ctf-ad-mirror-tool-rust/docs/verification.md

# Verification — 2026-10-23

All network checks used synthetic loopback endpoints. The legacy sibling and Downloads copy were references only; no credentials were copied, no old game endpoints contacted, no host firewall/routing changed and nothing deployed over the legacy service.

## Platforms and gates

| Platform | Toolchain | Final fresh checks |
|---|---|---|
| macOS arm64 | Rust/Cargo1.98.1 | fmt, Clippy all targets with warnings denied,40 tests, release binary and examples |
| Orb Ubuntu Linux amd64 | Rust/Cargo1.93.1 |41 tests, release binary and examples; extra test proves Linux127/8 wildcard behavior |

The declared Rust1.85 minimum was not independently built; use a current stable toolchain. Orb Cargo does not provide rustfmt, so formatting and Clippy are checked natively. Final R6 fix is included in these fresh root runs; independent re-review is recorded in `docs/final-review.md`.

Reproduce:

```sh
cargo fmt --check
cargo clippy --all-targets --locked -- -D warnings
cargo test --all-targets --locked
cargo build --release --bin mirror-tool --examples --locked
node --check web/app.js
```

Forwarding integration tests exercise byte-exact binary streams, request EOF with delayed response, idle beyond3s, target changes affecting new sessions, disable/re-enable and port reuse, strict mirror request integrity with large replica responses drained, failed/slow strict and isolate replicas, global connection limits, quiesce and bounded shutdown. Control tests cover authenticated same-origin/CSRF controls, durable restart, direct-IP target resolution, automatic selection, state-write rollback and health freshness. `tests/shutdown.rs` runs the actual process with an unfinished HTTP body and a live TCP session.

Fault-injection and negative controls for shutdown, observation timestamps, loop aliases, missing heartbeat, accept retry and early quiesce are detailed in `docs/backend-fixes-report.md`. Recoverable accept errors were injected into the actual private listener supervisor; OS descriptor exhaustion itself was not induced. Indefinitely blocked kernel filesystem calls were not induced.

## Legacy UI

`scripts/legacy_ui_reference.py` renders the unmodified original Jinja templates with synthetic data, without executing/importing legacy configuration. It confirms all24037 original CSS characters remain, modulo trailing whitespace normalization. Bootstrap5.1.3/Font Awesome6.0.0 and icon font are bundled locally with licenses. Computed styles matched original columns, font, colors, border radius, header/stat padding and gaps. The intentional small changes are listed in `docs/ui-report.md`.

Chrome against the release executable and temporary loopback fixture verified:

- Login/logout; service start; robot toggle; choosing primaryB retains primaryA as replica.
- A1MiB byte-exact primary echo and correct half-close through the UI-started proxy. Replica counter also reached1MiB, zero errors/disconnections.
- Original plus dialog creates a custom proxy directly from IPv6; advanced settings save listen/upstream ports and strict policy; editable direct-IP field updates primary without creating a team manually.
- Invalid self-loop custom address is rejected and add-dialog input remains (earlier restoration pass). Settings drafts survive SSE updates.
- Pausing the fixture process for seven seconds produces the five-second stale warning, disables mutations and marks TCP health unknown. Resuming fresh SSE clears the warning and restores controls.
- Actual390x844 viewport: innerWidth390, document width390, column width360; horizontal service-board scrolling retained. Browser-wide viewport setting was ineffective, so tab-scoped CDP metrics were used and cleared afterward.

Local disposable screenshots: `test-results/legacy-ui.jpg`, `test-results/restored-ui-final.jpg`, `test-results/restored-ui-mobile.jpg`. No app-origin JavaScript error was observed; browser-extension messages were excluded. Browser Use programmatic fill did not set native dirty-field state for change-on-blur; direct-IP saving was verified with real keyboard input and Tab.

