire.v1.ExactTarget
+	1,  // 38: vev.wire.v1.OpenStream.ref:type_name -> vev.wire.v1.BrokerStreamRef
-	2,  // 39: vev.wire.v1.OpenStream.policy:type_name -> vev.wire.v1.BrokerWirePolicy
+	39, // 39: vev.wire.v1.OpenStream.registration:type_name -> vev.wire.v1.RemoteRegistration
-	1,  // 40: vev.wire.v1.ClientStreamData.ref:type_name -> vev.wire.v1.BrokerStreamRef
+	40, // 40: vev.wire.v1.OpenStream.target:type_name -> vev.wire.v1.ExactTarget
-	1,  // 41: vev.wire.v1.CloseStream.ref:type_name -> vev.wire.v1.BrokerStreamRef
+	2,  // 41: vev.wire.v1.OpenStream.policy:type_name -> vev.wire.v1.BrokerWirePolicy
-	0,  // 42: vev.wire.v1.Registered.scope:type_name -> vev.wire.v1.BrokerScope
+	1,  // 42: vev.wire.v1.ClientStreamData.ref:type_name -> vev.wire.v1.BrokerStreamRef
-	0,  // 43: vev.wire.v1.SnapshotPart.scope:type_name -> vev.wire.v1.BrokerScope
+	1,  // 43: vev.wire.v1.CloseStream.ref:type_name -> vev.wire.v1.BrokerStreamRef
-	20, // 44: vev.wire.v1.SnapshotPart.begin:type_name -> vev.wire.v1.SnapshotBegin
+	1,  // 44: vev.wire.v1.StreamWindowUpdate.ref:type_name -> vev.wire.v1.BrokerStreamRef
-	21, // 45: vev.wire.v1.SnapshotPart.daemon:type_name -> vev.wire.v1.SnapshotDaemon
+	0,  // 45: vev.wire.v1.Registered.scope:type_name -> vev.wire.v1.BrokerScope
-	22, // 46: vev.wire.v1.SnapshotPart.session:type_name -> vev.wire.v1.SnapshotSession
+	0,  // 46: vev.wire.v1.SnapshotPart.scope:type_name -> vev.wire.v1.BrokerScope
-	23, // 47: vev.wire.v1.SnapshotPart.tombstone:type_name -> vev.wire.v1.SnapshotTombstone
+	21, // 47: vev.wire.v1.SnapshotPart.begin:type_name -> vev.wire.v1.SnapshotBegin
-	24, // 48: vev.wire.v1.SnapshotPart.end:type_name -> vev.wire.v1.SnapshotEnd
+	22, // 48: vev.wire.v1.SnapshotPart.daemon:type_name -> vev.wire.v1.SnapshotDaemon
-	38, // 49: vev.wire.v1.SnapshotDaemon.registration:type_name -> vev.wire.v1.RemoteRegistration
+	23, // 49: vev.wire.v1.SnapshotPart.session:type_name -> vev.wire.v1.SnapshotSession
-	2,  // 50: vev.wire.v1.SnapshotDaemon.policy:type_name -> vev.wire.v1.BrokerWirePolicy
+	24, // 50: vev.wire.v1.SnapshotPart.tombstone:type_name -> vev.wire.v1.SnapshotTombstone
-	4,  // 51: vev.wire.v1.SnapshotDaemon.last_attempt:type_name -> vev.wire.v1.BrokerTimestamp
+	25, // 51: vev.wire.v1.SnapshotPart.end:type_name -> vev.wire.v1.SnapshotEnd
-	4,  // 52: vev.wire.v1.SnapshotDaemon.last_success:type_name -> vev.wire.v1.BrokerTimestamp
+	39, // 52: vev.wire.v1.SnapshotDaemon.registration:type_name -> vev.wire.v1.RemoteRegistration
-	4,  // 53: vev.wire.v1.SnapshotDaemon.next_due:type_name -> vev.wire.v1.BrokerTimestamp
+	2,  // 53: vev.wire.v1.SnapshotDaemon.policy:type_name -> vev.wire.v1.BrokerWirePolicy
-	36, // 54: vev.wire.v1.SnapshotSession.session:type_name -> vev.wire.v1.BrokerCatalogSession
+	4,  // 54: vev.wire.v1.SnapshotDaemon.last_attempt:type_name -> vev.wire.v1.BrokerTimestamp
-	38, // 55: vev.wire.v1.SnapshotTombstone.registration:type_name -> vev.wire.v1.RemoteRegistration
