The BEAM↔Rust contract.

Transport is RESP3 over EchoMQ. On connect the client sends Hello{proto_min, proto_max}; the backend selects a version and replies Welcome{proto}, or refuses with Incompatible — and a refusal touches no Volume (the S-2 negative: assert the Volume set is byte-identical before and after a rejected connect). Each request carries a corr id the response echoes, on a per-client reply lane egraft:reply:{client}; commands ride per-Volume lanes egraft:cmd:{vol} so one hot Volume can never head-of-line-block another. The message set is small and closed — OpenVolume, Commit, Push, Pull, Read, Snapshot, GetCommit, the Ack/Pages/Err responses, and the opaque eg.3 FeedEvent — and the error enum is exactly {conflict, not_found, version_mismatch, unavailable}; a new kind is a version bump, never a silent addition. The backend is a thin 1:1 dispatch onto the real Rust Runtime (Commit→volume_writer, Push→volume_push, Read→volume_reader→lazy fault): no new engine logic, just session, dispatch, and publish.

The Rust engine does blocking object-storage and LSM I/O, so it runs as a supervised backend process, not an in-VM NIF: a NIF would couple crash domains (a segfault takes the orchestrator with it) and force dirty schedulers, while a backend turns an engine crash into a restart. The local-socket/bus hop is noise next to an object-storage commit, the latency regime the engine already lives in. On a crash the client reconnects and resubscribes from its last-seen LSN — the feed cursor is the recovery key, and replay is monotone and gap-free, so a restart is a hiccup, not a gap. The hard part is the cross-runtime contract, and the HIGH-risk mitigation is a single byte-frozen fixture set both runtimes assert against. The eg.4 proof is compositional (Operator ruling D-7 = A): the Rust dispatch is proven in-process over a real Runtime and an in-memory feed sink; the BEAM client’s bus mechanics are proven over a live Valkey on :6390 against an in-Elixir responder that speaks the same Proto; and the two meet at the shared fixtures (identical sha256). The one literally-connected Rust-to-Valkey socket is a deployment concern, deferred by ruling to eg.5/eg.6 — the contract is already proven.