# Mirror Tool — working journal

## Objective
Rewrite the legacy Python TCP mirror manager in Rust, in this repository. Preserve the operator workflow, repair networking/failover bugs, integrate ForcAD accurately, and verify performance rather than promise physically impossible zero overhead.

## Binding user decisions
- 2026-10-23: automatic routing means upstream selection inside the TCP proxy; no nftables/iptables or host route changes.
- Keep existing service/team selection, primary + replicas, custom services, statistics, availability and scoreboard views. No additional UI preferences yet.
- Keep the legacy directories unchanged. Never copy credentials from their config into this repository.

## Current state
Rust modules implemented: config, store, engine, scoreboard, control, auth, web and CLI. TCP engine implementer delivered 11 passing integration tests; UI implementer active on `web/*`. Parent owns integration, protocol fixtures, Linux verification, benchmark, final review and documentation. Read `task_plan.md`, `findings.md`, and `progress.md` before resuming.

## Verification policy
No completion/performance claims without fresh output. Use loopback and Orb Linux fixtures; never contact configured legacy game hosts. Test exact byte delivery, half-close, idle connections, live target changes, failure selection, replica overload, ForcAD reconnects, auth and persistence. Record limits explicitly.

## Milestone 1
- Async bounded engine, strict/isolate policies, replica response draining, hot target changes, RAII active accounting, acknowledged listener shutdown, bounded whole-engine drain.
- Verified canonical ForcAD init/delta format; persistent Engine.IO 4 implementation with heartbeat and reconnect.
- Typed config validation, same-filesystem fsync+rename state replacement, rollback on persistence failure, fresh-health deterministic selection with cooldown.
- Cookie sessions (HttpOnly/SameSite), CSRF header, same-origin checks, login rate limiting, no secret persistence. HTTP binds locally by default; user supplies environment password.
- Fresh engine evidence: 11 loopback tests passed (see docs/engine-report.md). Full integrated checks still pending.