From 96e5c8b33765b9f3335cc1d8629a7718ed1103fd Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Fri, 30 Oct 2026 23:08:08 +0100 Subject: [PATCH 01/40] docs(RUST-CI-031): start extended parity soak --- .../emulebb-rust/active/items/RUST-CI-031.md | 36 ++++++++++++++----- 1 file changed, 27 insertions(+), 9 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index bf5d0886..26f2fc97 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1468,17 +1468,35 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. exact server bytes: `560,478` and `664,615` bytes against the `4,194,304`-byte limit. Both budgets matched the file byte count exactly and reported no truncation. -- The common work-in-progress branch remains - `feature/persisted-soak-parity-gate`. The significant harness slice is now - green and ready for normal cross-repository review; no trace or profile path - is tracked. -- Review is open as Rust PR +- The completed slice merged in dependency order as Rust PR [#206](https://github.com/emulebb/emulebb-rust/pull/206), build-tests PR [#81](https://github.com/emulebb/emulebb-build-tests/pull/81), and tooling PR - [#132](https://github.com/emulebb/emulebb-tooling/pull/132). Build-tests - depends on the Rust bundle contract, and tooling records both implementation - PRs; the single topic branch remains active until the dependency-ordered - review and merge lifecycle completes. + [#132](https://github.com/emulebb/emulebb-tooling/pull/132). All required + checks passed, each repository returned to synchronized clean `main`, and the + local and remote `feature/persisted-soak-parity-gate` branches were deleted. + +## Extended Parity Soak Checkpoint - 2026-10-30 + +- Campaign `20261030T215509Z` started from the merged harness through the + canonical persisted controller after full-tunnel hide.me, VPN Guard Block, + loopback control, selected P2P port, profile, executable, and bounded-storage + preflight all passed. +- The controller reused the selected persisted MFC and Rust profiles, selected + the same exact public eD2K server endpoint for both clients, retained the + shared `8 KiB/s` upload cap, and launched the observer and watcher detached + for an until-stopped run. +- MFC completed its expected slower persisted-profile startup. Both client + processes, REST endpoints, diagnostic writers, Guard Block checks, observer, + watcher, storage policy, and full-tunnel route checks then reported healthy + with no findings. Both writers reported zero drops, encoding errors, write + errors, or storage-policy faults. +- The durable gate currently retains one successful eD2K server cycle and one + successful Kad cycle with zero retryable outcomes and zero confirmed + divergences. The campaign remains active so both writers can rotate + naturally and the action driver can collect longer causal-session evidence. +- This is an in-progress discovery checkpoint, not a parity conclusion. Final + evidence still requires canonical stop, finalized indexes, complete analyzer + review, and explicit inspection of exact unredacted protocol traces. ## Next Implementation From 58a999f72159311a72253a0376cb71753c253e23 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Fri, 30 Oct 2026 23:49:23 +0100 Subject: [PATCH 02/40] docs(RUST-CI-031): record extended green gate --- .../products/emulebb-rust/active/items/RUST-CI-031.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 26f2fc97..84140ead 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1490,10 +1490,13 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. watcher, storage policy, and full-tunnel route checks then reported healthy with no findings. Both writers reported zero drops, encoding errors, write errors, or storage-policy faults. -- The durable gate currently retains one successful eD2K server cycle and one - successful Kad cycle with zero retryable outcomes and zero confirmed - divergences. The campaign remains active so both writers can rotate - naturally and the action driver can collect longer causal-session evidence. +- The durable gate reached green at `2026-10-30T22:44:59.000212+00:00` after + four successful eD2K server cycles and four successful Kad cycles, with zero + retryable outcomes and zero confirmed divergences. Before the gate completed, + both diagnostic writers rotated naturally at least once and continued with + zero dropped events, encoding errors, write errors, or storage-policy faults. + The campaign remains active so the action driver can collect longer + post-green causal-session evidence. - This is an in-progress discovery checkpoint, not a parity conclusion. Final evidence still requires canonical stop, finalized indexes, complete analyzer review, and explicit inspection of exact unredacted protocol traces. From 6c785d1a52b72150ece1e24c8101f7448a3f4656 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sat, 31 Oct 2026 00:09:52 +0100 Subject: [PATCH 03/40] docs(RUST-CI-031): focus client UDP parity proof --- .../emulebb-rust/active/items/RUST-CI-031.md | 53 +++++++++++++------ 1 file changed, 37 insertions(+), 16 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 84140ead..d03814f6 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1495,11 +1495,33 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. retryable outcomes and zero confirmed divergences. Before the gate completed, both diagnostic writers rotated naturally at least once and continued with zero dropped events, encoding errors, write errors, or storage-policy faults. - The campaign remains active so the action driver can collect longer - post-green causal-session evidence. -- This is an in-progress discovery checkpoint, not a parity conclusion. Final - evidence still requires canonical stop, finalized indexes, complete analyzer - review, and explicit inspection of exact unredacted protocol traces. + The campaign continued through five successful cycles per method, then stopped + through the canonical controller. Both clients, the observer, launcher, and + watcher were verified stopped, and both diagnostic indexes finalized over + three closed segments per client after two natural rotations. +- The final observer summary retained all ten action reports and thirteen + checkpoints with zero retryable outcomes, divergences, connectivity skips, + driver errors, incomplete-evidence classifications, or storage/writer faults. + A canonical stopped-profile hash-state backup also completed with the MFC + known-file state and Rust metadata database passing their integrity checks. +- Full-window packet analysis found one concrete evidence gap rather than a + search-gate failure: MFC recorded one conformant inbound eD2K client-UDP reask, + while Rust recorded six undecodable shared-socket datagrams and no conformant + client-UDP packet or tracked reask attempt. The synchronized driver scheduled + no downloads, so the run never deliberately exercised Rust source, queue, or + UDP-reask state. Existing server TCP/UDP, peer TCP, Kad UDP, upload-path, and + action-owned server/Kad evidence remained present. +- Deprecated Kad1 background opcodes seen only by MFC are not Rust scope and do + not justify product changes. The next parity proof therefore uses the existing + sequential solo-capture model with one operator-approved direct transfer, + identical campaign fixtures, the configured persisted profile for each + client, and the shared low upload cap. This avoids simultaneous HighID identity + contention and generates deliberate source/queue/client-UDP evidence. +- Build-tests commits `472ad28` and `5dcbfe7` make that capture fail closed on + missing persisted-profile authority, apply the live-wire bandwidth limit to + both clients, remove dynamic public-result fixture selection, and snapshot the + approved direct transfer once per campaign. Focused tests passed, followed by + the complete harness suite: `2,817` passed, one skipped, one deselected. ## Next Implementation @@ -1514,19 +1536,18 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. - Preserve MFC zero hashing and the Rust zero-plan restart invariant while protocol parity work continues. Any future nonzero plan must identify genuinely changed or new files rather than another compatibility workaround. -- Use each bounded action report to separate action-owned coverage parity from - strict full-window background traffic differences, then investigate the - concrete eD2K/Kad opcode, payload, and lifecycle gaps instead of weakening - required-family or diagnostic-conformance gates. +- Run the approved direct-transfer action sequentially against Rust and MFC on + their configured persisted profiles. Hold each client long enough for source, + queue, and UDP-reask behavior, retain exact unredacted action windows, and then + compare the paired recordings offline by deterministic action identifier. +- Keep the proven server/Kad search gate unchanged. Treat the sequential transfer + capture as a separate protocol-coverage proof; do not weaken required-family + or diagnostic-conformance gates when an action did not generate the family. - Confirm the rebuilt traces name deprecated Kad routing and server-description UDP opcodes on both clients without changing unsupported Kad1 behavior. -- After multiple action cycles and both writers rotate naturally, stop through - the persisted controller - and require finalized indexes with no parse, identity, sequence, - writer-health, or retained-suffix gap. -- Run the complete diagnostic analyzer and inspect exact unredacted eD2K/Kad - traces. Implement only concrete protocol or correlation gaps demonstrated by - that evidence, each as a separate tested commit. +- Run the complete diagnostic analyzer and offline action diff after both solo + recordings exist. Implement only concrete protocol or correlation gaps + demonstrated by exact traces, each as a separate tested commit. - Keep the next run until-stopped once the action-driven proof is clean. Do not open a pull request until the complete significant slice is green and the operator explicitly requests it. This slice makes no VPN-safety claim until a From 288df061844e8431091d62b98be7584fdc9fc708 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sat, 31 Oct 2026 00:32:20 +0100 Subject: [PATCH 04/40] docs(RUST-CI-031): record bounded transfer harness --- .../emulebb-rust/active/items/RUST-CI-031.md | 43 +++++++++++++++++-- 1 file changed, 40 insertions(+), 3 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index d03814f6..bd370876 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1523,6 +1523,42 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. approved direct transfer once per campaign. Focused tests passed, followed by the complete harness suite: `2,817` passed, one skipped, one deselected. +## Focused Transfer Capture Harness Checkpoint - 2026-10-31 + +- The first sequential Rust attempt confirmed the persisted client connected + with HighID and Kad, applied the exact `8 KiB/s` upload limit, accepted the + approved direct transfer, and emitted `download_attempt_started`. It also + exposed harness defects before producing a valid parity claim: the solo lane + reapplied persisted shared roots, and its end-only raw-dump copy allowed the + high-volume Rust diagnostic ring to rotate away the early action window. +- Build-tests commits `f420a08` and `beeb919` now reuse persisted Rust shared + state without another hashing pass and expose complete local harness failures. + No compatibility adapter, profile reset, or Rust product workaround was added. +- Build-tests commit `337122a` derives a focused Rust writer ring from the + approved soak storage contract: short `4 MiB` / `60 s` segments, `64` retained + segments, and a `256 MiB` total ring under the existing minimum-free-space + authority. The raw ring remains bounded while closed segments become available + quickly enough for incremental inspection. +- Build-tests commit `5feb73f` adds the sole current compact transfer-proof + contract. It preserves exact `diag_event_v2` envelopes plus immutable segment + byte count, modification time, SHA-256, and record-count provenance for a + bounded source/queue/client-UDP milestone set. It retains exact local values + without redaction, rejects changed segments and malformed contracts, and fails + rather than truncating when its approved byte budget is exceeded. +- Build-tests commit `a50ea18` adds an explicit persisted-VPN wait mode. An empty + search-method set now creates a transfer-only action sequence; the runner scans + newly closed segments until a delivery-confirmed eD2K client-UDP request + lifecycle is observed, a bounded timeout expires, or the operator presses + Ctrl-C. Graceful shutdown then indexes the former active segment before the + compact proof is atomically finalized and moved to the private-artifact sibling. +- Build-tests commit `e33811e` makes the offline diff merge that exact compact + proof with the final retained raw suffix. Declared focused recordings fail when + the private proof is missing, mismatched, conflicting, or undeclared; no legacy + trace format or fallback parser was introduced. +- Focused scanner, collector, launcher, packaging, and offline-diff validation is + green: `124` tests passed. The complete harness suite then passed with `2,832` + tests passed, one skipped, and one deselected in `123.15 s`. + ## Next Implementation - Treat request encoding, parser behavior, lifecycle decisions, timeout cause, @@ -1537,9 +1573,10 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. protocol parity work continues. Any future nonzero plan must identify genuinely changed or new files rather than another compatibility workaround. - Run the approved direct-transfer action sequentially against Rust and MFC on - their configured persisted profiles. Hold each client long enough for source, - queue, and UDP-reask behavior, retain exact unredacted action windows, and then - compare the paired recordings offline by deterministic action identifier. + their configured persisted profiles. Use the incremental exact transfer-proof + gate rather than a fixed sleep, retain the complete source/queue/client-UDP + chain within the bounded private artifact, and compare the paired recordings + offline by deterministic action identifier. - Keep the proven server/Kad search gate unchanged. Treat the sequential transfer capture as a separate protocol-coverage proof; do not weaken required-family or diagnostic-conformance gates when an action did not generate the family. From 638eff18036a4726f2ccafa2aee5512fa01a2fa7 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sat, 31 Oct 2026 08:00:48 +0100 Subject: [PATCH 05/40] docs(RUST-CI-031): record focused transfer findings --- .../emulebb-rust/active/items/RUST-CI-031.md | 44 +++++++++++++++---- 1 file changed, 36 insertions(+), 8 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index bd370876..afe0dfc7 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1555,9 +1555,34 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. proof with the final retained raw suffix. Declared focused recordings fail when the private proof is missing, mismatched, conflicting, or undeclared; no legacy trace format or fallback parser was introduced. -- Focused scanner, collector, launcher, packaging, and offline-diff validation is - green: `124` tests passed. The complete harness suite then passed with `2,832` - tests passed, one skipped, and one deselected in `123.15 s`. +- Build-tests commits `c3ce4a0` and `d1f4562` remove the retired split-tunnel + mutator from the solo lane, require read-only full-tunnel readiness, keep REST + on loopback, pass VPN Guard Block to both clients, and address the diagnostic + writer through its canonical `/api/v1` base. +- A Rust-only transfer capture then retained a complete delivery-confirmed + client-UDP request lifecycle plus source engagement, server source request and + response, Kad lookup, queue rank, reask, and accepted payload evidence. The + recording itself packed successfully, but its action result exposed one final + persisted-profile defect: reposting an already active approved transfer returned + a structured duplicate conflict. +- Build-tests commit `9b859c5` makes the approved transfer action deterministic + for persisted profiles: add when absent, resume when paused, reuse only exact + runnable hash-and-size state, and fail explicitly for stopped, completed, + mismatched, or otherwise non-runnable state. No profile reset, transfer deletion, + or duplicate-conflict compatibility shim was added. The next Rust capture exited + cleanly with exact client-UDP proof and a packed bounded recording. +- The sequential MFC half added the same frozen fixture and retained server source + request/response, source engagement, and queue-rank evidence, but produced no + outbound client-UDP attempt or terminal outcome across multiple normal reask + intervals. During the extended standby wait hide.me later disconnected. Guard + Block and interface binding prevented a direct-route fallback, both clients were + confirmed stopped, and the incomplete MFC run remains local evidence rather than + a parity claim. +- Build-tests commit `efa206e` adds a read-only full-tunnel guard to every focused + transfer-proof poll and immediately converts route loss into a non-green retained + result followed by normal teardown, final-segment collection, and packing. The + complete harness suite is green at `2,842` passed, one skipped, and one deselected + in `130.02 s`. ## Next Implementation @@ -1572,11 +1597,14 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. - Preserve MFC zero hashing and the Rust zero-plan restart invariant while protocol parity work continues. Any future nonzero plan must identify genuinely changed or new files rather than another compatibility workaround. -- Run the approved direct-transfer action sequentially against Rust and MFC on - their configured persisted profiles. Use the incremental exact transfer-proof - gate rather than a fixed sleep, retain the complete source/queue/client-UDP - chain within the bounded private artifact, and compare the paired recordings - offline by deterministic action identifier. +- Reconnect hide.me, rerun only the MFC half under the same sequential model, and + let the new route guard produce either a complete packed proof or a packed + non-green route-loss result. Do not rerun the already-green Rust half unless the + frozen campaign fixture or diagnostic contract changes. +- If MFC again retains source engagement and queue rank without an outbound + client-UDP attempt, inspect the exact MFC queue/reask diagnostics before changing + either product. Determine whether the gap is MFC runtime behavior, missing MFC + instrumentation, or a transfer-state precondition; do not weaken the proof gate. - Keep the proven server/Kad search gate unchanged. Treat the sequential transfer capture as a separate protocol-coverage proof; do not weaken required-family or diagnostic-conformance gates when an action did not generate the family. From df6f0f847a4a8d300a42de3cd530091f488bbdd2 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sat, 31 Oct 2026 12:56:42 +0100 Subject: [PATCH 06/40] docs(RUST-CI-031): record UDP reask instrumentation --- .../emulebb-rust/active/items/RUST-CI-031.md | 45 +++++++++++++++---- 1 file changed, 37 insertions(+), 8 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index afe0dfc7..906c1fd2 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1584,6 +1584,36 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. complete harness suite is green at `2,842` passed, one skipped, and one deselected in `130.02 s`. +## UDP Reask Decision Instrumentation Checkpoint - 2026-10-31 + +- MFC commit `a1bc3551` and build-tests commits `13176a9` and `c6b02e3` + enforce the same focused `256 MiB` aggregate diagnostic budget on MFC, prune + retained closed segments when a lowered aggregate cap is exceeded, fail closed + when writer health is not ready, and cover the aggregate-retention policy in the + native parity suite. +- Build-tests commit `cadd8c4` makes the sole current recording contract carry an + explicit server endpoint for each client. The offline analyzer now requires that + authority directly and has no old-field fallback or recording adapter. +- A current-contract sequential capture completed exact delivery-confirmed Rust + client-UDP proof. The matching MFC half retained server source, source-engagement, + queue-rank, and peer-TCP evidence for the full bounded hour but no outbound + client-UDP attempt or terminal client-UDP outcome. The offline comparison therefore + failed the MFC required-family gate rather than weakening it. +- MFC commit `0ac94213` instruments every `UDPReaskForDownload` decision with the + current `sched/udp_reask_decision` event. Stable reasons cover missing request or + pending state, historical UDP failure ratio, remote/local UDP capability, + firewall, live TCP connection, proxy, LowID buddy prerequisites, source-exchange + priority, A4AF swap, and direct or callback send. Each event retains the exact + peer/file keys and the complete pre-decision eligibility snapshot. +- Repeated identical peer/file decisions are limited to one event per five minutes; + reason or file changes log immediately. Build-tests commit `9a6c492` covers gate + ordering, the existing failure-ratio threshold, direct and callback eligibility, + transport-versus-send classification, file-keyed suppression, reason changes, + interval expiry, and clock rollback. +- Validation passed MFC `Release|x64` diagnostics, MFC `Debug|x64`, and the complete + native parity suite: `840` tests and `5,396` assertions. No new soak was launched + after instrumentation; both clients remain stopped pending the next operator step. + ## Next Implementation - Treat request encoding, parser behavior, lifecycle decisions, timeout cause, @@ -1597,14 +1627,13 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. - Preserve MFC zero hashing and the Rust zero-plan restart invariant while protocol parity work continues. Any future nonzero plan must identify genuinely changed or new files rather than another compatibility workaround. -- Reconnect hide.me, rerun only the MFC half under the same sequential model, and - let the new route guard produce either a complete packed proof or a packed - non-green route-loss result. Do not rerun the already-green Rust half unless the - frozen campaign fixture or diagnostic contract changes. -- If MFC again retains source engagement and queue rank without an outbound - client-UDP attempt, inspect the exact MFC queue/reask diagnostics before changing - either product. Determine whether the gap is MFC runtime behavior, missing MFC - instrumentation, or a transfer-state precondition; do not weaken the proof gate. +- When the operator resumes the campaign, run only the instrumented MFC half under + the same sequential model and current frozen fixture. Do not rerun the already-green + Rust half unless that fixture or the diagnostic contract changes. +- Inspect the exact `udp_reask_decision` reason distribution before changing either + product. Determine whether the missing family is expected MFC runtime scheduling, + a transfer-state precondition, or a concrete protocol defect; do not weaken the + proof gate and do not add a compatibility adapter. - Keep the proven server/Kad search gate unchanged. Treat the sequential transfer capture as a separate protocol-coverage proof; do not weaken required-family or diagnostic-conformance gates when an action did not generate the family. From 549b9ae110caa1a03e69712096e1dd1fd50125c3 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sat, 31 Oct 2026 16:59:25 +0100 Subject: [PATCH 07/40] docs(RUST-CI-031): record exhausted fixture blocker --- .../emulebb-rust/active/items/RUST-CI-031.md | 48 ++++++++++++++++--- 1 file changed, 41 insertions(+), 7 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 906c1fd2..450ed395 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1613,6 +1613,36 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. - Validation passed MFC `Release|x64` diagnostics, MFC `Debug|x64`, and the complete native parity suite: `840` tests and `5,396` assertions. No new soak was launched after instrumentation; both clients remain stopped pending the next operator step. +- A subsequent full-hour MFC replay remained route-healthy and packed successfully, + but produced zero `udp_reask_decision` events. Build-tests commit `060333d` + upgrades the sole current offline report to `soak_offline_diff_v2` and retains + bounded exact examples plus outcome/reason distributions. The zero count proves + `UDPReaskForDownload` was never entered; it is not evidence for any transport + eligibility reason. +- MFC commit `bd3dc224` replaces the opaque `DS_ONQUEUE` compound condition with a + behavior-equivalent pure scheduler evaluator and emits + `sched/udp_reask_schedule_decision` for app connectivity, the strict two-minute + and one-second reask-window boundaries, the twenty-minute connect cooldown, and + the eligible transition. Build-tests commit `bca0455` covers every boundary, and + commit `d04cefb` includes both scheduler and transport distributions in the same + current offline report. MFC `Release|x64` diagnostics, MFC `Debug|x64`, and `842` + native tests with `5,408` assertions passed. +- The scheduler-aware full-hour replay also retained zero target scheduler and + transport decisions because the scripted download action failed before the frozen + fixture entered `DS_ONQUEUE`. Build-tests commit `0dbdb25` now retains structured + REST operation, HTTP status, and API error code for action failures. A bounded + probe identified `add`, HTTP `409`, `INVALID_STATE`. +- Build-tests commit `4ddd3b5` adds the missing persisted-state authority: after an + active-transfer miss