- tests/assembly-integration.rs (7 tests, local + composed): the full
-D story (vanilla cred-bearing client -> TCP door + UDP door ->
producer w/ local providers -> real echo targets; CONNECT + BIND +
ASSOCIATE live, one-command-per-connection, teardown + fresh
sessions), the composed story (direct_egress + bindfirst_accept +
real TCP dial; all three commands; the lazy-table dial-count
witness), mixed assembly (channels-native + door clients on one
registration; composed seams beside native sessions), the assembly
teardown matrix (UDP-door idle bound; channel reaped; fresh
association after), the producer door driving all three commands,
and the -D domain-target pin (resolution at the producer's seam,
ADR-012).
- Fix the drift the suite surfaced: ComposedEgress::next_reply ended
fresh (never-opened-table) associations at birth — the ended-relay
Err now fires only once a tunnel existed and every relay ended; the
fresh table parks (the readiness contract). Regression-pinned in
tests/composed-egress.rs (fresh_association_parks_before_any_
tunnel_is_opened).
- Harness: the composed-accept machinery single-sourced into
tests/harness.rs (the composed suites' shapes + the five-gate
composed identity); composed-accept.rs consumes the shared shapes.
- Docs sync: README Current State (the assembly layer landed; both
suites named), lib.rs crate docs (the assembly-layer paragraph),
consumer.md (the TokenClient door-only contract + the
one-command-per-connection posture reconciled).
- Task assembly-integration-suite: completed; Notes + Summary filled
(the local-on-wasm failure observed: mio's unsupported-wasm error).
Verification: cargo test (375), cargo test --all-features (615),
clippy --all-targets -D warnings (default + all-features), fmt --check,
doc --no-deps (0 warnings), both wasm checks (default + composed),
local-on-wasm fails as designed.
- C-1: BindSession::await_inbound is take-guarded — the first read
takes the session's stream; the returned BindDataPlane owns it (the
TakenInner pairing posture; the session stays the teardown owner),
so a second call returns the family's spent shape Ok(None) and can
never re-read the live data plane. A failed read restores the inner
(the phase is only consumed on success; the producer ends the
session on every post-reply#1 failure exit, so a re-call EOFs —
never a live data-plane re-read either way). Pinned by the
double-await_inbound integration test (the spent shape + the
data-plane bytes asserted untouched) and the spent-BIND unit test.
- D-1: one normative reply#2 reader (option a) — the session's
await_inbound; BindReply1::await_inbound is cut and reply1() is
documented as a view (bind_addr + raw_mut), matching its actual
usage; the reply1()-twice re-entry path is closed (pinned by the
view test).
- N-6: the three session constructors' prologues collapsed into one
private open_and_negotiate helper (teardown-at-birth in one place);
zero behavior change.
- S-2: the EOF-propagation doc line on all three reap sites (the
dropped teardown_channel handle is deliberate — the graceful shape;
clear_all aborts instead).
- BindDataPlane is un-lifetimed (owns the stream); into_inner returns
the owned Socks5Stream<BiStream>; docs synced (module + session
docs, consumer.md §The BIND client).
Verification: cargo test 352 green (all-features too), clippy
-D warnings clean, fmt clean, cargo doc clean, both wasm checks clean.
The batch-1 closing task: nine cross-cutting integration tests
(tests/core-integration.rs) pinning the whole protocol core end to
end over the channels harness, plus the architecture-sync docs pass.
Tests:
- One registration, all three commands: CONNECT + ASSOCIATE + BIND
interleaved live on the one channels/socks5/sub op; a teardown
ends only its own session (mux/demux isolation) — the POC #2/#5
regression guard, complete.
- Concurrency: nine concurrent mixed-command sessions (raw topology)
and six through the typed consumer sessions (consumer-side
topology) — the mux/demux pinned in both channel-id allocation
directions; fresh round-trips after the burst; no channel leaks.
- Teardown matrix (wire.md §Sentinels and lifecycle): CONNECT
half-close, ASSOCIATE EOF, BIND client-gone (a parked accept so
the quiet-wait exit is deterministic) — each followed by fresh
sessions of every command (no connection poisoning).
- Identity/scope matrix (ADR-006 end to end): open-only (CONNECT +
ASSOCIATE serve, BIND refused 0x02 at the command gate), bind-only
fail-closed at the open gate for all commands (the spec drift the
task's phrasing carried, reconciled — ADR-006's open gate requires
socks5:open unconditionally), both-scopes (everything, granted
explicitly); the CF-006 witness asserted per row.
- The readiness contract re-pinned under concurrent load: a
hot-Ok(None) egress across concurrent associations does not starve
the datagram stage's channel branch.
Docs sync: README Current State ("the protocol core is implemented"
+ the landed inventory; the decomposition residue gone); consumer.md
§Wiring reconciled to the landed session signatures; ADR-006
§Consequences states the grant asymmetry explicitly; lib.rs crate
docs describe the landed surface.
Verification: cargo test 302 green; --all-features green; clippy
--all-targets -D warnings clean; fmt --check clean; both wasm checks
clean; cargo doc --no-deps clean. Batch boundary holds: no
local/composed code, the default crate is protocol-only.
glm-5.3-flash