tests: rework the actually useful tests to live in the integration crate

crates/irtt-client/AGENTS.md

@@ -93,6 +93,29 @@ risks clearing readiness state that the normal Echo receive path depends on.
 There is no background task or second `AsyncFd` around the Tokio-owned
 socket.
 
+### Testing kernel timestamp behavior
+
+The requirements above describe production behavior, not a required unit-test
+architecture.
+
+Prefer Linux tests that exercise the real socket and kernel timestamp path
+through production APIs. A test intended to prove TX timestamp support must
+actually require and observe a kernel TX timestamp when running on a supported
+Linux environment; accepting the userspace fallback does not prove that path.
+
+Likewise, prefer observable socket/client behavior for genuine error-queue
+errors and bounded draining where it can reasonably be induced.
+
+Do not restore synthetic `ControlMessageOwned` permutations, classifier-unit
+suites, raw ancillary fixtures, test-only socket hooks, or other internal seams
+solely to cover every `MSG_ERRQUEUE` branch. `nix` owns ancillary-message
+decoding and ABI safety; `irtt-client` tests should primarily prove its own
+observable interpretation and behavior through the real path.
+
+If some invariant cannot reasonably be induced through a production interface,
+a small focused internal test may be retained, but the burden is on that test to
+justify why integration coverage is insufficient.
+
 ## Retained state
 
 `PendingProbe` carries an optional `kernel_tx_timestamp: Option<SystemTime>`

crates/irtt-client/Cargo.toml

@@ -25,6 +25,9 @@ default = []
 ancillary = ["dep:nix"]
 tokio = ["dep:tokio"]
 
+[dev-dependencies]
+irtt-server.workspace = true
+
 [package.metadata.docs.rs]
 all-features = true
 cargo-args = ["-Zunstable-options", "-Zrustdoc-scrape-examples"]
@@ -42,9 +45,3 @@ doc-scrape-examples = true
 name = "managed_client"
 required-features = ["tokio"]
 doc-scrape-examples = true
-
-[dev-dependencies]
-# Keep the packaged client testable against the latest published server while
-# workspace tests continue to exercise the local source through this path.
-irtt-server = { version = "0.5.1", path = "../irtt-server" }
-tokio = { version = "1.53.1", default-features = false, features = ["rt", "sync"] }

crates/irtt-client/src/async_client.rs

@@ -886,6 +886,3 @@ fn poll_readable_until(
         },
     }
 }
-
-#[cfg(test)]
-mod tests;

crates/irtt-client/src/async_client/in_tree_server_support.rs

@@ -1,82 +0,0 @@
-//! A real `irtt-server` running in-process, for tests that need to prove
-//! `AsyncClient` and the blocking `Client` are equivalent against a real peer.
-//!
-//! This duplicates `crates/irtt-integration-tests/tests/support/in_tree_server.rs`
-//! rather than depending on it: this module backs private (`super::*`) unit
-//! tests here, while the integration crate covers black-box client/server
-//! behavior, and neither can depend on the other's test-only code.
-
-use std::{
-    net::{IpAddr, Ipv4Addr, SocketAddr},
-    sync::mpsc,
-    thread::{self, JoinHandle},
-    time::Duration,
-};
-
-use irtt_server::{Server, ServerConfig};
-use tokio::sync::oneshot;
-
-const STARTUP_TIMEOUT: Duration = Duration::from_secs(2);
-
-pub struct InTreeServer {
-    pub addr: SocketAddr,
-    shutdown: Option<oneshot::Sender<()>>,
-    done: Option<JoinHandle<Result<(), irtt_server::ServerRuntimeError>>>,
-}
-
-impl InTreeServer {
-    pub fn start(config: ServerConfig) -> Self {
-        let (startup_tx, startup_rx) = mpsc::sync_channel(1);
-        let (shutdown_tx, shutdown_rx) = oneshot::channel();
-        let done = thread::spawn(move || {
-            let runtime = tokio::runtime::Builder::new_current_thread()
-                .enable_all()
-                .build()
-                .expect("failed to build in-tree test server runtime");
-            runtime.block_on(async move {
-                let bind_addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0);
-                let mut server = Server::bind(bind_addr, config).await?;
-                startup_tx
-                    .send(server.local_addr()?)
-                    .expect("test stopped waiting for in-tree server startup");
-                server
-                    .run(async {
-                        let _ = shutdown_rx.await;
-                    })
-                    .await
-            })
-        });
-
-        let addr = match startup_rx.recv_timeout(STARTUP_TIMEOUT) {
-            Ok(addr) => addr,
-            Err(error) => {
-                let _ = shutdown_tx.send(());
-                let result = done.join().expect("in-tree test server thread panicked");
-                panic!("in-tree test server failed before startup ({error}): {result:?}");
-            }
-        };
-
-        Self {
-            addr,
-            shutdown: Some(shutdown_tx),
-            done: Some(done),
-        }
-    }
-
-    fn stop_inner(&mut self) {
-        if let Some(shutdown) = self.shutdown.take() {
-            let _ = shutdown.send(());
-        }
-        if let Some(done) = self.done.take() {
-            done.join()
-                .expect("in-tree test server thread panicked")
-                .expect("in-tree test server stopped with an error");
-        }
-    }
-}
-
-impl Drop for InTreeServer {
-    fn drop(&mut self) {
-        self.stop_inner();
-    }
-}

