The runtime trust boundary for extension-owned callbacks.
Ordinary invocation admits active source-owned code before entering the callback. Unload invocation is a distinct token-scoped operation for a source that is already quiescing. Both entry points normalize exceptions, throws, and exits without translating failure into a successful decline or no-op.
Domain adapters remain responsible for validating successful return values.
They use invalid_return/4 so malformed extension values share this boundary's
observable failure type while core callbacks continue to run directly.
Summary
Types
A contained extension callback failure.
A successful callback value or an explicit extension failure.
The callback operation being performed, used in diagnostics.
An extension source accepted by the runtime callback boundary.
Functions
Builds and reports a malformed successful extension return.
Invokes an active extension callback after source-aware admission.
Invokes a callback owned by a quiescing source using unload authority.
Types
@type failure() :: {:source_unavailable, source(), module(), atom(), term()} | {:callback_failed, source(), module(), atom(), :exception | :exit | :throw, term()} | {:invalid_return, source(), module(), atom(), term()}
A contained extension callback failure.
@type result(value) :: {:ok, value} | {:error, failure()}
A successful callback value or an explicit extension failure.
@type semantics() :: atom()
The callback operation being performed, used in diagnostics.
@type source() :: {:extension, atom()}
An extension source accepted by the runtime callback boundary.
Functions
Builds and reports a malformed successful extension return.
@spec invoke(source(), module(), atom(), [term()], semantics(), GenServer.server()) :: result(term())
Invokes an active extension callback after source-aware admission.
@spec invoke_unload( source(), Minga.Extension.CodeLease.unload_token(), module(), atom(), [term()], semantics(), GenServer.server() ) :: result(term())
Invokes a callback owned by a quiescing source using unload authority.