the action checks the exact shared-file endpoint before add, + validates hash and size, and reports stable non-runnable state without deleting, + moving, resetting, or reimporting profile data. The sole approved campaign fixture + is already completed in the persisted MFC profile, so it cannot drive another + queue/reask cycle. The complete harness is green at `2,852` passed, one skipped, + and one deselected. +- Two short diagnostic probes stopped the client and restored bindability, confirmed + by the canonical preflight, but failed strict packing with `mfc-clean-teardown`. + Their markers are local troubleshooting evidence only, not valid recordings. No + client remains running and no pull request has been opened. ## Next Implementation @@ -1627,13 +1657,17 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. - Preserve MFC zero hashing and the Rust zero-plan restart invariant while protocol parity work continues. Any future nonzero plan must identify genuinely changed or new files rather than another compatibility workaround. -- When the operator resumes the campaign, run only the instrumented MFC half under - the same sequential model and current frozen fixture. Do not rerun the already-green - Rust half unless that fixture or the diagnostic contract changes. -- Inspect the exact `udp_reask_decision` reason distribution before changing either - product. Determine whether the missing family is expected MFC runtime scheduling, - a transfer-state precondition, or a concrete protocol defect; do not weaken the - proof gate and do not add a compatibility adapter. +- Obtain a second operator-approved direct-transfer fixture with exact name, eD2K + hash, and size in ignored local input. The current frozen fixture is completed and + must not be deleted or moved merely to manufacture another run. Because the fixture + changes, start a new campaign and rerun both sequential halves. +- Once the new action is active, inspect `udp_reask_schedule_decision` first and + `udp_reask_decision` second. Determine whether any remaining gap is expected MFC + runtime scheduling, a transfer-state precondition, or a concrete protocol defect; + do not weaken the proof gate and do not add a compatibility adapter. +- Resolve the strict short-run `mfc-clean-teardown` failure before treating short + probes as packable evidence. Long bounded captures already complete clean teardown; + do not conflate this harness issue with protocol behavior. - Keep the proven server/Kad search gate unchanged. Treat the sequential transfer capture as a separate protocol-coverage proof; do not weaken required-family or diagnostic-conformance gates when an action did not generate the family. From e23481b4a4cb22ecd5f3c56d9f92cace2c0e669e Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 12:34:02 +0100 Subject: [PATCH 08/40] docs(RUST-CI-031): require fixture-owned UDP proof --- .../emulebb-rust/active/items/RUST-CI-031.md | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 450ed395..bb26bf26 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1644,6 +1644,40 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. Their markers are local troubleshooting evidence only, not valid recordings. No client remains running and no pull request has been opened. +## Fixture-Owned Client-UDP Contract Checkpoint - 2026-11-01 + +- The V8 focused recordings retained valid general client-UDP lifecycle evidence: + Rust emitted two attempts with two successful terminals, and MFC emitted four + attempts with four successful terminals. MFC also retained 69 scheduler + decisions with ten eligible transitions and 16 transport decisions with six + sends. These events confirm that both persisted clients exercised client UDP. +- A contract audit found that this was not yet evidence for the selected + transfer fixture. The compact proof admitted packet and socket records that + carried no file hash, and the MFC scheduler and transport decisions matching + the selected fixture numbered zero. The selected transfer and the observed + client-UDP lifecycle therefore coexisted in the same process run but were not + causally correlated. V8 is general discovery evidence, not a fixture-owned + parity or coverage proof. +- Build-tests commit `1bbb722` replaces that permissive behavior with the sole + current `focused-client-udp-request-lifecycle` contract. A UDP attempt must + carry the exact fixture hash, its terminal must match the same + `sendAttemptId`, and MFC must additionally retain fixture-owned scheduler + eligibility and transport-send decisions. Hashless activity can no longer + complete the focused wait. +- Focused adjudication now reports the successful terminal state as + `coverage-proven`, never `parity`. Native packet capture, cumulative Kad + coverage, startup lifecycle, and narrow action-window traffic are explicitly + outside that focused claim; the full-campaign parity contract retains all of + those gates unchanged. +- The current contract intentionally rejects the retained V8 compact evidence + with a harness failure. No legacy summary, proof adapter, or compatibility + fallback was added. The next recording requires current Rust and MFC + diagnostics to place the logical file hash on the client-UDP attempt before + the focused proof can become green. +- Validation passed 124 focused tests, Ruff checks for every changed module, + and the complete harness suite: 2,859 passed, one skipped, and one + deselected. + ## Next Implementation - Treat request encoding, parser behavior, lifecycle decisions, timeout cause, @@ -1657,6 +1691,13 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. - Preserve MFC zero hashing and the Rust zero-plan restart invariant while protocol parity work continues. Any future nonzero plan must identify genuinely changed or new files rather than another compatibility workaround. +- Add the exact logical file hash to Rust and MFC client-UDP send-attempt + diagnostics and retain it through the compact proof. MFC scheduler and + transport decisions already own the required file key; do not infer fixture + ownership from process timing, peer coincidence, or packet presence. +- Rerun both sequential focused halves under the current contract. Do not use + V8 as a green fixture-owned proof, and do not weaken the correlation gate if + unrelated persisted downloads emit client UDP first. - Obtain a second operator-approved direct-transfer fixture with exact name, eD2K hash, and size in ignored local input. The current frozen fixture is completed and must not be deleted or moved merely to manufacture another run. Because the fixture From 0fd3baa7c4e81eab529599b30a7d8caffde67343 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 13:27:01 +0100 Subject: [PATCH 09/40] docs(RUST-CI-031): record UDP producer correlation --- .../emulebb-rust/active/items/RUST-CI-031.md | 28 ++++++++++++++++--- 1 file changed, 24 insertions(+), 4 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index bb26bf26..1ab85461 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1678,6 +1678,30 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. and the complete harness suite: 2,859 passed, one skipped, and one deselected. +## Fixture-Owned Client-UDP Producer Checkpoint - 2026-11-01 + +- Rust commit `ec19a5d8` carries the logical transfer hash in typed outbound + client-UDP metadata for direct `OP_REASKFILEPING` and buddy-relayed + `OP_REASKCALLBACKUDP` requests. The socket attempt emits the lower-case hash + as `keys.fileHash`; unrelated packets omit it. +- MFC commit `91b770d2` copies the producer-owned request hash into the queued + UDP packet and emits the same `keys.fileHash` on the actual socket attempt. + Diagnostics now classify outgoing client UDP by the `OP_EMULEPROT` wire + marker, so buddy-relayed requests remain visible even though their queue + routing flag is Kad-owned. +- Neither client decodes or infers transfer identity from obfuscated wire + bytes. Terminal events remain compact and correlate to the fixture-owned + attempt only through `sendAttemptId`; no compatibility field, fallback, or + legacy schema was added. +- Build-tests commit `c37eed4` covers wire-family classification independently + of queue routing. The native parity suite passed 843 cases and 5,411 + assertions. MFC `Debug|x64`, `Release|x64`, and diagnostics `Release|x64` + builds passed. +- The Rust diagnostics binary check passed, and the complete diagnostics-feature + `emulebb-ed2k` suite passed 1,223 tests. This checkpoint changes producers + only; a new focused live recording is still required before claiming + fixture-owned coverage. + ## Next Implementation - Treat request encoding, parser behavior, lifecycle decisions, timeout cause, @@ -1691,10 +1715,6 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. - Preserve MFC zero hashing and the Rust zero-plan restart invariant while protocol parity work continues. Any future nonzero plan must identify genuinely changed or new files rather than another compatibility workaround. -- Add the exact logical file hash to Rust and MFC client-UDP send-attempt - diagnostics and retain it through the compact proof. MFC scheduler and - transport decisions already own the required file key; do not infer fixture - ownership from process timing, peer coincidence, or packet presence. - Rerun both sequential focused halves under the current contract. Do not use V8 as a green fixture-owned proof, and do not weaken the correlation gate if unrelated persisted downloads emit client UDP first. From 8db9b601ae1f3a45afa2cddd931b20b80776063c Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 15:51:39 +0100 Subject: [PATCH 10/40] docs(RUST-CI-031): record fixture-owned UDP proof --- .../emulebb-rust/active/items/RUST-CI-031.md | 54 +++++++++++++------ 1 file changed, 38 insertions(+), 16 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 1ab85461..8b5432b4 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1702,6 +1702,36 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. only; a new focused live recording is still required before claiming fixture-owned coverage. +## Fixture-Owned Client-UDP Live Proof - 2026-11-01 + +- Build-tests commit `8aa8697` makes each selected soak half run the supported + incremental diagnostics build before resolving and launching that client's + canonical executable. A failed build stops before launch; the harness does + not search for or silently reuse a different binary. +- Build-tests commits `94dff83` and `6112466` keep immutable snapshots of closed + segments already read by the scanner and establish the focused scan checkpoint + immediately before the scripted transfer action. Retention can no longer remove + evidence between scanning and collection, and startup backlog cannot outrun the + bounded segment ring. Every segment from the action boundary remains contiguous + and mandatory. +- A sequential current-contract campaign reused both persisted profiles and the + same operator-approved fixture. Rust completed nine fixture-owned client-UDP + attempts with nine successful correlated terminals. MFC completed 94 attempts + with 94 successful terminals and retained fixture-owned scheduler eligibility + plus transport-send evidence. Both halves finalized and packed cleanly without + reimporting profiles or rehashing shared content. +- Offline adjudication initially exposed one harness false positive: MFC happened + to receive a routed reply carrying the conditional packet `note`, while the Rust + half contained send attempts and outcomes only. Rust already emits a routed-reply + note when that receive state occurs. Build-tests commit `35f107a` classifies this + receive/drop decision field as conditional across independent captures and adds + regression coverage; required wire fields and family-presence gates remain strict. +- Re-adjudication completed as `coverage-proven` with matching fixture authority, + both required diagnostic families present, valid client-UDP lifecycles on both + clients, and no focused-contract findings. This is fixture-owned client-UDP + lifecycle coverage, not a claim of whole-run ED2K/Kad parity. The complete + build-tests suite passed 2,866 tests with one skip and one deselection. + ## Next Implementation - Treat request encoding, parser behavior, lifecycle decisions, timeout cause, @@ -1715,27 +1745,19 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. - Preserve MFC zero hashing and the Rust zero-plan restart invariant while protocol parity work continues. Any future nonzero plan must identify genuinely changed or new files rather than another compatibility workaround. -- Rerun both sequential focused halves under the current contract. Do not use - V8 as a green fixture-owned proof, and do not weaken the correlation gate if - unrelated persisted downloads emit client UDP first. -- Obtain a second operator-approved direct-transfer fixture with exact name, eD2K - hash, and size in ignored local input. The current frozen fixture is completed and - must not be deleted or moved merely to manufacture another run. Because the fixture - changes, start a new campaign and rerun both sequential halves. -- Once the new action is active, inspect `udp_reask_schedule_decision` first and - `udp_reask_decision` second. Determine whether any remaining gap is expected MFC - runtime scheduling, a transfer-state precondition, or a concrete protocol defect; - do not weaken the proof gate and do not add a compatibility adapter. -- Resolve the strict short-run `mfc-clean-teardown` failure before treating short - probes as packable evidence. Long bounded captures already complete clean teardown; - do not conflate this harness issue with protocol behavior. +- Use the completed fixture-owned proof as the baseline for the next until-stopped + paired soak. Keep broad server lifecycle, secure-ident, peer-transfer, server UDP, + Kad, sequence-integrity, and writer-health gates active; the focused proof does not + satisfy those whole-run surfaces. +- Keep selected-client incremental build refresh and action-boundary tailing as the + sole launch path. Reuse the persisted profiles and hash state; fail rather than + reset, reimport, rehash, or select a different executable implicitly. - Keep the proven server/Kad search gate unchanged. Treat the sequential transfer capture as a separate protocol-coverage proof; do not weaken required-family or diagnostic-conformance gates when an action did not generate the family. - Confirm the rebuilt traces name deprecated Kad routing and server-description UDP opcodes on both clients without changing unsupported Kad1 behavior. -- Run the complete diagnostic analyzer and offline action diff after both solo - recordings exist. Implement only concrete protocol or correlation gaps +- During the next broad soak, implement only concrete protocol or correlation gaps demonstrated by exact traces, each as a separate tested commit. - Keep the next run until-stopped once the action-driven proof is clean. Do not open a pull request until the complete significant slice is green and the From ec8f28909e95e617b2464de76611ebb0fd938873 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 16:37:39 +0100 Subject: [PATCH 11/40] docs(RUST-CI-031): record maintained soak checkpoint --- .../emulebb-rust/active/items/RUST-CI-031.md | 36 +++++++++++++++++-- 1 file changed, 34 insertions(+), 2 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 8b5432b4..4f101215 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1732,6 +1732,38 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. lifecycle coverage, not a claim of whole-run ED2K/Kad parity. The complete build-tests suite passed 2,866 tests with one skip and one deselection. +## Maintained Persisted Soak Checkpoint - 2026-11-01 + +- `persisted-soak-control.py` is the maintained until-stopped authority. It owns + the detached `launch-soak.py` lifecycle plus the attach-only bounded observer + and watcher. The older all-in-one `converged-soak-live.py` loaded complete + growing traces during a checkpoint and reached unbounded process memory; that + run was stopped cleanly and the script is not an authority for long soaks. +- Build-tests commits `956cb87` and `f9b6eb3` put the supported incremental Rust + and MFC diagnostics builds directly in both maintained launch paths. Commits + `bbcacd9`, `7cc232e`, and `c1218b2` preserve campaign retention wiring, direct + persisted MFC diagnostics, and loopback REST control in full-tunnel mode. +- The first maintained campaign reused both persisted profiles and their hash + state, refreshed both selected diagnostics builds, applied the 8 KiB/s upload + cap, and reached healthy full-tunnel operation with VPN Guard Block and active + `diag_event_v2` writers on both clients. No profile import, reset, rehash, or + storage deletion occurred. +- Its first server-search action proved the required `OP_SEARCHREQUEST` on both + clients, but the original adjudicator incorrectly failed the action because + unrelated background client-UDP traffic had different event shapes in the same + time window. The action-owned server diagnostics were conformant; no Rust + protocol defect was established. +- Build-tests commit `5644b9e` scopes an action verdict to that lane's explicitly + required diagnostic families while retaining every unrelated family in the + report for analysis. Two regression levels cover the family gate and the full + server-action verdict. The complete build-tests suite passes 2,869 tests with + one skip and one deselection. +- Corrected campaign `20261101T153238Z` is the active bounded soak. Both clients, + REST planes, diagnostics writers, VPN routing, and guards are healthy. Its first + server action completed as `coverage-parity`; the gate is at server 1/4 and Kad + 0/4 with zero confirmed divergences. This is an in-progress action-lane result, + not a whole-protocol parity claim. + ## Next Implementation - Treat request encoding, parser behavior, lifecycle decisions, timeout cause, @@ -1774,9 +1806,9 @@ distinguish observed parity from merely unobserved behavior. ## Representative Sites -- `repos/emulebb-build-tests/scripts/converged-soak-live.py` +- `repos/emulebb-build-tests/scripts/persisted-soak-control.py` - `repos/emulebb-build-tests/scripts/launch-soak.py` -- `repos/emulebb-build-tests/scripts/rust-soak-control.py` +- `repos/emulebb-build-tests/scripts/converged-soak-observer.py` - `repos/emulebb-build-tests/emule_test_harness/soak_launch.py` - `repos/emulebb-build-tests/emule_test_harness/hideme_split_tunnel.py` - `repos/emulebb-build-tests/emule_test_harness/mfc_profile_import.py` From 50082d350f80f076967945a6c28f0989711f4962 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 16:51:30 +0100 Subject: [PATCH 12/40] docs(rust): checkpoint canonical parity soak --- .../emulebb-rust/active/items/RUST-CI-031.md | 35 ++++++++++++++++--- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 4f101215..366e194c 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1758,11 +1758,36 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. report for analysis. Two regression levels cover the family gate and the full server-action verdict. The complete build-tests suite passes 2,869 tests with one skip and one deselection. -- Corrected campaign `20261101T153238Z` is the active bounded soak. Both clients, - REST planes, diagnostics writers, VPN routing, and guards are healthy. Its first - server action completed as `coverage-parity`; the gate is at server 1/4 and Kad - 0/4 with zero confirmed divergences. This is an in-progress action-lane result, - not a whole-protocol parity claim. +- Build-tests commit `af44832` closes a gate false-green: a REST search must now + report `completed=true` for both clients before identical packet diagnostics + can count as parity. Deadline snapshots retain their counts but remain + `evidence-incomplete` and retryable. Completed zero-result Kad searches remain + valid when both exact lookup lifecycles and request diagnostics are present. +- Build-tests commit `26f707a` adds the blocking `run-to-gate` operation. It starts + the canonical persisted-profile controller, waits for the configured server/Kad + gate while all three owned processes remain alive, and always stops and finalizes + diagnostics. Both Rust release campaign manifests now use this command with + localhost control and full-tunnel assumptions; a detached `start` can no longer + create a false-green release scenario. +- Build-tests commit `088e06f` retires the unsafe whole-trace + `converged-soak-live.py` implementation and 4,846 lines of runner-specific code + and tests. The filename is a fail-fast tombstone with canonical guidance, while + stale-process recognition remains for recovery. The complete build-tests suite + passed 2,786 tests with one skip and one deselection after this cleanup. +- Build-tests commit `e27a8d0` scopes diagnostic conformance to action-relevant + records inside the exact window. Server searches gate only their request/result + packet records; Kad searches gate their request/result packets and exact + search-ID lookup lifecycle. Unrelated traffic remains in the full diagnostic + diff for analysis but cannot create a same-family false protocol divergence. +- Campaign `20261101T154310Z` independently confirmed one authoritative server + action before that final scoping change: both REST searches completed, both + clients emitted `OP_SEARCHREQUEST` to the same configured public server, both + result totals were zero, diagnostic evidence was complete, and the verdict was + `coverage-parity`. No Rust protocol defect was established. +- Final corrected campaign `20261101T155047Z` is the active bounded soak. It uses + the latest gate and action-scoping code, reuses both persisted profiles and hash + state, and targets four completed server plus four completed Kad actions. This + remains an in-progress action-lane proof, not a whole-protocol parity claim. ## Next Implementation From c752d35b438ac71f3dcacc0dd4fad5cd5d36f534 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 17:37:38 +0100 Subject: [PATCH 13/40] docs(rust): record causal soak gate evidence --- .../emulebb-rust/active/items/RUST-CI-031.md | 24 +++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 366e194c..8e869ad3 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1784,10 +1784,26 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. clients emitted `OP_SEARCHREQUEST` to the same configured public server, both result totals were zero, diagnostic evidence was complete, and the verdict was `coverage-parity`. No Rust protocol defect was established. -- Final corrected campaign `20261101T155047Z` is the active bounded soak. It uses - the latest gate and action-scoping code, reuses both persisted profiles and hash - state, and targets four completed server plus four completed Kad actions. This - remains an in-progress action-lane proof, not a whole-protocol parity claim. +- Campaign `20261101T155047Z` was stopped and retained as provisional discovery + evidence after review proved that same-opcode traffic was not yet sufficient + causal authority. Its single server success does not count toward the final + deterministic gate. +- Rust commit `4def7119` and MFC commit `9bee814d` add the canonical Kad target to + each public lookup's exact search-ID lifecycle. Build-tests commit `64a151a` + then attributes server requests by exact query plus configured endpoint and + Kad request/response packets by exact search ID plus canonical target. Missing, + duplicate, overlapping, conflicting, or bilaterally different authority is + retryable `evidence-incomplete`, never protocol parity or confirmed divergence. +- The causal-attribution change passed 2,811 build-tests tests with one skip and + one deselection. Independent review verified the Kad request/response target + offsets, UInt128 byte order, bilateral target equality, server overlap rejection, + exact query-only payload parsing, lifecycle uniqueness, and report validation. +- Final campaign `20261101T162656Z` refreshed both selected diagnostics builds, + reused both persisted profiles and hash state, and started the four-server plus + four-Kad gate with healthy full-tunnel binding and VPN Guard Block. Its first + server slot was safely skipped while MFC completed eD2K connection; no retry or + divergence was recorded. This remains an in-progress action-lane proof, not a + whole-protocol parity claim. ## Next Implementation From 0fa207d11af143e9422e66ab113b9e55eb61d8ea Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 17:46:23 +0100 Subject: [PATCH 14/40] docs(policy): focus protocol parity evidence --- docs/active/TEST-STRATEGY.md | 23 ++-- .../emulebb-rust/active/items/RUST-CI-031.md | 106 +++++++++++----- docs/reference/HARNESS-LIVE-POLICY.md | 118 +++++++++++++----- 3 files changed, 176 insertions(+), 71 deletions(-) diff --git a/docs/active/TEST-STRATEGY.md b/docs/active/TEST-STRATEGY.md index 1d74577d..e3da09b6 100644 --- a/docs/active/TEST-STRATEGY.md +++ b/docs/active/TEST-STRATEGY.md @@ -1,6 +1,6 @@ # Test Strategy -Status: active lifecycle policy. Updated 2026-10-02. +Status: active lifecycle policy. Updated 2026-11-01. There is no forward cross-product “Suite” release gate. Test depth follows each repository's current lifecycle and the risk of the proposed change. @@ -10,22 +10,27 @@ repository's current lifecycle and the risk of the proposed change. | Lane | Required direction | |---|---| | **emulebb-rust** | Active beta. Repo-native quality, test, and cross-platform build gates are primary; add targeted workspace evidence as needed. | -| **emulebb-mfc `0.7.x`** | Diagnostics and critical-fix maintenance. Keep it buildable and shippable; require proof proportional to the touched surface. | -| **ed2k-server** | Sole local deterministic server and upstream-aligned Rust fork. Use