Module actor 

Whether the actor a request names is the agent that sent it — identity M4a-2 (docs/specs/SPEC_AGENT_IDENTITY_CARRIED_NOT_DERIVED_2026_09_23.md §6.5.3, §6.5.6).

An actor site is a handler whose request says who is acting: a memory owner, a global-memory writer, a work claimer or creator, an inject or bus sender, a cron creator, a UI-automation signer (§6.5.2 item 4). When the request is Caller::Agent, the named actor is checked against that UID’s own row, and one of these is counted per site:

• m4.actor_mismatch.<site> — the name is none of the row’s {slug, display name, instance_name}, matched as the M3 resolver matches (Store::agents_matching_name): slug exactly, the others ASCII case-insensitively. A name that would not select the caller’s row.
• m4.actor_ambiguous.<site> — the name selects the caller’s row, but not by its slug, and also selects another row — any row, a template included: the colliding-name case, in which a slug-keyed consumer (memory) resolves to the other agent, and the template-stub case of #3573.
• m4.actor_absent.<site> — an attributed request that names no actor.
• m4.actor_unchecked.<site> — the caller’s row could not be read.

Never refused, never awaited, and nothing is written: the check runs detached on the blocking pool; the handler does not await it, though it contends for the store’s connection lock like any store read (§7); M4c dual-writes the UID. This only measures how often the name and the token disagree before anything relies on the token. Unattributed requests are not checked — there is no row to compare with, and most are the UI (§6.5.1).

Macros

actor_sites 🔒

Enums

ActorSite 🔒

Where the actor name came from — the <site> in the counters.

Outcome 🔒

Functions

check_actor 🔒

Count actor against the caller’s row at site. A no-op for an Unattributed caller. Never fails and is never awaited: the store reads run detached on the blocking pool (inline under test, so tests can read the counters right after the request).

check_carried_uid 🔒

A work claim also carries the claimer’s UID (agent_uid, identity M1a). A carried UID that is not the token’s is counted on its own, since it is the UID — not the name — that M3 writes to claimed_by_uid.

classify 🔒

What to count for actor against the caller’s row; None when the name is the caller’s own. rows_named lists every row the name selects, templates included (Store::rows_answering_to); it is asked only when the name selects the caller’s row other than by its slug.

count_against_row 🔒

jekt_sender_by_token 🔒

Identity M4d-4: whether a host-tier jekt is from the agent it claims by its token (audit_source_uid is the request’s Caller). Far-side receivers have no Caller and keep checking the signature, which is still sent.

names_the_row 🔒

Whether actor would select row by name (see the module doc).

own_pane_by_token 🔒

Identity M4d-4: the pane of a caller whose token names it under its own slug, from its UID’s registration, with no key to check. None (today’s name path) for anyone else, or before the UID registers.

uid_has_slug 🔒

Identity M4d-4: whether uid’s own row has name as its slug, exactly (spec §6.5.10 rule ii: never its display or instance name), so a request carrying uid’s token under name is that agent by its token.