+	4,  // 55: vev.wire.v1.SnapshotDaemon.last_success:type_name -> vev.wire.v1.BrokerTimestamp
-	0,  // 56: vev.wire.v1.OperationResult.scope:type_name -> vev.wire.v1.BrokerScope
+	4,  // 56: vev.wire.v1.SnapshotDaemon.next_due:type_name -> vev.wire.v1.BrokerTimestamp
-	3,  // 57: vev.wire.v1.OperationResult.error:type_name -> vev.wire.v1.BrokerErrorDetail
+	37, // 57: vev.wire.v1.SnapshotSession.session:type_name -> vev.wire.v1.BrokerCatalogSession
-	38, // 58: vev.wire.v1.OperationResult.registration:type_name -> vev.wire.v1.RemoteRegistration
+	39, // 58: vev.wire.v1.SnapshotTombstone.registration:type_name -> vev.wire.v1.RemoteRegistration
-	1,  // 59: vev.wire.v1.StreamOpened.ref:type_name -> vev.wire.v1.BrokerStreamRef
+	0,  // 59: vev.wire.v1.OperationResult.scope:type_name -> vev.wire.v1.BrokerScope
-	1,  // 60: vev.wire.v1.ServerStreamData.ref:type_name -> vev.wire.v1.BrokerStreamRef
+	3,  // 60: vev.wire.v1.OperationResult.error:type_name -> vev.wire.v1.BrokerErrorDetail
-	1,  // 61: vev.wire.v1.StreamClosed.ref:type_name -> vev.wire.v1.BrokerStreamRef
+	39, // 61: vev.wire.v1.OperationResult.registration:type_name -> vev.wire.v1.RemoteRegistration
-	3,  // 62: vev.wire.v1.StreamClosed.error:type_name -> vev.wire.v1.BrokerErrorDetail
+	1,  // 62: vev.wire.v1.StreamOpened.ref:type_name -> vev.wire.v1.BrokerStreamRef
-	1,  // 63: vev.wire.v1.Progress.ref:type_name -> vev.wire.v1.BrokerStreamRef
+	1,  // 63: vev.wire.v1.ServerStreamData.ref:type_name -> vev.wire.v1.BrokerStreamRef
-	0,  // 64: vev.wire.v1.BrokerErrorMessage.scope:type_name -> vev.wire.v1.BrokerScope
+	1,  // 64: vev.wire.v1.StreamClosed.ref:type_name -> vev.wire.v1.BrokerStreamRef
-	3,  // 65: vev.wire.v1.BrokerErrorMessage.error:type_name -> vev.wire.v1.BrokerErrorDetail
+	3,  // 65: vev.wire.v1.StreamClosed.error:type_name -> vev.wire.v1.BrokerErrorDetail
-	0,  // 66: vev.wire.v1.Shutdown.scope:type_name -> vev.wire.v1.BrokerScope
+	1,  // 66: vev.wire.v1.Progress.ref:type_name -> vev.wire.v1.BrokerStreamRef
-	38, // 67: vev.wire.v1.PreviewRoute.registration:type_name -> vev.wire.v1.RemoteRegistration
+	0,  // 67: vev.wire.v1.BrokerErrorMessage.scope:type_name -> vev.wire.v1.BrokerScope
-	2,  // 68: vev.wire.v1.PreviewRoute.policy:type_name -> vev.wire.v1.BrokerWirePolicy
+	3,  // 68: vev.wire.v1.BrokerErrorMessage.error:type_name -> vev.wire.v1.BrokerErrorDetail
-	0,  // 69: vev.wire.v1.StartPreview.scope:type_name -> vev.wire.v1.BrokerScope
+	0,  // 69: vev.wire.v1.Shutdown.scope:type_name -> vev.wire.v1.BrokerScope
-	40, // 70: vev.wire.v1.StartPreview.preview:type_name -> vev.wire.v1.RemotePreviewRequest
+	39, // 70: vev.wire.v1.PreviewRoute.registration:type_name -> vev.wire.v1.RemoteRegistration
-	32, // 71: vev.wire.v1.StartPreview.route:type_name -> vev.wire.v1.PreviewRoute
+	2,  // 71: vev.wire.v1.PreviewRoute.policy:type_name -> vev.wire.v1.BrokerWirePolicy
