- install_forwarded_surface registers
register_tunnel_forwarded_openable_with_establisher (ADR-008
Amendment 2's recommended shape) with a ForwardedGate capturing the
ListenRouter: a stale/missing listen token fails the open typed at
the call plane (channel:open_failed, unknown_resource) BEFORE any
channel is born — the phantom-channel shape is closed at the open;
malformed arrivals are likewise typed (handler_error) instead of
success-then-silent-birth-teardown.
- the arrival pump's handler-side correlation re-lookup stays as the
residual-race + cap-admission teardown-at-birth fallback (the base
shape's posture, retained; the narrow gate-pass->handler-run race
documented on the pump).
- the unscoped-arrival ACL row double-pins the pinned gate order
(ACL before establisher — a genuinely minted token refused by ACL
alone).
- rows: a_correlation_miss_fails_the_open_typed_before_any_channel
(miss: typed refusal, no phantom channel, no acceptor row),
a_gate_pass_arrival_serves_the_route_unchanged (the serving flow
unchanged), and the lib unit pin
the_pump_residual_miss_teardown_at_births_the_fabric_half.
- the harness opener now maps the wire refusal's details.reason back
into the TunnelEstablishError taxonomy (the real opener's map) —
the flat HandlerError swallow would erase exactly what the gate
rows pin.
Verification: cargo test --all-features --test tunnel_mapping (22,
incl. both real-tool smokes), cargo test --features tunnel --lib
tunnel_map, full cargo test (default + --all-features), clippy x2
-D warnings, fmt.
glm-5.3-flash
4668061b19