review-003 D-1/D-3: the associate_with_token probe + the io-kind mapping tables table-tested

tests/door-tcp.rs

@@ -959,3 +959,62 @@ async fn bind_session_with_token_round_trip() {
     assert_eq!(&buf, b"token-bind");
     session.close().await;
 }
+
+/// The ASSOCIATE token twin driven directly (review 003 D-1: the
+/// `associate_with_token` constructor is the session family's
+/// completeness twin — no door calls it, so it needs its own probe;
+/// the same shape as `bind_session_with_token_round_trip`): the
+/// open rides the payload `auth_token` (CF-005 precedence (1)),
+/// the ASSOCIATE's DST.ADDR is the unspecified address (the
+/// vanilla shape), the reply's BND.ADDR is the in-band sentinel
+/// (ADR-003), and a datagram round-trips through the echo egress.
+#[tokio::test]
+async fn associate_session_with_token_round_trip() {
+    let topo = harness::wire_consumer_side_with_provider(
+        alksocks::tcp_dial(),
+        Some(harness::echo_egress()),
+        None,
+        Some(consumer_identity()),
+        Arc::new(DoorTokenProvider {
+            bind_scoped: vec![],
+        }),
+    )
+    .await;
+
+    let token_client = Arc::new(
+        alksocks::consumer::TokenClient::wrap(topo.consumer.as_ref())
+            .await
+            .expect("the door's token surface wraps"),
+    );
+    let mut session = alksocks::consumer::AssociateSession::associate_with_token(
+        token_client.as_ref(),
+        b"door-native-associate".to_vec(),
+    )
+    .await
+    .expect("the token-carrying ASSOCIATE session associates");
+
+    let relay = session
+        .relay_addr()
+        .expect("the reply carried BND.ADDR")
+        .into_string_and_port();
+    assert_eq!(relay.0, "127.0.0.1", "the in-band sentinel BND.ADDR");
+    assert_eq!(relay.1, 0);
+
+    let target = TargetAddr::Ip("10.0.0.9:53".parse().unwrap());
+    session
+        .send_datagram(&target, b"token-assoc")
+        .await
+        .expect("send datagram");
+    let (_, payload) = timeout(BOUND, session.recv_datagram())
+        .await
+        .expect("recv within timeout")
+        .expect("a datagram (not eof)")
+        .expect("a datagram");
+    assert_eq!(&payload[..], b"token-assoc");
+
+    assert!(
+        topo.consumer.manager().has_channel(session.channel_id()),
+        "the adopted channel entry exists while associated"
+    );
+    session.shutdown().await.expect("shutdown");
+}