crates/irtt-client/src/async_client/tests.rs

@@ -1,681 +0,0 @@
-use std::{
-    future::Future,
-    net::UdpSocket,
-    pin::Pin,
-    sync::mpsc,
-    task::{Context, Poll, Waker},
-    thread::{self, JoinHandle},
-};
-
-use irtt_proto::{
-    decode_request, encode_echo_reply, encode_open_reply, flags, verify_packet_hmac,
-    DecodedRequestKind, EchoReply, OpenReply, Params, ReceivedStats, StampAt, TimestampFields,
-};
-use tokio::runtime::{Builder, Runtime};
-
-#[path = "in_tree_server_support.rs"]
-mod in_tree_server;
-
-use super::*;
-use crate::{Client, RunMode, SocketConfig};
-use in_tree_server::InTreeServer;
-use irtt_server::ServerConfig;
-
-const TOKEN: u64 = 0x1234_5678_90ab_cdef;
-
-struct TestServer {
-    addr: SocketAddr,
-    packets: mpsc::Receiver<Vec<u8>>,
-    done: JoinHandle<()>,
-}
-
-impl TestServer {
-    fn finish(self) -> Vec<Vec<u8>> {
-        self.done.join().unwrap();
-        self.packets.try_iter().collect()
-    }
-}
-
-fn runtime() -> Runtime {
-    Builder::new_current_thread()
-        .enable_io()
-        .enable_time()
-        .build()
-        .unwrap()
-}
-
-fn config(addr: SocketAddr, key: Option<Vec<u8>>, dscp: u8) -> ClientConfig {
-    ClientConfig {
-        server_addr: addr.to_string(),
-        received_stats: ReceivedStats::None,
-        stamp_at: StampAt::None,
-        dscp,
-        hmac_key: key,
-        open_timeouts: vec![Duration::from_millis(200)],
-        socket_config: SocketConfig {
-            recv_timeout: Some(Duration::from_millis(200)),
-            ..SocketConfig::default()
-        },
-        ..ClientConfig::default()
-    }
-}
-
-async fn opened_client(addr: SocketAddr, dscp: u8) -> AsyncClient {
-    let mut client = AsyncClient::connect(config(addr, None, dscp))
-        .await
-        .unwrap();
-    client.open().await.unwrap();
-    client
-}
-
-fn start_server<F>(handler: F) -> TestServer
-where
-    F: FnOnce(UdpSocket, mpsc::Sender<Vec<u8>>) + Send + 'static,
-{
-    let socket = UdpSocket::bind("127.0.0.1:0").unwrap();
-    socket
-        .set_read_timeout(Some(Duration::from_secs(2)))
-        .unwrap();
-    let addr = socket.local_addr().unwrap();
-    let (tx, packets) = mpsc::channel();
-    let done = thread::spawn(move || handler(socket, tx));
-    TestServer {
-        addr,
-        packets,
-        done,
-    }
-}
-
-fn recv_packet(socket: &UdpSocket, tx: &mpsc::Sender<Vec<u8>>) -> (Vec<u8>, SocketAddr) {
-    let mut buffer = [0_u8; 8192];
-    let (len, peer) = socket.recv_from(&mut buffer).unwrap();
-    let packet = buffer[..len].to_vec();
-    tx.send(packet.clone()).unwrap();
-    (packet, peer)
-}
-
-/// Admits a request the way a compliant server does: structural decode first,
-/// then HMAC presence policy, then authentication. Returns `None` for anything
-/// a server would silently discard.
-fn decode_server_request<'a>(
-    packet: &'a [u8],
-    key: Option<&[u8]>,
-) -> Option<DecodedRequestKind<'a>> {
-    let request = decode_request(packet).ok()?;
-    if request.hmac_present != key.is_some() {
-        return None;
-    }
-    if let Some(key) = key {
-        verify_packet_hmac(key, packet).ok()?;
-    }
-    Some(request.kind)
-}
-
-/// Returns the requested parameters and whether this was a no-test open.
-fn open_request(packet: &[u8], key: Option<&[u8]>) -> (Params, bool) {
-    match decode_server_request(packet, key) {
-        Some(DecodedRequestKind::Open { params, no_test }) => {
-            (Params::decode(params).unwrap(), no_test)
-        }
-        other => panic!("expected an authenticated open request, got {other:?}"),
-    }
-}
-
-fn echo_request_sequence(packet: &[u8], key: Option<&[u8]>) -> u32 {
-    match decode_server_request(packet, key) {
-        Some(DecodedRequestKind::Echo { sequence, .. }) => sequence,
-        other => panic!("expected an authenticated echo request, got {other:?}"),
-    }
-}
-
-fn close_request_token(packet: &[u8], key: Option<&[u8]>) -> u64 {
-    match decode_server_request(packet, key) {
-        Some(DecodedRequestKind::Close { token }) => token,
-        other => panic!("expected an authenticated close request, got {other:?}"),
-    }
-}
-
-fn send_open_reply(
-    socket: &UdpSocket,
-    peer: SocketAddr,
-    params: Params,
-    key: Option<&[u8]>,
-    reply_flags: u8,
-    token: u64,
-) {
-    let reply = encode_open_reply(
-        &OpenReply {
-            flags: reply_flags,
-            token,
-            params,
-        },
-        key,
-    )
-    .unwrap();
-    socket.send_to(&reply, peer).unwrap();
-}
-
-fn open_session(
-    socket: &UdpSocket,
-    tx: &mpsc::Sender<Vec<u8>>,
-    key: Option<&[u8]>,
-) -> (Params, SocketAddr) {
-    let (packet, peer) = recv_packet(socket, tx);
-    let (params, _) = open_request(&packet, key);
-    send_open_reply(
-        socket,
-        peer,
-        params.clone(),
-        key,
-        flags::FLAG_OPEN | flags::FLAG_REPLY,
-        TOKEN,
-    );
-    (params, peer)
-}
-
-fn echo_reply(
-    params: &Params,
-    sequence: u32,
-    token: u64,
-    reply_flags: u8,
-    key: Option<&[u8]>,
-) -> Vec<u8> {
-    encode_echo_reply(
-        &EchoReply {
-            flags: reply_flags,
-            token,
-            sequence,
-            recv_count: None,
-            recv_window: None,
-            timestamps: TimestampFields::default(),
-            payload: Vec::new(),
-        },
-        params,
-        key,
-    )
-    .unwrap()
-}
-
-fn start_no_test_server() -> TestServer {
-    start_server(move |socket, tx| {
-        let (open_packet, peer) = recv_packet(&socket, &tx);
-        let (params, no_test) = open_request(&open_packet, None);
-        assert!(no_test);
-        send_open_reply(
-            &socket,
-            peer,
-            params,
-            None,
-            flags::FLAG_OPEN | flags::FLAG_REPLY | flags::FLAG_CLOSE,
-            0,
-        );
-    })
-}
-
-fn start_peer_close_server() -> TestServer {
-    start_server(move |socket, tx| {
-        let (params, peer) = open_session(&socket, &tx, None);
-        let (probe_packet, _) = recv_packet(&socket, &tx);
-        let sequence = echo_request_sequence(&probe_packet, None);
-        socket
-            .send_to(
-                &echo_reply(
-                    &params,
-                    sequence,
-                    TOKEN,
-                    flags::FLAG_REPLY | flags::FLAG_CLOSE,
-                    None,
-                ),
-                peer,
-            )
-            .unwrap();
-    })
-}
-
-fn poll_once<F: Future>(future: Pin<&mut F>) -> Poll<F::Output> {
-    let mut context = Context::from_waker(Waker::noop());
-    Future::poll(future, &mut context)
-}
-
-fn poll_recv_once(client: &mut AsyncClient) -> Poll<Result<Vec<ClientEvent>, ClientError>> {
-    let mut future = Box::pin(client.recv());
-    poll_once(Pin::as_mut(&mut future))
-}
-
-#[test]
-fn connect_requires_current_runtime_when_polled() {
-    let mut future = Box::pin(AsyncClient::connect(ClientConfig::default()));
-    assert!(matches!(
-        poll_once(Pin::as_mut(&mut future)),
-        Poll::Ready(Err(ClientError::NoTokioRuntime))
-    ));
-}
-
-#[test]
-fn recv_before_open_fails_on_first_poll_without_socket_readiness() {
-    runtime().block_on(async {
-        let remote = SocketAddr::from(([127, 0, 0, 1], 2112));
-        let mut client = AsyncClient::connect(config(remote, None, 0)).await.unwrap();
-
-        assert!(matches!(
-            poll_recv_once(&mut client),
-            Poll::Ready(Err(ClientError::NotOpen))
-        ));
-    });
-}
-
-#[test]
-fn ignored_open_traffic_cannot_extend_the_absolute_attempt_deadline() {
-    let server = start_server(move |socket, tx| {
-        let (first_packet, peer) = recv_packet(&socket, &tx);
-        let (params, _) = open_request(&first_packet, None);
-        socket
-            .set_read_timeout(Some(Duration::from_millis(10)))
-            .unwrap();
-        let started = Instant::now();
-        let mut next_noise = started;
-        let mut buffer = [0_u8; 512];
-
-        while started.elapsed() < Duration::from_millis(350) {
-            let now = Instant::now();
-            if now >= next_noise {
-                socket.send_to(&[0_u8], peer).unwrap();
-                next_noise = now + Duration::from_millis(25);
-            }
-            match socket.recv_from(&mut buffer) {
-                Ok((len, second_peer)) => {
-                    tx.send(buffer[..len].to_vec()).unwrap();
-                    send_open_reply(
-                        &socket,
-                        second_peer,
-                        params,
-                        None,
-                        flags::FLAG_OPEN | flags::FLAG_REPLY,
-                        TOKEN,
-                    );
-                    return;
-                }
-                Err(error)
-                    if matches!(
-                        error.kind(),
-                        io::ErrorKind::WouldBlock | io::ErrorKind::TimedOut
-                    ) => {}
-                Err(error) => panic!("{error}"),
-            }
-        }
-        panic!("second open request did not arrive after the first absolute deadline");
-    });
-    let mut client_config = config(server.addr, None, 0);
-    client_config.open_timeouts = vec![Duration::from_millis(200), Duration::from_millis(200)];
-
-    runtime().block_on(async {
-        let mut client = AsyncClient::connect(client_config).await.unwrap();
-        assert!(matches!(
-            client.open().await.unwrap(),
-            OpenOutcome::Started { .. }
-        ));
-    });
-    assert_eq!(server.finish().len(), 2);
-}
-
-#[test]
-fn authenticated_rejection_is_terminal_without_retry() {
-    let server = start_server(move |socket, tx| {
-        let (open_packet, peer) = recv_packet(&socket, &tx);
-        let (params, _) = open_request(&open_packet, None);
-        send_open_reply(
-            &socket,
-            peer,
-            params,
-            None,
-            flags::FLAG_OPEN | flags::FLAG_REPLY | flags::FLAG_CLOSE,
-            0,
-        );
-    });
-    let mut client_config = config(server.addr, None, 0);
-    client_config.open_timeouts = vec![Duration::from_millis(200), Duration::from_millis(200)];
-
-    runtime().block_on(async {
-        let mut client = AsyncClient::connect(client_config).await.unwrap();
-        assert!(matches!(
-            client.open().await,
-            Err(ClientError::ServerRejected)
-        ));
-        assert!(client.machine.prepare_open_request().is_ok());
-    });
-    assert_eq!(server.finish().len(), 1);
-}
-
-#[test]
-fn recv_after_local_close_and_no_test_fails_on_first_poll() {
-    let close_server = start_server(move |socket, tx| {
-        open_session(&socket, &tx, None);
-        let (close_packet, _) = recv_packet(&socket, &tx);
-        assert_eq!(close_request_token(&close_packet, None), TOKEN);
-    });
-    runtime().block_on(async {
-        let mut client = opened_client(close_server.addr, 0).await;
-        client.close().await.unwrap();
-        assert!(matches!(
-            poll_recv_once(&mut client),
-            Poll::Ready(Err(ClientError::AlreadyClosed))
-        ));
-    });
-    assert_eq!(close_server.finish().len(), 2);
-
-    let no_test_server = start_no_test_server();
-    runtime().block_on(async {
-        let mut client_config = config(no_test_server.addr, None, 0);
-        client_config.run_mode = RunMode::NoTest;
-        let mut client = AsyncClient::connect(client_config).await.unwrap();
-        client.open().await.unwrap();
-        assert!(matches!(
-            poll_recv_once(&mut client),
-            Poll::Ready(Err(ClientError::AlreadyCompleted))
-        ));
-    });
-    assert_eq!(no_test_server.finish().len(), 1);
-}
-
-#[test]
-fn authenticated_async_lifecycle_applies_negotiated_dscp() {
-    let key = b"async-lifecycle-key".to_vec();
-    let server = InTreeServer::start(ServerConfig::default().with_hmac_key(key.clone()));
-    runtime().block_on(async {
-        let mut client = AsyncClient::connect(config(server.addr, Some(key), 46))
-            .await
-            .unwrap();
-        let opened = client.open().await.unwrap();
-        assert_eq!(open_negotiated(&opened).params.dscp, 184);
