Serial admission integration v1

Experimental loopback harness · 5 September 2026

Result

Ten finite TCP cases connect bounded framing, the real signature verification queue, serial scheduling, and the durable reserved-capacity ledger. Valid admission and quarantine responses follow successful ledger calls. Invalid signatures, insufficient open-cost work, quarantined claims, and truncated frames do not append records. A precommit gate checks that the client receives no byte during a 40-ms probe before the ledger call is released.

The server deliberately suppresses one admission response and one quarantine response after commit. Reconnecting after clean ledger close/reopen returns the corresponding successful status without appending a duplicate record. Each new record adds exactly 221 journal bytes; rejection and replay add zero. Quarantine survives reopening and blocks the previously admitted claim.

Experimental exchange

The existing four-byte big-endian length prefix accepts only 210-, 442-, and 884-byte payloads, with a fixed 884-byte reader array and a 500-ms absolute read deadline. Each accepted connection carries one request. Complete frames enter a one-source, one-job verification queue with four signature credits. A single server thread owns the ledger and processes ten sessions sequentially.

A response is 34 bytes: version 1, status byte, then SHA-256 of the exact request payload. Status 0 means rejection, 1 durable admission, and 2 durable quarantine. Malformed or truncated frames close without a response. The output deadline is one second. These are test settings and an unsigned, unauthenticated local response format, not a public wire standard. The payload fingerprint is not a claim ID; this response grants no transferable permission or entitlement to attention.

Scope and reproduction

cargo run --locked --offline --features peer-recovery \
  --example admission_integration

The harness binds only an ephemeral loopback port and removes its temporary ledger. It uses fixed signed fixtures and policy time 100, not a live epoch clock. Report: docs/results/admission-integration-v1.json; the accompanying manifest records source, binary, and result hashes. Session and queue maxima are by construction, not measurements of process RAM or throughput.

Response suppression models loss after commit; clean reopen is not a process crash or power failure. The precommit probe does not suspend fsync. Separate sync-failure and controlled-completion suites cover those narrower failure models. This harness maps ledger errors to rejection and does not establish production error recovery.

Next are concurrent session limits and slow-reader output backpressure, followed by allocator/process measurements. Authentication, complete descriptor transport, real filesystem stalls, and independent review remain open. Public admission and Fly deployment remain disabled.