Concurrent admission and TCP backpressure v1

Experimental integration evidence · 5 September 2026

Concurrent pipeline result

Eleven checks pass through real concurrent loopback connections, incremental framing, the signature queue, a single serial ledger owner, and bounded output. Four retained sessions reach a measured peak of three queued jobs. A fifth connection is refused. Two valid clients and one invalid-signature client finish while a silent client still holds its slot; the silent session then expires.

A second group tests replay, conflict evidence, truncated input and an oversized length. A subsequent request for the quarantined claim is rejected. Six decisions produce two admissions and one quarantine: exactly 663 journal bytes. Replay and rejection add no records. Clean reopen preserves both claims and the quarantine. All nine retained sessions close; the final verification queue and session pool are empty. The refused connection is counted separately.

Implementation boundaries

Each of four slots has one fixed 884-byte payload array, a four-byte header, and at most one 128-byte response array. The verification queue allows four sources, one job per source, four total. Nominal payload/header/output array capacity plus four maximum-sized queue copies is 7,600 bytes. This excludes metadata, decoded objects, ledger state, fixtures, stack usage and kernel buffers; it is not measured RAM. Accept may temporarily own a fifth socket before rejecting it.

Each turn attempts one read or write per applicable session, then verifies at most one job using four credits and makes at most one synchronous ledger decision. The reader validates length before payload access. Three additional unit tests cover byte-at-a-time framing with WouldBlock/Interrupted, unsupported lengths that consume only the header, and EOF in headers or bodies. Absolute real-time session deadlines are 500 ms; output deadlines are 200 ms. These are experiment settings.

The 34-byte unsigned response retains the serial experiment's version, status, and exact-payload hash. Successful status is constructed only after ledger success; local output completion is not peer receipt. Policy time remains fixture time 100. The harness maps ledger errors to rejection; it does not implement production recovery. Synchronous fsync can stall every session. There is no timed credit refill, reserved conflict lane, handshake authentication, or complete descriptor exchange.

Separate real TCP saturation result

The output component also passes four checks on real TCP sockets. A non-reading client causes WouldBlock during bounded setup. The recorded run writes 540,152 bytes of filler using a reusable 16-KiB array, then observes a pending bounded response. A second socket delivers its 34-byte response while the first output remains pending. The slow output expires after its fixed 100-ms deadline.

Filler is test setup, not valid protocol traffic. Setup is limited to three seconds and 64 MiB; buffered bytes vary by OS. The test allows either eventual completion when capacity returns or deadline expiry, while separately injected writer tests force expiry deterministically. This is an output-component experiment, separate from the concurrent ledger run. It does not measure kernel memory or throughput.

Reproduce and next work

cargo run --locked --offline --features peer-recovery --example admission_concurrent
cargo test --locked --offline --features peer-recovery --example admission_concurrent
cargo run --locked --offline --example admission_saturation

Reports are docs/results/admission-concurrent-v1.json and docs/results/admission-saturation-v1.json, with a shared source/binary manifest. Both executables use finite loopback clients and exit. No production ingress or Fly deployment is enabled.

Next: isolate the ledger owner from network scheduling with a bounded handoff, using the existing controlled-completion model to test stalled writes, timeout fencing and capacity reclamation together. Measure allocator/process overhead before increasing concurrency. Independent review and complete wire profiles remain prerequisites for public admission.