-        #[cfg(not(any(
-            target_os = "fuchsia", target_os = "redox", target_os = "solaris",
-            target_os = "illumos", target_os = "haiku",
-        )))]
-        assert_eq!(socket2::SockRef::from(&client.socket).tos_v4().unwrap() >> 2, 46);
-        client.send_probe().await.unwrap();
-        assert!(matches!(client.recv().await.unwrap().as_slice(), [ClientEvent::EchoReply { seq: 0, .. }]));
-        assert!(matches!(client.close().await.unwrap().as_slice(), [ClientEvent::SessionClosed { token, .. }] if *token == open_token(&opened)));
-    });
-}
-
-#[test]
-fn blocking_and_async_peer_close_are_semantically_equivalent() {
-    let blocking_peer_close_server = start_peer_close_server();
-    let mut blocking_peer_close =
-        Client::connect(config(blocking_peer_close_server.addr, None, 0)).unwrap();
-    blocking_peer_close.open().unwrap();
-    blocking_peer_close.send_probe().unwrap();
-    let blocking_peer_close_events = blocking_peer_close.recv_once().unwrap();
-    assert!(blocking_peer_close.is_peer_closed());
-    assert_eq!(blocking_peer_close_server.finish().len(), 2);
-
-    let async_peer_close_server = start_peer_close_server();
-    let async_peer_close_events = runtime().block_on(async {
-        let mut client = AsyncClient::connect(config(async_peer_close_server.addr, None, 0))
-            .await
-            .unwrap();
-        client.open().await.unwrap();
-        client.send_probe().await.unwrap();
-        let events = client.recv().await.unwrap();
-        assert!(client.is_peer_closed());
-        events
-    });
-    assert_eq!(async_peer_close_server.finish().len(), 2);
-    assert_eq!(
-        blocking_peer_close_events.len(),
-        async_peer_close_events.len()
-    );
-    for (blocking, asynchronous) in blocking_peer_close_events
-        .iter()
-        .zip(&async_peer_close_events)
-    {
-        assert_matching_event_shape(blocking, asynchronous);
-    }
-}
-
-fn open_negotiated(outcome: &OpenOutcome) -> &crate::NegotiatedParams {
-    match outcome {
-        OpenOutcome::Started { negotiated, .. }
-        | OpenOutcome::NoTestCompleted { negotiated, .. } => negotiated,
-    }
-}
-
-fn open_token(outcome: &OpenOutcome) -> u64 {
-    match outcome {
-        OpenOutcome::Started { token, .. } => *token,
-        OpenOutcome::NoTestCompleted { .. } => panic!("no-test open has no session token"),
-    }
-}
-
-fn assert_matching_event_shape(blocking: &ClientEvent, asynchronous: &ClientEvent) {
-    assert_eq!(event_shape(blocking), event_shape(asynchronous));
-}
-
-fn event_shape(event: &ClientEvent) -> (&'static str, u64, usize) {
-    match event {
-        ClientEvent::EchoSent { seq, bytes, .. } => ("sent", u64::from(*seq), *bytes),
-        ClientEvent::EchoReply { seq, bytes, .. } => ("reply", u64::from(*seq), *bytes),
-        ClientEvent::SessionClosed { .. } => ("closed", 0, 0),
-        other => panic!("unexpected equivalence event: {other:?}"),
-    }
-}
-
-/// A peer that ignores the first `ignored_requests` datagrams before serving a
-/// compliant open, one echo, and one close.
-///
-/// Silence is the point here, so this stays a narrow fake peer rather than a
-/// real `irtt-server`: a compliant server has no way to be deliberately mute
-/// for exactly one open attempt.
-fn start_silent_then_open_server(ignored_requests: usize) -> TestServer {
-    start_server(move |socket, tx| {
-        for _ in 0..ignored_requests {
-            let _ = recv_packet(&socket, &tx);
-        }
-        let (params, peer) = open_session(&socket, &tx, None);
-        let (probe_packet, _) = recv_packet(&socket, &tx);
-        let sequence = echo_request_sequence(&probe_packet, None);
-        socket
-            .send_to(
-                &echo_reply(&params, sequence, TOKEN, flags::FLAG_REPLY, None),
-                peer,
-            )
-            .unwrap();
-        let (close_packet, _) = recv_packet(&socket, &tx);
-        assert_eq!(close_request_token(&close_packet, None), TOKEN);
-    })
-}
-
-/// Stable name for a `ClientError` variant, for comparing what each driver
-/// promises rather than how it produced it.
-fn error_name(error: &ClientError) -> &'static str {
-    match error {
-        ClientError::OpenTimeout => "open timeout",
-        ClientError::NotOpen => "not open",
-        ClientError::AlreadyOpen => "already open",
-        ClientError::AlreadyClosed => "already closed",
-        ClientError::AlreadyCompleted => "already completed",
-        ClientError::ServerRejected => "server rejected",
-        other => panic!("unexpected conformance error: {other:?}"),
-    }
-}
-
-fn probe_sequences(events: &[ClientEvent]) -> Vec<u32> {
-    events
-        .iter()
-        .filter_map(|event| match event {
-            ClientEvent::EchoSent { seq, .. } => Some(*seq),
-            _ => None,
-        })
-        .collect()
-}
-
-fn reply_sequences(events: &[ClientEvent]) -> Vec<u32> {
-    events
-        .iter()
-        .filter_map(|event| match event {
-            ClientEvent::EchoReply { seq, .. } => Some(*seq),
-            _ => None,
-        })
-        .collect()
-}
-
-#[test]
-fn blocking_and_async_roll_back_a_failed_open_and_accept_a_retry() {
-    // One open attempt is ignored, so the first open times out and the second
-    // must be able to open the same connected client.
-    let blocking_server = start_silent_then_open_server(1);
-    let mut blocking = Client::connect(config(blocking_server.addr, None, 0)).unwrap();
-    assert!(!blocking.has_pending_probes());
-    let blocking_first = blocking.open().unwrap_err();
-    assert!(!blocking.has_pending_probes());
-    let blocking_second = blocking.open().unwrap();
-    assert!(!blocking.has_pending_probes());
-    let blocking_sent = blocking.send_probe().unwrap();
-    let blocking_reply = blocking.recv_once().unwrap();
-    let blocking_close = blocking.close().unwrap();
-    assert_eq!(blocking_server.finish().len(), 4);
-
-    let async_server = start_silent_then_open_server(1);
-    let (async_first, async_second, async_sent, async_reply, async_close) =
-        runtime().block_on(async {
-            let mut client = AsyncClient::connect(config(async_server.addr, None, 0))
-                .await
-                .unwrap();
-            assert!(!client.has_pending_probes());
-            let first = client.open().await.unwrap_err();
-            assert!(!client.has_pending_probes());
-            let second = client.open().await.unwrap();
-            assert!(!client.has_pending_probes());
-            let sent = client.send_probe().await.unwrap();
-            let reply = client.recv().await.unwrap();
-            let closed = client.close().await.unwrap();
-            (first, second, sent, reply, closed)
-        });
-    assert_eq!(async_server.finish().len(), 4);
-
-    // Both drivers promise the same failure, and neither leaves the client in a
-    // state that refuses the retry.
-    assert_eq!(error_name(&blocking_first), "open timeout");
-    assert_eq!(error_name(&blocking_first), error_name(&async_first));
-    assert!(matches!(blocking_second, OpenOutcome::Started { .. }));
-    assert!(matches!(async_second, OpenOutcome::Started { .. }));
-    assert_eq!(
-        open_negotiated(&blocking_second),
-        open_negotiated(&async_second)
-    );
-    assert_eq!(open_token(&blocking_second), open_token(&async_second));
-
-    // The retried session starts a fresh probe sequence in both drivers.
-    assert_eq!(probe_sequences(&blocking_sent), [0]);
-    assert_eq!(probe_sequences(&async_sent), [0]);
-    assert_eq!(reply_sequences(&blocking_reply), [0]);
-    assert_eq!(reply_sequences(&async_reply), [0]);
-    assert_eq!(blocking_sent.len(), async_sent.len());
-    assert_eq!(blocking_reply.len(), async_reply.len());
-    assert_eq!(blocking_close.len(), async_close.len());
-    assert_matching_event_shape(&blocking_close[0], &async_close[0]);
-}
-
-#[test]
-fn blocking_and_async_complete_every_caller_paced_probe() {
-    const PROBES: u32 = 3;
-    fn caller_config(addr: SocketAddr) -> ClientConfig {
-        ClientConfig {
-            duration: Some(Duration::from_millis(1)),
-            interval: Duration::from_secs(1),
-            ..config(addr, None, 0)
-        }
-    }
-
-    let blocking_server = InTreeServer::start(ServerConfig::default());
-    let mut blocking = Client::connect(caller_config(blocking_server.addr)).unwrap();
-    let outcome = blocking.open().unwrap();
-    assert_eq!(
-        blocking.negotiated_params(),
-        Some(open_negotiated(&outcome))
-    );
-    assert!(!blocking.has_pending_probes());
-    // Oversleeping cannot invalidate this: low-level sends remain caller-owned
-    // after the negotiated duration. The compliant server has no duration cap.
-    thread::sleep(Duration::from_millis(2));
-    let mut blocking_sent = Vec::new();
-    let mut blocking_replies = Vec::new();
-    for _ in 0..PROBES {
-        blocking_sent.extend(blocking.send_probe().unwrap());
-        assert!(blocking.has_pending_probes());
-        assert!(blocking.next_probe_timeout_deadline().is_some());
-        blocking_replies.extend(blocking.recv_once().unwrap());
-        assert!(!blocking.has_pending_probes());
-    }
-    blocking.close().unwrap();
-    drop(blocking_server);
-
-    let async_server = InTreeServer::start(ServerConfig::default());
-    let (async_sent, async_replies) = runtime().block_on(async {
-        let mut client = AsyncClient::connect(caller_config(async_server.addr))
-            .await
-            .unwrap();
-        let outcome = client.open().await.unwrap();
-        assert_eq!(client.negotiated_params(), Some(open_negotiated(&outcome)));
-        tokio::time::sleep(Duration::from_millis(2)).await;
-        let mut sent = Vec::new();
-        let mut replies = Vec::new();
-        for _ in 0..PROBES {
-            sent.extend(client.send_probe().await.unwrap());
-            assert!(client.has_pending_probes());
-            assert!(client.next_probe_timeout_deadline().is_some());
-            replies.extend(client.recv().await.unwrap());
-            assert!(!client.has_pending_probes());
-        }
-        client.close().await.unwrap();
-        (sent, replies)
-    });
-    drop(async_server);
-
-    let expected: Vec<u32> = (0..PROBES).collect();
-    assert_eq!(probe_sequences(&blocking_sent), expected);
-    assert_eq!(probe_sequences(&async_sent), expected);
-    assert_eq!(reply_sequences(&blocking_replies), expected);
-    assert_eq!(reply_sequences(&async_replies), expected);
-    // Compare the whole emitted streams, not just the probe and reply events
-    // the sequence helpers keep: an extra event on either side is a difference.
-    assert_eq!(blocking_sent.len(), async_sent.len());
-    assert_eq!(blocking_replies.len(), async_replies.len());
-    for event in blocking_sent.iter().chain(&async_sent) {
-        assert!(matches!(
-            event,
-            ClientEvent::EchoSent {
-                scheduled_at: None,
-                timer_error: None,
-                ..
-            }
-        ));
-    }
-    for (blocking, asynchronous) in blocking_sent.iter().zip(&async_sent) {
-        assert_matching_event_shape(blocking, asynchronous);
-    }
-    for (blocking, asynchronous) in blocking_replies.iter().zip(&async_replies) {
-        assert_matching_event_shape(blocking, asynchronous);
-    }
-}
-
-#[test]
-fn ignored_open_traffic_uses_one_request_and_deadline_per_attempt() {
-    let server = start_server(move |socket, tx| {
-        for _ in 0..2 {
-            let (_, peer) = recv_packet(&socket, &tx);
-            for _ in 0..3 {
-                socket.send_to(&[0_u8], peer).unwrap();
-            }
-        }
-    });
-    let mut client_config = config(server.addr, None, 0);
-    client_config.open_timeouts = vec![Duration::from_millis(200), Duration::from_millis(200)];
-
-    runtime().block_on(async {
-        let mut client = AsyncClient::connect(client_config).await.unwrap();
-        assert!(matches!(client.open().await, Err(ClientError::OpenTimeout)));
-        assert!(client.machine.prepare_open_request().is_ok());
-    });
-    assert_eq!(server.finish().len(), 2);
-}

