Bounded admission loopback framing v1

Experimental TCP harness · 5 September 2026 · one frame per session

Result

Sixteen real loopback cases pass. They cover 210-byte open claims, 442-byte sponsored claims, 884-byte conflict pairs, fragmented sends, invalid envelope shape/signature, zero/unsupported/oversized lengths, truncated headers/bodies, silent peers, slow headers, slow trickles, and a pipelined second frame that is not processed.

The receiver uses a four-byte unsigned big-endian length followed by exactly that many payload bytes. Only 210, 442, and 884 are allowed. Length is validated before reading payload or making a length-dependent heap allocation. A huge declaration and a zero declaration each consume zero payload bytes and zero signature credits. This experimental wrapper is not a negotiated public wire standard.

One absolute 250-ms deadline covers header and body reads. Each read uses the remaining time; receiving another byte never resets the deadline. Completion also checks that the deadline has not expired. EOF before completion rejects the frame. The slow-trickle test sends additional bytes every 80 ms and still times out. Timers are test settings, not recommended Internet latency limits.

Completed frames enter the real bounded preverification queue with one source and one pending slot. Valid fixtures pass real signature checks; invalid signatures consume the same four-credit job budget. Each session processes one frame and closes; a second pipelined frame is neither verified nor admitted. The harness sends no protocol response, creates no ledger, and issues no durable acknowledgement.

Resource observations

The recorded peak server-worker count is one, measured with an atomic live/peak counter. Every worker has exited after join before the next case starts. The main test thread acts as the client; it is not included in that server-worker count. There is one accepted session per worker, not a multi-peer admission server.

The fixed reader payload array is 884 bytes; its frame struct is 896 bytes on this arm64 build. Header storage is four bytes. With one queue copy, nominal payload capacity is 884 + 4 + 884 = 1,772 bytes. This is a sum of declared buffer capacities, not stack high-water, total heap, or process RAM. Compiler-generated moves, allocator metadata, fixture preparation, thread stacks, and kernel/socket buffers are excluded. Successful reads and queue occupancy are recorded for each case.

TCP may coalesce fragmented sends. Read-call counts and wall-clock timings are observations, not portable expected outputs. The suite checks outcome categories, byte caps, zero payload processing for invalid declarations, and worker cleanup. It does not benchmark throughput or establish production connection limits.

Reproduce and remaining work

cargo run --locked --offline --features peer-recovery \
  --example admission_loopback

The executable binds only 127.0.0.1 on ephemeral ports, runs finite cases, and exits. It needs local socket permission; it makes no Internet requests. Results are retained in docs/results/admission-loopback-v1.json, with source/binary hashes and environment details in the accompanying manifest. No production runtime path or existing transport profile is modified.

Next: combine this bounded receiver with the scheduler and ledger in a finite loopback integration test, including lost acknowledgements and reconnection. Add aggregate session limits, slow-reader output handling, and allocator/process measurements before scaling beyond one session. Authentication, full descriptor encoding, actual stalled-filesystem handling, and independent review remain open. Public admission and Fly deployment remain disabled.