minimal upstreamable changes and focused harness proof; no production-service gate. | -| **aMule upstream** | Managed official upstream used for interoperability and protocol parity. It is not an eMuleBB product release lane. | +| **emulebb-mfc `0.7.x`** | Preferred observable protocol oracle. Diagnostics, deterministic controls, and oracle buildability only; no product or protocol evolution. | +| **ed2k-server** | Upstream-clean local deterministic dependency. Keep emulebb-specific protocol behavior out of the fork and adapt tests in the harness. | +| **aMule stable** | Frozen independent protocol-parity reference at one exact release and diagnostics-only patch revision. | +| **aMule HEAD** | Moving upstream source-analysis and future-interoperability lane; never a current parity gate. | ## Shared rules - Keep fast deterministic unit and contract checks close to the owning repo. - Use `emulebb-build-tests` only for cross-process, protocol, package, soak, or live evidence that cannot be proved cleanly in one repository. -- MFC source/parity checks do not gate Rust beta work, and paused/frozen fork - coverage does not gate an unrelated Rust change. +- MFC product-release checks do not gate Rust beta work. A selected protocol + campaign may require causally attributed MFC oracle evidence for the exact + supported states it claims to cover. - Public-network, VM, long soak, and destructive scenarios remain explicit, evidence-bound lanes rather than default fast checks. -- Native Windows VPN integration is not a forward product priority. If a test - explicitly selects a VPN mode, it must fail closed and must never silently - fall back to a direct route. +- The persisted native-Windows hide.me lane is discovery-only, treats provider + state as inherited and read-only, requires full-tunnel mode plus VPN Guard + Block, and must never silently fall back to a direct route. + +Protocol-parity evidence semantics, oracle roles, and consolidation rules are +defined by the [Harness And Live Policy](../reference/HARNESS-LIVE-POLICY.md). The superseded cross-product planning document is recoverable from the archival commit recorded in the [history overview](../history/INDEX.md). diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 8e869ad3..53370fad 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -30,13 +30,66 @@ reuse a valid nonempty Rust profile thereafter. The workflow is a diagnostic discovery lane, not unbounded certification evidence. Repeatable bounded captures remain the authority for a parity claim. +## Focused Protocol-Parity Goal - 2026-11-01 + +Consolidate Rust protocol-parity testing into one evidence-driven harness in +`repos\emulebb-build-tests`. Deterministic eD2K/Kad codec, transcript, +state-machine, and local cross-client campaigns are the parity authority. The +persisted public-network soak remains a discovery lane that supplies candidate +findings and rare-state recordings; it cannot certify a state it did not +observe and cannot report useful progress when no causally attributable action +completed. + +The governing role model is: + +- emulebb Rust is the product under test; +- emulebb MFC is the preferred observable runtime oracle and receives only + diagnostics, deterministic test control, and required oracle buildability + work; +- stock eMule source and accepted goldens define protocol intent; +- one frozen stable aMule lane is an independent parity reference, while aMule + HEAD is analysis-only; +- `ed2k-server` is an upstream-clean deterministic dependency, not an emulebb + protocol fork; and +- the historical community tracing harness is retired from active parity work. + +One machine-readable catalog will own supported protocol variants, states, +transitions, required evidence, runners, authorities, build provenance, and +current status. Campaigns are named selections from that catalog. Missing, +ambiguous, malformed, dropped, or unattributable evidence is +`evidence-incomplete`; an unexercised transition is `not-observed`. Neither +counts as parity or divergence. Zero divergences with zero covered entries is +not evidence. + +The current significant chunk is consolidation, not expansion of the soak +controller: + +1. establish the single catalog and verdict model; +2. import the existing protocol-golden groups and proven deterministic cases; +3. classify every current protocol test as canonical coverage, shared support, + duplicate, non-protocol product coverage, or historical material; +4. freeze and name the MFC, stock, stable-aMule, and aMule-HEAD roles; +5. remove the tracing harness from active topology after its remaining + consumers are migrated or retired; +6. restore `ed2k-server` to upstream code behavior and move test-specific + adaptation into the harness; +7. make exact source/binary/profile provenance and stale-build rejection part + of every executable campaign; and +8. finish with a machine-generated coverage report and the complete harness + validation green. + +Work continues through granular commits on the existing single workstream +branch. Do not open coordinated pull requests until this whole chunk is +complete, reviewed, and green. Do not create compatibility aliases, legacy +schema readers, or parallel work-in-progress branches during the consolidation. + ## Current State - The canonical dual-client launchers now expose an explicit full-tunnel mode, perform a read-only hide.me preflight, use IPv4 loopback for control, and require VPN Guard Block configuration before client launch. - The full-tunnel lane accepts an explicitly selected operator-owned Rust - profile outside `EMULEBB_WORKSPACE_OUTPUT_ROOT`; split-tunnel runs retain the + profile outside `EMULEBB_WORKSPACE_OUTPUT_ROOT`; other workflows retain the managed-output boundary. - An empty persisted Rust profile is imported transactionally from the selected MFC profile, while a populated profile must contain the current Rust settings @@ -1807,35 +1860,23 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. ## Next Implementation -- Treat request encoding, parser behavior, lifecycle decisions, timeout cause, - packet correlation, and connection continuity as parity authority. Public - result counts may differ and are comparable only when both clients used the - same exact server endpoint. -- Run a serial or endpoint-swapped live A/B before treating a missing - `OP_SEARCHRESULT` as a Rust protocol defect. Connected-server result counts - from different public endpoints are not a valid parity assertion; request - encoding, parser behavior, timeout cause, and connection continuity are. -- Preserve MFC zero hashing and the Rust zero-plan restart invariant while - protocol parity work continues. Any future nonzero plan must identify - genuinely changed or new files rather than another compatibility workaround. -- Use the completed fixture-owned proof as the baseline for the next until-stopped - paired soak. Keep broad server lifecycle, secure-ident, peer-transfer, server UDP, - Kad, sequence-integrity, and writer-health gates active; the focused proof does not - satisfy those whole-run surfaces. -- Keep selected-client incremental build refresh and action-boundary tailing as the - sole launch path. Reuse the persisted profiles and hash state; fail rather than - reset, reimport, rehash, or select a different executable implicitly. -- Keep the proven server/Kad search gate unchanged. Treat the sequential transfer - capture as a separate protocol-coverage proof; do not weaken required-family - or diagnostic-conformance gates when an action did not generate the family. -- Confirm the rebuilt traces name deprecated Kad routing and server-description - UDP opcodes on both clients without changing unsupported Kad1 behavior. -- During the next broad soak, implement only concrete protocol or correlation gaps - demonstrated by exact traces, each as a separate tested commit. -- Keep the next run until-stopped once the action-driven proof is clean. Do not - open a pull request until the complete significant slice is green and the - operator explicitly requests it. This slice makes no VPN-safety claim until a - separate controlled tunnel-down proof is completed. +- Treat the running persisted soak as discovery only. Its current gate remains + pending until causally attributed actions complete; a zero-action run makes no + parity statement. +- Build the catalog from the existing golden manifest, deterministic lifecycle + evidence, native Rust tests, and live-suite inventory before adding another + runner. +- Produce the classification and proposed removal/migration list before deleting + historical tests or changing workspace topology. +- Consolidate the first complete vertical campaign around server session, + search, source discovery, and source lifecycle because that area already has + the strongest deterministic and cross-client evidence. +- Continue domain by domain through peer transfer/queue/callback, client UDP, + and Kad. Promote every reproducible soak finding into the lowest applicable + deterministic layer. +- Preserve the persisted MFC and Rust profile/hash state while this + consolidation proceeds. Harness restructuring does not authorize profile + reset, reimport, or rehash. ## Why This Matters @@ -1851,7 +1892,6 @@ distinguish observed parity from merely unobserved behavior. - `repos/emulebb-build-tests/scripts/launch-soak.py` - `repos/emulebb-build-tests/scripts/converged-soak-observer.py` - `repos/emulebb-build-tests/emule_test_harness/soak_launch.py` -- `repos/emulebb-build-tests/emule_test_harness/hideme_split_tunnel.py` - `repos/emulebb-build-tests/emule_test_harness/mfc_profile_import.py` - `repos/emulebb-build-tests/emule_test_harness/diag_event_diff.py` - `repos/emulebb-build-tests/emule_test_harness/packet_trace_diff.py` @@ -1909,8 +1949,8 @@ distinguish observed parity from merely unobserved behavior. ## Scope Constraints - Stock/community eMule remains the authority for wire behavior. Maintained - eMuleBB MFC is the operational comparator, and current aMule is a distinct - interoperability evidence lane. + eMuleBB MFC is the preferred observable runtime oracle. Frozen stable aMule is + a distinct parity-reference lane, while moving aMule HEAD is analysis-only. - Supported scope is IPv4 eD2K/Kad behavior minus the registered permanent omissions. Intentional extensions such as `offerfiles-v1` remain separate negotiated/fallback lanes. diff --git a/docs/reference/HARNESS-LIVE-POLICY.md b/docs/reference/HARNESS-LIVE-POLICY.md index 2225e988..8f389b67 100644 --- a/docs/reference/HARNESS-LIVE-POLICY.md +++ b/docs/reference/HARNESS-LIVE-POLICY.md @@ -14,27 +14,87 @@ live evidence. - Search existing `scripts` and `emule_test_harness` capabilities before adding a helper. Prefer an existing module, then extending the closest script, then a reusable module with a thin operator wrapper. -- `baseline/community-0.72a` is the seam-enabled parity/regression baseline. - Its maintenance is limited to inert seams, deterministic probes/adapters, - narrow tracing, and required buildability fixes; normal runtime behavior, - persistence, network behavior, and default control flow must not change. -- `tracing-harness/community-0.72a` is the only sanctioned location for parity - behavior that intentionally changes runtime decisions. It is neither a - release branch nor the default regression baseline. -- `repos/amule` is the managed official upstream aMule checkout and the moving - interoperability target. Refresh it through workspace sync before current - parity work and record its exact commit in retained evidence. Never silently - substitute it for the fixed Community 0.72a regression baseline; campaigns - report fixed-stock and moving-upstream results as distinct lanes. -- `ed2k-server` is the sole local deterministic harness server and an - upstream-contribution reference. Keep it close to upstream, prefer - harness-side adaptation, and keep server changes minimal, generic, and - upstreamable. Local live and parity campaigns may select it; release and - public-production campaigns do not. +- `workspaces\workspace\app\emulebb-main` is the preferred observable runtime + oracle for eD2K/Kad parity because it carries the maintained MFC diagnostics + surface. It is not a second product-development target. Changes are limited + to diagnostics, deterministic test control, and buildability required for + oracle use; do not evolve product or protocol behavior there. +- Stock eMule source and accepted protocol goldens remain the authority for wire + and state-machine intent. `baseline/community-0.72a` is the frozen, + seam-enabled executable stock lane. Its maintenance is limited to inert + probes/adapters, narrow tracing, and required buildability fixes; normal + runtime behavior, persistence, network behavior, and default control flow + must not change. +- `tracing-harness/community-0.72a` is retired from active parity work. Do not + add new runners, aliases, tests, or topology dependencies for it. Preserve + historical work in Git and migrate or remove remaining consumers before the + worktree is archived. +- aMule has two explicit roles. The parity lane uses one frozen stable release + and records its exact revision plus any diagnostics-only patch revision. The + moving upstream HEAD lane is source-analysis and future-interoperability + evidence only; it is never silently substituted for the frozen parity lane + and never gates a current parity claim. +- `ed2k-server` is an upstream-clean deterministic test dependency. Its code + must follow upstream without emulebb-specific protocol behavior. CI, + packaging, and test wiring may be carried locally when necessary, but packet, + state-machine, and client-compatibility adaptation belongs in the harness or + a scripted fixture. A result that depends on fork-only server behavior is not + stock protocol-parity evidence. - Rust metadata schema helpers are internal, bounded, backup-first infrastructure for known persisted test/soak profiles. They are never an end-user migration or recovery path. +## Protocol-Parity Evidence + +The active goal is one evidence-driven Rust protocol-parity harness, not a +collection of independent test scripts. The harness must maintain one +machine-readable catalog of the supported eD2K and Kad variants and state +transitions. Each catalog entry identifies its starting state, stimulus, +expected wire/state result, authority, required evidence, deterministic runner, +optional live runner, exact build provenance, and current evidence status. +Named campaigns are selections from that catalog; they do not define competing +coverage or verdict models. + +Use these evidence layers in order: + +1. codec and transcript tests for packet, tag, boundary, malformed-input, and + compatibility variants; +2. deterministic local state-machine tests with controlled time, faults, and + exact ordered transitions; +3. deterministic local cross-client campaigns, with Rust versus MFC as the + primary observable comparison and frozen stock/aMule lanes as independent + references where applicable; and +4. public-network persisted-profile soaks for discovery and rare-state + collection only. + +A public finding must be reduced to a deterministic regression whenever the +state can be reproduced locally. Public-network success cannot replace missing +deterministic coverage. + +Verdicts have strict meanings: + +- `parity`: the required transition occurred on both selected clients and all + required, causally attributed evidence was recorded and compared; +- `divergence`: comparable causal evidence exists on both sides and establishes + an actual mismatch; +- `evidence-incomplete`: an action or transition may have occurred, but required + evidence is absent, ambiguous, dropped, malformed, or cannot be attributed; +- `not-observed`: the required action or transition did not occur; and +- `intentional-difference`: an approved supported-scope difference with its + authority and rationale recorded in the catalog. + +`evidence-incomplete` and `not-observed` never count as parity, divergence, or +green coverage. A campaign reports the exact covered/required count and each +non-covered catalog entry. Zero recorded divergences without covered entries is +not progress or protocol evidence. + +Before adding a runner or suite, map it to catalog entries and search the +existing harness. Every existing protocol test must ultimately be classified +as canonical coverage, a shared fixture/helper, a duplicate to remove, a +non-protocol product test, or historical material isolated from active Rust +parity campaigns. Do not preserve obsolete client aliases, report adapters, or +schema compatibility shims during this beta consolidation. + ## Selected-Route Safety Public-network P2P routing is always explicit. Direct mode intentionally uses @@ -56,12 +116,9 @@ separate. Never fall back silently from VPN to direct. hooks from operator-local configuration. VPN mode must prove tunnel-down blocks off-tunnel data before a VPN-safe claim can be made. - Public profiles enable main P2P UPnP when the selected route supports it and - record mapping/reachability evidence. Native Windows VPN integration is not a - forward development priority, but existing safety claims still require proof. -- On the operator split-tunnel machine, non-P2P services and control/probe - traffic use inherited `X_LOCAL_IP` / `--lan-bind-addr`, never loopback or - wildcard. Product runtime and other machines retain deliberate loopback and - wildcard compatibility. + record mapping/reachability evidence. The persisted native-Windows hide.me + lane treats provider state as inherited operator state and remains read-only; + it does not configure, repair, or bypass the provider. - A full-tunnel host lane must prove split tunneling is disabled and must not call helpers that add application allow-list entries, excluded ranges, or other provider settings. Its local control planes use loopback while P2P @@ -75,8 +132,8 @@ separate. Never fall back silently from VPN to direct. A direct Rust beta public test must be explicitly selected, use a fresh isolated profile with empty shared roots, accept only operator-approved hashes with exact size and SHA-256, bound traffic and runtime, tear down automatically, and retain -evidence. WSL REST stays on loopback; Windows control follows the split-tunnel -LAN rule. +evidence. WSL and Windows REST control stay on loopback unless a selected +scenario explicitly tests LAN control. An explicitly selected native-Windows Rust-versus-MFC protocol-parity campaign may use a narrower operator-approved exception to that direct-test baseline. It @@ -86,8 +143,8 @@ clients must use fresh isolated profiles and output-root incoming directories, must never open or execute the downloaded payloads, and must compute SHA-256 after completion and require cross-client equality. That equality proves parity between the two completed payloads; it does not establish content provenance or -trust. The campaign must remain bounded, tear down automatically, retain -sanitized evidence, and leave the ordinary direct Rust beta requirements above +trust. The campaign must remain bounded, tear down automatically, retain exact +local-only evidence, and leave the ordinary direct Rust beta requirements above unchanged for every other workflow. An explicitly selected persisted-profile diagnostic soak is a separate @@ -97,7 +154,7 @@ outside the workspace output root under the core policy exception, provided all of the following remain true: - profile paths come only from ignored local input or explicit runtime - arguments and never enter tracked files or retained messages; + arguments and never enter tracked files; - hide.me is already active in full-tunnel mode, split tunneling is off, both P2P planes use `BindInterface`, both clients use VPN Guard Block, and the harness fails before launch rather than changing provider settings; @@ -120,7 +177,10 @@ Discoveries from this lane require a separate bounded, reproducible campaign before they support a parity, certification, release, or VPN-safety claim. Never put real media titles or live search terms in tracked harness code, docs, -tests, or retained evidence. +or tests. Retained local-only diagnostic evidence is intentionally unredacted +and may contain exact titles, terms, hashes, addresses, paths, identifiers, and +packet payloads. Never publish, upload, commit, or attach those artifacts to a + public issue or pull request. ## Persisted Rust Soak Workflow From 184718c2f7fd49c42b1583aa12ff7f918758d699 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 18:09:45 +0100 Subject: [PATCH 15/40] docs(policy): separate stable and head protocol authorities --- docs/reference/GUIDE-CROSS-PLATFORM.md | 10 ++-- docs/reference/WORKSPACE-OPERATIONS-POLICY.md | 46 +++++++++++-------- docs/reference/WORKSPACE-REPO-MAP.md | 41 +++++++++++------ 3 files changed, 60 insertions(+), 37 deletions(-) diff --git a/docs/reference/GUIDE-CROSS-PLATFORM.md b/docs/reference/GUIDE-CROSS-PLATFORM.md index 45147e78..03411b99 100644 --- a/docs/reference/GUIDE-CROSS-PLATFORM.md +++ b/docs/reference/GUIDE-CROSS-PLATFORM.md @@ -136,10 +136,12 @@ and eMuleBB peers interoperate normally. The trade-off is that aMule is a different client: you do not get eMuleBB-specific features such as the broadband upload-slot controller or the eMuleBB MFC/Rust REST contracts and integrations. Current upstream aMule has its own REST API and -WebUI; these are not eMuleBB controller compatibility surfaces. In this workspace, -`repos/amule` is the single managed official upstream source, build, and parity -reference. The historical eMuleBB fork is retained only as a secondary Git -remote for provenance. +WebUI; these are not eMuleBB controller compatibility surfaces. In this +workspace, `repos/amule-stable` is the frozen aMule 3.0.1 protocol-parity +authority at commit `02db0d7faecfc377694ff6242bc23346185990ed`. +Diagnostics-only patches must be separate exact revisions recorded with their +pinned base. `repos/amule` follows upstream HEAD for analysis and future +interoperability only and is never a current parity gate. ## Native Cross-Platform Future: emulebb-rust diff --git a/docs/reference/WORKSPACE-OPERATIONS-POLICY.md b/docs/reference/WORKSPACE-OPERATIONS-POLICY.md index 7ba435f8..7cba96fe 100644 --- a/docs/reference/WORKSPACE-OPERATIONS-POLICY.md +++ b/docs/reference/WORKSPACE-OPERATIONS-POLICY.md @@ -17,9 +17,11 @@ runtime work. recorded in both contracts, and non-core repositories are exposed separately rather than implied by paths. Consumers do not reconstruct old names or establish an independent topology authority. -- The canonical MFC worktrees are `emulebb-main`, - `emulebb-community-baseline`, and `emulebb-community-tracing-harness` on +- The active MFC worktrees are `emulebb-main`, the preferred diagnostics oracle, + and `emulebb-community-baseline`, the frozen instrumented stock reference, on topology-defined branches. `repos\emulebb` is their branch-store anchor. + `emulebb-community-tracing-harness` is retired and is not part of active + topology, materialization, build, or parity-gate workflows. - Retired pre-rename `eMule*` paths are historical references only. - Output-root children are `builds`, `logs`, `reports`, `artifacts`, `packages`, `release`, `tmp`, `tools`, `cache`, and `profiles`. @@ -96,15 +98,16 @@ sync configure the shared hook and must not overwrite dirty managed work. ## Managed Repositories - The default `core` profile contains the active Rust product, the MFC seed and - all three diagnostic/release worktrees, their required third-party forks, - workspace support repos, the single aMule reference, the stock eMule 0.72 - reference, and the sole local Rust ED2K server. MFC remains buildable and - shippable for diagnostics and critical fixes; it is not a historical-only - lane. + its two active diagnostic/reference worktrees, their required third-party + forks, workspace support repos, the frozen aMule parity authority, the frozen + stock eMule 0.72a reference, the explicitly named aMule HEAD analysis + checkout, and the sole local Rust ED2K server. MFC remains buildable for + diagnostics and critical fixes; it is not a product-development lane. - Public-presence repositories use an explicit optional profile. Historical - analysis repositories are not workspace profiles and must not be materialized - by setup or synchronization. Normal operations must not pull archived, stale, - paused, frozen, or unrelated product-family repositories. + analysis repositories are not workspace profiles and must not be + materialized by setup or synchronization. The active `amule-head` analysis + checkout is an explicit exception, not an archive. Normal operations must not + pull archived, stale, paused, or unrelated product-family repositories. - `stale/*` branches are Git provenance only. Inspect one only when a task names the exact historical comparison; do not create a persistent workspace clone or worktree for it. @@ -134,14 +137,21 @@ sync configure the shared hook and must not overwrite dirty managed work. stock supports the required workflows, materialization and validation must move to that upstream commit and the eMuleBB fork must stop acting as the local implementation authority. -- Official `amule-org/amule` under `repos\amule` is the single managed moving - interoperability and offline-fixture reference. Sync may fast-forward only a - clean `master`; parity evidence records the tested commit. The archival - `emulebb/amule` fork may remain a secondary remote, not a second checkout, - product worktree, or release gate. -- Stock eMule 0.72 under `repos\emule-stock` is the single clean moving stock - compatibility reference. Instrumented eMuleBB MFC branches remain in the - canonical app seed and worktrees; they do not replace the