# `Pixir.Tools.CommandBoundary`
[🔗](https://github.com/Ranvier-Technologies/pixir/blob/main/lib/pixir/tools/command_boundary.ex#L1)

Bounded host-command boundary for local Tool execution (ADR 0027).

This process is deliberately smaller than a product `CommandBroker`: it only
accounts for external process capacity, bounded queueing, and read-only runtime
snapshots. Tool lifecycle, permissions, and canonical `tool_call`/`tool_result`
Events remain owned by `Pixir.Tools.Executor`.

# `lease`

```elixir
@type lease() :: %{id: reference(), host_command: map()}
```

# `limits`

```elixir
@type limits() :: %{
  max_concurrent: pos_integer(),
  queue_limit: non_neg_integer(),
  queue_timeout_ms: non_neg_integer()
}
```

# `child_spec`

Application child spec.

# `limits`

```elixir
@spec limits(map() | keyword() | nil) :: {:ok, limits()} | {:error, map()}
```

Normalize user/app config into command-boundary limits.

# `snapshot`

```elixir
@spec snapshot(keyword()) :: {:ok, map()} | {:error, map()}
```

Return a read-only snapshot of host-command pressure.

# `start_link`

Start a command boundary. Omitting `:name` starts the application singleton.

# `with_slot`

```elixir
@spec with_slot(String.t(), keyword(), (lease() -> term()) | (-> term())) ::
  term() | {:error, map()}
```

Acquire a host-command slot, run `fun`, and release the slot in all normal
return/raise/throw/exit paths.

---

*Consult [api-reference.md](api-reference.md) for complete listing*