## ForcAD interoperability

Canonical upstream inspected: `pomo-mondreganto/ForcAD` at `6ce3407be569b7f69f879501c5e2ca79231c1ff9`. Beyond wire fixtures, the final release was checked with actual python-socketio5.10.0/python-engineio4.8.0, matching upstream versions:

```sh
python scripts/verify_forcad_library.py target/release/mirror-tool
```

The optional dev environment needs `aiohttp`, `python-socketio==5.10.0`, `python-engineio==4.8.0`. Passed: initial metadata/state, delta updates retaining metadata, heartbeat with reused session, stale data, namespace disconnect and reconnect (two handshakes). This is interoperability with the inspected protocol, not a live tournament or arbitrary fork certification. Adplatf parsing is covered by synthetic fixtures, not a live deployment.

## Measured loopback performance

Three alternating direct/proxy transfers of64MiB per mode,500 sequential32-byte echo latency samples per path. Every primary response byte checked. Mirror modes use one real IPv6 replica plus IPv4 primary. Default engine limits, same-process runtime, warmup; aggregate upload+echo-download throughput excludes replica bytes. Numbers are local baselines, not one-way link capacity or a claim of improvement over the Python implementation. Both platforms ran on the same host; scheduling and virtualization affect results.

| Platform | Mode | Direct median MiB/s | Proxy median MiB/s | Direct p50 µs | Proxy p50 µs | Replica disconnects |
|---|---|---:|---:|---:|---:|---:|
| macOS arm64 | none |4023|2819|18.5|33.9|0|
| macOS arm64 | strict |4098|1532|19.1|45.0|0|
| macOS arm64 | isolate |3944|2772|18.4|46.2|3|
| Orb Linux amd64 | none |2521|2266|9.8|20.5|0|
| Orb Linux amd64 | strict |2343|2230|10.5|32.5|0|
| Orb Linux amd64 | isolate |2526|2268|10.4|34.0|4|

All primary byte totals matched; accept/connect/I/O/rejection/replica-error counters were zero. Strict replica local-write byte totals also matched all205536896 primary upload bytes (warmup, bulk and latency combined). Integration tests separately verify bytes actually read by the replica. In isolate mode the maximum-rate bursts saturated the default bounded queue and explicitly disconnected the replica: three disconnections on macOS and four on Linux across five proxy sessions per mode, with only a prefix mirrored for affected sessions. These are observed overload outcomes, not full-replica-delivery passes. Increase queue resources for expected bursts or select strict when every healthy replica must keep up; an indefinitely slower replica cannot maintain primary speed with finite memory and full delivery.

Raw records are checked in at `docs/benchmarks/{macos,linux}-{none,strict,isolate}.json`, including each throughput run, p50/p95 and all counters.

```sh
cargo build --release --example benchmark --locked
./target/release/examples/benchmark 64 none
./target/release/examples/benchmark 64 strict
./target/release/examples/benchmark 64 isolate
```

No zero-overhead/zero-loss claim is supported. Socket-write counters do not prove application commit; TCP mirroring is not database replication. Real-network load, multi-hour soak, live checker compatibility and systemd deployment remain environment-specific validation, not performed here.

## Final cancellation and release checks

The final controller admits at most one owned transaction worker after acquiring its operation lock. Five new automated regressions cancel callers during service save/publication, failed-save rollback, DELETE drain, team publication and automatic promotion. Native40 and Linux41 test counts include them. The original real-HTTP-disconnect DELETE reproduction independently changed from disk/live/active0/1/1 to0/0/0. The real HTTP reproduction is review evidence; automated committed regressions cancel at the transaction caller boundary rather than reproducing HTTP transport cancellation. Early quiesce, concurrent shutdown, rollback and process partial-body tests remain green.

Final root pipelines ran all format/Clippy/test/release gates successfully on the fixed source, then reran all six benchmarks, real ForcAD-library interoperability, sample configuration validation and JS syntax. The final release UI was restarted and rechecked for login, start, primary/replica promotion, robot, custom-IP creation and exact1MiB half-close. No game configuration was installed.

Generated local release artifacts are in git-ignored `dist/`, with `SHA256SUMS`. macOS artifact is arm64 Mach-O; Linux artifact is x86-64 glibc-linked ELF built in Orb Ubuntu, not a static binary certified for all Linux distributions. No systemd unit was installed. The12 tracked legacy reference files still match the Downloads copy; an existing untracked legacy `.gitignore` was not modified or removed.