clean stock oracle. +- Official aMule 3.0.1 under `repos\amule-stable` is the frozen parity authority, + pinned to commit `02db0d7faecfc377694ff6242bc23346185990ed`. Diagnostics-only + patches are permitted only as separately recorded exact revisions; evidence + must identify both the 3.0.1 base and the exact instrumented revision. Such + patches must not change protocol behavior or silently replace the frozen + authority. +- Official `amule-org/amule` under `repos\amule` tracks upstream `master` for + analysis and future-interoperability work. Sync may fast-forward only a clean + branch. This moving checkout is never an authority or gate for current parity + claims. The archival `emulebb/amule` fork may remain a secondary remote for + provenance, not a product or release authority. +- Stock eMule v0.72a under `repos\emule-stock` is the frozen clean stock source + authority. `emulebb-community-baseline` is its frozen instrumented MFC + counterpart; diagnostics may differ, but protocol behavior must remain tied + to the recorded stock revision. - Shared tests are extended in `emulebb-build-tests` rather than forked into parallel per-client suites. diff --git a/docs/reference/WORKSPACE-REPO-MAP.md b/docs/reference/WORKSPACE-REPO-MAP.md index bed16168..7f5c3cdd 100644 --- a/docs/reference/WORKSPACE-REPO-MAP.md +++ b/docs/reference/WORKSPACE-REPO-MAP.md @@ -16,10 +16,12 @@ sources are not materialized as workspace repositories. | Path | Branch | Role | Validation | |---|---|---|---| | `repos/emulebb` | `main` seed | Canonical app branch-store clone. | `validate` | -| `workspaces/workspace/app/emulebb-main` | `main` | Maintained MFC app worktree for diagnostics and critical fixes. | `build app --variant main` | +| `workspaces/workspace/app/emulebb-main` | `main` | Preferred MFC diagnostics oracle for Rust protocol-parity work. | `build app --variant main` | | `repos/emulebb-rust` | `main` | eMuleBB Rust active beta eD2K/Kad client and embedded SPA WebUI. | Cargo checks via workspace policy | -| `workspaces/workspace/app/emulebb-community-baseline` | `baseline/community-0.72a` | Community baseline worktree. | compare/live-diff | -| `workspaces/workspace/app/emulebb-community-tracing-harness` | `tracing-harness/community-0.72a` | Tracing baseline worktree. | harness tests | +| `workspaces/workspace/app/emulebb-community-baseline` | `baseline/community-0.72a` | Frozen instrumented stock eMule v0.72a reference. | compare/live-diff | + +`workspaces/workspace/app/emulebb-community-tracing-harness` is retired. It is +not an active topology entry, build target, or parity authority. ## Project Focus Map @@ -42,10 +44,15 @@ Use these operator terms exactly in protocol audits and source comparisons. Every path is relative to `EMULEBB_WORKSPACE_ROOT`; the Lugdunum evidence is a read-only sibling outside the canonical workspace source boundary. -- `aMule` means `repos/amule`, the managed `amule-org/amule` upstream - reference. -- `stock eMule` means `repos/emule-stock`, the community eMule 0.72 stock - reference. +- `aMule stable` means `repos/amule-stable`, the frozen aMule 3.0.1 parity + authority pinned to commit `02db0d7faecfc377694ff6242bc23346185990ed`. + Diagnostics-only patches are valid only as separately recorded exact + revisions and must retain that pinned base. +- `aMule HEAD` means `repos/amule`, the moving `amule-org/amule` upstream HEAD + checkout used only for analysis and future-interoperability work. It is never + a current parity gate. +- `stock eMule` means `repos/emule-stock`, the frozen community eMule v0.72a + stock source authority. - `eD2K Rust server` means `repos/ed2k-server`, the managed upstream-aligned fork and sole local deterministic server. - `Lugdunum decompiled` means @@ -53,11 +60,14 @@ read-only sibling outside the canonical workspace source boundary. decompiled Lugdunum 17.15 protocol evidence with no Git synchronization contract. -For any current-state comparison, refresh the relevant Git remote refs first. -Only fast-forward a clean tracking branch; stop and report rewritten or -divergent history instead of resetting, rebasing, or merging it implicitly. -Keep `repos/amule` current with `origin/master`; keep `repos/ed2k-server` -current with `origin/master` and review `upstream/master` before merging it. +For moving-source analysis, refresh the relevant Git remote refs first. Only +fast-forward a clean tracking branch; stop and report rewritten or divergent +history instead of resetting, rebasing, or merging it implicitly. Keep +`repos/amule` current with `origin/master` without using it as a parity gate. +Do not move the pinned `repos/amule-stable` or `repos/emule-stock` authorities. +Keep `repos/ed2k-server` current with upstream and preserve the intent that its +code remain upstream-clean; harness and CI/CD adaptation belongs outside that +repository. ## Workspace Orchestration @@ -74,9 +84,10 @@ products require explicit work and are not materialized by the core profile. | Path | Branch | Role | Validation | |---|---|---|---| -| `repos/ed2k-server` | `master` | Sole local deterministic ED2K server and upstream-aligned Rust reference fork. | workspace build, harness, and quality checks | -| `repos/amule` | `master` | Managed official aMule upstream and moving parity reference. | clean fast-forward sync; record tested SHA in parity evidence | -| `repos/emule-stock` | `v0.72a` | Clean stock eMule compatibility oracle. | clean fast-forward sync; source/parity comparison | +| `repos/ed2k-server` | `master` | Upstream-clean deterministic ED2K server for CI/CD and tests only. | build, harness, quality | +| `repos/amule-stable` | pinned aMule 3.0.1 | Frozen parity authority; diagnostics revisions are recorded exactly. | verify pin and evidence | +| `repos/amule` | `master` | Moving official upstream HEAD for analysis and future interoperability only; never a current parity gate. | clean fast-forward sync; analysis only | +| `repos/emule-stock` | `v0.72a` | Frozen clean stock eMule source authority. | verify pinned revision; source/parity comparison | Historical documentation does not make retired product-family checkouts part of normal materialization or validation. From 68a9167000b6eee1ce486c683fa33ff1d8accd7f Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 18:21:59 +0100 Subject: [PATCH 16/40] refactor(policy): drop the retired tracing worktree --- ci/check-workspace-policy.py | 5 ----- ci/policy_guards.py | 2 +- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/ci/check-workspace-policy.py b/ci/check-workspace-policy.py index ae5fb6f6..a88b5198 100644 --- a/ci/check-workspace-policy.py +++ b/ci/check-workspace-policy.py @@ -509,7 +509,6 @@ def audit_project_entrypoints(root: Path) -> None: for variant in ( r"workspaces\workspace\app\emulebb-main", r"workspaces\workspace\app\emulebb-community-baseline", - r"workspaces\workspace\app\emulebb-community-tracing-harness", ): app_root = resolve_workspace_path(root, variant) assert_path_missing(app_root / r"srchybrid\emule.sln") @@ -645,7 +644,6 @@ def audit_powershell_boundary(root: Path) -> None: resolve_workspace_path(root, r"repos\emulebb"), resolve_workspace_path(root, r"workspaces\workspace\app\emulebb-main"), resolve_workspace_path(root, r"workspaces\workspace\app\emulebb-community-baseline"), - resolve_workspace_path(root, r"workspaces\workspace\app\emulebb-community-tracing-harness"), ) issues: list[str] = [] for repo_root in scan_roots: @@ -706,7 +704,6 @@ def audit_editorconfig_policy(root: Path) -> None: ("tests", resolve_workspace_path(root, r"repos\emulebb-build-tests")), ("app-main", resolve_workspace_path(root, r"workspaces\workspace\app\emulebb-main")), ("app-community", resolve_workspace_path(root, r"workspaces\workspace\app\emulebb-community-baseline")), - ("app-tracing-harness", resolve_workspace_path(root, r"workspaces\workspace\app\emulebb-community-tracing-harness")), ): if not repo_root.is_dir(): raise RuntimeError(f"Editorconfig audit root is missing: {repo_root}") @@ -749,7 +746,6 @@ def collect_doc_path_issues(root: Path) -> list[str]: (resolve_workspace_path(root, r"repos\emulebb-build-tests"), ("README.md", "AGENTS.md")), (resolve_workspace_path(root, r"workspaces\workspace\app\emulebb-main"), ("README.md", "AGENTS.md")), (resolve_workspace_path(root, r"workspaces\workspace\app\emulebb-community-baseline"), ("AGENTS.md",)), - (resolve_workspace_path(root, r"workspaces\workspace\app\emulebb-community-tracing-harness"), ("AGENTS.md",)), ) absolute_path_re = re.compile(r"\b[a-z]:\\", re.IGNORECASE) for repo_root, patterns in scan_scopes: @@ -907,7 +903,6 @@ def audit_doc_paths(root: Path) -> None: (resolve_workspace_path(root, r"repos\emulebb-build-tests"), "AGENTS.md"), (resolve_workspace_path(root, r"workspaces\workspace\app\emulebb-main"), "AGENTS.md"), (resolve_workspace_path(root, r"workspaces\workspace\app\emulebb-community-baseline"), "AGENTS.md"), - (resolve_workspace_path(root, r"workspaces\workspace\app\emulebb-community-tracing-harness"), "AGENTS.md"), ) for repo_root, relative_path in agent_files: assert_text_contains(issues, repo_root, relative_path, policy_text, "AGENTS.md must point to the central workspace policy.") diff --git a/ci/policy_guards.py b/ci/policy_guards.py index 896e3ff9..50073fcf 100644 --- a/ci/policy_guards.py +++ b/ci/policy_guards.py @@ -48,6 +48,7 @@ def __init__(self, issues: tuple[str, ...]) -> None: WORKSPACE_CLEAN_REPO_PATHS = ( "repos/emulebb", "repos/amule", + "repos/amule-stable", "repos/emulebb-build", "repos/emulebb-build-tests", "repos/ed2k-server", @@ -62,7 +63,6 @@ def __init__(self, issues: tuple[str, ...]) -> None: "repos/third_party/emulebb-zlib", "workspaces/workspace/app/emulebb-main", "workspaces/workspace/app/emulebb-community-baseline", - "workspaces/workspace/app/emulebb-community-tracing-harness", ) From 4f27e75308f8a72c62e3976413073ad3947008b0 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 18:22:39 +0100 Subject: [PATCH 17/40] docs(rust): checkpoint parity harness consolidation --- .../emulebb-rust/active/items/RUST-CI-031.md | 60 +++++++++++++++---- 1 file changed, 50 insertions(+), 10 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 53370fad..5590f21d 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1858,22 +1858,62 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. divergence was recorded. This remains an in-progress action-lane proof, not a whole-protocol parity claim. +## Consolidation Checkpoint - 2026-11-01 + +- `emulebb-build-tests` now owns one strict protocol-parity catalog with 97 + coverage IDs in 15 groups, seven campaign selections, five verdicts, exact + provenance requirements, and explicit asset classifications. The old + protocol-golden naming and MFC `harness` client alias are gone; there is no + compatibility reader. +- The current generated report is intentionally `0/15` covered with all 15 + groups `evidence-incomplete`. This is the truthful starting point until + current receipts are registered; zero recorded divergences is not presented + as progress. +- aMule parity now resolves only the frozen 3.0.1 checkout at + `02db0d7faecfc377694ff6242bc23346185990ed`. Moving aMule HEAD at + `59425b0c7d9f0e661dd57e7c42b5e92069cf0774` is a separately named + analysis-only checkout and cannot supply the executable parity runtime. +- Active topology now contains only the `main` MFC diagnostics oracle and the + frozen `community` instrumented-stock worktree. The clean tracing worktree at + `a4fb0564018e49043c266baaaa04b062e343abdb` was removed after its consumers + migrated; its local and remote Git branch remain available as history. +- Controlled smoke, local live resolution, and VM payload staging now rebuild + and select `main` explicitly as `mfc-oracle`. Old tracing executable names, + folders, window-title support, and command aliases are removed. +- Green evidence for this checkpoint is 2,816 Python harness tests with one + platform skip and one deselection, plus 464 orchestration tests after + excluding the two known unrelated baseline-red modules. Focused policy, + entrypoint, PowerShell-boundary, normalization, docs-structure, and strict + MkDocs checks pass. Full workspace validation reaches the pre-existing + `docs/active/INDEX.md` non-done-count metadata failure after all topology + checks pass. + +Representative granular commits are `89e771d`, `ba19118`, `73d2a43`, +`cfc9f98`, and `db3145b` in `emulebb-build-tests`; `bcaf9f3` and `b865ee0` in +`emulebb-build`; `0fa207d`, `184718c`, and `68a9167` in `emulebb-tooling`; and +`03da20c9` in the MFC oracle branch. All are on the single +`feature/persisted-soak-parity-analysis` workstream branch and pushed without a +pull request. + ## Next Implementation -- Treat the running persisted soak as discovery only. Its current gate remains - pending until causally attributed actions complete; a zero-action run makes no - parity statement. -- Build the catalog from the existing golden manifest, deterministic lifecycle - evidence, native Rust tests, and live-suite inventory before adding another - runner. -- Produce the classification and proposed removal/migration list before deleting - historical tests or changing workspace topology. +- Reconcile `ed2k-server` to upstream-clean code behavior. Inventory its current + divergence (38 commits ahead of and four behind `upstream/master`), retain + only CI/CD wiring outside server protocol code, and move required + deterministic adaptation into the harness before changing the managed server + authority. - Consolidate the first complete vertical campaign around server session, search, source discovery, and source lifecycle because that area already has - the strongest deterministic and cross-client evidence. + the strongest deterministic and cross-client evidence. Register exact + current source, binary, profile, runner, and artifact receipts before any + group can become green. - Continue domain by domain through peer transfer/queue/callback, client UDP, and Kad. Promote every reproducible soak finding into the lowest applicable - deterministic layer. + deterministic layer and delete the two cataloged duplicate/historical runner + candidates only after their remaining useful coverage is mapped. +- Treat the persisted public soak as discovery only. Its gate remains pending + until causally attributed actions complete; a zero-action run makes no parity + statement. - Preserve the persisted MFC and Rust profile/hash state while this consolidation proceeds. Harness restructuring does not authorize profile reset, reimport, or rehash. From d583061f797535d0beb58b6f63731611496642a0 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 18:35:31 +0100 Subject: [PATCH 18/40] docs(rust): record upstream server gate --- .../emulebb-rust/active/items/RUST-CI-031.md | 49 ++++++++++++++----- 1 file changed, 36 insertions(+), 13 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 5590f21d..bd2e500a 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1887,26 +1887,49 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. MkDocs checks pass. Full workspace validation reaches the pre-existing `docs/active/INDEX.md` non-done-count metadata failure after all topology checks pass. +- The managed `ed2k-server` is now synchronized with upstream 0.9.87 at + `3742f9e4bc64e36faf4b8ed4cb355be3744ff96c`. Runtime source, configuration, + and tests match upstream; the fork retains only repository policy, CI, and + artifact-packaging ownership. CI fetches that exact upstream commit and + rejects future upstream-owned path drift. The canonical Release build passed + with zero warnings. +- A harness-owned wire client and bounded server-dependency campaign now prove + stock local LowID login, file publication, exact-hash and keyword search, + plain and obfuscated source replies, publisher disconnect, and indexed-file + and source withdrawal. The committed live receipt at + `reports/ed2k-server-state-campaign/20261101T173415Z/report.json` passed with + runner `123246ad4a24ee9c676cf27643e7ac9467155202`, server fork + `66b892d215821d499dd9c351f14e234ae309d2f1`, upstream `3742f9e4`, and staged + binary SHA-256 + `ffb5655198a882156627e0ff6d5d5a3a94ce02a423023f3b94f0bd8c00569886`. + Reports retain every reached state, check, and frame on failure as well as on + success. This external receipt is local infrastructure evidence and is not + committed or registered as Rust parity evidence. +- The catalog classifies the new server campaign as a support gate and the old + fork-dependent `local-ed2k-search-soak.py` as historical. The canonical Rust + product vertical remains `deterministic-two-client-transfer.py`. Coverage is + still truthfully 0/15 with all groups `evidence-incomplete`. Representative granular commits are `89e771d`, `ba19118`, `73d2a43`, -`cfc9f98`, and `db3145b` in `emulebb-build-tests`; `bcaf9f3` and `b865ee0` in -`emulebb-build`; `0fa207d`, `184718c`, and `68a9167` in `emulebb-tooling`; and -`03da20c9` in the MFC oracle branch. All are on the single +`cfc9f98`, `db3145b`, `fe30438`, `565bf60`, `123246a`, and `dbaa27b` in +`emulebb-build-tests`; `bcaf9f3` and `b865ee0` in `emulebb-build`; `0fa207d`, +`184718c`, and `68a9167` in `emulebb-tooling`; `da1c873` and `66b892d` in +`ed2k-server`; and `03da20c9` in the MFC oracle branch. All are on the single `feature/persisted-soak-parity-analysis` workstream branch and pushed without a pull request. ## Next Implementation -- Reconcile `ed2k-server` to upstream-clean code behavior. Inventory its current - divergence (38 commits ahead of and four behind `upstream/master`), retain - only CI/CD wiring outside server protocol code, and move required - deterministic adaptation into the harness before changing the managed server - authority. -- Consolidate the first complete vertical campaign around server session, - search, source discovery, and source lifecycle because that area already has - the strongest deterministic and cross-client evidence. Register exact - current source, binary, profile, runner, and artifact receipts before any - group can become green. +- Remove the canonical Rust product campaign's remaining dependencies on the + retired server `/api/files/:hash` probe and old `highid_verify_*` fields. Use + harness-owned wire observations and the current `highid_observe_*` contract; + do not add a compatibility reader or restore fork-only server APIs. +- Complete the first Rust product vertical around server session, search, + source discovery, source lifecycle, and a local Rust-versus-MFC transfer. + Keep deterministic server protocol evidence separate from direct peer + transfer evidence so local LowID server behavior does not require a fabricated + private HighID. Register exact current source, binary, profile, runner, and + artifact receipts before either server coverage group can become green. - Continue domain by domain through peer transfer/queue/callback, client UDP, and Kad. Promote every reproducible soak finding into the lowest applicable deterministic layer and delete the two cataloged duplicate/historical runner From 596817db0be1e15e8d1a9348c0d2482520cc7081 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 18:41:00 +0100 Subject: [PATCH 19/40] docs(rust): record server gate validation --- docs/products/emulebb-rust/active/items/RUST-CI-031.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index bd2e500a..ee694a76 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1909,9 +1909,17 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. fork-dependent `local-ed2k-search-soak.py` as historical. The canonical Rust product vertical remains `deterministic-two-client-transfer.py`. Coverage is still truthfully 0/15 with all groups `evidence-incomplete`. +- Final validation for this slice is 2,824 passing harness tests with one + platform skip and one deliberate deselection; 626 upstream server unit tests + and 29 integration tests; the upstream-owned path audit; the canonical + zero-warning Release build; the committed live server-state campaign; catalog + validation; changed-file lint; and documentation structure and active-item + checks. Repository-wide Ruff remains a known non-gate with 166 unrelated + pre-existing findings; every file changed by this slice passes Ruff. Representative granular commits are `89e771d`, `ba19118`, `73d2a43`, -`cfc9f98`, `db3145b`, `fe30438`, `565bf60`, `123246a`, and `dbaa27b` in +`cfc9f98`, `db3145b`, `fe30438`, `565bf60`, `123246a`, `dbaa27b`, and +`8e8b663` in `emulebb-build-tests`; `bcaf9f3` and `b865ee0` in `emulebb-build`; `0fa207d`, `184718c`, and `68a9167` in `emulebb-tooling`; `da1c873` and `66b892d` in `ed2k-server`; and `03da20c9` in the MFC oracle branch. All are on the single From 2c3f561f0232b441cf7e1457905a4b21cae5cf89 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 19:13:43 +0100 Subject: [PATCH 20/40] docs(rust): record canonical Rust-MFC transfer proof --- .../emulebb-rust/active/items/RUST-CI-031.md | 51 ++++++++++++++----- 1 file changed, 39 insertions(+), 12 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index ee694a76..672e33d9 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1907,8 +1907,10 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. committed or registered as Rust parity evidence. - The catalog classifies the new server campaign as a support gate and the old fork-dependent `local-ed2k-search-soak.py` as historical. The canonical Rust - product vertical remains `deterministic-two-client-transfer.py`. Coverage is - still truthfully 0/15 with all groups `evidence-incomplete`. + product vertical is `deterministic-two-client-transfer.py`; it now runs Rust + as the product-under-test downloader and MFC as the diagnostics-oracle + publisher. Coverage remains truthfully 0/15 until the current receipts gain + the required hash-correlated diagnostics and are registered in the catalog. - Final validation for this slice is 2,824 passing harness tests with one platform skip and one deliberate deselection; 626 upstream server unit tests and 29 integration tests; the upstream-owned path audit; the canonical @@ -1916,6 +1918,27 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. validation; changed-file lint; and documentation structure and active-item checks. Repository-wide Ruff remains a known non-gate with 166 unrelated pre-existing findings; every file changed by this slice passes Ruff. +- Build-tests commits `2944027`, `9093718`, `f75e48b`, and `0dcb69f` remove + legacy executable fallback, model local LowID source references from the + wire, assign the canonical Rust/MFC roles, and record both source revisions. + The committed live receipt at + `reports/deterministic-two-client-transfer/latest/deterministic-two-client-transfer-result.json` + passed a 10 MiB Rust download from MFC in about ten seconds. It records the + exact eD2K hash `684b18845d856fd43f44e0493d2fdc3f`, completed byte count, + SHA-256 verification, LowID wire source reference, direct peer endpoint, and + cleanup outcome. +- That receipt pins Rust revision + `ebae9ae1f65fd45f70ca7ea6046a1239c97c7ab7` with executable SHA-256 + `853aa5622ba8d92b32b938a76b9ebcea3eee83f0921049173c0dbd19861d8293`, + MFC revision `03da20c9cd339da2e6f1287e908e577ac1386e81` with executable SHA-256 + `6645d3270c30aa7fc1cf92edef3512970cb831bfd0f116ff50b7b885c2b6283a`, + and runner revision `0dcb69f7512c5d6ba0efb681e41e5fdfa814b574`. + Canonical Release build receipts are + `20261101T180402Z-build-clients/build-result.json` for Rust and + `20261101T174427Z-build-app/build-result.json` for MFC. +- Final build-tests validation on the committed runner is 2,837 passing tests, + one POSIX-only skip, and one deliberate deselection. The focused changed + files also pass Ruff and `git diff --check`. Representative granular commits are `89e771d`, `ba19118`, `73d2a43`, `cfc9f98`, `db3145b`, `fe30438`, `565bf60`, `123246a`, `dbaa27b`, and @@ -1928,16 +1951,20 @@ pull request. ## Next Implementation -- Remove the canonical Rust product campaign's remaining dependencies on the - retired server `/api/files/:hash` probe and old `highid_verify_*` fields. Use - harness-owned wire observations and the current `highid_observe_*` contract; - do not add a compatibility reader or restore fork-only server APIs. -- Complete the first Rust product vertical around server session, search, - source discovery, source lifecycle, and a local Rust-versus-MFC transfer. - Keep deterministic server protocol evidence separate from direct peer - transfer evidence so local LowID server behavior does not require a fabricated - private HighID. Register exact current source, binary, profile, runner, and - artifact receipts before either server coverage group can become green. +- Make converged Rust and MFC diagnostics mandatory evidence for the canonical + transfer vertical. Correlate MFC publication, exact wire hash/source + observation, Rust source acceptance and request state, MFC upload state, and + Rust completion by the same file hash. A completed file without that causal + chain remains infrastructure proof, not protocol-parity evidence. +- Reuse the canonical runner from the protocol matrix instead of retaining + separate orchestration in older local combinations and bidirectional + cross-client scripts. Map their unique cases first, then isolate or remove + duplicate and historical paths without a compatibility layer. +- Register exact current source, binary, profile, runner, diagnostics, wire, + and artifact receipts before the affected server or peer-transfer coverage + groups become green. Keep deterministic server protocol evidence separate + from direct peer transfer evidence so local LowID server behavior does not + require a fabricated private HighID. - Continue domain by domain through peer transfer/queue/callback, client UDP, and Kad. Promote every reproducible soak finding into the lowest applicable deterministic