crates/irtt-client/src/client.rs

@@ -613,6 +613,3 @@ pub(crate) fn validate_datagram_length(expected: usize, actual: usize) -> Result
         Err(ClientError::DatagramLengthMismatch { expected, actual })
     }
 }
-
-#[cfg(test)]
-mod tests;

crates/irtt-client/src/client/tests/dscp.rs

@@ -1,126 +0,0 @@
-use super::*;
-
-#[test]
-#[cfg(not(any(
-    target_os = "fuchsia",
-    target_os = "redox",
-    target_os = "solaris",
-    target_os = "illumos",
-    target_os = "haiku",
-)))]
-fn normal_open_applies_negotiated_traffic_class_after_open_and_close_clears_it() {
-    let mut params = default_params();
-    // Raw wire TOS/Traffic Class byte for DSCP codepoint 46 (EF): a
-    // compliant server echoes back the raw byte it received, unchanged.
-    params.dscp = 184;
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
-        socket.send_to(&reply, peer).unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let mut config = default_test_config(server.addr);
-    config.dscp = 46;
-    let mut client = Client::connect(config).unwrap();
-
-    assert_eq!(
-        socket2::SockRef::from(&client.socket).tos_v4().unwrap() & 0xfc,
-        0
-    );
-    assert_open_started(client.open().unwrap());
-    assert_eq!(
-        socket2::SockRef::from(&client.socket).tos_v4().unwrap() & 0xfc,
-        184
-    );
-
-    client.close().unwrap();
-    assert_eq!(socket2::SockRef::from(&client.socket).tos_v4().unwrap(), 0);
-    server.join();
-}
-
-#[test]
-#[cfg(not(any(
-    target_os = "fuchsia",
-    target_os = "redox",
-    target_os = "solaris",
-    target_os = "illumos",
-    target_os = "haiku",
-)))]
-fn normal_open_uses_negotiated_traffic_class_not_requested_dscp() {
-    let mut returned = default_params();
-    returned.dscp = 0;
-    let server = open_success_server(returned);
-
-    let mut config = default_test_config(server.addr);
-    config.dscp = 46;
-    config.negotiation_policy = NegotiationPolicy::Loose;
-    let mut client = Client::connect(config).unwrap();
-
-    let negotiated = assert_open_started(client.open().unwrap());
-    assert_eq!(negotiated.params.dscp, 0);
-    assert_eq!(
-        negotiated.restrictions,
-        vec![crate::NegotiationRestriction::DscpChanged {
-            requested: 46,
-            negotiated: 0,
-        }]
-    );
-    assert_eq!(socket2::SockRef::from(&client.socket).tos_v4().unwrap(), 0);
-    server.join();
-}
-
-#[test]
-#[cfg(not(any(
-    target_os = "fuchsia",
-    target_os = "redox",
-    target_os = "solaris",
-    target_os = "illumos",
-    target_os = "haiku"
-)))]
-fn authenticated_peer_close_clears_negotiated_traffic_class() {
-    let mut params = default_params();
-    // Raw wire TOS/Traffic Class byte for DSCP codepoint 46 (EF).
-    params.dscp = 184;
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
-                peer,
-            )
-            .unwrap();
-        let (request, _) = recv_request(&socket, &tx);
-        let seq = u32::from_le_bytes(request[12..16].try_into().unwrap());
-        socket
-            .send_to(
-                &echo_reply_packet_with_flags(
-                    TOKEN,
-                    seq,
-                    &params,
-                    &TimestampFields::default(),
-                    None,
-                    FLAG_REPLY | flags::FLAG_CLOSE,
-                ),
-                peer,
-            )
-            .unwrap();
-    });
-    let mut config = default_test_config(server.addr);
-    config.dscp = 46;
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.send_probe().unwrap();
-
-    let events = client.recv_once().unwrap();
-
-    assert!(matches!(
-        events.as_slice(),
-        [
-            ClientEvent::EchoReply { .. },
-            ClientEvent::SessionClosed { .. }
-        ]
-    ));
-
-    assert_eq!(socket2::SockRef::from(&client.socket).tos_v4().unwrap(), 0);
-    server.join();
-}

crates/irtt-client/src/client/tests/hmac.rs

@@ -1,207 +0,0 @@
-use super::*;
-
-#[test]
-fn hmac_open_ignores_missing_hmac_before_valid_reply() {
-    let key = b"secret".to_vec();
-    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    config.hmac_key = Some(key.clone());
-    let params = params_from_config(&config).unwrap();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let missing = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
-        let valid = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&key));
-        socket.send_to(&missing, peer).unwrap();
-        socket.send_to(&valid, peer).unwrap();
-    });
-    config.server_addr = server.addr.to_string();
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    assert_eq!(server.rx.iter().take(1).count(), 1);
-    assert!(server.rx.try_recv().is_err());
-    server.join();
-}
-
-#[test]
-fn hmac_open_ignores_bad_hmac_before_valid_reply() {
-    let key = b"secret".to_vec();
-    let wrong_key = b"wrong".to_vec();
-    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    config.hmac_key = Some(key.clone());
-    let params = params_from_config(&config).unwrap();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let bad = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&wrong_key));
-        let valid = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&key));
-        socket.send_to(&bad, peer).unwrap();
-        socket.send_to(&valid, peer).unwrap();
-    });
-    config.server_addr = server.addr.to_string();
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    assert_eq!(server.rx.iter().take(1).count(), 1);
-    assert!(server.rx.try_recv().is_err());
-    server.join();
-}
-
-#[test]
-fn post_token_hmac_negotiation_failure_sends_authenticated_cleanup_close() {
-    let key = b"secret".to_vec();
-    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    config.hmac_key = Some(key.clone());
-    let mut returned = params_from_config(&config).unwrap();
-    returned.interval_ns += 1;
-    let server_key = key.clone();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &returned, Some(&server_key));
-        socket.send_to(&reply, peer).unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    config.server_addr = server.addr.to_string();
-    let mut client = Client::connect(config).unwrap();
-
-    assert!(matches!(
-        client.open(),
-        Err(ClientError::NegotiationRejected { .. })
-    ));
-    let packets: Vec<_> = server.rx.iter().take(2).collect();
-    let cleanup = &packets[1];
-    assert_eq!(cleanup[3], flags::FLAG_CLOSE | FLAG_HMAC);
-    verify_packet_hmac(&key, cleanup).unwrap();
-    assert_eq!(
-        u64::from_le_bytes(cleanup[4 + HMAC_SIZE..12 + HMAC_SIZE].try_into().unwrap()),
-        TOKEN
-    );
-    server.join();
-}
-
-#[test]
-fn hmac_close_packet_includes_valid_hmac() {
-    let key = b"secret".to_vec();
-    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    config.hmac_key = Some(key.clone());
-    let params = params_from_config(&config).unwrap();
-    let server_key = key.clone();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&server_key));
-        socket.send_to(&reply, peer).unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    config.server_addr = server.addr.to_string();
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.close().unwrap();
-    let packets: Vec<_> = server.rx.iter().take(2).collect();
-    let close = &packets[1];
-    assert_eq!(close[3], flags::FLAG_CLOSE | FLAG_HMAC);
-    verify_packet_hmac(&key, close).unwrap();
-    assert_eq!(
-        u64::from_le_bytes(close[4 + HMAC_SIZE..12 + HMAC_SIZE].try_into().unwrap()),
-        TOKEN
-    );
-    server.join();
-}
-
-#[test]
-fn bad_hmac_reply_is_dropped() {
-    let key = b"secret".to_vec();
-    let wrong_key = b"wrong".to_vec();
-    let params = default_params();
-    let server_key = key.clone();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&server_key));
-        socket.send_to(&reply, peer).unwrap();
-
-        socket
-            .set_read_timeout(Some(Duration::from_secs(2)))
-            .unwrap();
-        let mut buf = [0_u8; 2048];
-        if let Ok((size, _)) = socket.recv_from(&mut buf) {
-            tx.send(buf[..size].to_vec()).unwrap();
-            let seq = u32::from_le_bytes(
-                buf[4 + HMAC_SIZE + 8..4 + HMAC_SIZE + 12]
-                    .try_into()
-                    .unwrap(),
-            );
-            let ts = TimestampFields::default();
-            let reply_packet = echo_reply_packet_with_flags(
-                TOKEN,
-                seq,
-                &params,
-                &ts,
-                Some(&wrong_key),
-                FLAG_REPLY | flags::FLAG_CLOSE,
-            );
-            socket.send_to(&reply_packet, peer).unwrap();
-        }
-    });
-    let config = ClientConfig {
-        hmac_key: Some(key),
-        socket_config: crate::SocketConfig {
-            recv_timeout: Some(Duration::from_millis(200)),
-            ..Default::default()
-        },
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.send_probe().unwrap();
-    thread::sleep(Duration::from_millis(30));
-    let events = client.recv_once().unwrap();
-    assert_eq!(events.len(), 1);
-    assert!(matches!(&events[0], ClientEvent::Warning { .. }));
-    assert!(!client.is_peer_closed());
-    client.close().unwrap();
-    server.join();
-}
-
-#[test]
-fn hmac_echo_request_reply_works() {
-    let key = b"testkey".to_vec();
-    let params = default_params();
-    let server_key = key.clone();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&server_key));
-        socket.send_to(&reply, peer).unwrap();
-
-        socket
-            .set_read_timeout(Some(Duration::from_secs(2)))
-            .unwrap();
-        let mut buf = [0_u8; 2048];
-        if let Ok((size, _)) = socket.recv_from(&mut buf) {
-            tx.send(buf[..size].to_vec()).unwrap();
-            verify_packet_hmac(&server_key, &buf[..size]).unwrap();
-            let seq = u32::from_le_bytes(
-                buf[4 + HMAC_SIZE + 8..4 + HMAC_SIZE + 12]
-                    .try_into()
-                    .unwrap(),
-            );
-            let ts = TimestampFields {
-                recv_mono: Some(100),
-                send_mono: Some(200),
-                ..Default::default()
-            };
-            let reply_packet = echo_reply_packet(TOKEN, seq, &params, &ts, Some(&server_key));
-            socket.send_to(&reply_packet, peer).unwrap();
-        }
-    });
-    let config = ClientConfig {
-        hmac_key: Some(key),
-        socket_config: crate::SocketConfig {
-            recv_timeout: Some(Duration::from_millis(200)),
-            ..Default::default()
-        },
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.send_probe().unwrap();
-    thread::sleep(Duration::from_millis(50));
-    let events = client.recv_once().unwrap();
-    assert_eq!(events.len(), 1);
-    assert!(matches!(&events[0], ClientEvent::EchoReply { .. }));
-    server.join();
-}

crates/irtt-client/src/client/tests/mod.rs

@@ -1,30 +0,0 @@
-use super::*;
-use crate::config::NegotiationPolicy;
-use crate::{
-    session::machine::{
-        compute_one_way, compute_rtt, params_from_config, sequence_is_after, sequence_is_before,
-        unix_epoch_ns_i64, update_highest_received,
-    },
-    session::negotiate_params,
-    NegotiatedParams, RunMode, SignedDuration, WarningKind, MAX_UDP_PAYLOAD_LENGTH,
-};
-use irtt_proto::{flags, Params, TimestampFields, PROTOCOL_VERSION};
-use irtt_proto::{
-    flags::FLAG_HMAC, flags::FLAG_OPEN, flags::FLAG_REPLY, verify_packet_hmac, Clock,
-    ReceivedStats, StampAt, HMAC_SIZE, MAGIC,
-};
-use std::{thread, time::SystemTime};
-
-mod support;
-use support::*;
-
-mod close;
-mod config;
-mod dscp;
-mod hmac;
-mod negotiation;
-mod no_test;
-mod open;
-mod probes_replies;
-mod sequence;
-mod ttl;