-	0,  // 72: vev.wire.v1.CancelPreview.scope:type_name -> vev.wire.v1.BrokerScope
+	0,  // 72: vev.wire.v1.StartPreview.scope:type_name -> vev.wire.v1.BrokerScope
-	0,  // 73: vev.wire.v1.PreviewPublication.scope:type_name -> vev.wire.v1.BrokerScope
+	41, // 73: vev.wire.v1.StartPreview.preview:type_name -> vev.wire.v1.RemotePreviewRequest
-	41, // 74: vev.wire.v1.PreviewPublication.preview:type_name -> vev.wire.v1.RemotePreview
+	33, // 74: vev.wire.v1.StartPreview.route:type_name -> vev.wire.v1.PreviewRoute
-	3,  // 75: vev.wire.v1.PreviewPublication.error:type_name -> vev.wire.v1.BrokerErrorDetail
+	0,  // 75: vev.wire.v1.CancelPreview.scope:type_name -> vev.wire.v1.BrokerScope
-	37, // 76: vev.wire.v1.BrokerCatalogSession.tabs:type_name -> vev.wire.v1.BrokerCatalogTab
+	0,  // 76: vev.wire.v1.PreviewPublication.scope:type_name -> vev.wire.v1.BrokerScope
-	77, // [77:77] is the sub-list for method output_type
+	42, // 77: vev.wire.v1.PreviewPublication.preview:type_name -> vev.wire.v1.RemotePreview
-	77, // [77:77] is the sub-list for method input_type
+	3,  // 78: vev.wire.v1.PreviewPublication.error:type_name -> vev.wire.v1.BrokerErrorDetail
-	77, // [77:77] is the sub-list for extension type_name
+	38, // 79: vev.wire.v1.BrokerCatalogSession.tabs:type_name -> vev.wire.v1.BrokerCatalogTab
-	77, // [77:77] is the sub-list for extension extendee
+	80, // [80:80] is the sub-list for method output_type
-	0,  // [0:77] is the sub-list for field type_name
+	80, // [80:80] is the sub-list for method input_type
+	80, // [80:80] is the sub-list for extension type_name
+	80, // [80:80] is the sub-list for extension extendee
+	0,  // [0:80] is the sub-list for field type_name
 }
 func init() { file_broker_proto_init() }
 		(*BrokerClientEnvelope_UpdateHostPolicy)(nil),
 		(*BrokerClientEnvelope_StartPreview)(nil),
 		(*BrokerClientEnvelope_CancelPreview)(nil),
+		(*BrokerClientEnvelope_StreamWindowUpdate)(nil),
 	}
 	file_broker_proto_msgTypes[6].OneofWrappers = []any{
 		(*BrokerServerEnvelope_Registered)(nil),
 		(*BrokerServerEnvelope_BrokerErrorMessage)(nil),
 		(*BrokerServerEnvelope_Shutdown)(nil),
 		(*BrokerServerEnvelope_PreviewPublication)(nil),
+		(*BrokerServerEnvelope_StreamWindowUpdate)(nil),
 	}
-	file_broker_proto_msgTypes[19].OneofWrappers = []any{
+	file_broker_proto_msgTypes[20].OneofWrappers = []any{
 		(*SnapshotPart_Begin)(nil),
 		(*SnapshotPart_Daemon)(nil),
 		(*SnapshotPart_Session)(nil),
 		(*SnapshotPart_Tombstone)(nil),
 		(*SnapshotPart_End)(nil),
 	}
-	file_broker_proto_msgTypes[35].OneofWrappers = []any{
+	file_broker_proto_msgTypes[36].OneofWrappers = []any{
 		(*PreviewPublication_Preview)(nil),
 		(*PreviewPublication_Error)(nil),
 	}
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_broker_proto_rawDesc), len(file_broker_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   38,
+			NumMessages:   39,
 			NumExtensions: 0,
 			NumServices:   0,
 		},