layer and delete the two cataloged duplicate/historical runner From 79e97f86d5444b3c45f7eb22627b5ba77757869b Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 19:34:45 +0100 Subject: [PATCH 21/40] docs(rust): record causal transfer evidence --- .../emulebb-rust/active/items/RUST-CI-031.md | 53 +++++++++++++++---- 1 file changed, 43 insertions(+), 10 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 672e33d9..6defa103 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1939,23 +1939,56 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. - Final build-tests validation on the committed runner is 2,837 passing tests, one POSIX-only skip, and one deliberate deselection. The focused changed files also pass Ruff and `git diff --check`. +- The canonical Rust-from-MFC transfer now requires diagnostics builds for both + clients and passed the causal evidence gate at + `reports/deterministic-two-client-transfer/latest/deterministic-two-client-transfer-result.json`. + The 10 MiB fixture completed in about 13 seconds with eD2K hash + `684b18845d856fd43f44e0493d2fdc3f`: all 30 Rust-to-MFC + `OP_REQUESTPARTS` frames and all 1,024 MFC-to-Rust `OP_SENDINGPART` frames + matched exactly, with no unmatched decisive frames. +- The same receipt correlates Rust source engagement, 58 positive payload + acceptances, and manifest-backed `download_task_settled=completed` with MFC + exact-hash publication, upload-slot opening, 58 admitted requests, and nine + positive upload-accounting events. `download_attempt_outcome` is not an + authority because the successful direct-completion path returns before that + event; completed task state, exact wire frames, and final byte/hash + verification form the truthful chain. +- That diagnostics-gated receipt pins runner revision + `2ab3e0b3104ad3cc66a18a3c4b2bf2a60b8ee721`, Rust revision + `4def7119f32e0230d3cc0f09f6117825b1a65d46` and executable SHA-256 + `6c2ba174164af085695e6dc68fb038142ad6f8324d58aa113f65c6de0f23f8d3`, + and MFC revision `1c99b8f9cd7d4d701a104514882e6c1557e5eee1` and executable SHA-256 + `637457534644390e72b9d5f020a369283c12a3fdb91028b1ac431978cc551778`. + Canonical diagnostics build receipts are + `20261101T182436Z-build-clients/build-result.json` for Rust and + `20261101T182834Z-build-app/build-result.json` for MFC. +- Strict post-shutdown loading exposed an MFC writer-health defect rather than + a harness timing exception. MFC now explicitly finalizes diagnostic writer + health during application shutdown; the loader remains strict. Raw, + unredacted diagnostic segments remain in the timestamped run artifacts while + the receipt stores compact causal summaries. +- Final validation for the diagnostics-gated vertical is 2,849 passing harness + tests, one POSIX-only skip, and one deliberate deselection in 215.53 seconds. + The 193 focused tests pass with one skip, and all changed Python files pass + Ruff and `git diff --check`. Representative granular commits are `89e771d`, `ba19118`, `73d2a43`, -`cfc9f98`, `db3145b`, `fe30438`, `565bf60`, `123246a`, `dbaa27b`, and -`8e8b663` in +`cfc9f98`, `db3145b`, `fe30438`, `565bf60`, `123246a`, `dbaa27b`, +`8e8b663`, `7f384b1`, `7f0b748`, `80ec675`, `36f2f60`, `db77fcd`, and +`2ab3e0b` in `emulebb-build-tests`; `bcaf9f3` and `b865ee0` in `emulebb-build`; `0fa207d`, `184718c`, and `68a9167` in `emulebb-tooling`; `da1c873` and `66b892d` in -`ed2k-server`; and `03da20c9` in the MFC oracle branch. All are on the single -`feature/persisted-soak-parity-analysis` workstream branch and pushed without a -pull request. +`ed2k-server`; and `03da20c9` plus `1c99b8f9` in the MFC oracle branch. All are +on the single `feature/persisted-soak-parity-analysis` workstream branch and +pushed without a pull request. ## Next Implementation -- Make converged Rust and MFC diagnostics mandatory evidence for the canonical - transfer vertical. Correlate MFC publication, exact wire hash/source - observation, Rust source acceptance and request state, MFC upload state, and - Rust completion by the same file hash. A completed file without that causal - chain remains infrastructure proof, not protocol-parity evidence. +- Register the diagnostics-gated canonical transfer receipt in the parity + catalog and generated coverage report with exact runner, source, executable, + diagnostics, wire, and artifact provenance. Only then may the affected + peer-transfer coverage IDs become green; the successful standalone receipt + does not update coverage implicitly. - Reuse the canonical runner from the protocol matrix instead of retaining separate orchestration in older local combinations and bidirectional cross-client scripts. Map their unique cases first, then isolate or remove From ef7c52a3b3fd939f4751a3b675695ff455fff67d Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 19:42:57 +0100 Subject: [PATCH 22/40] docs(rust): record per-ID parity coverage --- .../emulebb-rust/active/items/RUST-CI-031.md | 38 +++++++++++++++---- 1 file changed, 31 insertions(+), 7 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 6defa103..166dcf80 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -1971,11 +1971,40 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. tests, one POSIX-only skip, and one deliberate deselection in 215.53 seconds. The 193 focused tests pass with one skip, and all changed Python files pass Ruff and `git diff --check`. +- Catalog evidence is now owned per coverage ID, not per group. The obsolete + group-wide `latestEvidence` shape was removed without a compatibility reader; + a group becomes green only when every owned ID has decisive evidence. Missing + IDs are derived as `evidence-incomplete` instead of requiring 95 placeholder + records. +- The canonical transfer diagnostics now emit eligible coverage claims from + the decisive matched frames. The successful uncompressed run claims only + `queue.admission` and `transfer.block.uncompressed`; it does not claim + compression-error handling, rank transitions, slot promotion/recycle, abuse + escalation, framing, startup profiles, or any other coincidental traffic. +- A persisted registration tool rejects mutable `latest` aliases, report or + delivered-file hash drift, unmatched frames, malformed subject provenance, + and coverage overclaims before producing catalog rows. Catalog validation + also requires every receipt claim to be registered exactly once with the + same evidence layers and canonical runner. +- The registered immutable receipt is + `output-root:reports/deterministic-two-client-transfer/20261101T183823Z-emulebb-main-release-15004/deterministic-two-client-transfer-result.json` + with SHA-256 + `4d26bd2319ec9eafaee3d84c2800e609a1f6765a2fc05b0139ac9ee5db8ab91a`. + It pins runner `4417566425047daaf8968adfae6db9eded056f97`, the same Rust and + MFC revisions and executable hashes above, 30 exact request-frame matches, + 1,024 exact uncompressed payload-frame matches, 58 MFC admissions, and final + delivered-file hash equality. +- The generated catalog report now truthfully shows 2/97 coverage IDs and + 0/15 complete groups. `queue-upload-state` is 1/5 and `transfer-blocks` is + 1/4; every other group remains 0 covered. Full harness validation is 2,856 + passing tests, one POSIX-only skip, and one deliberate deselection in 132.95 + seconds. Focused registration, catalog, transfer-gate, inventory, and runner + tests pass, as do Ruff and `git diff --check`. Representative granular commits are `89e771d`, `ba19118`, `73d2a43`, `cfc9f98`, `db3145b`, `fe30438`, `565bf60`, `123246a`, `dbaa27b`, -`8e8b663`, `7f384b1`, `7f0b748`, `80ec675`, `36f2f60`, `db77fcd`, and -`2ab3e0b` in +`8e8b663`, `7f384b1`, `7f0b748`, `80ec675`, `36f2f60`, `db77fcd`, +`2ab3e0b`, `8df3921`, `4417566`, `2420da3`, and `55bd85e` in `emulebb-build-tests`; `bcaf9f3` and `b865ee0` in `emulebb-build`; `0fa207d`, `184718c`, and `68a9167` in `emulebb-tooling`; `da1c873` and `66b892d` in `ed2k-server`; and `03da20c9` plus `1c99b8f9` in the MFC oracle branch. All are @@ -1984,11 +2013,6 @@ pushed without a pull request. ## Next Implementation -- Register the diagnostics-gated canonical transfer receipt in the parity - catalog and generated coverage report with exact runner, source, executable, - diagnostics, wire, and artifact provenance. Only then may the affected - peer-transfer coverage IDs become green; the successful standalone receipt - does not update coverage implicitly. - Reuse the canonical runner from the protocol matrix instead of retaining separate orchestration in older local combinations and bidirectional cross-client scripts. Map their unique cases first, then isolate or remove From f920f2599b60a7ea1d1cada8c450920a7d70ce5a Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 20:05:33 +0100 Subject: [PATCH 23/40] docs(rust): record canonical transport matrix --- .../emulebb-rust/active/items/RUST-CI-031.md | 56 +++++++++++++++++-- 1 file changed, 52 insertions(+), 4 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 166dcf80..d64dcc4e 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -2001,6 +2001,49 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. seconds. Focused registration, catalog, transfer-gate, inventory, and runner tests pass, as do Ruff and `git diff --check`. +## Canonical Transport Matrix Checkpoint - 2026-11-01 + +- The canonical Rust-downloader/MFC-publisher vertical now owns four explicit + transport cases: plain server plus plain clients, obfuscation preferred, + obfuscation required, and obfuscation required with a compressible fixture. + Case intent configures both clients, the server, and the fixture, but never + substitutes for observed evidence. +- The transfer gate requires exact bilateral request and payload frames to + report the expected peer transport mode and obfuscation state. It also + requires the expected compressed or uncompressed payload opcode family. + Server transport, crypt startup, preferred-mode fallback, and client UDP are + not claimed by these cases. +- The first preferred-mode attempt correctly failed because the direct source + carried only an endpoint, so Rust could not derive the MFC crypt identity and + negotiated plaintext. A server-search experiment then proved that two local + LowID clients cannot obtain a routable source from the stock local server. + The canonical direct source now carries the exact MFC profile user hash and + the case-derived crypt capability bits; no private HighID is fabricated. +- Four immutable runs on runner `03a21bbebaece261061f8f309e625a9a2e461ad4` + passed with the same diagnostics Rust and MFC builds used by the first + registered transfer receipt: + `20261101T185845Z-emulebb-main-release-6756` proved preferred obfuscation, + `20261101T185904Z-emulebb-main-release-5464` proved bilateral plaintext, + `20261101T185917Z-emulebb-main-release-16176` proved required obfuscation, + and `20261101T185931Z-emulebb-main-release-14948` proved required + obfuscation plus 58 exact paired `OP_COMPRESSEDPART` payload frames. +- The compressed receipt SHA-256 is + `118caf7127d9a85d26fb628eaced1ed7ae200ce813f0b7c478f2943d6605cfab`. + It is registered for `transfer.block.compressed` and also supplies a second + independent `queue.admission` receipt. Catalog validation now reports 3/97 + coverage IDs and 0/15 complete groups; `transfer-blocks` is 2/4 and + `queue-upload-state` remains 1/5. +- The former MFC and Rust protocol-combination scripts are historical donors, + not parity authorities. Their transport claims are superseded by the + diagnostics-gated canonical runner. The Rust donor remains temporarily only + for unique metadata, hashset/AICH, recovery, connection-reuse, and + multi-transfer states that still need migration. +- Granular build-tests commits for this checkpoint are `aa748a6`, `023b7cb`, + `bbbf25e`, `7f8f569`, `20f26ee`, `5b42c89`, `03a21bb`, `bf07037`, and + `5423d9c`. Final validation is 2,862 passing harness tests, one POSIX-only + skip, and one deliberate deselection in 123.41 seconds; catalog validation, + focused Ruff, and `git diff --check` also pass. + Representative granular commits are `89e771d`, `ba19118`, `73d2a43`, `cfc9f98`, `db3145b`, `fe30438`, `565bf60`, `123246a`, `dbaa27b`, `8e8b663`, `7f384b1`, `7f0b748`, `80ec675`, `36f2f60`, `db77fcd`, @@ -2013,15 +2056,20 @@ pushed without a pull request. ## Next Implementation -- Reuse the canonical runner from the protocol matrix instead of retaining - separate orchestration in older local combinations and bidirectional - cross-client scripts. Map their unique cases first, then isolate or remove - duplicate and historical paths without a compatibility layer. +- Migrate metadata exchange, hash-only lookup, hashset/AICH, connection reuse, + recovery, and multi-transfer states one by one from the historical Rust + protocol-combination donor into diagnostics-gated canonical scenarios. Do + not credit the donor's old transport assertions. +- Delete the old Rust and MFC protocol-combination scripts after every unique + useful state has an authoritative owner. Do not retain wrappers, aliases, or + compatibility readers. - Register exact current source, binary, profile, runner, diagnostics, wire, and artifact receipts before the affected server or peer-transfer coverage groups become green. Keep deterministic server protocol evidence separate from direct peer transfer evidence so local LowID server behavior does not require a fabricated private HighID. +- Do not claim preferred-mode fallback or server obfuscation until a scenario + causally records those exact transitions on both relevant sides. - Continue domain by domain through peer transfer/queue/callback, client UDP, and Kad. Promote every reproducible soak finding into the lowest applicable deterministic layer and delete the two cataloged duplicate/historical runner From dc93e6ab4634a489a8c8b489a499d9c7eb5f4cb6 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 20:20:06 +0100 Subject: [PATCH 24/40] docs(rust): record startup metadata recovery --- .../emulebb-rust/active/items/RUST-CI-031.md | 60 ++++++++++++++++--- 1 file changed, 53 insertions(+), 7 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index d64dcc4e..3a160b6e 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -2044,6 +2044,48 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. skip, and one deliberate deselection in 123.41 seconds; catalog validation, focused Ruff, and `git diff --check` also pass. +## Canonical Startup Metadata Checkpoint - 2026-11-01 + +- The canonical Rust-downloader/MFC-publisher gate now proves exact bilateral + `OP_MULTIPACKET_EXT2` request/answer and `OP_HASHSETREQUEST2`/answer frames, + decodes their nested file identifiers and metadata, and requires exact MD4 + and AICH equality between the wire exchange and the persisted Rust transfer + manifest. These checks own `peer.startup.multipacket-ext2` and + `peer.startup.aich`; they do not imply crypt startup, fallback, SX2, server + obfuscation, or client UDP coverage. +- Standard live run `20261101T190951Z-emulebb-main-release-14504` on runner + `ddbd352` passed with report SHA-256 + `387b4e7f69ed5b9ace9d95aab93a99cb29ac03002811f1fbea3224526f90973f`. + It recorded one exact bilateral metadata request/answer, one exact bilateral + hashset request/answer, and two exact persisted MD4 and AICH parts. +- The catalog now models hash-only metadata recovery explicitly as + `peer.startup.metadata-recovery`, increasing the catalog from 97 to 98 IDs. + Its canonical scenario gives Rust only the file MD4, a zero size, and the + exact MFC source identity; Rust must recover the Unicode name, size, AICH + root, MD4 hashset, and AICH hashset before completing the transfer. +- The first hash-only live run exposed a valid protocol distinction: a client + that does not yet know the AICH root sends an MD4-only metadata identifier. + The gate now permits that request shape while still requiring a full exact + MFC answer and exact persisted AICH data. Corrected run + `20261101T191416Z-emulebb-main-release-10176` on runner `8f480e8` passed with + report SHA-256 + `5fc02b960fcf4503505bf2d7b706484beecbfd3cab9a9dac59461bf71ffbbd38`. + It recovered the exact Unicode name and size and recorded the causal order: + source engaged at event 26, metadata answer at 42, hashset answer at 46, + payload at 70, and settled completion at 1282. +- Catalog validation now reports 6/98 covered IDs and 0/15 complete groups; + `peer-startup-profiles` is 3/11, `queue-upload-state` is 1/5, and + `transfer-blocks` is 2/4. The aggregate MFC and Rust protocol-combination + matrices are historical donors, not evidence authorities. LowID callback + ownership is assigned to the canonical deterministic transfer runner. The + only useful state still awaiting extraction from the old Rust matrix is + server keyword search and its exact reply. +- Granular build-tests commits for this checkpoint are `ddbd352`, `01ff636`, + `d7d742d`, `ee9781a`, `88ce714`, `8f480e8`, `d0b17c8`, `a5ff041`, and + `ef1cfdf`. Final validation is 2,869 passing harness tests, one POSIX-only + skip, and one deliberate deselection in 124.18 seconds. Catalog validation + and `git diff --check` also pass. + Representative granular commits are `89e771d`, `ba19118`, `73d2a43`, `cfc9f98`, `db3145b`, `fe30438`, `565bf60`, `123246a`, `dbaa27b`, `8e8b663`, `7f384b1`, `7f0b748`, `80ec675`, `36f2f60`, `db77fcd`, @@ -2056,13 +2098,17 @@ pushed without a pull request. ## Next Implementation -- Migrate metadata exchange, hash-only lookup, hashset/AICH, connection reuse, - recovery, and multi-transfer states one by one from the historical Rust - protocol-combination donor into diagnostics-gated canonical scenarios. Do - not credit the donor's old transport assertions. -- Delete the old Rust and MFC protocol-combination scripts after every unique - useful state has an authoritative owner. Do not retain wrappers, aliases, or - compatibility readers. +- Extract exact server keyword search and reply into a separate canonical + deterministic transfer scenario. Credit only causally observed search + request/reply evidence and the exact result hash, name, and size. Do not + claim plain or obfuscated server-source coverage unless exact + `GETSOURCES`/`FOUNDSOURCES` frames are also observed. +- Delete the old Rust protocol-combination script, its synthetic tests, and its + campaign invocation after server search has an authoritative owner. Delete + the old MFC aggregate matrix when its historical caller is removed. Do not + retain wrappers, aliases, or compatibility readers. The old donor's three + transfers do not prove connection reuse; that state remains owned by the + existing dedicated cross-client runner. - Register exact current source, binary, profile, runner, diagnostics, wire, and artifact receipts before the affected server or peer-transfer coverage groups become green. Keep deterministic server protocol evidence separate From fb303be90cfbdd47a5f761a95aab8f2a1f80a188 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 20:31:47 +0100 Subject: [PATCH 25/40] docs(rust): record canonical server search --- .../emulebb-rust/active/items/RUST-CI-031.md | 83 +++++++++++++------ 1 file changed, 57 insertions(+), 26 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 3a160b6e..d7f84334 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -2033,11 +2033,10 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. independent `queue.admission` receipt. Catalog validation now reports 3/97 coverage IDs and 0/15 complete groups; `transfer-blocks` is 2/4 and `queue-upload-state` remains 1/5. -- The former MFC and Rust protocol-combination scripts are historical donors, +- The former MFC and Rust protocol-combination scripts were historical donors, not parity authorities. Their transport claims are superseded by the - diagnostics-gated canonical runner. The Rust donor remains temporarily only - for unique metadata, hashset/AICH, recovery, connection-reuse, and - multi-transfer states that still need migration. + diagnostics-gated canonical runner, and both aggregate scripts have now + been deleted after their useful states received explicit owners. - Granular build-tests commits for this checkpoint are `aa748a6`, `023b7cb`, `bbbf25e`, `7f8f569`, `20f26ee`, `5b42c89`, `03a21bb`, `bf07037`, and `5423d9c`. Final validation is 2,862 passing harness tests, one POSIX-only @@ -2078,14 +2077,58 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. `transfer-blocks` is 2/4. The aggregate MFC and Rust protocol-combination matrices are historical donors, not evidence authorities. LowID callback ownership is assigned to the canonical deterministic transfer runner. The - only useful state still awaiting extraction from the old Rust matrix is - server keyword search and its exact reply. + remaining useful server keyword-search state was extracted into its own + canonical scenario before both matrices were deleted. - Granular build-tests commits for this checkpoint are `ddbd352`, `01ff636`, `d7d742d`, `ee9781a`, `88ce714`, `8f480e8`, `d0b17c8`, `a5ff041`, and `ef1cfdf`. Final validation is 2,869 passing harness tests, one POSIX-only skip, and one deliberate deselection in 124.18 seconds. Catalog validation and `git diff --check` also pass. +## Canonical Server Search and Harness Consolidation Checkpoint - 2026-11-01 + +- The catalog now has one canonical deterministic `server-keyword-search` + scenario. It issues exactly one Rust `OP_SEARCHREQUEST`, requires its + successful socket outcome, decodes exactly one matching `OP_SEARCHRESULT`, + verifies the exact REST row and endpoint, and enforces causal ordering. It + owns only `server.search.keyword` and `server.reply.search`; it does not + infer any server-source transport claim. +- The first live attempt, + `20261101T192311Z-emulebb-main-release-6964`, proved that the search and REST + result worked but correctly failed the evidence gate because the following + 132 MiB transfer rotated the early search records out of the retained ring. + This was a harness evidence-lifetime defect, not protocol divergence. +- The corrected runner snapshots compact search evidence before transfer and + uses a 10 MiB fixture for this search case. Immutable run + `20261101T192443Z-emulebb-main-release-14604` passed on runner + `567cefa875f1bad8c10597c005156527b3bee592` with report SHA-256 + `16de57d51e2259118520d379a3fb39ca8af9000411603e9fc509385b3a4d3c42`. + Request sequence 14 and reply sequence 16 matched the exact result name, + 10,485,760-byte size, hash `684b18845d856fd43f44e0493d2fdc3f`, + and endpoint. The run also retained the already-authoritative startup, + queue, and uncompressed-transfer claims. +- The receipt pins Rust revision + `4def7119f32e0230d3cc0f09f6117825b1a65d46` and executable SHA-256 + `6c2ba174164af085695e6dc68fb038142ad6f8324d58aa113f65c6de0f23f8d3`, + plus MFC revision `1c99b8f9cd7d4d701a104514882e6c1557e5eee1` + and executable SHA-256 + `637457534644390e72b9d5f020a369283c12a3fdb91028b1ac431978cc551778`. +- With server search registered, both aggregate protocol-combination runners, + their synthetic tests, and their campaign invocation were deleted. The + competing total-parity audit, its tests, and its release invocation were + also deleted. No wrapper, compatibility reader, or alias remains. The + protocol catalog, canonical receipts, and named campaigns are now the sole + verdict model. +- Catalog validation reports 8/98 covered IDs and 0/15 complete groups; + `server-query-reply` is 2/11. Assets are classified as six canonical, zero + duplicate, two historical, two product-only, and eleven support assets. +- Granular build-tests commits for this checkpoint are `16413ab`, `bc9fecc`, + `22fcd4c`, `08b6376`, `567cefa`, `557c425`, `ed15e0d`, and `fd37930`. + Final validation is 2,854 passing harness tests, one POSIX-only skip, and one + deliberate deselection in 128.06 seconds. The focused release/catalog/ + inventory gate has 48 passing tests; catalog validation, Ruff, rendered + campaign inspection, and `git diff --check` also pass. + Representative granular commits are `89e771d`, `ba19118`, `73d2a43`, `cfc9f98`, `db3145b`, `fe30438`, `565bf60`, `123246a`, `dbaa27b`, `8e8b663`, `7f384b1`, `7f0b748`, `80ec675`, `36f2f60`, `db77fcd`, @@ -2098,28 +2141,16 @@ pushed without a pull request. ## Next Implementation -- Extract exact server keyword search and reply into a separate canonical - deterministic transfer scenario. Credit only causally observed search - request/reply evidence and the exact result hash, name, and size. Do not - claim plain or obfuscated server-source coverage unless exact - `GETSOURCES`/`FOUNDSOURCES` frames are also observed. -- Delete the old Rust protocol-combination script, its synthetic tests, and its - campaign invocation after server search has an authoritative owner. Delete - the old MFC aggregate matrix when its historical caller is removed. Do not - retain wrappers, aliases, or compatibility readers. The old donor's three - transfers do not prove connection reuse; that state remains owned by the - existing dedicated cross-client runner. -- Register exact current source, binary, profile, runner, diagnostics, wire, - and artifact receipts before the affected server or peer-transfer coverage - groups become green. Keep deterministic server protocol evidence separate - from direct peer transfer evidence so local LowID server behavior does not - require a fabricated private HighID. - Do not claim preferred-mode fallback or server obfuscation until a scenario causally records those exact transitions on both relevant sides. -- Continue domain by domain through peer transfer/queue/callback, client UDP, - and Kad. Promote every reproducible soak finding into the lowest applicable - deterministic layer and delete the two cataloged duplicate/historical runner - candidates only after their remaining useful coverage is mapped. +- Continue