crates/irtt-client/src/client/tests/negotiation.rs

@@ -1,164 +0,0 @@
-use super::*;
-use crate::NegotiationRestriction;
-
-fn assert_negotiates(
-    requested: &Params,
-    returned: &Params,
-    policy: NegotiationPolicy,
-) -> NegotiatedParams {
-    negotiate_params(requested, returned.clone(), policy)
-        .unwrap_or_else(|err| panic!("expected negotiation success, got {err:?}"))
-}
-
-fn rejection_reason(requested: &Params, returned: &Params, policy: NegotiationPolicy) -> String {
-    match negotiate_params(requested, returned.clone(), policy) {
-        Err(ClientError::NegotiationRejected { reason }) => reason,
-        other => panic!("expected negotiation rejection, got {other:?}"),
-    }
-}
-
-#[test]
-fn loose_negotiation_accepts_server_restricted_params() {
-    let config = ClientConfig::default();
-    let mut requested = params_from_config(&config).unwrap();
-    requested.length = 128;
-    let mut returned = requested.clone();
-    returned.duration_ns /= 2;
-    returned.length = 0;
-    let negotiated = assert_negotiates(&requested, &returned, NegotiationPolicy::Loose);
-    assert_eq!(
-        negotiated.restrictions,
-        vec![
-            NegotiationRestriction::DurationReduced {
-                requested_ns: requested.duration_ns,
-                negotiated_ns: returned.duration_ns,
-            },
-            NegotiationRestriction::LengthReduced {
-                requested: requested.length,
-                negotiated: returned.length,
-            },
-        ]
-    );
-}
-
-#[test]
-fn loose_negotiation_rejects_non_positive_returned_interval() {
-    let config = ClientConfig::default();
-    let requested = params_from_config(&config).unwrap();
-
-    for interval_ns in [0, -1] {
-        let mut returned = requested.clone();
-        returned.interval_ns = interval_ns;
-        assert_eq!(
-            rejection_reason(&requested, &returned, NegotiationPolicy::Loose),
-            "interval must be positive"
-        );
-    }
-}
-
-#[test]
-fn loose_negotiation_rejects_negative_returned_length() {
-    let config = ClientConfig::default();
-    let requested = params_from_config(&config).unwrap();
-    let mut returned = requested.clone();
-    returned.length = -1;
-    assert_eq!(
-        rejection_reason(&requested, &returned, NegotiationPolicy::Loose),
-        "length must be non-negative"
-    );
-}
-
-#[test]
-fn strict_negotiation_rejects_negative_returned_length() {
-    let config = ClientConfig::default();
-    let requested = params_from_config(&config).unwrap();
-    let mut returned = requested.clone();
-    returned.length = -1;
-    assert_eq!(
-        rejection_reason(&requested, &returned, NegotiationPolicy::Strict),
-        "length must be non-negative"
-    );
-}
-
-#[test]
-fn loose_negotiation_rejects_runtime_invalid_returned_dscp() {
-    let config = ClientConfig {
-        dscp: 46,
-        ..ClientConfig::default()
-    };
-    let requested = params_from_config(&config).unwrap();
-    assert_eq!(
-        requested.dscp, 184,
-        "codepoint 46 must become raw wire byte 184"
-    );
-
-    for dscp in [-1, 256] {
-        let mut returned = requested.clone();
-        returned.dscp = dscp;
-        assert_eq!(
-            rejection_reason(&requested, &returned, NegotiationPolicy::Loose),
-            "dscp must be in range 0..=255"
-        );
-    }
-
-    // A raw returned value of 184 must be accepted even though it exceeds the
-    // 0..=63 codepoint range; it is the correctly negotiated wire value for
-    // codepoint 46 and is not subject to the codepoint bound at all.
-    let returned = requested.clone();
-    assert!(
-        assert_negotiates(&requested, &returned, NegotiationPolicy::Loose)
-            .restrictions
-            .is_empty()
-    );
-}
-
-#[test]
-fn loose_negotiation_records_dscp_disabled_by_server() {
-    let config = ClientConfig {
-        dscp: 46,
-        ..ClientConfig::default()
-    };
-    let requested = params_from_config(&config).unwrap();
-    let mut returned = requested.clone();
-    returned.dscp = 0;
-
-    let negotiated = assert_negotiates(&requested, &returned, NegotiationPolicy::Loose);
-
-    assert_eq!(
-        negotiated.restrictions,
-        vec![NegotiationRestriction::DscpChanged {
-            requested: 46,
-            negotiated: 0,
-        }]
-    );
-}
-
-#[test]
-fn negotiation_rejects_unsupported_dscp_changes() {
-    let config = ClientConfig {
-        dscp: 46,
-        ..ClientConfig::default()
-    };
-    let requested = params_from_config(&config).unwrap();
-    let mut returned = requested.clone();
-    returned.dscp = 8;
-
-    assert_eq!(
-        rejection_reason(&requested, &returned, NegotiationPolicy::Loose),
-        "server returned unsupported DSCP change"
-    );
-    assert_eq!(
-        rejection_reason(&requested, &returned, NegotiationPolicy::Strict),
-        "server returned unsupported DSCP change"
-    );
-
-    let zero_config = ClientConfig::default();
-    let zero_requested = params_from_config(&zero_config).unwrap();
-    let mut returned = zero_requested.clone();
-    returned.dscp = 46;
-
-    assert_eq!(
-        rejection_reason(&zero_requested, &returned, NegotiationPolicy::Loose),
-        "server returned unsupported DSCP change"
-    );
-}

crates/irtt-client/src/client/tests/probes_replies/timing_math.rs

@@ -1,192 +0,0 @@
-use super::*;
-use crate::metadata::ReceiveMeta;
-
-#[test]
-fn server_processing_greater_than_raw_does_not_underflow() {
-    let base = Instant::now();
-    let rtt = compute_rtt(
-        &ClientTimestamp {
-            mono: base,
-            wall: SystemTime::now(),
-        },
-        &ClientTimestamp {
-            mono: base + Duration::from_nanos(1),
-            wall: SystemTime::now(),
-        },
-        &TimestampFields {
-            recv_mono: Some(0),
-            send_mono: Some(1_000_000_000),
-            ..Default::default()
-        },
-    );
-    assert_eq!(rtt.adjusted, Some(SignedDuration::from_nanos(-999_999_999)));
-    assert_eq!(rtt.effective, SignedDuration::from_nanos(-999_999_999));
-}
-
-#[test]
-fn effective_rtt_uses_raw_when_adjusted_rtt_is_unavailable() {
-    let base = Instant::now();
-    let rtt = compute_rtt(
-        &ClientTimestamp {
-            mono: base,
-            wall: SystemTime::now(),
-        },
-        &ClientTimestamp {
-            mono: base + Duration::from_nanos(42),
-            wall: SystemTime::now(),
-        },
-        &TimestampFields::default(),
-    );
-
-    assert_eq!(rtt.adjusted, None);
-    assert_eq!(rtt.effective, SignedDuration::from_duration(rtt.raw));
-}
-
-#[test]
-fn unix_epoch_ns_i64_rejects_out_of_range_wall_time() {
-    let i64_max_ns = u64::try_from(i64::MAX).unwrap();
-    let max = SystemTime::UNIX_EPOCH + Duration::from_nanos(i64_max_ns);
-    let overflow = max + Duration::from_nanos(1);
-
-    assert_eq!(unix_epoch_ns_i64(max), Some(i64::MAX));
-    assert_eq!(unix_epoch_ns_i64(overflow), None);
-}
-
-#[test]
-fn compute_one_way_omits_samples_when_client_wall_time_overflows_i64() {
-    let i64_max_ns = u64::try_from(i64::MAX).unwrap();
-    let overflow_wall =
-        SystemTime::UNIX_EPOCH + Duration::from_nanos(i64_max_ns) + Duration::from_nanos(1);
-    let sent_at = ClientTimestamp {
-        mono: Instant::now(),
-        wall: overflow_wall,
-    };
-    let received_at = ClientTimestamp {
-        mono: sent_at.mono + Duration::from_millis(40),
-        wall: overflow_wall + Duration::from_millis(40),
-    };
-    let ts = TimestampFields {
-        recv_wall: Some(i64::MAX),
-        send_wall: Some(i64::MAX),
-        ..Default::default()
-    };
-
-    assert_eq!(
-        compute_one_way(
-            &sent_at,
-            sent_at.wall,
-            &received_at,
-            None,
-            &ReceiveMeta::default(),
-            &ts
-        ),
-        None
-    );
-}
-
-#[test]
-fn compute_one_way_returns_available_direction_samples() {
-    let sent_at = ClientTimestamp {
-        mono: Instant::now(),
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(10),
-    };
-    let received_at = ClientTimestamp {
-        mono: sent_at.mono + Duration::from_millis(40),
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(10) + Duration::from_millis(40),
-    };
-    let ts = TimestampFields {
-        recv_wall: Some(10_000_000_000 + 15_000_000),
-        send_wall: Some(10_000_000_000 + 25_000_000),
-        ..Default::default()
-    };
-
-    let sample = compute_one_way(
-        &sent_at,
-        sent_at.wall,
-        &received_at,
-        None,
-        &ReceiveMeta::default(),
-        &ts,
-    )
-    .unwrap();
-    assert_eq!(
-        sample.client_to_server,
-        Some(SignedDuration::from_nanos(15_000_000))
-    );
-    assert_eq!(
-        sample.server_to_client,
-        Some(SignedDuration::from_nanos(15_000_000))
-    );
-}
-
-#[test]
-fn compute_one_way_preserves_negative_client_to_server_delay() {
-    let sent_at = ClientTimestamp {
-        mono: Instant::now(),
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(10),
-    };
-    let received_at = ClientTimestamp {
-        mono: sent_at.mono + Duration::from_millis(40),
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(10) + Duration::from_millis(40),
-    };
-    let ts = TimestampFields {
-        recv_wall: Some(10_000_000_000 - 5_000_000),
-        send_wall: Some(10_000_000_000 + 25_000_000),
-        ..Default::default()
-    };
-
-    let sample = compute_one_way(
-        &sent_at,
-        sent_at.wall,
-        &received_at,
-        None,
-        &ReceiveMeta::default(),
-        &ts,
-    )
-    .unwrap();
-
-    assert_eq!(
-        sample.client_to_server,
-        Some(SignedDuration::from_nanos(-5_000_000))
-    );
-    assert_eq!(
-        sample.server_to_client,
-        Some(SignedDuration::from_nanos(15_000_000))
-    );
-}
-
-#[test]
-fn compute_one_way_preserves_negative_server_to_client_delay() {
-    let sent_at = ClientTimestamp {
-        mono: Instant::now(),
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(10),
-    };
-    let received_at = ClientTimestamp {
-        mono: sent_at.mono + Duration::from_millis(40),
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(10) + Duration::from_millis(40),
-    };
-    let ts = TimestampFields {
-        recv_wall: Some(10_000_000_000 + 15_000_000),
-        send_wall: Some(10_000_000_000 + 45_000_000),
-        ..Default::default()
-    };
-
-    let sample = compute_one_way(
-        &sent_at,
-        sent_at.wall,
-        &received_at,
-        None,
-        &ReceiveMeta::default(),
-        &ts,
-    )
-    .unwrap();
-
-    assert_eq!(
-        sample.client_to_server,
-        Some(SignedDuration::from_nanos(15_000_000))
-    );
-    assert_eq!(
-        sample.server_to_client,
-        Some(SignedDuration::from_nanos(-5_000_000))
-    );
-}

crates/irtt-client/src/client/tests/sequence.rs

@@ -1,27 +0,0 @@
-use super::*;
-
-#[test]
-fn sequence_ordering_handles_normal_and_wrapped_values() {
-    assert!(sequence_is_after(11, 10));
-    assert!(sequence_is_before(9, 10));
-    assert!(!sequence_is_after(10, 10));
-    assert!(!sequence_is_before(10, 10));
-
-    assert!(sequence_is_after(0, u32::MAX - 1));
-    assert!(!sequence_is_before(0, u32::MAX - 1));
-    assert!(sequence_is_after(1, u32::MAX));
-    assert!(!sequence_is_before(1, u32::MAX));
-
-    assert!(sequence_is_before(u32::MAX, 1));
-    assert!(!sequence_is_after(u32::MAX, 1));
-}
-
-#[test]
-fn highest_received_seq_updates_across_wrap() {
-    let mut highest = Some(u32::MAX);
-
-    update_highest_received(&mut highest, 0);
-    assert_eq!(highest, Some(0));
-    update_highest_received(&mut highest, u32::MAX);
-    assert_eq!(highest, Some(0));
-}

