8.7 KiB
Verification — 2026-10-23
All network checks used synthetic loopback endpoints. The legacy sibling and Downloads copy were references only; no credentials were copied, no old game endpoints contacted, no host firewall/routing changed and nothing deployed over the legacy service.
Platforms and gates
| Platform | Toolchain | Final fresh checks |
|---|---|---|
| macOS arm64 | Rust/Cargo1.98.1 | fmt, Clippy all targets with warnings denied,40 tests, release binary and examples |
| Orb Ubuntu Linux amd64 | Rust/Cargo1.93.1 | 41 tests, release binary and examples; extra test proves Linux127/8 wildcard behavior |
The declared Rust1.85 minimum was not independently built; use a current stable toolchain. Orb Cargo does not provide rustfmt, so formatting and Clippy are checked natively. Final R6 fix is included in these fresh root runs; independent re-review is recorded in docs/final-review.md.
Reproduce:
cargo fmt --check
cargo clippy --all-targets --locked -- -D warnings
cargo test --all-targets --locked
cargo build --release --bin mirror-tool --examples --locked
node --check web/app.js
Forwarding integration tests exercise byte-exact binary streams, request EOF with delayed response, idle beyond3s, target changes affecting new sessions, disable/re-enable and port reuse, strict mirror request integrity with large replica responses drained, failed/slow strict and isolate replicas, global connection limits, quiesce and bounded shutdown. Control tests cover authenticated same-origin/CSRF controls, durable restart, direct-IP target resolution, automatic selection, state-write rollback and health freshness. tests/shutdown.rs runs the actual process with an unfinished HTTP body and a live TCP session.
Fault-injection and negative controls for shutdown, observation timestamps, loop aliases, missing heartbeat, accept retry and early quiesce are detailed in docs/backend-fixes-report.md. Recoverable accept errors were injected into the actual private listener supervisor; OS descriptor exhaustion itself was not induced. Indefinitely blocked kernel filesystem calls were not induced.
Legacy UI
scripts/legacy_ui_reference.py renders the unmodified original Jinja templates with synthetic data, without executing/importing legacy configuration. It confirms all24037 original CSS characters remain, modulo trailing whitespace normalization. Bootstrap5.1.3/Font Awesome6.0.0 and icon font are bundled locally with licenses. Computed styles matched original columns, font, colors, border radius, header/stat padding and gaps. The intentional small changes are listed in docs/ui-report.md.
Chrome against the release executable and temporary loopback fixture verified:
- Login/logout; service start; robot toggle; choosing primaryB retains primaryA as replica.
- A1MiB byte-exact primary echo and correct half-close through the UI-started proxy. Replica counter also reached1MiB, zero errors/disconnections.
- Original plus dialog creates a custom proxy directly from IPv6; advanced settings save listen/upstream ports and strict policy; editable direct-IP field updates primary without creating a team manually.
- Invalid self-loop custom address is rejected and add-dialog input remains (earlier restoration pass). Settings drafts survive SSE updates.
- Pausing the fixture process for seven seconds produces the five-second stale warning, disables mutations and marks TCP health unknown. Resuming fresh SSE clears the warning and restores controls.
- Actual390x844 viewport: innerWidth390, document width390, column width360; horizontal service-board scrolling retained. Browser-wide viewport setting was ineffective, so tab-scoped CDP metrics were used and cleared afterward.
Local disposable screenshots: test-results/legacy-ui.jpg, test-results/restored-ui-final.jpg, test-results/restored-ui-mobile.jpg. No app-origin JavaScript error was observed; browser-extension messages were excluded. Browser Use programmatic fill did not set native dirty-field state for change-on-blur; direct-IP saving was verified with real keyboard input and Tab.
ForcAD interoperability
Canonical upstream inspected: pomo-mondreganto/ForcAD at 6ce3407be569b7f69f879501c5e2ca79231c1ff9. Beyond wire fixtures, the final release was checked with actual python-socketio5.10.0/python-engineio4.8.0, matching upstream versions:
python scripts/verify_forcad_library.py target/release/mirror-tool
The optional dev environment needs aiohttp, python-socketio==5.10.0, python-engineio==4.8.0. Passed: initial metadata/state, delta updates retaining metadata, heartbeat with reused session, stale data, namespace disconnect and reconnect (two handshakes). This is interoperability with the inspected protocol, not a live tournament or arbitrary fork certification. Adplatf parsing is covered by synthetic fixtures, not a live deployment.