domain by domain through server session/source replies, + peer-transfer queue/callback states, client UDP, and Kad. Add the smallest + deterministic transcript or local cross-client scenario that can causally + own each transition, then register its immutable receipt before changing a + catalog verdict. +- Consolidate remaining historical MFC test material only after its unique + protocol states have an explicit canonical owner. MFC remains the preferred + diagnostics oracle and receives no product evolution. - Treat the persisted public soak as discovery only. Its gate remains pending until causally attributed actions complete; a zero-action run makes no parity statement. From 5ec73eeecb30bdabb520fa4834e0127b4a1438ee Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 20:44:59 +0100 Subject: [PATCH 26/40] docs(parity): record bilateral server login proof --- .../emulebb-rust/active/items/RUST-CI-031.md | 100 +++++++++++------- 1 file changed, 62 insertions(+), 38 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index d7f84334..9b1f5fa9 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -2085,49 +2085,65 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. skip, and one deliberate deselection in 124.18 seconds. Catalog validation and `git diff --check` also pass. -## Canonical Server Search and Harness Consolidation Checkpoint - 2026-11-01 - -- The catalog now has one canonical deterministic `server-keyword-search` - scenario. It issues exactly one Rust `OP_SEARCHREQUEST`, requires its - successful socket outcome, decodes exactly one matching `OP_SEARCHRESULT`, - verifies the exact REST row and endpoint, and enforces causal ordering. It - owns only `server.search.keyword` and `server.reply.search`; it does not - infer any server-source transport claim. -- The first live attempt, - `20261101T192311Z-emulebb-main-release-6964`, proved that the search and REST - result worked but correctly failed the evidence gate because the following - 132 MiB transfer rotated the early search records out of the retained ring. - This was a harness evidence-lifetime defect, not protocol divergence. -- The corrected runner snapshots compact search evidence before transfer and - uses a 10 MiB fixture for this search case. Immutable run - `20261101T192443Z-emulebb-main-release-14604` passed on runner - `567cefa875f1bad8c10597c005156527b3bee592` with report SHA-256 - `16de57d51e2259118520d379a3fb39ca8af9000411603e9fc509385b3a4d3c42`. - Request sequence 14 and reply sequence 16 matched the exact result name, - 10,485,760-byte size, hash `684b18845d856fd43f44e0493d2fdc3f`, - and endpoint. The run also retained the already-authoritative startup, - queue, and uncompressed-transfer claims. -- The receipt pins Rust revision +## Server Observation and Bilateral Login Checkpoint - 2026-11-01 + +- The deterministic `server-keyword-search` scenario remains the canonical + exact Rust product observation for one `OP_SEARCHREQUEST`, its successful + socket outcome, one decoded matching `OP_SEARCHRESULT`, the matching REST + row and endpoint, and causal ordering. It does not prove parity: Rust + performed the search while MFC only published the fixture result. The + scenario therefore reports the observed coverage IDs but no eligible parity + claims. +- The first search attempt, + `20261101T192311Z-emulebb-main-release-6964`, also exposed an evidence-lifetime + defect when a following 132 MiB transfer rotated the early search records out + of the retained ring. The corrected runner snapshots the compact search + evidence before a bounded 10 MiB transfer. Immutable run + `20261101T192443Z-emulebb-main-release-14604` remains valid local Rust + diagnostic evidence, but its unilateral `server.search.keyword` and + `server.reply.search` parity claims and catalog receipt were withdrawn. +- Exact server-session decoders and a bilateral diagnostic gate now compare + one Rust and one MFC login request, profile identity, stock user-hash markers, + version, server flags, UDP-port tag, the known Rust `offerfiles_v=1` + extension, exact sends, `OP_IDCHANGE`, accepted-session transitions, and the + assigned ID class. The known extension is recorded separately instead of + weakening the stock-core comparison. +- Run `20261101T193947Z-emulebb-main-release-2224` failed preflight before client + launch because the selected loopback bind was rejected. Run + `20261101T193958Z-emulebb-main-release-10216` reached the bilateral gate and + exposed an incorrect requirement for the optional `SUPPORTCRYPT` capability + in a plaintext case. Commit `0c04531` corrected the invariant capability + mask without relaxing exact equality between the two clients. +- Immutable run `20261101T194032Z-emulebb-main-release-14448` then passed in + 12.7 seconds on runner revision + `0c045312d948ef745e1483e13e07df4330f65bb8`. Its report SHA-256 is + `c13af999bb23ff1989f57e2cc3e16fc646f7200ed1e8a086c9c998c64dba01a8`. + Rust and MFC each emitted one decoded stock-core login followed by exact + ID-change and accepted-session transitions at login sequences 2 and 3. +- Receipt `rust-mfc-transfer-20261101t194032z` pins Rust revision `4def7119f32e0230d3cc0f09f6117825b1a65d46` and executable SHA-256 `6c2ba174164af085695e6dc68fb038142ad6f8324d58aa113f65c6de0f23f8d3`, plus MFC revision `1c99b8f9cd7d4d701a104514882e6c1557e5eee1` and executable SHA-256 `637457534644390e72b9d5f020a369283c12a3fdb91028b1ac431978cc551778`. -- With server search registered, both aggregate protocol-combination runners, - their synthetic tests, and their campaign invocation were deleted. The - competing total-parity audit, its tests, and its release invocation were - also deleted. No wrapper, compatibility reader, or alias remains. The - protocol catalog, canonical receipts, and named campaigns are now the sole - verdict model. -- Catalog validation reports 8/98 covered IDs and 0/15 complete groups; - `server-query-reply` is 2/11. Assets are classified as six canonical, zero - duplicate, two historical, two product-only, and eleven support assets. -- Granular build-tests commits for this checkpoint are `16413ab`, `bc9fecc`, - `22fcd4c`, `08b6376`, `567cefa`, `557c425`, `ed15e0d`, and `fd37930`. - Final validation is 2,854 passing harness tests, one POSIX-only skip, and one - deliberate deselection in 128.06 seconds. The focused release/catalog/ - inventory gate has 48 passing tests; catalog validation, Ruff, rendered - campaign inspection, and `git diff --check` also pass. + It owns `server.login.request` and repeats four already-authoritative startup, + queue, and uncompressed-transfer observations. +- Both aggregate protocol-combination runners, their synthetic tests and + campaign invocation, plus the competing total-parity audit, remain deleted. + No wrapper, compatibility reader, or alias remains. The protocol catalog, + canonical receipts, and named campaigns are the sole verdict model. +- Catalog validation now truthfully reports 7/98 covered IDs and 0/15 complete + groups. `server-session` is 1/4 and `server-query-reply` remains 0/11. Assets + are six canonical, zero duplicate, two historical, two product-only, and + eleven support assets. +- The search checkpoint commits are `16413ab`, `bc9fecc`, `22fcd4c`, `08b6376`, + `567cefa`, `557c425`, `ed15e0d`, and `fd37930`. The bilateral-login commits + are `17889fe`, `5cd0b89`, `39f1df2`, `8bbc75a`, `f41e875`, `06ede5d`, + `0c04531`, and `17479f6`; the provisional `5cd0b89` implementation was + replaced in the next granular commit by the strict bilateral gate. Final + validation passes 2,867 harness tests with one POSIX-only skip and one + deliberate deselection in 124.73 seconds. The focused protocol gate passes + 135 tests; catalog validation, Ruff, and `git diff --check` also pass. Representative granular commits are `89e771d`, `ba19118`, `73d2a43`, `cfc9f98`, `db3145b`, `fe30438`, `565bf60`, `123246a`, `dbaa27b`, @@ -2141,6 +2157,14 @@ pushed without a pull request. ## Next Implementation +- Correct the catalog authority for server status and description before + claiming either transition. The current corpus ambiguously mixes request and + response opcodes and does not distinguish TCP `OP_SERVERSTATUS` from UDP + `OP_GLOBSERVSTATRES` or TCP `OP_SERVERIDENT` from UDP + `OP_SERVER_DESC_RES`. +- Add deterministic bilateral server connection-transport cases and then a + bilateral keyword-search case. One-sided product observations remain useful + diagnostics, but they cannot change catalog parity verdicts. - Do not claim preferred-mode fallback or server obfuscation until a scenario causally records those exact transitions on both relevant sides. - Continue domain by domain through server session/source replies, From ba7499c84f1696c7209e43f02e7c115396f95f25 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 21:01:21 +0100 Subject: [PATCH 27/40] docs(rust): record bilateral server transports --- .../emulebb-rust/active/items/RUST-CI-031.md | 74 ++++++++++++++++--- 1 file changed, 64 insertions(+), 10 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 9b1f5fa9..30bf9442 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -2145,6 +2145,60 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. deliberate deselection in 124.73 seconds. The focused protocol gate passes 135 tests; catalog validation, Ruff, and `git diff --check` also pass. +## Bilateral Server Transport Checkpoint - 2026-11-01 + +- The ambiguous server metadata authorities were split before any new verdict: + TCP `OP_SERVERIDENT` and `OP_SERVERSTATUS` are now distinct from UDP + `OP_SERVER_DESC_RES` and `OP_GLOBSERVSTATRES`. The stock corpus contains + transport- and opcode-exact framed replies rather than request opcodes or an + invalid search response. This raises the catalog inventory from 98 to 100 + IDs and from 15 to 17 groups without claiming those four metadata states. +- The singular deterministic server-login schema now requires the configured + transport on both Rust and MFC at all three causal boundaries: login packet, + `OP_IDCHANGE`, and accepted connection state. Only forced plaintext and + forced-obfuscated cases are eligible. Preferred/fallback configurations + cannot accidentally claim either transport. +- Plaintext run `20261101T194931Z-emulebb-main-release-15012` passed on runner + `b880c382da408ae7c425db40100e87d7365b7831`. Receipt + `rust-mfc-transfer-20261101t194931z` records report SHA-256 + `e13ea2806cdf88fa85b033dec524dc270850175d3d54e3a41d8e5de1c451ceaa` + and owns `server.connect.plaintext` plus the repeated bilateral login claim. +- The first forced-obfuscation run, + `20261101T194957Z-emulebb-main-release-5604`, failed evidence collection + truthfully: Rust recorded obfuscated transport throughout, while MFC labeled + the selected encrypted attempt plaintext until handshake completion. The + MFC oracle used the late stream-state predicate instead of the already-fixed + per-attempt server-crypt selection. No coverage was registered from that run. +- MFC oracle commit `dd3123e0` changes only the three diagnostics labels to use + the selected server transport before handshake completion. Commit `84415e72` + fixes the independent standard-build regression exposed by canonical + validation by guarding diagnostics-writer shutdown with its compile feature. + Build-tests commits `06edf6c` and `7a35545` enforce both source contracts. + Canonical MFC Debug x64, Release x64, and diagnostics Release x64 builds all + pass; the diagnostics build has zero warnings. +- Corrected forced-obfuscation run + `20261101T195457Z-emulebb-main-release-2528` passed on runner + `7a35545fa799b2d6008f6aeceae295a5fe768043`. Both clients recorded + obfuscated login, ID-change, and accepted state. Independent receipt + `rust-mfc-transfer-20261101t195457z` pins report SHA-256 + `b1dfb5bb70970e3f317d7d2b7c1cce39aebfdaae82196bf99aa94d46435bacb7`, + MFC revision `84415e72c4e35120ee87f9c29780cadfb65d60f6` and executable + `dee24e99e7fad4553e37915ae0bf0aa79bd145eab49eb42529ed896a328cc0aa`, + plus Rust revision `4def7119f32e0230d3cc0f09f6117825b1a65d46` and executable + `6c2ba174164af085695e6dc68fb038142ad6f8324d58aa113f65c6de0f23f8d3`. +- Catalog commit `fed7a04` registers only the independently revalidated + plaintext and obfuscated receipts. Catalog validation now reports 9/100 + covered IDs and 0/17 complete groups; `server-session` is truthfully 3/4, + with `server.connect.fallback` still evidence-incomplete. The stock-proof + inventory assertion was refreshed in `b97b368` after the authority split. +- The build-tests commits for this checkpoint are `d913ae0`, `b880c38`, + `06edf6c`, `7a35545`, `fed7a04`, and `b97b368`; the MFC commits are + `dd3123e0` and `84415e72`. Final validation passes 2,874 harness tests with + one POSIX-only skip and one deliberate deselection in 127.41 seconds. The + focused 235-test protocol/source gate, catalog validator, changed-file Ruff, + and `git diff --check` also pass. A repository-wide Ruff sweep is not a + configured gate and still reports the unrelated pre-existing legacy backlog. + Representative granular commits are `89e771d`, `ba19118`, `73d2a43`, `cfc9f98`, `db3145b`, `fe30438`, `565bf60`, `123246a`, `dbaa27b`, `8e8b663`, `7f384b1`, `7f0b748`, `80ec675`, `36f2f60`, `db77fcd`, @@ -2157,16 +2211,16 @@ pushed without a pull request. ## Next Implementation -- Correct the catalog authority for server status and description before - claiming either transition. The current corpus ambiguously mixes request and - response opcodes and does not distinguish TCP `OP_SERVERSTATUS` from UDP - `OP_GLOBSERVSTATRES` or TCP `OP_SERVERIDENT` from UDP - `OP_SERVER_DESC_RES`. -- Add deterministic bilateral server connection-transport cases and then a - bilateral keyword-search case. One-sided product observations remain useful - diagnostics, but they cannot change catalog parity verdicts. -- Do not claim preferred-mode fallback or server obfuscation until a scenario - causally records those exact transitions on both relevant sides. +- Add one deterministic fallback campaign that forces an obfuscated preferred + attempt to fail and records the subsequent plaintext retry and accepted + session on both Rust and MFC. Keep `server.connect.fallback` incomplete until + the independent registrar can prove that exact sequence bilaterally. +- Add the bilateral keyword-search campaign next. Both clients must issue and + receive the matching search transition; the existing one-sided Rust + observation remains diagnostics-only and cannot change a parity verdict. +- Prove the now-separate TCP and UDP server metadata reply states using their + exact transport/opcode authorities. The corrected corpus is a static oracle, + not runtime parity evidence by itself. - Continue domain by domain through server session/source replies, peer-transfer queue/callback states, client UDP, and Kad. Add the smallest deterministic transcript or local cross-client scenario that can causally From e71ffbed707b3981595b32d58ccbec7fdcd23dd8 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 21:06:30 +0100 Subject: [PATCH 28/40] docs(RUST-CI-031): focus parity harness execution --- .../emulebb-rust/active/items/RUST-CI-031.md | 38 +++++++++++++------ docs/reference/HARNESS-LIVE-POLICY.md | 16 ++++++++ 2 files changed, 42 insertions(+), 12 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 30bf9442..374c371c 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -61,23 +61,37 @@ ambiguous, malformed, dropped, or unattributable evidence is counts as parity or divergence. Zero divergences with zero covered entries is not evidence. -The current significant chunk is consolidation, not expansion of the soak -controller: +The goal is bounded by catalog coverage and consolidation, not by soak duration +or infrastructure volume. It is complete only when every supported catalog +entry has one canonical deterministic owner and a causally proven verdict, +every existing protocol test has been classified, duplicate and retired MFC +paths are removed or isolated, exact build provenance is enforced, and the +machine-generated coverage report plus the complete harness validation are +green. The public soak may continue as a discovery tool, but it is not a goal +completion gate. + +Implementation proceeds through one catalog group at a time: 1. establish the single catalog and verdict model; 2. import the existing protocol-golden groups and proven deterministic cases; -3. classify every current protocol test as canonical coverage, shared support, - duplicate, non-protocol product coverage, or historical material; -4. freeze and name the MFC, stock, stable-aMule, and aMule-HEAD roles; -5. remove the tracing harness from active topology after its remaining - consumers are migrated or retired; -6. restore `ed2k-server` to upstream code behavior and move test-specific - adaptation into the harness; -7. make exact source/binary/profile provenance and stale-build rejection part - of every executable campaign; and -8. finish with a machine-generated coverage report and the complete harness +3. complete `server-session`, beginning with the currently missing forced + obfuscated-to-plaintext fallback sequence; +4. complete bilateral server query and reply coverage, beginning with keyword + search and the separated TCP/UDP metadata replies; +5. continue through server source, peer transfer and queue/callback, client + UDP, and Kad groups without opening parallel implementation lanes; +6. classify every current protocol test as canonical coverage, shared support, + duplicate, non-protocol product coverage, or historical material, retiring + old MFC paths only after their unique states have a canonical owner; and +7. finish with a machine-generated coverage report and the complete harness validation green. +For each group, the mandatory loop is diagnostics only where causal evidence is +missing, then the smallest deterministic runner, immutable receipt, independent +registration, catalog update, and full scoped validation. A diagnostic event, +runner, successful process exit, packet capture, or zero-divergence report is +not progress until that loop proves at least one named catalog entry. + Work continues through granular commits on the existing single workstream branch. Do not open coordinated pull requests until this whole chunk is complete, reviewed, and green. Do not create compatibility aliases, legacy diff --git a/docs/reference/HARNESS-LIVE-POLICY.md b/docs/reference/HARNESS-LIVE-POLICY.md index 8f389b67..5e0fb9af 100644 --- a/docs/reference/HARNESS-LIVE-POLICY.md +++ b/docs/reference/HARNESS-LIVE-POLICY.md @@ -88,6 +88,22 @@ green coverage. A campaign reports the exact covered/required count and each non-covered catalog entry. Zero recorded divergences without covered entries is not progress or protocol evidence. +Protocol-parity implementation proceeds as one bounded catalog slice at a +time. Before product, oracle, or harness code changes, the slice identifies the +exact catalog entries, deterministic stimulus, selected clients, protocol +authority, required causal joins, expected verdict, and validation gate. Work +outside that boundary is allowed only when it directly blocks the selected +slice; record the dependency, resolve the smallest sufficient blocker, and +return to the same slice. General diagnostics, orchestration, storage, or soak +work does not advance protocol coverage by itself. + +A slice is complete only when its deterministic run produces an immutable +receipt, an independent registrar validates the receipt against exact build +provenance and required causal evidence, the catalog records only the proven +claims, and every changed repository passes its scoped green gate. Ad hoc +manual traffic and public-soak observations may identify the next slice but +cannot own a catalog verdict. + Before adding a runner or suite, map it to catalog entries and search the existing harness. Every existing protocol test must ultimately be classified as canonical coverage, a shared fixture/helper, a duplicate to remove, a From 3c9971e3ab715589b0441ab2c1cf2d371e3b3e7d Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 21:52:53 +0100 Subject: [PATCH 29/40] docs(RUST-CI-031): record fallback parity proof --- .../emulebb-rust/active/items/RUST-CI-031.md | 25 ++++++++++++++++--- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 374c371c..4a53a88d 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -2212,6 +2212,27 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. focused 235-test protocol/source gate, catalog validator, changed-file Ruff, and `git diff --check` also pass. A repository-wide Ruff sweep is not a configured gate and still reports the unrelated pre-existing legacy backlog. +- The forced fallback slice is now complete. Rust commits `b98beb8d` and + `b365ba14`, MFC commits `12a2b126` and `acc007d0`, and build-tests commits + `19de036`, `19bd7e7`, `c1146ef`, `e4b7988`, and `7cff7ae` add causal + attempt, failure, fallback, retry, login-send, ID-change, and acceptance + evidence without changing wire behavior or accepting a legacy schema. +- Deterministic run `20261101T204626Z-emulebb-main-release-6532` passed with + endpoint-only Rust seed metadata and independently proved the exact + obfuscated-failure-to-plaintext-success sequence on both clients. Receipt + `rust-mfc-transfer-20261101t204626z` pins report SHA-256 + `7ae22d90cb05d4dc69bc637d7ee1890eb4ed3e692f0560d9489c30caa72243d4`, + runner revision `7cff7aee08fdad05045583ec3019d8a8db2dae2f`, MFC revision + `acc007d07a0107b5a20557d8648dd172f83bd163` and executable + `1ca1adf48b9d0d9310601e9eb2d0eda1acdd8b34cffba85df8b1c8fac29db258`, + plus Rust revision `b365ba140f5db9ba28bbc1138eb9e1512d6e9803` and executable + `3fca4e29e4bc18426491cf729f45eadbff4b269dc34761802fe37695277b2545`. +- Build-tests commit `e1178c8` registers that immutable receipt only after the + independent registrar revalidated both attempt graphs. Catalog validation + now reports 10/100 covered IDs and 1/17 complete groups: `server-session` is + 4/4 parity, while all other incomplete groups remain explicitly + evidence-incomplete. The complete harness suite passes 2,909 tests with one + POSIX-only skip and one deliberate deselection in 122.62 seconds. Representative granular commits are `89e771d`, `ba19118`, `73d2a43`, `cfc9f98`, `db3145b`, `fe30438`, `565bf60`, `123246a`, `dbaa27b`, @@ -2225,10 +2246,6 @@ pushed without a pull request. ## Next Implementation -- Add one deterministic fallback campaign that forces an obfuscated preferred - attempt to fail and records the subsequent plaintext retry and accepted - session on both Rust and MFC. Keep `server.connect.fallback` incomplete until - the independent registrar can prove that exact sequence bilaterally. - Add the bilateral keyword-search campaign next. Both clients must issue and receive the matching search transition; the existing one-sided Rust observation remains diagnostics-only and cannot change a parity verdict. From a67ca0b628e0de546f34b5f90b71f2d9cb529d69 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 22:32:30 +0100 Subject: [PATCH 30/40] docs(RUST-CI-031): record bilateral search proof --- .../emulebb-rust/active/items/RUST-CI-031.md | 39 +++++++++++++++++-- 1 file changed, 36 insertions(+), 3 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 4a53a88d..1a3aeae5 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -2234,6 +2234,42 @@ artifacts, never by field omission or mutation of `diag_event_v2` records. evidence-incomplete. The complete harness suite passes 2,909 tests with one POSIX-only skip and one deliberate deselection in 122.62 seconds. +## Bilateral Server Keyword Search Checkpoint - 2026-11-01 + +- Build-tests commit `f68cf4c` replaces the unilateral search observation with + one strict bilateral schema. A neutral raw-wire publisher offers a fixture + distinct from the transfer fixture; Rust and MFC each issue exactly one + terminal keyword search through their REST control plane over an obfuscated + server session. +- Eligibility requires exact request bytes, one accepted decoded reply, the + same result identity and availability on wire and REST, and complete causal + joins from request through apply/completion. Rust must prove its active, + request, send, reply, completed, and scheduler transitions. MFC must prove + its request, reply, and post-parse applied transition with exact before/after + counters. Structured failures retain partial evidence and cannot create a + claim. +- MFC diagnostics commit `6db52bee` adds only the post-parse + `ed2k_tcp/search_result_applied` oracle event. Canonical Debug, Release, and + diagnostics Release builds pass, including the zero-warning diagnostics + build. This is observability work only, not MFC product evolution. +- Deterministic run `20261101T212829Z-emulebb-main-release-14724` passed on + runner `f68cf4c259fb936991dd80efc65b256c3ad1a150`. Independent receipt + `rust-mfc-transfer-20261101t212829z` pins report SHA-256 + `8e5b9d419aa755a0913855ed69a11745e1c339979ceef6e4167c513b07f72059`, + MFC revision `6db52beecf725d9248bee1bffb0809160c932d02` and executable + `d3fb07ad2865c6909dffb865b58e91e8f4538844016242448af4a1447df398d5`, + plus Rust revision `b365ba140f5db9ba28bbc1138eb9e1512d6e9803` and executable + `3fca4e29e4bc18426491cf729f45eadbff4b269dc34761802fe37695277b2545`. +- Build-tests commit `1fce8aa` registers the immutable receipt only after the + independent registrar revalidated all six claims. Four are repeat evidence; + the only new coverage is `server.search.keyword` and `server.reply.search`. + Catalog validation now reports 12/100 covered IDs and 1/17 complete groups; + `server-query-reply` is explicitly partial at 2/9. +- Final validation passes 2,942 harness tests with one POSIX-only skip and one + deliberate deselection in 122.00 seconds. The focused catalog/registrar