crates/irtt-client/src/client/tests/ttl.rs

@@ -1,47 +0,0 @@
-use super::*;
-
-#[test]
-fn connect_accepts_valid_ttl_config_values() {
-    for ttl in [None, Some(1), Some(255)] {
-        let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 9)));
-        config.socket_config.ttl = ttl;
-        Client::connect(config).unwrap();
-    }
-}
-
-#[test]
-fn connect_applies_configured_ipv4_ttl_before_open_and_close_preserves_it() {
-    let params = Params {
-        protocol_version: PROTOCOL_VERSION,
-        duration_ns: 3_000_000_000,
-        interval_ns: 1_000_000_000,
-        received_stats: ReceivedStats::Both,
-        stamp_at: StampAt::Both,
-        clock: Clock::Both,
-        ..Params::default()
-    };
-    let server = open_success_server(params.clone());
-    let mut config = default_test_config(server.addr);
-    config.socket_config.ttl = Some(64);
-    let mut client = Client::connect(config).unwrap();
-
-    assert_eq!(socket2::SockRef::from(&client.socket).ttl_v4().unwrap(), 64);
-
-    client.open().unwrap();
-    server.join();
-
-    client.close().unwrap();
-    assert_eq!(socket2::SockRef::from(&client.socket).ttl_v4().unwrap(), 64);
-}
-
-#[test]
-fn connect_rejects_invalid_ttl_values() {
-    for ttl in [0, 256] {
-        let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 9)));
-        config.socket_config.ttl = Some(ttl);
-        assert!(matches!(
-            Client::connect(config),
-            Err(ClientError::InvalidConfig { .. })
-        ));
-    }
-}

crates/irtt-client/src/managed/blocking_tests.rs

@@ -1,379 +0,0 @@
-use std::{
-    net::{SocketAddr, UdpSocket},
-    sync::{mpsc::sync_channel, Arc, Condvar, Mutex},
-    thread::{self, JoinHandle},
-    time::{Duration, Instant},
-};
-
-use irtt_proto::{
-    decode_request, encode_echo_reply, encode_open_reply, flags, DecodedRequestKind, EchoReply,
-    OpenReply, Params, ReceivedStats, StampAt, TimestampFields,
-};
-use tokio::{runtime::Builder, time::timeout};
-
-use super::{
-    blocking::WorkerRuntime, BlockingManagedClient, ManagedClientConfig, ManagedCompletionPolicy,
-    ManagedEndReason, ManagedEvent, ManagedLifecycle, ManagedPacing, ManagedTargetConfig,
-    ManagedTargetEndReason,
-};
-use crate::ClientConfig;
-
-const TOKEN: u64 = 0x1234_5678_90ab_cdef;
-
-struct Signal {
-    value: Mutex<bool>,
-    ready: Condvar,
-}
-
-impl Signal {
-    fn set(&self) {
-        *self.value.lock().unwrap() = true;
-        self.ready.notify_all();
-    }
-
-    fn wait(&self) {
-        let value = self.value.lock().unwrap();
-        let (value, timeout) = self
-            .ready
-            .wait_timeout_while(value, Duration::from_secs(2), |value| !*value)
-            .unwrap();
-        assert!(*value && !timeout.timed_out());
-    }
-}
-
-struct EchoServer {
-    addr: SocketAddr,
-    probe: Arc<Signal>,
-    close: Arc<Signal>,
-    worker: JoinHandle<()>,
-}
-
-impl EchoServer {
-    fn start() -> Self {
-        let socket = UdpSocket::bind("127.0.0.1:0").unwrap();
-        socket
-            .set_read_timeout(Some(Duration::from_secs(3)))
-            .unwrap();
-        let addr = socket.local_addr().unwrap();
-        let probe = Arc::new(Signal {
-            value: Mutex::new(false),
-            ready: Condvar::new(),
-        });
-        let close = Arc::new(Signal {
-            value: Mutex::new(false),
-            ready: Condvar::new(),
-        });
-        let worker_probe = Arc::clone(&probe);
-        let worker_close = Arc::clone(&close);
-        let worker = thread::spawn(move || {
-            let mut buffer = [0_u8; 8192];
-            let (open_len, peer) = socket.recv_from(&mut buffer).unwrap();
-            let negotiated = match decode_request(&buffer[..open_len]).unwrap().kind {
-                DecodedRequestKind::Open { params, .. } => Params::decode(params).unwrap(),
-                other => panic!("expected an open request, got {other:?}"),
-            };
-            let reply = encode_open_reply(
-                &OpenReply {
-                    flags: flags::FLAG_OPEN | flags::FLAG_REPLY,
-                    token: TOKEN,
-                    params: negotiated.clone(),
-                },
-                None,
-            )
-            .unwrap();
-            socket.send_to(&reply, peer).unwrap();
-
-            loop {
-                let (len, packet_peer) = socket.recv_from(&mut buffer).unwrap();
-                let Ok(request) = decode_request(&buffer[..len]) else {
-                    continue;
-                };
-                match request.kind {
-                    DecodedRequestKind::Echo { sequence, .. } => {
-                        worker_probe.set();
-                        let reply = encode_echo_reply(
-                            &EchoReply {
-                                flags: flags::FLAG_REPLY,
-                                token: TOKEN,
-                                sequence,
-                                recv_count: None,
-                                recv_window: None,
-                                timestamps: TimestampFields::default(),
-                                payload: Vec::new(),
-                            },
-                            &negotiated,
-                            None,
-                        )
-                        .unwrap();
-                        socket.send_to(&reply, packet_peer).unwrap();
-                    }
-                    DecodedRequestKind::Close { .. } => {
-                        worker_close.set();
-                        return;
-                    }
-                    DecodedRequestKind::Open { .. } => {}
-                }
-            }
-        });
-        Self {
-            addr,
-            probe,
-            close,
-            worker,
-        }
-    }
-
-    fn wait_probe(&self) {
-        self.probe.wait();
-    }
-
-    fn wait_close(&self) {
-        self.close.wait();
-    }
-
-    fn finish(self) {
-        self.worker.join().unwrap();
-    }
-}
-
-fn test_runtime() -> tokio::runtime::Runtime {
-    Builder::new_current_thread()
-        .enable_io()
-        .enable_time()
-        .build()
-        .unwrap()
-}
-
-fn config(completion: ManagedCompletionPolicy) -> ManagedClientConfig {
-    ManagedClientConfig {
-        client: ClientConfig {
-            duration: Some(Duration::from_millis(120)),
-            interval: Duration::from_millis(20),
-            probe_timeout: Duration::from_millis(40),
-            open_timeouts: vec![Duration::from_millis(200)],
-            received_stats: ReceivedStats::None,
-            stamp_at: StampAt::None,
-            ..ClientConfig::default()
-        },
-        pacing: ManagedPacing::Burst,
-        completion,
-        final_drain: Duration::from_millis(5),
-        ..ManagedClientConfig::default()
-    }
-}
-
-fn target(server: &EchoServer) -> ManagedTargetConfig {
-    ManagedTargetConfig::new("target", server.addr.to_string())
-}
-
-fn assert_stopped(outcome: &super::ManagedOutcome) {
-    assert_eq!(outcome.end_reason, ManagedEndReason::StopRequested);
-}
-
-#[test]
-fn starts_without_caller_runtime_and_finishes_naturally() {
-    let server = EchoServer::start();
-    let owner = BlockingManagedClient::start(
-        config(ManagedCompletionPolicy::FinishWhenQuiescent),
-        vec![target(&server)],
-    )
-    .unwrap();
-
-    server.wait_probe();
-    let outcome = owner.join().unwrap();
-    assert_eq!(outcome.end_reason, ManagedEndReason::TargetsComplete);
-    assert_eq!(outcome.recent_target_outcomes.len(), 1);
-    assert_eq!(
-        outcome.recent_target_outcomes[0].end_reason,
-        ManagedTargetEndReason::TestComplete
-    );
-    server.wait_close();
-    server.finish();
-}
-
-#[test]
-fn subscribed_start_captures_events_from_a_short_run() {
-    let server = EchoServer::start();
-    let (owner, mut events) = BlockingManagedClient::start_with_subscription(
-        config(ManagedCompletionPolicy::FinishWhenQuiescent),
-        vec![target(&server)],
-    )
-    .unwrap();
-
-    server.wait_probe();
-    let outcome = owner.join().unwrap();
-    assert_eq!(outcome.end_reason, ManagedEndReason::TargetsComplete);
-
-    let mut saw_started = false;
-    let mut saw_finished = false;
-    let mut saw_completed = false;
-    while let Ok(event) = events.try_recv() {
-        match event {
-            ManagedEvent::Started => saw_started = true,
-            ManagedEvent::TargetFinished { .. } => saw_finished = true,
-            ManagedEvent::Completed { .. } => saw_completed = true,
-            _ => {}
-        }
-    }
-    assert!(saw_started && saw_finished && saw_completed);
-    server.wait_close();
-    server.finish();
-}
-
-#[test]
-fn external_handle_stop_ends_with_graceful_close() {
-    let server = EchoServer::start();
-    let owner = BlockingManagedClient::start(
-        config(ManagedCompletionPolicy::ExplicitStop),
-        vec![target(&server)],
-    )
-    .unwrap();
-    let handle = owner.handle();
-
-    server.wait_probe();
-    test_runtime().block_on(async {
-        timeout(Duration::from_secs(2), handle.stop())
-            .await
-            .unwrap();
-    });
-    let outcome = owner.join().unwrap();
-    assert_stopped(&outcome);
-    server.wait_close();
-    server.finish();
-}
-
-#[test]
-fn dynamic_update_reaches_background_worker() {
-    let server = EchoServer::start();
-    let owner = BlockingManagedClient::start(config(ManagedCompletionPolicy::ExplicitStop), vec![])
-        .unwrap();
-    let handle = owner.handle();
-
-    let acknowledgement = handle
-        .update_targets(vec![target(&server)])
-        .unwrap()
-        .blocking_wait()
-        .unwrap();
-    assert_eq!(acknowledgement.sequence, 1);
-    server.wait_probe();
-    test_runtime().block_on(async {
-        timeout(Duration::from_secs(2), owner.handle().stop())
-            .await
-            .unwrap();
-    });
-    assert_stopped(&owner.join().unwrap());
-    server.wait_close();
-    server.finish();
-}
-
-#[test]
-fn dropping_external_handles_does_not_stop_owner() {
-    let server = EchoServer::start();
-    let owner = BlockingManagedClient::start(
-        config(ManagedCompletionPolicy::FinishWhenQuiescent),
-        vec![target(&server)],
-    )
-    .unwrap();
-    drop(owner.handle());
-    drop(owner.handle());
-
-    server.wait_probe();
-    assert_eq!(
-        owner.join().unwrap().end_reason,
-        ManagedEndReason::TargetsComplete
-    );
-    server.wait_close();
-    server.finish();
-}
-
-#[test]
-fn dropping_owner_stops_and_joins_worker() {
-    let server = EchoServer::start();
-    let owner = BlockingManagedClient::start(
-        config(ManagedCompletionPolicy::ExplicitStop),
-        vec![target(&server)],
-    )
-    .unwrap();
-    let handle = owner.handle();
-
-    server.wait_probe();
-    drop(owner);
-    let status = handle.status();
-    assert_eq!(status.lifecycle, ManagedLifecycle::Completed);
-    assert_eq!(
-        status.final_outcome.as_ref().unwrap().end_reason,
-        ManagedEndReason::StopRequested
-    );
-    server.wait_close();
-    server.finish();
-}
-
-#[test]
-fn dropping_worker_runtime_inside_async_context_does_not_panic() {
-    test_runtime().block_on(async {
-        let runtime = Builder::new_current_thread()
-            .enable_io()
-            .enable_time()
-            .build()
-            .unwrap();
-        drop(WorkerRuntime::new(runtime));
-    });
-}
-
-#[test]
-fn worker_runtime_shutdown_is_bounded_with_blocking_work() {
-    let runtime = Builder::new_current_thread()
-        .enable_io()
-        .enable_time()
-        .build()
-        .unwrap();
-    let (started_send, started_receive) = sync_channel(0);
-    let (release_send, release_receive) = sync_channel(0);
-
-    runtime.block_on(async move {
-        tokio::task::spawn_blocking(move || {
-            started_send.send(()).unwrap();
-            release_receive.recv().unwrap();
-        });
-    });
-    started_receive
-        .recv_timeout(Duration::from_secs(2))
-        .unwrap();
-
-    let started = Instant::now();
-    WorkerRuntime::new(runtime).shutdown();
-    assert!(started.elapsed() < Duration::from_secs(2));
-    release_send.send(()).unwrap();
-}
-
-#[test]
-fn drop_after_natural_completion_preserves_outcome() {
-    let server = EchoServer::start();
-    let owner = BlockingManagedClient::start(
-        config(ManagedCompletionPolicy::FinishWhenQuiescent),
-        vec![target(&server)],
-    )
-    .unwrap();
-    let handle = owner.handle();
-    server.wait_probe();
-    server.wait_close();
-    let deadline = Instant::now() + Duration::from_secs(2);
-    let status = loop {
-        let status = handle.status();
-        if status.lifecycle == ManagedLifecycle::Completed && status.final_outcome.is_some() {
-            break status;
-        }
-        assert!(Instant::now() < deadline, "managed worker did not complete");
-        thread::sleep(Duration::from_millis(5));
-    };
-    assert_eq!(
-        status.final_outcome.as_ref().unwrap().end_reason,
-        ManagedEndReason::TargetsComplete
-    );
-    drop(owner);
-    assert_eq!(
-        handle.status().final_outcome.as_ref().unwrap().end_reason,
-        ManagedEndReason::TargetsComplete
-    );
-    server.finish();
-}