Measured loopback performance
Three alternating direct/proxy transfers of64MiB per mode,500 sequential32-byte echo latency samples per path. Every primary response byte checked. Mirror modes use one real IPv6 replica plus IPv4 primary. Default engine limits, same-process runtime, warmup; aggregate upload+echo-download throughput excludes replica bytes. Numbers are local baselines, not one-way link capacity or a claim of improvement over the Python implementation. Both platforms ran on the same host; scheduling and virtualization affect results.
| Platform | Mode | Direct median MiB/s | Proxy median MiB/s | Direct p50 µs | Proxy p50 µs | Replica disconnects |
|---|---|---|---|---|---|---|
| macOS arm64 | none | 4023 | 2819 | 18.5 | 33.9 | 0 |
| macOS arm64 | strict | 4098 | 1532 | 19.1 | 45.0 | 0 |
| macOS arm64 | isolate | 3944 | 2772 | 18.4 | 46.2 | 3 |
| Orb Linux amd64 | none | 2521 | 2266 | 9.8 | 20.5 | 0 |
| Orb Linux amd64 | strict | 2343 | 2230 | 10.5 | 32.5 | 0 |
| Orb Linux amd64 | isolate | 2526 | 2268 | 10.4 | 34.0 | 4 |
All primary byte totals matched; accept/connect/I/O/rejection/replica-error counters were zero. Strict replica local-write byte totals also matched all205536896 primary upload bytes (warmup, bulk and latency combined). Integration tests separately verify bytes actually read by the replica. In isolate mode the maximum-rate bursts saturated the default bounded queue and explicitly disconnected the replica: three disconnections on macOS and four on Linux across five proxy sessions per mode, with only a prefix mirrored for affected sessions. These are observed overload outcomes, not full-replica-delivery passes. Increase queue resources for expected bursts or select strict when every healthy replica must keep up; an indefinitely slower replica cannot maintain primary speed with finite memory and full delivery.
Raw records are checked in at docs/benchmarks/{macos,linux}-{none,strict,isolate}.json, including each throughput run, p50/p95 and all counters.
cargo build --release --example benchmark --locked
./target/release/examples/benchmark 64 none
./target/release/examples/benchmark 64 strict
./target/release/examples/benchmark 64 isolate
No zero-overhead/zero-loss claim is supported. Socket-write counters do not prove application commit; TCP mirroring is not database replication. Real-network load, multi-hour soak, live checker compatibility and systemd deployment remain environment-specific validation, not performed here.
Final cancellation and release checks
The final controller admits at most one owned transaction worker after acquiring its operation lock. Five new automated regressions cancel callers during service save/publication, failed-save rollback, DELETE drain, team publication and automatic promotion. Native40 and Linux41 test counts include them. The original real-HTTP-disconnect DELETE reproduction independently changed from disk/live/active0/1/1 to0/0/0. The real HTTP reproduction is review evidence; automated committed regressions cancel at the transaction caller boundary rather than reproducing HTTP transport cancellation. Early quiesce, concurrent shutdown, rollback and process partial-body tests remain green.
Final root pipelines ran all format/Clippy/test/release gates successfully on the fixed source, then reran all six benchmarks, real ForcAD-library interoperability, sample configuration validation and JS syntax. The final release UI was restarted and rechecked for login, start, primary/replica promotion, robot, custom-IP creation and exact1MiB half-close. No game configuration was installed.
Generated local release artifacts are in git-ignored dist/, with SHA256SUMS. macOS artifact is arm64 Mach-O; Linux artifact is x86-64 glibc-linked ELF built in Orb Ubuntu, not a static binary certified for all Linux distributions. No systemd unit was installed. The12 tracked legacy reference files still match the Downloads copy; an existing untracked legacy .gitignore was not modified or removed.