set + passes 60 tests, the catalog validator passes, and `git diff --check` passes. + No pull request has been opened. + Representative granular commits are `89e771d`, `ba19118`, `73d2a43`, `cfc9f98`, `db3145b`, `fe30438`, `565bf60`, `123246a`, `dbaa27b`, `8e8b663`, `7f384b1`, `7f0b748`, `80ec675`, `36f2f60`, `db77fcd`, @@ -2246,9 +2282,6 @@ pushed without a pull request. ## Next Implementation -- Add the bilateral keyword-search campaign next. Both clients must issue and - receive the matching search transition; the existing one-sided Rust - observation remains diagnostics-only and cannot change a parity verdict. - Prove the now-separate TCP and UDP server metadata reply states using their exact transport/opcode authorities. The corrected corpus is a static oracle, not runtime parity evidence by itself. From 9bed9a3f33586bb275e5b9df7313cd3cd944a7c3 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Sun, 1 Nov 2026 23:08:15 +0100 Subject: [PATCH 31/40] docs(RUST-CI-031): record TCP metadata parity proof --- .../emulebb-rust/active/items/RUST-CI-031.md | 56 ++++++++++++++++++- 1 file changed, 53 insertions(+), 3 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 1a3aeae5..e8c68ed8 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -2280,11 +2280,61 @@ Representative granular commits are `89e771d`, `ba19118`, `73d2a43`, on the single `feature/persisted-soak-parity-analysis` workstream branch and pushed without a pull request. +## Bilateral TCP Server Metadata Checkpoint - 2026-11-01 + +- Rust commit `3c2c0b27` emits `server_status_applied` and + `server_ident_applied` only after the decoded `OP_SERVERSTATUS` and + `OP_SERVERIDENT` values mutate the server model. MFC oracle commit + `c014f880` emits the same `diag_event_v2` state transitions after its + corresponding model updates. Both commits are pushed on the single workstream + branch; MFC received diagnostics only, not product evolution. +- Build-tests commits `576df52`, `0b91d6e`, and `564423c` add the exact ident + codec, ephemeral profile controls, bilateral causal gate, deterministic + `server-tcp-metadata` scenario, and strict independent registration. Follow-up + commits `78c75b5`, `410bd04`, `3f6124d`, and `53fea9b` corrected assumptions + exposed by real execution instead of weakening the gate. +- The final evidence model uses `/api/v1/status` only to prove the active server + endpoint and `GET /api/v1/servers/{address}:{port}` to prove the applied + server-list metadata. This distinction is required because MFC updates its + canonical server-list entry after the two replies while its separate current + connection snapshot retains the seed name and counters. Comparing that stale + duplicate object would manufacture a false protocol divergence. +- The outbound `OP_GETSERVERLIST` boundary is also explicit rather than + normalized away: Rust records the packet as `attempted`, while MFC records it + as `send_succeeded`. The gate requires those exact client-specific outcomes, + then joins one ID-change, request, status, ident, post-apply status, post-apply + ident, and REST state through one positive trace ID per client. +- The canonical local campaign passed at + `reports/deterministic-two-client-transfer/20261101T220451Z-emulebb-main-release-10372/deterministic-two-client-transfer-result.json`. + It used runner revision `53fea9b3380ab2c338b1923f4e83f54abf2e59d9`, + Rust revision `3c2c0b27a67bdd7b5af21d9fe611a139831ec1ba` and + executable SHA-256 + `29efd66ad3841672b7a8fbd86f0a5b2a536f8d7383de224b01f63f7f4d7349ff`, + plus MFC revision `c014f88019256e02be7dbfd673f08e025a9ed006` and + executable SHA-256 + `040ff59f632d15324fce0e163bbcc5b8dc351ea50e2fbc7191836291d8f4b392`. + The Rust diagnostics build receipt is + `logs/builds/20261101T214857Z-build-clients/build-result.json`; it completed + with zero warnings and failures. +- The independent registrar re-derived all six claims from immutable receipt + SHA-256 + `c9acf8151a9fddefce4ddcd828764298d654c6c9f6df9f98354d2b6f2e82b4c8`. + Build-tests commit `7e94cc3` registers only the two new IDs, + `server.reply.tcp-ident` and `server.reply.tcp-status`, while retaining the + four repeated transfer claims as corroborating receipt ownership. Catalog + validation now reports 14/100 covered IDs and 2/17 complete groups; the + `server-tcp-metadata` group is complete. +- Final build-tests validation passes 2,965 tests with one POSIX-only skip and + one deliberate deselection in 122.61 seconds. Changed-file Ruff, + `git diff --check`, the catalog validator, Rust packet-diagnostics tests, and + all three canonical MFC builds are green. No pull request has been opened. + ## Next Implementation -- Prove the now-separate TCP and UDP server metadata reply states using their - exact transport/opcode authorities. The corrected corpus is a static oracle, - not runtime parity evidence by itself. +- Prove the separate UDP server metadata reply states using their exact + transport/opcode authorities. The corrected corpus is a static oracle, not + runtime parity evidence by itself; TCP status and ident are now causally + proven and registered. - Continue domain by domain through server session/source replies, peer-transfer queue/callback states, client UDP, and Kad. Add the smallest deterministic transcript or local cross-client scenario that can causally From ab7b2996b4e0ecbcc512561aae0a2343f34deffa Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Mon, 2 Nov 2026 00:09:21 +0100 Subject: [PATCH 32/40] docs(RUST-CI-031): record UDP metadata parity --- .../emulebb-rust/active/items/RUST-CI-031.md | 70 +++++++++++++++++-- 1 file changed, 64 insertions(+), 6 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index e8c68ed8..ec293284 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -164,8 +164,10 @@ schema readers, or parallel work-in-progress branches during the consolidation. captures while keeping narrow action windows sampling-tolerant. Rust server TCP and UDP diagnostics now preserve trace/state context and emit correlated socket-boundary send attempts plus exactly one success, failure, - or cancellation terminal outcome. The Rust `ed2k_server_udp` family still - lacks an aligned MFC comparator and is not yet cross-client parity evidence. + or cancellation terminal outcome. Challenged UDP server status and + description replies now have an aligned MFC comparator and deterministic + bilateral evidence; the remaining server UDP source/search/callback states + are still evidence-incomplete until their own bounded slices run. The soak launcher now captures ready, low-cadence periodic, and final bundles into a bounded campaign stream while pruning manifest entries as their bundle files rotate. The persisted watcher now enables strict Rust and MFC writer @@ -2329,12 +2331,68 @@ pushed without a pull request. `git diff --check`, the catalog validator, Rust packet-diagnostics tests, and all three canonical MFC builds are green. No pull request has been opened. +## Bilateral UDP Server Metadata Checkpoint - 2026-11-02 + +- MFC diagnostics commit `c32a1589` and Rust diagnostics commit `9456eed6` + emit post-apply status and description events with the exact challenge, + receive trace, peer endpoint, transport, and decoded metadata. MFC remains a + diagnostics-only oracle; no MFC product behavior changed. +- The deterministic `server-udp-metadata` scenario connects each client to an + anchor server and polls a second server containing exactly one synthetic + publisher and one file. Status is challenged plaintext UDP at the stock + `base+4` endpoint. Description is accepted only once across either that + plaintext endpoint or the status-negotiated obfuscated UDP endpoint. Both + clients must then post-apply the decoded values and expose the same target + server state through REST. +- The first routed campaign exposed two real defects instead of weakening the + gate. Build-tests commit `c4e7344` stopped encoding a numeric MFC `server.met` + entry as dynamic DNS, allowing MFC to associate the reply. Rust commit + `fd639054` keys the one-shot poll to stable session, endpoint topology, and + operator configuration, so metadata learned from a successful reply cannot + immediately schedule the same poll again. +- Build-tests commits `d28dc8d` and `65683df` make the evidence gate + transport-aware and derive the actual Windows-to-WSL protocol route while + keeping REST on loopback. The canonical command no longer requires transient + WSL or Windows route addresses. Commit `ba77ac4` independently reloads the + exact retained Rust and MFC diagnostic segments and rebuilds the evidence + before catalog admission; receipt facts not backed by those immutable + captures are rejected. +- The final clean-source campaign passed at + `reports/deterministic-two-client-transfer/20261101T230237Z-emulebb-main-release-11248/deterministic-two-client-transfer-result.json` + on runner revision `ba77ac42536e425df260cdcad6ae3272da6ca750`. + Rust recorded one plaintext status transaction and one negotiated obfuscated + description transaction; MFC recorded one plaintext transaction for each. + Both sides decoded, applied, and exposed the same one-user, one-file metadata. +- Receipt `rust-mfc-transfer-20261101t230237z` pins report SHA-256 + `e89a79f10dc17e238a9084379fdc2aa69348eae3d069843ffa89618be6874a59`, + Rust revision `fd6390543d5042162c6ec4a6f8e27d70f47bc9f6` and executable + `d9dc0cc3daf16563ce51c5b06dbed4cd6ae48999d98adc4b8c34ef2abfb2617c`, + plus MFC revision `c32a15896e952468463c75ff4d89b919ca1f94e5` and executable + `10de8cb83f390ea2759ab123992fbe352fa554200b21bf6f44fff5fef8f640c1`. + The canonical Rust diagnostics build receipt is + `logs/builds/20261101T225207Z-build-clients/build-result.json`; it completed + with zero warnings and failures. +- Build-tests commit `38920e7` registers only the two new IDs, + `server.reply.udp-description` and `server.reply.udp-status`, while retaining + the four repeated transfer claims as corroborating receipt ownership. Catalog + validation now reports 16/100 covered IDs and 3/17 complete groups; the + `server-udp-metadata` group is complete. `ed2k-server` remained untouched and + upstream-clean at `66b892d`. +- Final harness validation passes 2,997 tests with one POSIX-only skip and one + deliberate deselection in 235.04 seconds. The focused 190-test route, + diagnostics, runner, and registrar gate, the 75-test catalog/registrar gate, + changed-file Ruff, `git diff --check`, two complete Rust library suites + (1,220 and 1,228 tests), and the canonical Rust diagnostics build are green. + Strict Rust Clippy reaches only seven pre-existing unfulfilled lint + expectations in unrelated files. No pull request has been opened. + ## Next Implementation -- Prove the separate UDP server metadata reply states using their exact - transport/opcode authorities. The corrected corpus is a static oracle, not - runtime parity evidence by itself; TCP status and ident are now causally - proven and registered. +- Take the next bounded `server-query-reply` slice: + `server.source.tcp-plain` plus its causally joined `server.reply.sources` + result. Reuse the current anchor/publisher fixture and independent receipt + registration; add diagnostics only where the exact request, reply, apply, or + REST join is missing. Do not change `ed2k-server` protocol behavior. - Continue domain by domain through server session/source replies, peer-transfer queue/callback states, client UDP, and Kad. Add the smallest deterministic transcript or local cross-client scenario that can causally From 82c128c5aadee11d5f47b352961231d29c3b70aa Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Mon, 2 Nov 2026 00:18:26 +0100 Subject: [PATCH 33/40] docs(RUST-CI-031): focus parity harness objective --- docs/products/emulebb-rust/active/INDEX.md | 2 +- .../emulebb-rust/active/items/RUST-CI-031.md | 56 ++++++++++++------- docs/reference/HARNESS-LIVE-POLICY.md | 33 +++++++---- 3 files changed, 58 insertions(+), 33 deletions(-) diff --git a/docs/products/emulebb-rust/active/INDEX.md b/docs/products/emulebb-rust/active/INDEX.md index fc31c309..8d1a0ced 100644 --- a/docs/products/emulebb-rust/active/INDEX.md +++ b/docs/products/emulebb-rust/active/INDEX.md @@ -44,7 +44,7 @@ exception; new Rust items always use the `RUST-*` form. | [RUST-CI-008](items/RUST-CI-008.md) | Evidence | Prove Unicode and long-path large-library behavior across platforms | | [RUST-CI-009](items/RUST-CI-009.md) | Evidence | Certify a Beta 3 candidate without publishing | | [RUST-CI-030](items/RUST-CI-030.md) | Evidence | Verify Rust FFI layouts against vendored C headers | -| [RUST-CI-031](items/RUST-CI-031.md) | Evidence | Build persisted full-tunnel protocol parity soaks | +| [RUST-CI-031](items/RUST-CI-031.md) | Evidence | Consolidate deterministic eD2K and Kad protocol-parity testing | | [CI-054](items/CI-054.md) | Evidence | Add native Windows Rust/MFC protocol-parity diagnostics campaign | | [RUST-REF-005](items/RUST-REF-005.md) | Refactor | Decompose oversized Rust modules by responsibility | | [RUST-REF-006](items/RUST-REF-006.md) | Refactor | Consolidate Rust NAT and runtime safety internals | diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index ec293284..e08ec032 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -4,7 +4,7 @@ workflow: github product: emulebb-rust phase: Phase 0 github_issue: https://github.com/emulebb/emulebb-rust/issues/164 -title: Build persisted full-tunnel protocol parity soaks +title: Consolidate deterministic eD2K and Kad protocol-parity testing status: IN_PROGRESS priority: Major category: ci @@ -16,29 +16,43 @@ source: 2026-10-24 operator request for long-running persisted eD2K and Kad pari > Workflow status is tracked in GitHub: https://github.com/emulebb/emulebb-rust/issues/164. This local document is retained as the durable engineering spec and evidence record. -# RUST-CI-031 - Build persisted full-tunnel protocol parity soaks +# RUST-CI-031 - Consolidate deterministic eD2K and Kad protocol-parity testing ## Summary -Provide a supported, restartable Rust-versus-MFC diagnostics workflow for -arbitrarily long eD2K and Kad investigation against explicitly selected -operator-owned persisted profiles. The workflow must use hide.me in full-tunnel -mode, keep both P2P planes fail-closed through VPN Guard, use loopback for local -control, import the MFC profile into an empty Rust profile exactly once, and -reuse a valid nonempty Rust profile thereafter. - -The workflow is a diagnostic discovery lane, not unbounded certification -evidence. Repeatable bounded captures remain the authority for a parity claim. - -## Focused Protocol-Parity Goal - 2026-11-01 - -Consolidate Rust protocol-parity testing into one evidence-driven harness in -`repos\emulebb-build-tests`. Deterministic eD2K/Kad codec, transcript, -state-machine, and local cross-client campaigns are the parity authority. The -persisted public-network soak remains a discovery lane that supplies candidate -findings and rare-state recordings; it cannot certify a state it did not -observe and cannot report useful progress when no causally attributable action -completed. +Consolidate Rust protocol-parity testing into one evidence-driven harness. Make +deterministic eD2K/Kad state-machine and local cross-client campaigns +authoritative; use emulebb MFC only as the preferred diagnostics oracle, frozen +stock/aMule references as independent authorities, and the persisted public +soak only for discovery. Require causally recorded evidence for every parity or +divergence result, classify and consolidate the existing scattered tests, and +retire or isolate duplicate and legacy MFC paths without losing unique coverage. + +The supported, restartable Rust-versus-MFC persisted-profile workflow remains +the arbitrarily long discovery lane. It uses inherited hide.me full-tunnel +state, keeps both P2P planes fail-closed through VPN Guard, uses loopback for +local control, imports an empty Rust profile exactly once, and reuses a valid +nonempty profile thereafter. Its runtime and observations are not certification +evidence until reduced to a bounded deterministic catalog claim. + +## Operating Objective + +Consolidate emulebb Rust protocol-parity testing into one evidence-driven +harness: make deterministic eD2K/Kad state-machine and local cross-client +campaigns authoritative; use emulebb MFC only as the preferred diagnostics +oracle, frozen stock/aMule references as independent authorities, and the +persisted public soak only for discovery; require causally recorded evidence +for every parity or divergence result; retire or isolate duplicate and legacy +MFC test paths; keep `ed2k-server` upstream-clean; work on the existing single +feature branch with granular commits and open coordinated pull requests only +after a significant complete chunk is fully green. + +The current machine-measured baseline is 16 of 100 catalog entries covered and +3 of 17 groups complete. The active bounded slice is +`server.source.tcp-plain` plus the causally joined `server.reply.sources` +result. Until that slice has an immutable receipt, independent registration, +catalog admission, and scoped green validation, unrelated protocol slices do +not begin. The governing role model is: diff --git a/docs/reference/HARNESS-LIVE-POLICY.md b/docs/reference/HARNESS-LIVE-POLICY.md index 5e0fb9af..160230ea 100644 --- a/docs/reference/HARNESS-LIVE-POLICY.md +++ b/docs/reference/HARNESS-LIVE-POLICY.md @@ -46,14 +46,21 @@ live evidence. ## Protocol-Parity Evidence -The active goal is one evidence-driven Rust protocol-parity harness, not a -collection of independent test scripts. The harness must maintain one -machine-readable catalog of the supported eD2K and Kad variants and state -transitions. Each catalog entry identifies its starting state, stimulus, -expected wire/state result, authority, required evidence, deterministic runner, -optional live runner, exact build provenance, and current evidence status. -Named campaigns are selections from that catalog; they do not define competing -coverage or verdict models. +The harness has one mission: determine and improve emulebb Rust parity for the +supported eD2K and Kad scope through causally evidenced, reproducible tests. It +is not a general MFC test program, a soak framework that happens to compare +clients, or a collection of independent campaigns. emulebb Rust is the product +under test; MFC is the preferred observable runtime oracle; stock source and +accepted goldens define protocol intent; frozen stable aMule is an independent +reference; and public traffic is a discovery input. + +The harness maintains one machine-readable catalog of the supported variants +and state transitions. The catalog is the coverage authority. Each entry +identifies its starting state, stimulus, expected wire/state result, authority, +required evidence, deterministic runner, optional live runner, exact build +provenance, and current evidence status. Named campaigns are selections from +that catalog; runner lists, test counts, trace volume, and soak duration do not +create implicit scope or competing coverage and verdict models. Use these evidence layers in order: @@ -86,7 +93,9 @@ Verdicts have strict meanings: `evidence-incomplete` and `not-observed` never count as parity, divergence, or green coverage. A campaign reports the exact covered/required count and each non-covered catalog entry. Zero recorded divergences without covered entries is -not progress or protocol evidence. +not progress or protocol evidence. Harness progress is measured by covered +catalog entries and complete catalog groups, not by elapsed runtime, generated +artifacts, emitted events, process success, or raw test count. Protocol-parity implementation proceeds as one bounded catalog slice at a time. Before product, oracle, or harness code changes, the slice identifies the @@ -94,8 +103,10 @@ exact catalog entries, deterministic stimulus, selected clients, protocol authority, required causal joins, expected verdict, and validation gate. Work outside that boundary is allowed only when it directly blocks the selected slice; record the dependency, resolve the smallest sufficient blocker, and -return to the same slice. General diagnostics, orchestration, storage, or soak -work does not advance protocol coverage by itself. +return to the same slice. At any time, implementation work must either prove the +selected entries, remove a direct blocker to that proof, or consolidate an +existing test under its canonical owner. General diagnostics, orchestration, +storage, or soak work does not advance protocol coverage by itself. A slice is complete only when its deterministic run produces an immutable receipt, an independent registrar validates the receipt against exact build From 007bc83405bcbecd92ff9bfa8d695522567f1116 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Mon, 2 Nov 2026 01:02:32 +0100 Subject: [PATCH 34/40] docs(RUST-CI-031): record TCP source parity --- .../emulebb-rust/active/items/RUST-CI-031.md | 39 ++++++++++++++----- 1 file changed, 30 insertions(+), 9 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index e08ec032..69bd5dde 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -47,12 +47,11 @@ MFC test paths; keep `ed2k-server` upstream-clean; work on the existing single feature branch with granular commits and open coordinated pull requests only after a significant complete chunk is fully green. -The current machine-measured baseline is 16 of 100 catalog entries covered and +The current machine-measured baseline is 18 of 100 catalog entries covered and 3 of 17 groups complete. The active bounded slice is -`server.source.tcp-plain` plus the causally joined `server.reply.sources` -result. Until that slice has an immutable receipt, independent registration, -catalog admission, and scoped green validation, unrelated protocol slices do -not begin. +`server.source.tcp-obfuscated`. Until that slice has an immutable receipt, +independent registration, catalog admission, and scoped green validation, +unrelated protocol slices do not begin. The governing role model is: @@ -2399,14 +2398,36 @@ pushed without a pull request. (1,220 and 1,228 tests), and the canonical Rust diagnostics build are green. Strict Rust Clippy reaches only seven pre-existing unfulfilled lint expectations in unrelated files. No pull request has been opened. +- The bounded plaintext server-source slice is complete. The canonical run at + `output-root:reports/deterministic-two-client-transfer/20261101T235531Z-emulebb-main-release-11696/deterministic-two-client-transfer-result.json` + passed with artifact SHA-256 + `a226acc680c505e8ea20681de3d915463c36542bc89b1468b923b5f7eb9df4b8`. + Its independently reconstructed receipt proves + `server.source.tcp-plain` and `server.reply.sources` against Rust + `dc9804c9`, MFC oracle `aebbc5b2`, and harness `c50f8f7`, while four + existing transfer claims are retained only as corroboration. +- MFC server-TCP packet diagnostics now truthfully report the pre-queue send + record as `attempted`. Rust still requires its terminal socket + `send_outcome`; MFC delivery is instead proven by the exact later reply with + the same trace ID, followed by the exact source-state application. No + fabricated terminal MFC event or compatibility path was added. +- Build-tests `b127c98` admits the immutable source receipt. Catalog validation + now reports 18/100 covered IDs and 3/17 complete groups. The focused catalog, + registrar, diagnostics, and MFC-source gate passes 345 tests; the complete + harness gate passes 3,084 tests with one POSIX-only skip and one deliberate + deselection in 236.00 seconds. The canonical MFC diagnostics build receipt is + `logs/builds/20261101T235454Z-build-app/build-result.json`. `ed2k-server` + remained untouched and upstream-clean at `66b892d`; no pull request has been + opened. ## Next Implementation - Take the next bounded `server-query-reply` slice: - `server.source.tcp-plain` plus its causally joined `server.reply.sources` - result. Reuse the current anchor/publisher fixture and independent receipt - registration; add diagnostics only where the exact request, reply, apply, or - REST join is missing. Do not change `ed2k-server` protocol behavior. + `server.source.tcp-obfuscated`. Reuse the reachable HighID publisher and + independent receipt registration, require exact obfuscated request/reply + transport plus the already-defined source-state causal joins, and add + diagnostics only if that proof is incomplete. Do not change `ed2k-server` + protocol behavior. - Continue domain by domain through server session/source replies, peer-transfer queue/callback states, client UDP, and Kad. Add the smallest deterministic transcript or local cross-client scenario that can causally From a214a82d917f14de8fceb14d2e118e5f5a932b98 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Mon, 2 Nov 2026 01:29:02 +0100 Subject: [PATCH 35/40] docs(RUST-CI-031): record obfuscated source parity --- .../emulebb-rust/active/items/RUST-CI-031.md | 52 ++++++++++++++++--- 1 file changed, 45 insertions(+), 7 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 69bd5dde..33625d6c 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -47,9 +47,9 @@ MFC test paths; keep `ed2k-server` upstream-clean; work on the existing single feature branch with granular commits and open coordinated pull requests only after a significant complete chunk is fully green. -The current machine-measured baseline is 18 of 100 catalog entries covered and +The current machine-measured baseline is 19 of 100 catalog entries covered and 3 of 17 groups complete. The active bounded slice is -`server.source.tcp-obfuscated`. Until that slice has an immutable receipt, +`server.source.udp-v1`. Until that slice has an immutable receipt, independent registration, catalog admission, and scoped