M internal/protocol/wire/broker_test.go +8 -2


@@ -20,7 +20,7 @@ var brokerClientTags = map[string]protoreflect.FieldNumber{
20	20		"register": 101, "subscribe": 102, "resync": 103, "unsubscribe": 104,
21	21		"add_host": 105, "remove_host": 106, "reconcile": 107, "open_stream": 108,
22	22		"client_stream_data": 109, "close_stream": 110, "update_host_policy": 111,
23		-	"start_preview": 112, "cancel_preview": 113,
	23	+	"start_preview": 112, "cancel_preview": 113, "stream_window_update": 114,
24	24		}
25	25
26	26		// brokerServerTags is the frozen server tag inventory.

@@ -28,7 +28,7 @@ var brokerServerTags = map[string]protoreflect.FieldNumber{
28	28		"registered": 201, "snapshot_part": 202, "operation_result": 203,
29	29		"stream_opened": 204, "server_stream_data": 205, "stream_closed": 206,
30	30		"progress": 207, "broker_error_message": 208, "shutdown": 209,
31		-	"preview_publication": 210,
	31	+	"preview_publication": 210, "stream_window_update": 211,
32	32		}
33	33
34	34		func oneofTags(t *testing.T, message proto.Message) map[string]protoreflect.FieldNumber {

@@ -194,6 +194,9 @@ func brokerClientSamples() map[string]*BrokerClientEnvelope {
194	194		"cancel_preview": {Payload: &BrokerClientEnvelope_CancelPreview{CancelPreview: &CancelPreview{
195	195		Scope: brokerScope(), Generation: 3,
196	196		}}},
	197	+	"stream_window_update": {Payload: &BrokerClientEnvelope_StreamWindowUpdate{StreamWindowUpdate: &StreamWindowUpdate{
	198	+	Ref: brokerRef(), Credit: 4096,
	199	+	}}},
197	200		}
198	201		}
199	202

@@ -241,6 +244,9 @@ func brokerServerSamples() map[string]*BrokerServerEnvelope {
241	244		Scope: brokerScope(), Generation: 3,
242	245		Result: &PreviewPublication_Error{Error: &BrokerErrorDetail{Code: 1, Text: "unavailable"}},
243	246		}}},
	247	+	"stream_window_update": {Payload: &BrokerServerEnvelope_StreamWindowUpdate{StreamWindowUpdate: &StreamWindowUpdate{
	248	+	Ref: brokerRef(), Credit: 4096,
	249	+	}}},
244	250		}
245	251		}
246	252

 	"register": 101, "subscribe": 102, "resync": 103, "unsubscribe": 104,
 	"add_host": 105, "remove_host": 106, "reconcile": 107, "open_stream": 108,
 	"client_stream_data": 109, "close_stream": 110, "update_host_policy": 111,
-	"start_preview": 112, "cancel_preview": 113,
+	"start_preview": 112, "cancel_preview": 113, "stream_window_update": 114,
 }
 // brokerServerTags is the frozen server tag inventory.
 	"registered": 201, "snapshot_part": 202, "operation_result": 203,
 	"stream_opened": 204, "server_stream_data": 205, "stream_closed": 206,
 	"progress": 207, "broker_error_message": 208, "shutdown": 209,
-	"preview_publication": 210,
+	"preview_publication": 210, "stream_window_update": 211,
 }
 func oneofTags(t *testing.T, message proto.Message) map[string]protoreflect.FieldNumber {
 		"cancel_preview": {Payload: &BrokerClientEnvelope_CancelPreview{CancelPreview: &CancelPreview{
 			Scope: brokerScope(), Generation: 3,
 		}}},
+		"stream_window_update": {Payload: &BrokerClientEnvelope_StreamWindowUpdate{StreamWindowUpdate: &StreamWindowUpdate{
+			Ref: brokerRef(), Credit: 4096,
+		}}},
 	}
 }
 			Scope: brokerScope(), Generation: 3,
 			Result: &PreviewPublication_Error{Error: &BrokerErrorDetail{Code: 1, Text: "unavailable"}},
 		}}},
+		"stream_window_update": {Payload: &BrokerServerEnvelope_StreamWindowUpdate{StreamWindowUpdate: &StreamWindowUpdate{
+			Ref: brokerRef(), Credit: 4096,
+		}}},
 	}
 }

M internal/protocol/wire/envelope_inventory_test.go +2 -2


@@ -15,8 +15,8 @@ import (
15	15		// shares a payload type except route navigation failure, and the preamble
16	16		// constants agree with the schema authority.
17	17		func TestEnvelopeInventoryProvesDirectionAndSemanticPath(t *testing.T) {
18		-	if protocol.Version != 65 {
19		-	t.Fatalf("protocol.Version = %d, want 65", protocol.Version)
	18	+	if protocol.Version != 66 {
	19	+	t.Fatalf("protocol.Version = %d, want 66", protocol.Version)
20	20		}
21	21		if ProtocolEpoch != 1 {
22	22		t.Fatalf("ProtocolEpoch = %d, want 1", ProtocolEpoch)


