Review checkpoint closing batch 2 (the assembly layer). The gate
opens: the never-binds posture, seam contracts, door fidelity, the
bind-first graduation, feature-gate hygiene, and POC fidelity all
verify clean; two findings were corrected in the review change.
Findings corrected:
- R-1 (major): the UDP front door's in-band decode created a fresh
DatagramReader per call and kept only the first frame of a batch —
POC #2's first-cut bug (reader state must persist across calls;
batched datagrams were silently dropped, mid-frame EOF was silent).
Fix: an owning InbandBridge (persistent reader + pending queue +
fail-loud mid-frame EOF, the AssociateSession shape) threaded
through the channel->socket pump; pinned by three bridge unit
tests (which fail against the per-call reader) and an end-to-end
doubled-echo door-udp test.
- R-2 (convention 2): seven non-test expects -> typed errors —
DoorBuildError (both door builders' .build() is now Result),
ProducerDoorBuildError/ProducerDoorError (the bind decision is
serve's typed error), the composed table invariant as an egress
error, register_forwarded_serving -> Result (the alkcall
diagnostic surfaced), TokenClientError (wrap on a spent client).
New error types re-exported; test call sites updated.
- R-3/R-4 (doc residues): producer.md's local-backend section
described a channel pipe — the landed ProducerDoor serves
serve_socks5_over on the accepted socket directly;
associate_with_token's doc (the TCP door refuses ASSOCIATE, never
calls it); SessionOwner's doc (the accept uses SyncHalves/
OwnedWrite).
Verification: cargo test (default) green; cargo test --all-features
green; cargo clippy --all-targets [--all-features] -- -D warnings
clean; cargo fmt --check clean; both wasm checks clean (default +
composed); local-on-wasm fails at mio as designed; cargo doc
--no-deps clean.
Task: tasks/implementation/review-assembly-layer.md (status:
completed; the batch-2 gate opens release polish).
glm-5.3-flash
04c76e3a41