green validation, unrelated protocol slices do not begin. @@ -2420,14 +2420,52 @@ pushed without a pull request. remained untouched and upstream-clean at `66b892d`; no pull request has been opened. +## Obfuscated TCP Server Source Checkpoint - 2026-11-02 + +- The first bounded obfuscated run was retained as a failed diagnostic receipt, + not parity evidence. Its publisher advertised plaintext-era server flags + `0x0119`, so the local server returned source crypt options `0x00`; the + crypt-required MFC oracle correctly decoded one wire source and declined to + add it. No catalog claim was admitted from that run. +- Build-tests `0a4df98` parameterized the source scenario by the selected + singular server transport. Follow-up `97603af` binds the obfuscated proof to + exact `OP_GETSOURCES_OBFU`/`OP_FOUNDSOURCES_OBFU` opcodes (`0x23`/`0x44`), + publisher flags `0x0319`, source crypt options `0x81`, the canonical publisher + user hash, exact trace and sequence joins, a source-free eD2K-link stimulus, + post-apply source state, REST corroboration, and immutable diagnostic + captures. Opposite-family, duplicate, malformed, truncated, or conflicting + source frames and publisher login frames fail closed. No compatibility shim + or legacy diagnostic schema was added. +- The canonical campaign passed at + `output-root:reports/deterministic-two-client-transfer/20261102T002608Z-emulebb-main-release-12868/deterministic-two-client-transfer-result.json` + with artifact SHA-256 + `c6673a16d172c9e41a4218d41e3c113da700a34b303cd47a5194408af4eb972e`. + Rust used revision `dc9804c9` and executable SHA-256 + `b636909c95b0887a455709a57b8eab8ef7544ec8275cdc2551ad735a5b373f9c`; + MFC used diagnostics revision `aebbc5b2` and executable SHA-256 + `6223a2eb1c8d6e6cd508eddbd500006275de468b299ddbd728fcc2f7b868f832`; + the harness revision was `97603af`. +- The independent registrar reloaded the exact retained Rust and MFC segments, + reconstructed the publisher login and publication transcript, and admitted + `server.source.tcp-obfuscated` as the sole new coverage ID. The source reply + and four transfer IDs are corroboration only. Build-tests `e3595a7` records + receipt `rust-mfc-transfer-20261102t002608z`; catalog validation now reports + 19/100 covered IDs and 3/17 complete groups. +- The final pre-catalog harness gate passes 3,107 tests with one POSIX-only skip + and one deliberate deselection in 124.80 seconds. The final catalog and + inventory gate passes 25 tests, the catalog validator and changed-file Ruff + pass, and `git diff --check` is clean. `ed2k-server` remained untouched and + upstream-clean at `66b892d`; no pull request has been opened. + ## Next Implementation - Take the next bounded `server-query-reply` slice: - `server.source.tcp-obfuscated`. Reuse the reachable HighID publisher and - independent receipt registration, require exact obfuscated request/reply - transport plus the already-defined source-state causal joins, and add - diagnostics only if that proof is incomplete. Do not change `ed2k-server` - protocol behavior. + `server.source.udp-v1`. First bind the stock v1 request/reply wire contract and + existing Rust/MFC diagnostics to one local managed-server fixture; then add + only the smallest bounded cross-client scenario needed to prove the exact + endpoint, file identity, request and reply opcodes, source decode, and + post-apply state. Register its immutable receipt before considering UDP v2. + Do not change `ed2k-server` protocol behavior. - Continue domain by domain through server session/source replies, peer-transfer queue/callback states, client UDP, and Kad. Add the smallest deterministic transcript or local cross-client scenario that can causally From 1f7da37ece926d65eddf37d079d036ee6233caa3 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Mon, 2 Nov 2026 02:04:20 +0100 Subject: [PATCH 36/40] docs(rust): record UDP source v1 parity [RUST-CI-031] --- .../emulebb-rust/active/items/RUST-CI-031.md | 58 ++++++++++++++++--- 1 file changed, 50 insertions(+), 8 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 33625d6c..d4dbe184 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -47,9 +47,9 @@ MFC test paths; keep `ed2k-server` upstream-clean; work on the existing single feature branch with granular commits and open coordinated pull requests only after a significant complete chunk is fully green. -The current machine-measured baseline is 19 of 100 catalog entries covered and +The current machine-measured baseline is 20 of 100 catalog entries covered and 3 of 17 groups complete. The active bounded slice is -`server.source.udp-v1`. Until that slice has an immutable receipt, +`server.source.udp-v2`. Until that slice has an immutable receipt, independent registration, catalog admission, and scoped green validation, unrelated protocol slices do not begin. @@ -2457,15 +2457,57 @@ pushed without a pull request. pass, and `git diff --check` is clean. `ed2k-server` remained untouched and upstream-clean at `66b892d`; no pull request has been opened. +## UDP v1 Server Source Checkpoint - 2026-11-02 + +- Rust `eb1256ba` and MFC `2d8fb8b3` add causal UDP source-application + diagnostics. MFC remains diagnostics-only; no MFC product behavior or legacy + diagnostic schema was added. +- Build-tests `013512f`, `4615d22`, `51fa9eb`, and `e5ecbf8` establish the + managed UDP source fixture, exact wire codecs, evidence gate, and bounded + runner scenario. Follow-up commits `7bea419`, `280b7d9`, `0739a36`, + `4618bfa`, and `5985d2d` add the accepted stock reply vector, independent + registrar, send-attempt correlation, file-hash-scoped reconstruction, and + catalog registration. +- The first canonical run at + `output-root:reports/deterministic-two-client-transfer/20261102T005632Z-emulebb-main-release-14764/deterministic-two-client-transfer-result.json` + was retained as failed diagnostic evidence. It exposed that stateless Rust + UDP sends use `sendAttemptId` for request-to-terminal-outcome correlation and + reserve a positive `traceId` for reply-to-application correlation. No catalog + evidence was admitted from that run. +- The corrected canonical campaign passed at + `output-root:reports/deterministic-two-client-transfer/20261102T005817Z-emulebb-main-release-14048/deterministic-two-client-transfer-result.json` + with artifact SHA-256 + `6b15f9da1758ffe9420b8f22714de6e2788b81eef578007f86ff88ce6642a94b`. + Rust used revision `eb1256ba` and executable SHA-256 + `f8718d0530552885d4ba7fa3d9b079e34f1e7d1b6709deea8d5c2841af449136`; + MFC used diagnostics revision `2d8fb8b3` and executable SHA-256 + `a56cc028191b51523a60fd2ab44abd45e657a6e8d322e4524d5b556af7098352`; + the harness revision was `0739a36`. +- The independent registrar reloaded the exact immutable segments and fixture + transcript, reconstructed exact plaintext UDP v1 + `OP_GLOBGETSOURCES`/`OP_GLOBFOUNDSOURCES` traffic, terminal Rust send outcome, + per-client reply-to-application joins, and the exact source-state transition. + Receipt `rust-mfc-transfer-20261102t005817z` admits + `server.source.udp-v1` as the sole new coverage ID. The source reply and four + transfer IDs are corroboration only. +- Catalog validation now reports 20/100 covered IDs and 3/17 complete groups; + `server-query-reply` is 6/9. Canonical build receipts are + `logs/builds/20261102T005332Z-build-clients/build-result.json` for Rust and + `logs/builds/20261102T003550Z-build-app/build-result.json` for MFC. The final + harness gate passes 3,131 tests with one POSIX-only skip and one deliberate + deselection. `ed2k-server` remained untouched and upstream-clean at + `66b892d`; no pull request has been opened. + ## Next Implementation - Take the next bounded `server-query-reply` slice: - `server.source.udp-v1`. First bind the stock v1 request/reply wire contract and - existing Rust/MFC diagnostics to one local managed-server fixture; then add - only the smallest bounded cross-client scenario needed to prove the exact - endpoint, file identity, request and reply opcodes, source decode, and - post-apply state. Register its immutable receipt before considering UDP v2. - Do not change `ed2k-server` protocol behavior. + `server.source.udp-v2`. Bind the accepted stock v2 request/reply wire contract, + including its exact source-size payload, to the existing Rust/MFC diagnostics + and one harness-owned managed or scripted fixture. Add only the smallest + bounded cross-client scenario needed to prove exact endpoint, file identity, + request and reply opcodes, source decode, and post-apply state. Register its + immutable receipt before advanced search or callback work. Do not change + `ed2k-server` protocol behavior. - Continue domain by domain through server session/source replies, peer-transfer queue/callback states, client UDP, and Kad. Add the smallest deterministic transcript or local cross-client scenario that can causally From 344a86e3b43f8a106b9b645e9054a161de80b8d6 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Mon, 2 Nov 2026 02:19:33 +0100 Subject: [PATCH 37/40] docs(rust): record UDP source v2 parity [RUST-CI-031] --- .../emulebb-rust/active/items/RUST-CI-031.md | 50 ++++++++++++++++--- 1 file changed, 42 insertions(+), 8 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index d4dbe184..07723e6f 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -47,9 +47,9 @@ MFC test paths; keep `ed2k-server` upstream-clean; work on the existing single feature branch with granular commits and open coordinated pull requests only after a significant complete chunk is fully green. -The current machine-measured baseline is 20 of 100 catalog entries covered and +The current machine-measured baseline is 21 of 100 catalog entries covered and 3 of 17 groups complete. The active bounded slice is -`server.source.udp-v2`. Until that slice has an immutable receipt, +`server.search.advanced`. Until that slice has an immutable receipt, independent registration, catalog admission, and scoped green validation, unrelated protocol slices do not begin. @@ -2498,15 +2498,49 @@ pushed without a pull request. deselection. `ed2k-server` remained untouched and upstream-clean at `66b892d`; no pull request has been opened. +## UDP v2 Server Source Checkpoint - 2026-11-02 + +- Build-tests `e555c09` codifies the accepted stock UDP v2 request grammar: + `OP_GLOBGETSOURCES2` followed by repeated `` entries, or + `` for a large file. The shared + `OP_GLOBFOUNDSOURCES` reply API is no longer mislabeled as v1-only. +- Build-tests `e91871e` extends the single harness-owned source fixture to + explicit v1/v2 modes and exact v2 size matching. Commits `f4e495f` and + `1cd2ed6` rename and generalize the bilateral evidence gate without aliases; + `df56e58` adds the bounded v2 campaign; `a240a46` independently reconstructs + either version; and `83aeb64` admits the immutable result. +- The canonical campaign passed on its first run at + `output-root:reports/deterministic-two-client-transfer/20261102T011511Z-emulebb-main-release-500/deterministic-two-client-transfer-result.json` + with artifact SHA-256 + `6e4fe12abaeb4e02d255e429d3ca18bf27c6a08d2107ab9ee81506fc3e49186a`. + The harness revision was `a240a46`; no Rust or MFC source rebuild was needed. + Rust remained at `eb1256ba` with executable SHA-256 + `f8718d0530552885d4ba7fa3d9b079e34f1e7d1b6709deea8d5c2841af449136`; + MFC remained at diagnostics revision `2d8fb8b3` with executable SHA-256 + `a56cc028191b51523a60fd2ab44abd45e657a6e8d322e4524d5b556af7098352`. +- Rust and MFC each emitted the exact payload + `22334455667788990011aabbccddeeff32090100`: the canonical file hash plus + 67,890 as little-endian `u32`. The fixture observed no v1 request; the gate + causally joined Rust's terminal send outcome and each client's exact reply to + its `0 -> 1` source-state application. +- Independent receipt `rust-mfc-transfer-20261102t011511z` admits + `server.source.udp-v2` as the sole new coverage ID. The source reply and four + transfer IDs are corroboration only. Catalog validation now reports 21/100 + covered IDs and 3/17 complete groups; `server-query-reply` is 7/9. +- The final harness gate passes 3,138 tests with one POSIX-only skip and one + deliberate deselection in 125.85 seconds. The focused 240-test gate, catalog + validator, changed-file Ruff, and `git diff --check` also pass. `ed2k-server` + remained untouched and upstream-clean at `66b892d`; no pull request has been + opened. + ## Next Implementation - Take the next bounded `server-query-reply` slice: - `server.source.udp-v2`. Bind the accepted stock v2 request/reply wire contract, - including its exact source-size payload, to the existing Rust/MFC diagnostics - and one harness-owned managed or scripted fixture. Add only the smallest - bounded cross-client scenario needed to prove exact endpoint, file identity, - request and reply opcodes, source decode, and post-apply state. Register its - immutable receipt before advanced search or callback work. Do not change + `server.search.advanced`. Bind the accepted stock advanced-search expression + grammar to the existing managed local search fixture and prove the exact Rust + and MFC request bytes, reply correlation, decoded result, and post-apply REST + state. Reuse the existing keyword-search lane and add no parallel runner. + Register its immutable receipt before callback work. Do not change `ed2k-server` protocol behavior. - Continue domain by domain through server session/source replies, peer-transfer queue/callback states, client UDP, and Kad. Add the smallest From dd87a18cb0290f71c3d945aa1ca3665f46dde2e5 Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Mon, 2 Nov 2026 02:32:29 +0100 Subject: [PATCH 38/40] docs(rust): record advanced server search parity [RUST-CI-031] --- .../emulebb-rust/active/items/RUST-CI-031.md | 63 ++++++++++++++++--- 1 file changed, 55 insertions(+), 8 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 07723e6f..8e23b16b 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -47,9 +47,9 @@ MFC test paths; keep `ed2k-server` upstream-clean; work on the existing single feature branch with granular commits and open coordinated pull requests only after a significant complete chunk is fully green. -The current machine-measured baseline is 21 of 100 catalog entries covered and +The current machine-measured baseline is 22 of 100 catalog entries covered and 3 of 17 groups complete. The active bounded slice is -`server.search.advanced`. Until that slice has an immutable receipt, +`server.reply.callback`. Until that slice has an immutable receipt, independent registration, catalog admission, and scoped green validation, unrelated protocol slices do not begin. @@ -2533,15 +2533,62 @@ pushed without a pull request. remained untouched and upstream-clean at `66b892d`; no pull request has been opened. +## Advanced Server Search Checkpoint - 2026-11-02 + +- Build-tests `e3161b2` adds an independent stock server-search codec and + literal golden vector for + `AND(keyword, AND(size >= 12345, size <= 12345))`. The old + `encode_term_search` API was removed rather than retained as an alias. + Commit `96a88e7` drives the exact shared Rust/MFC REST request and persists + that stimulus in both successful and failed evidence. +- Build-tests `d8777a1` replaces server-search diagnostics v2 with the single + current `emulebb-build-tests.deterministic-server-search-diagnostics.v3` + contract. It accepts explicit keyword or advanced variants, requires the + recorded REST stimulus, independently encoded wire expression, reply, and + application lifecycle to agree, and has no v2 reader. Commit `cdacb72` adds + the advanced scenario through the existing neutral publisher and bilateral + search lane; no parallel runner was created. +- Build-tests `0c79d5e` derives registration directly from the one evidence + contract and requires exact fixture-sized lower and upper bounds for the + advanced claim. The canonical keyword v3 replacement passed at + `output-root:reports/deterministic-two-client-transfer/20261102T012738Z-emulebb-main-release-11248/deterministic-two-client-transfer-result.json` + with artifact SHA-256 + `62c486faafd62375c727afd27f89eb1b1794b120c10126b7ce917721c632b35e`. + Receipt `rust-mfc-transfer-20261102t012738z` replaces the obsolete v2 + keyword receipt. +- The canonical advanced campaign passed on its first run at + `output-root:reports/deterministic-two-client-transfer/20261102T012801Z-emulebb-main-release-3136/deterministic-two-client-transfer-result.json` + with artifact SHA-256 + `272af4a45cd2bc6f3c7d8362c4a459e03dda4312f0a62799a9dd69578c7f0fcd`. + Rust and MFC emitted the identical request payload + `000001190064657465726d696e69737469637061726974797365617263680000033930000003010002033930000004010002` + at sequences 20/19 and applied the exact reply at sequences 22/20. + Receipt `rust-mfc-transfer-20261102t012801z` independently admits + `server.search.advanced`. +- Both runs used harness revision `0c79d5e`, Rust revision `eb1256ba` with + executable SHA-256 + `f8718d0530552885d4ba7fa3d9b079e34f1e7d1b6709deea8d5c2841af449136`, + and MFC diagnostics revision `2d8fb8b3` with executable SHA-256 + `a56cc028191b51523a60fd2ab44abd45e657a6e8d322e4524d5b556af7098352`. + No Rust, MFC, or `ed2k-server` product behavior changed. +- Build-tests `d25e198` records both immutable receipts and advances the + catalog to 22/100 covered IDs and 3/17 complete groups; + `server-query-reply` is now 8/9 with only `server.reply.callback` remaining. + At that exact committed head the complete harness gate passes 3,147 tests + with one POSIX-only skip and one deliberate deselection in 126.58 seconds. + Both independent registrations, catalog validation, changed-file Ruff, and + `git diff --check` pass. `ed2k-server` remains untouched and upstream-clean + at `66b892d`; no pull request has been opened. + ## Next Implementation - Take the next bounded `server-query-reply` slice: - `server.search.advanced`. Bind the accepted stock advanced-search expression - grammar to the existing managed local search fixture and prove the exact Rust - and MFC request bytes, reply correlation, decoded result, and post-apply REST - state. Reuse the existing keyword-search lane and add no parallel runner. - Register its immutable receipt before callback work. Do not change - `ed2k-server` protocol behavior. + `server.reply.callback`. First map the stock callback request/reply grammar, + the existing Rust/MFC control surfaces, and the smallest deterministic LowID + server state that can causally produce the reply. Extend the existing managed + server-session lane rather than adding a parallel runner. Prove the exact + request, exact reply, trace/state join, and post-apply client state before + catalog admission. Do not change `ed2k-server` protocol behavior. - Continue domain by domain through server session/source replies, peer-transfer queue/callback states, client UDP, and Kad. Add the smallest deterministic transcript or local cross-client scenario that can causally From ccbd90c63e320ce21d30aa981aa20d847a92875c Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Mon, 2 Nov 2026 03:15:12 +0100 Subject: [PATCH 39/40] docs(rust): record server callback parity [RUST-CI-031] --- .../emulebb-rust/active/items/RUST-CI-031.md | 68 +++++++++++++++---- 1 file changed, 56 insertions(+), 12 deletions(-) diff --git a/docs/products/emulebb-rust/active/items/RUST-CI-031.md b/docs/products/emulebb-rust/active/items/RUST-CI-031.md index 8e23b16b..b4d33e47 100644 --- a/docs/products/emulebb-rust/active/items/RUST-CI-031.md +++ b/docs/products/emulebb-rust/active/items/RUST-CI-031.md @@ -47,11 +47,12 @@ MFC test paths; keep `ed2k-server` upstream-clean; work on the existing single feature branch with granular commits and open coordinated pull requests only after a significant complete chunk is fully green. -The current machine-measured baseline is 22 of 100 catalog entries covered and -3 of 17 groups complete. The active bounded slice is -`server.reply.callback`. Until that slice has an immutable receipt, -independent registration, catalog admission, and scoped green validation, -unrelated protocol slices do not begin. +The current machine-measured baseline is 23 of 100 catalog entries covered and +4 of 17 groups complete. `server-query-reply` is complete at 9/9. The active +bounded slice is `lowid.server-callback`; unrelated protocol slices do not +begin until that distinct LowID state transition has an exact authority, +causal evidence contract, independent registration, catalog admission, and +scoped green validation. The governing role model is: @@ -2580,15 +2581,58 @@ pushed without a pull request. `git diff --check` pass. `ed2k-server` remains untouched and upstream-clean at `66b892d`; no pull request has been opened. +## Server Callback Reply Checkpoint - 2026-11-02 + +- Rust `e8ff2faf` and MFC `9c556184` add causal callback-reply application + diagnostics. MFC remains a diagnostics-only oracle; no MFC or Rust protocol + behavior changed and no diagnostic compatibility reader was added. +- Build-tests `cb6332f`, `4ad003d`, `c7192f3`, and `7a0ce5f` establish the + stock callback codecs, managed HighID requester, bilateral evidence gate, + and bounded campaign in the existing deterministic transfer runner. Commits + `697bc8f`, `30b0917`, `8f7ebea`, and `ba86acb` require honest login delivery + proof and route only the isolated callback requester through the managed WSL + host and Docker bridge. Failed pre-route and pre-ingress runs remain local + diagnostic evidence and admitted no catalog claim. +- The canonical campaign passed in 17 seconds at + `output-root:reports/deterministic-two-client-transfer/20261102T020224Z-emulebb-main-release-12340/deterministic-two-client-transfer-result.json` + with artifact SHA-256 + `5f0e895b0b2b231f55531abb9cb813308de57de906f5e89424ebfddd0d08088c`. + Rust used revision `e8ff2faf` and executable SHA-256 + `15cb10e6a8753ac78c3f9716b06abae10eaa74ac746c292bf0c0f238f07bc154`; + MFC used diagnostics revision `9c556184` and executable SHA-256 + `fa0a5961caaefb29dfba440d3cf771ec4d9329c6b9f8070efde1d7160a824b1f`; + the campaign runner revision was `ba86acb`. +- The requester issued exact `OP_CALLBACKREQUEST` commands for LowIDs 4 and 2. + Rust applied the exact short `OP_CALLBACKREQUESTED` reply at wire/application + sequences 17/18; MFC did so at 19/21. Both resulting callback HELLO payloads + independently decode to the accepted login hash, LowID, and TCP port. The + exact `/32` Windows route was removed during clean teardown. +- Build-tests `8288de4` binds the parsed callback identity to the retained raw + HELLO bytes. Commit `85fd1e7` independently reloads the exact diagnostic + segments, readiness receipt, request/result control files, route, requester + runtime, accepted LowID targets, and build provenance. Receipt + `rust-mfc-transfer-20261102t020224z` admits only + `server.reply.callback` as the new catalog ID; existing login and transfer + IDs are corroboration. Commit `7e7deb9` records that receipt. +- Catalog validation now reports 23/100 covered IDs and 4/17 complete groups; + `server-query-reply` is complete at 9/9. The focused callback, registrar, and + catalog gate passes 131 tests. The complete harness gate passes 3,177 tests + with one POSIX-only skip and one deliberate deselection in 201.69 seconds. + Changed-file Ruff, formatting, catalog validation, and `git diff --check` + pass. `ed2k-server` remains untouched and upstream-clean at `66b892d`; no + pull request has been opened. + ## Next Implementation -- Take the next bounded `server-query-reply` slice: - `server.reply.callback`. First map the stock callback request/reply grammar, - the existing Rust/MFC control surfaces, and the smallest deterministic LowID - server state that can causally produce the reply. Extend the existing managed - server-session lane rather than adding a parallel runner. Prove the exact - request, exact reply, trace/state join, and post-apply client state before - catalog admission. Do not change `ed2k-server` protocol behavior. +- Take the next bounded `lowid-callbacks` slice: + `lowid.server-callback`. First determine whether the immutable callback + receipt above already proves the distinct full LowID transition from + accepted LowID login through exact `OP_CALLBACKREQUEST`, server-routed + `OP_CALLBACKREQUESTED`, application, and callback HELLO. Reuse that receipt + only if an independent gate can prove the complete state transition; add the + smallest missing diagnostic or deterministic stimulus otherwise. Do not + rerun unchanged traffic, add a parallel runner, or change `ed2k-server` + protocol behavior. - Continue domain by domain through server session/source replies, peer-transfer queue/callback states, client UDP, and Kad. Add the smallest deterministic transcript or local cross-client scenario that can causally From c6384e973b01ad04b502e958356ca2f70046841b Mon Sep 17 00:00:00 2001 From: Threepwood-7 Date: Mon, 2 Nov 2026 03:19:19 +0100 Subject: [PATCH 40/40] docs(rust): document diagnostic bundle budget [RUST-CI-031] --- docs/products/emulebb-rust/api/REST-API-OPENAPI.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/products/emulebb-rust/api/REST-API-OPENAPI.yaml b/docs/products/emulebb-rust/api/REST-API-OPENAPI.yaml index 7d3271be..f8d384de 100644 --- a/docs/products/emulebb-rust/api/REST-API-OPENAPI.yaml +++ b/docs/products/emulebb-rust/api/REST-API-OPENAPI.yaml @@ -6326,11 +6326,17 @@ components: DiagnosticBundleCaptureRequest: type: object additionalProperties: false - required: [confirmCapture] + required: [confirmCapture, maxBytes] properties: confirmCapture: type: boolean enum: [true] + maxBytes: + type: integer + format: int64 + minimum: 65536 + maximum: 67108864 + description: Maximum encoded bundle size in bytes. DiagnosticCrashTestRequest: type: object additionalProperties: false