Live state from Kafka to the browser. Never silently wrong.

1. Describe the state

   A channel names one piece of state, its parameters, and its schema. The gateway checks every payload against it, and streamotter generate turns it into TypeScript types.

   {
     "station": {
       "delivery": {
         "kind": "state",
         "overflow": "resync"
       },
       "handlersRef": "station",
       "paramsSchema": "StationParams",
       "payloadSchema": "GaugeReading",
       "source": "field",
       "version": 1
     }
   }

2. Decide who sees it

   Your handlers authenticate viewers, authorize each channel, pick state out of Kafka records, and read snapshots from your own store. Access is never guessed.

   export const holt: HoltHandlers = {
     // Den sites are protected: only researchers may subscribe.
     authorize: ({ principal }) =>
       principal.claims["role"] === "researcher",
     // Pick this channel's state out of each Kafka record.
     map: ({ record }) => holtStates(record.value),
     // Read current state before releasing buffered updates.
     snapshot: ({ params, signal }) =>
       fieldStation.holt(params.holtId, signal)
   };

3. Subscribe in the browser

   The SDK hands you a snapshot, then every newer state in order, plus a state you can show. After a disconnect it resynchronizes from a fresh snapshot on its own.

   const client = createClient<AppChannels>({
     getToken: ({ signal }) => session.token(signal)
   });
   
   const gauge = client.subscribe("station", {
     channelVersion: 1,
     params: { stationId: "LC-02" }
   });
   // A snapshot, then newer states in order.
   gauge.on("data", event => render(event.data));
   // Live, stale, resync-required…
   gauge.on("state", ({ state }) => showState(state));
   await gauge.ready();

Code samples are type-checked against [email protected].

• Preserve the record

  A policy can copy the original record to a quarantine topic. Only a write Kafka acknowledged counts as saved; until then the source holds.

• Continue only under control

  Moving past the record needs your application's recovery guard to vouch for its snapshots. Otherwise the source stays held. There is no skip or ignore option.

• See each outcome

  Whether evidence was saved, whether the source advanced, and whether views resynchronized are reported separately. None stands in for another.

Recording · October 5, 2026 · [email protected] · local fixture project, not the hosted demo.