videre-host: document handshake admission boundaries

crates/videre-host/src/handshake.rs

@@ -44,6 +44,9 @@ fn parse<S: for<'de> Deserialize<'de>>(owner: &str, value: &toml::Value) -> anyh
 
 /// Admit one provider: a `[venue]` section, when present, must be the
 /// adapter shape with a non-empty version set.
+///
+/// Opt-in: a manifest omitting `[venue]` is admitted unconditionally, an
+/// intentional silent opt-out for non-venue keepers.
 pub(crate) fn admit_provider(provider: &str, sections: &ExtensionSections) -> anyhow::Result<()> {
     let Some(value) = sections.get(SECTION) else {
         return Ok(());
@@ -91,6 +94,9 @@ pub(crate) fn verify_exported_versions(
 /// `[venue] body_versions` set contains that version. Every installed
 /// venue is a legal runtime submit target, so one non-decoding adapter
 /// refuses the keeper.
+///
+/// Opt-in: a manifest omitting `[venue]` is admitted unconditionally, an
+/// intentional silent opt-out for non-venue keepers.
 pub(crate) fn admit_worker(
     worker: &str,
     sections: &ExtensionSections,

crates/videre-host/src/registry.rs

@@ -746,6 +746,11 @@ impl<T: RuntimeTypes> ProviderKind<T> for VenueAdapterKind {
             .await
             .map_err(anyhow::Error::from)
             .context("read adapter body-versions")?;
+        // Post-instantiation, pre-init: an export cannot be called before
+        // instantiating, so unlike the pre-compile manifest-section
+        // predicates in `supervisor.rs` a buggy or malicious adapter fully
+        // instantiates, running any instantiation side effects, before this
+        // divergence check catches the mismatch.
         crate::handshake::verify_exported_versions(venue_id.as_str(), &declared, exported)?;
         match bindings
             .call_init(&mut store, &config)