crates/irtt-client/src/managed/mod.rs

@@ -16,8 +16,5 @@ pub use model::*;
 #[cfg(feature = "tokio")]
 pub use task::*;
 
-#[cfg(all(feature = "tokio", test))]
-mod blocking_tests;
-
 #[cfg(feature = "tokio")]
 mod schedule;

crates/irtt-client/src/managed/schedule.rs

@@ -152,73 +152,3 @@ pub(crate) fn instant_abs_diff(left: Instant, right: Instant) -> Duration {
         .or_else(|| right.checked_duration_since(left))
         .unwrap_or(Duration::ZERO)
 }
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use irtt_proto::Params;
-
-    fn negotiated(duration_ns: i64) -> NegotiatedParams {
-        NegotiatedParams {
-            params: Params {
-                interval_ns: 10_000_000,
-                duration_ns,
-                ..Params::default()
-            },
-            restrictions: Vec::new(),
-        }
-    }
-
-    #[test]
-    fn missed_slots_skip_on_the_absolute_grid_only_after_commit() {
-        let start = Instant::now();
-        let mut schedule = ProbeSchedule::new(start, &negotiated(0)).unwrap();
-        for (now_ms, intended_ms, next_ms) in [(0, 0, 10), (45, 40, 50), (50, 50, 60)] {
-            let deadline = schedule.next_send_deadline().unwrap();
-            let commit = schedule
-                .preflight_managed_commit(deadline, start + Duration::from_millis(now_ms))
-                .unwrap();
-            assert_eq!(
-                commit.scheduled_at,
-                start + Duration::from_millis(intended_ms)
-            );
-            // A failed or pending submission discards this preflight.
-            assert_eq!(schedule.next_send_deadline(), Some(deadline));
-            schedule.commit(commit);
-            assert_eq!(
-                schedule.next_send_deadline(),
-                Some(start + Duration::from_millis(next_ms))
-            );
-        }
-        schedule
-            .skip_missed_slots_at(start + Duration::from_millis(85))
-            .unwrap();
-        assert_eq!(
-            schedule.next_send_deadline(),
-            Some(start + Duration::from_millis(90))
-        );
-    }
-
-    #[test]
-    fn finite_duration_excludes_its_end_even_when_a_slot_is_missed() {
-        let start = Instant::now();
-        let mut schedule = ProbeSchedule::new(start, &negotiated(20_000_000)).unwrap();
-        assert!(schedule.permit_probe_at(start + Duration::from_millis(19)));
-        let commit = schedule
-            .preflight_managed_commit(start, start + Duration::from_millis(19))
-            .unwrap();
-        schedule.commit(commit);
-        assert!(schedule.is_finished());
-
-        let mut missed = ProbeSchedule::new(start, &negotiated(20_000_000)).unwrap();
-        assert!(!missed.permit_probe_at(start + Duration::from_millis(20)));
-        assert!(missed.is_finished());
-    }
-
-    #[test]
-    fn cadence_rejects_overflow_before_commit() {
-        assert!(matches!(
-            advance_cadence(Instant::now(), Duration::MAX, Instant::now()),
-            Err(ClientError::DurationOverflow)
-        ));
-    }
-}

crates/irtt-client/src/managed/task.rs

@@ -177,74 +177,6 @@ pub struct ManagedClientHandle {
     max_live_target_generations: usize,
     status: watch::Receiver<Arc<ManagedStatus>>,
     events: broadcast::WeakSender<ManagedEvent>,
-    #[cfg(test)]
-    update_submission_hook: Option<Arc<UpdateSubmissionTestHook>>,
-}
-
-// Pauses between admission and enqueue to exercise stop/seal linearization.
-#[cfg(test)]
-#[derive(Default)]
-struct UpdateSubmissionTestHook {
-    state: std::sync::Mutex<UpdateSubmissionTestState>,
-    arrived: std::sync::Condvar,
-    released: std::sync::Condvar,
-}
-
-#[cfg(test)]
-#[derive(Default)]
-struct UpdateSubmissionTestState {
-    armed: bool,
-    arrived: bool,
-    released: bool,
-}
-
-#[cfg(test)]
-impl UpdateSubmissionTestHook {
-    fn arm(&self) {
-        self.state
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner)
-            .armed = true;
-    }
-
-    fn pause_after_admission(&self) {
-        let mut state = self
-            .state
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        if !state.armed {
-            return;
-        }
-        state.arrived = true;
-        self.arrived.notify_all();
-        while !state.released {
-            state = self
-                .released
-                .wait(state)
-                .unwrap_or_else(std::sync::PoisonError::into_inner);
-        }
-    }
-
-    fn wait_until_arrived(&self) {
-        let state = self
-            .state
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        let (state, timeout) = self
-            .arrived
-            .wait_timeout_while(state, Duration::from_secs(2), |state| !state.arrived)
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        assert!(state.arrived && !timeout.timed_out());
-    }
-
-    fn release(&self) {
-        let mut state = self
-            .state
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        state.released = true;
-        self.released.notify_all();
-    }
 }
 
 impl fmt::Debug for ManagedClientHandle {
@@ -306,11 +238,6 @@ impl ManagedClientHandle {
             });
         }
 
-        #[cfg(test)]
-        if let Some(hook) = &self.update_submission_hook {
-            hook.pause_after_admission();
-        }
-
         // Observing `Open` only permits attempting submission. A successful
         // `try_send` transfers command ownership to the driver. A concurrent
         // stop may move admission to `Stopping` before this send, allowing the
@@ -403,9 +330,6 @@ impl Future for ManagedStopReceipt {
 type ConnectFuture =
     Pin<Box<dyn Future<Output = Result<AsyncClient, ClientError>> + Send + 'static>>;
 type WakeFuture = Pin<Box<dyn Future<Output = Option<watch::Receiver<()>>> + Send + 'static>>;
-// Snapshots at publication verify status is visible before the corresponding event.
-#[cfg(test)]
-type EventObservations = Arc<std::sync::Mutex<Vec<(ManagedEvent, Arc<ManagedStatus>)>>>;
 
 fn arm_wake(mut receiver: watch::Receiver<()>) -> WakeFuture {
     Box::pin(async move {
@@ -688,6 +612,8 @@ enum OpenSessionFailureCleanup {
 /// The sole authoritative zero-or-many target driver.
 #[must_use = "ManagedClientTask must be awaited or deliberately dropped"]
 pub struct ManagedClientTask {
+    #[cfg(test)]
+    timeout_inspections: std::cell::RefCell<Vec<usize>>,
     state: DriverState,
     lifecycle: ManagedLifecycle,
     config: ManagedClientConfig,
@@ -710,20 +636,6 @@ pub struct ManagedClientTask {
     final_outcome: Option<Arc<ManagedOutcome>>,
     next_generation: u64,
     applied_command_sequence: u64,
-    #[cfg(test)]
-    event_observations: Option<EventObservations>,
-    #[cfg(test)]
-    drain_test_hook: DrainTestHook,
-    // Counts work that cannot be observed through lossy presentation events.
-    #[cfg(test)]
-    timeout_inspections: usize,
-}
-
-// Holds queued replies past the drain deadline to exercise the final receive budget.
-#[cfg(test)]
-#[derive(Default)]
-struct DrainTestHook {
-    defer_work_until_deadline: bool,
 }
 