@@ -15,8 +15,8 @@ import (
15		// shares a payload type except route navigation failure, and the preamble	15		// shares a payload type except route navigation failure, and the preamble
16		// constants agree with the schema authority.	16		// constants agree with the schema authority.
17		func TestEnvelopeInventoryProvesDirectionAndSemanticPath(t *testing.T) {	17		func TestEnvelopeInventoryProvesDirectionAndSemanticPath(t *testing.T) {
18	-	if protocol.Version != 65 {	18	+	if protocol.Version != 66 {
19	-	t.Fatalf("protocol.Version = %d, want 65", protocol.Version)	19	+	t.Fatalf("protocol.Version = %d, want 66", protocol.Version)
20		}	20		}
21		if ProtocolEpoch != 1 {	21		if ProtocolEpoch != 1 {
22		t.Fatalf("ProtocolEpoch = %d, want 1", ProtocolEpoch)	22		t.Fatalf("ProtocolEpoch = %d, want 1", ProtocolEpoch)

M internal/protocol/wire/schema/broker.proto +11 -0


@@ -89,6 +89,7 @@ message BrokerClientEnvelope {
89	89		UpdateHostPolicy update_host_policy = 111;
90	90		StartPreview start_preview = 112;
91	91		CancelPreview cancel_preview = 113;
	92	+	StreamWindowUpdate stream_window_update = 114;
92	93		}
93	94		}
94	95

@@ -106,6 +107,7 @@ message BrokerServerEnvelope {
106	107		BrokerErrorMessage broker_error_message = 208;
107	108		Shutdown shutdown = 209;
108	109		PreviewPublication preview_publication = 210;
	110	+	StreamWindowUpdate stream_window_update = 211;
109	111		}
110	112		}
111	113

@@ -221,6 +223,15 @@ message CloseStream {
221	223		BrokerStreamRef ref = 1;
222	224		}
223	225
	226	+	// StreamWindowUpdate grants the peer credit to send more stream data on one
	227	+	// logical stream: the receiver consumed that much of its stream window. Each
	228	+	// direction of a stream has its own window, so a client grants credit for
	229	+	// ServerStreamData and the server grants credit for ClientStreamData.
	230	+	message StreamWindowUpdate {
	231	+	BrokerStreamRef ref = 1;
	232	+	uint64 credit = 2;
	233	+	}
	234	+
224	235		// Registered confirms one accepted client connection and its assigned scope.
225	236		message Registered {
226	237		BrokerScope scope = 1;


@@ -89,6 +89,7 @@ message BrokerClientEnvelope {
89	UpdateHostPolicy update_host_policy = 111;	89		UpdateHostPolicy update_host_policy = 111;
90	StartPreview start_preview = 112;	90		StartPreview start_preview = 112;
91	CancelPreview cancel_preview = 113;	91		CancelPreview cancel_preview = 113;
		92	+	StreamWindowUpdate stream_window_update = 114;
92	}	93		}
93	}	94		}
94		95

@@ -106,6 +107,7 @@ message BrokerServerEnvelope {
106	BrokerErrorMessage broker_error_message = 208;	107		BrokerErrorMessage broker_error_message = 208;
107	Shutdown shutdown = 209;	108		Shutdown shutdown = 209;
108	PreviewPublication preview_publication = 210;	109		PreviewPublication preview_publication = 210;
		110	+	StreamWindowUpdate stream_window_update = 211;
109	}	111		}
110	}	112		}
111		113

@@ -221,6 +223,15 @@ message CloseStream {
221	BrokerStreamRef ref = 1;	223		BrokerStreamRef ref = 1;
222	}	224		}
223		225
		226	+	// StreamWindowUpdate grants the peer credit to send more stream data on one
		227	+	// logical stream: the receiver consumed that much of its stream window. Each
		228	+	// direction of a stream has its own window, so a client grants credit for
		229	+	// ServerStreamData and the server grants credit for ClientStreamData.
		230	+	message StreamWindowUpdate {
		231	+	BrokerStreamRef ref = 1;
		232	+	uint64 credit = 2;
		233	+	}
		234	+
224	// Registered confirms one accepted client connection and its assigned scope.	235		// Registered confirms one accepted client connection and its assigned scope.
225	message Registered {	236		message Registered {
226	BrokerScope scope = 1;	237		BrokerScope scope = 1;