 impl ManagedClientTask {
@@ -734,13 +646,6 @@ impl ManagedClientTask {
     }
 
     fn publish_event(&self, event: ManagedEvent) {
-        #[cfg(test)]
-        if let Some(observations) = &self.event_observations {
-            observations
-                .lock()
-                .unwrap_or_else(std::sync::PoisonError::into_inner)
-                .push((event.clone(), Arc::clone(&self.resources().status.borrow())));
-        }
         if let Some(events) = &self.resources().events {
             let _ = events.send(event);
         }
@@ -1376,22 +1281,6 @@ impl ManagedClientTask {
                 mut cleanup_failure,
                 mut post_deadline_receives_remaining,
             } => {
-                #[cfg(test)]
-                let defer_work = self.drain_test_hook.defer_work_until_deadline && now < deadline;
-                #[cfg(not(test))]
-                let defer_work = false;
-                if defer_work {
-                    self.targets[index].state = TargetState::Draining {
-                        client,
-                        drain_started_at,
-                        deadline,
-                        primary_end,
-                        cleanup_failure,
-                        post_deadline_receives_remaining,
-                    };
-                    return false;
-                }
-
                 if client
                     .next_probe_timeout_deadline()
                     .is_some_and(|timeout| timeout <= now)
@@ -1899,10 +1788,6 @@ impl ManagedClientTask {
             }
             let index = self.timeout_cursor;
             self.timeout_cursor = (self.timeout_cursor + 1) % target_len;
-            #[cfg(test)]
-            {
-                self.timeout_inspections += 1;
-            }
             if self.target_has_due_timeout(index, now) {
                 let generation = self.targets[index].instance.generation;
                 let step = self.poll_target_timeout(index, now);
@@ -1950,6 +1835,8 @@ impl ManagedClientTask {
     }
 
     fn target_has_due_timeout(&self, index: usize, now: Instant) -> bool {
+        #[cfg(test)]
+        self.timeout_inspections.borrow_mut().push(index);
         match &self.targets[index].state {
             TargetState::Active { client } => {
                 self.state != DriverState::Stopping
@@ -1958,20 +1845,9 @@ impl ManagedClientTask {
                         .next_probe_timeout_deadline()
                         .is_some_and(|deadline| deadline <= now)
             }
-            TargetState::Draining {
-                client,
-                deadline: _deadline,
-                ..
-            } => {
-                #[cfg(test)]
-                let defer_work = self.drain_test_hook.defer_work_until_deadline && now < *_deadline;
-                #[cfg(not(test))]
-                let defer_work = false;
-                !defer_work
-                    && client
-                        .next_probe_timeout_deadline()
-                        .is_some_and(|timeout| timeout <= now)
-            }
+            TargetState::Draining { client, .. } => client
+                .next_probe_timeout_deadline()
+                .is_some_and(|timeout| timeout <= now),
             _ => false,
         }
     }
@@ -2076,17 +1952,9 @@ impl ManagedClientTask {
                 TargetState::Draining {
                     client, deadline, ..
                 } => {
-                    #[cfg(test)]
-                    let defer_work = self.drain_test_hook.defer_work_until_deadline;
-                    #[cfg(not(test))]
-                    let defer_work = false;
                     non_send_deadline = non_send_deadline
                         .into_iter()
-                        .chain(
-                            (!defer_work)
-                                .then(|| client.next_probe_timeout_deadline())
-                                .flatten(),
-                        )
+                        .chain(client.next_probe_timeout_deadline())
                         .chain(Some(*deadline))
                         .min();
                 }
@@ -2454,6 +2322,8 @@ fn build_task(
         stop: Arc::clone(&stop),
     };
     let task = ManagedClientTask {
+        #[cfg(test)]
+        timeout_inspections: std::cell::RefCell::new(Vec::new()),
         state: DriverState::NotStarted,
         lifecycle: ManagedLifecycle::NotStarted,
         config,
@@ -2476,12 +2346,6 @@ fn build_task(
         final_outcome: None,
         next_generation,
         applied_command_sequence: 0,
-        #[cfg(test)]
-        event_observations: None,
-        #[cfg(test)]
-        drain_test_hook: DrainTestHook::default(),
-        #[cfg(test)]
-        timeout_inspections: 0,
     };
     let handle = ManagedClientHandle {
         stop,
@@ -2489,8 +2353,6 @@ fn build_task(
         max_live_target_generations,
         status: status_receiver,
         events: weak_events,
-        #[cfg(test)]
-        update_submission_hook: None,
     };
     Ok((task, handle))
 }
@@ -2533,5 +2395,39 @@ fn close_timeout_failure() -> ManagedTargetFailure {
 }
 
 #[cfg(test)]
-#[path = "tests.rs"]
-mod tests;
+mod tests {
+    use super::*;
+
+    // Poll latency through public events cannot distinguish an O(n) discovery
+    // scan from a bounded scan reliably. This tiny inspection trace measures
+    // work directly, including empty targets, and checks eventual coverage
+    // without asserting a cursor value or a particular visitation order.
+    #[test]
+    fn timeout_discovery_has_bounded_work_and_eventually_visits_every_target() {
+        let count = TIMEOUT_WORK_BUDGET * 2 + 1;
+        let targets = (0..count)
+            .map(|i| ManagedTargetConfig::new(i.to_string(), "127.0.0.1:2112"))
+            .collect();
+        let (mut task, _handle) = ManagedClient::task(
+            ManagedClientConfig {
+                max_live_target_generations: count,
+                ..ManagedClientConfig::default()
+            },
+            targets,
+        )
+        .unwrap();
+        let mut visited = HashSet::new();
+        for _ in 0..count.div_ceil(TIMEOUT_WORK_BUDGET) {
+            task.timeout_inspections.borrow_mut().clear();
+            task.poll_timeout_pass(Instant::now());
+            let inspected = task.timeout_inspections.borrow();
+            assert!(inspected.len() <= TIMEOUT_WORK_BUDGET);
+            visited.extend(inspected.iter().copied());
+        }
+        assert_eq!(
+            visited.len(),
+            count,
+            "timeout discovery must reach all targets"
+        );
+    }
+}

crates/irtt-client/src/metadata.rs

@@ -56,136 +56,3 @@ impl From<ReceiveMeta> for PacketMeta {
         }
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use std::time::{Duration, SystemTime};
-
-    use super::{ReceiveMeta, MAX_KERNEL_RX_LAG};
-    use crate::event::PacketMeta;
-
-    fn userspace_wall() -> SystemTime {
-        SystemTime::UNIX_EPOCH + Duration::from_secs(1_700_000_000)
-    }
-
-    fn meta_with_kernel_rx(kernel_rx_timestamp: SystemTime) -> ReceiveMeta {
-        ReceiveMeta {
-            traffic_class: None,
-            kernel_rx_timestamp: Some(kernel_rx_timestamp),
-        }
-    }
-
-    #[test]
-    fn preferred_receive_wall_without_kernel_timestamp_uses_userspace_sample() {
-        let userspace = userspace_wall();
-
-        assert_eq!(
-            ReceiveMeta::default().preferred_receive_wall(userspace),
-            userspace
-        );
-    }
-
-    #[test]
-    fn preferred_receive_wall_uses_plausible_earlier_kernel_timestamp() {
-        let userspace = userspace_wall();
-        let kernel = userspace - Duration::from_micros(80);
-
-        assert_eq!(
-            meta_with_kernel_rx(kernel).preferred_receive_wall(userspace),
-            kernel
-        );
-    }
-
-    #[test]
-    fn preferred_receive_wall_accepts_kernel_timestamp_equal_to_userspace_sample() {
-        let userspace = userspace_wall();
-
-        assert_eq!(
-            meta_with_kernel_rx(userspace).preferred_receive_wall(userspace),
-            userspace
-        );
-    }
-
-    #[test]
-    fn preferred_receive_wall_rejects_kernel_timestamp_later_than_userspace_sample() {
-        let userspace = userspace_wall();
-        let kernel = userspace + Duration::from_nanos(1);
-
-        assert_eq!(
-            meta_with_kernel_rx(kernel).preferred_receive_wall(userspace),
-            userspace
-        );
-    }
-
-    #[test]
-    fn preferred_receive_wall_accepts_kernel_timestamp_exactly_at_the_lag_bound() {
-        // The bound is inclusive: a lag of exactly MAX_KERNEL_RX_LAG is
-        // still accepted, one nanosecond more is not.
-        let userspace = userspace_wall();
-        let at_bound = userspace - MAX_KERNEL_RX_LAG;
-        let past_bound = userspace - MAX_KERNEL_RX_LAG - Duration::from_nanos(1);
-
-        assert_eq!(
-            meta_with_kernel_rx(at_bound).preferred_receive_wall(userspace),
-            at_bound
-        );
-        assert_eq!(
-            meta_with_kernel_rx(past_bound).preferred_receive_wall(userspace),
-            userspace
-        );
-    }
-
-    #[test]
-    fn metadata_preserves_kernel_timestamp_rejected_for_measurement() {
-        let userspace = userspace_wall();
-        let rejected = userspace + Duration::from_secs(30);
-        let meta = meta_with_kernel_rx(rejected);
-
-        assert_eq!(meta.preferred_receive_wall(userspace), userspace);
-        assert_eq!(
-            PacketMeta::from(meta).kernel_rx_timestamp,
-            Some(rejected),
-            "observed metadata must survive rejection as a measurement endpoint"
-        );
-    }
-
-    #[test]
-    fn metadata_observed_traffic_class_derives_dscp_and_ecn() {
-        let packet_meta = PacketMeta::from(ReceiveMeta {
-            traffic_class: Some(184),
-            kernel_rx_timestamp: None,
-        });
-
-        assert_eq!(packet_meta.traffic_class, Some(184));
-        assert_eq!(packet_meta.dscp, Some(46));
-        assert_eq!(packet_meta.ecn, Some(0));
-        assert_eq!(packet_meta.kernel_rx_timestamp, None);
-
-        let packet_meta = PacketMeta::from(ReceiveMeta {
-            traffic_class: Some(186),
-            kernel_rx_timestamp: None,
-        });
-
-        assert_eq!(packet_meta.traffic_class, Some(186));
-        assert_eq!(packet_meta.dscp, Some(46));
-        assert_eq!(packet_meta.ecn, Some(2));
-        assert_eq!(packet_meta.kernel_rx_timestamp, None);
-    }
-
-    #[test]
-    fn metadata_mapping_preserves_none_vs_observed_zero() {
-        let unavailable = PacketMeta::from(ReceiveMeta::default());
-        let observed_zero = PacketMeta::from(ReceiveMeta {
-            traffic_class: Some(0),
-            kernel_rx_timestamp: None,
-        });
-
-        assert_eq!(unavailable.traffic_class, None);
-        assert_eq!(unavailable.dscp, None);
-        assert_eq!(unavailable.ecn, None);
-
-        assert_eq!(observed_zero.traffic_class, Some(0));
-        assert_eq!(observed_zero.dscp, Some(0));
-        assert_eq!(observed_zero.ecn, Some(0));
-    }
-}

crates/irtt-client/src/probe.rs

@@ -195,12 +195,6 @@ impl PendingMap {
         self.map.is_empty()
     }
 
-    // Verify repeated or abandoned send preflights do not create pending probes.
-    #[cfg(test)]
-    pub fn len(&self) -> usize {
-        self.map.len()
-    }
-
     /// Mutable access to a still-pending probe by wire sequence, without
     /// disturbing its position in the timeout order. Used to attach an
     /// observed kernel TX timestamp to a probe that has not yet completed or
@@ -215,7 +209,7 @@ impl PendingMap {
             .map(|entry| entry.probe.timeout_at)
     }
 
-    #[cfg(any(feature = "tokio", test))]
+    #[cfg(feature = "tokio")]
     pub fn latest_timeout_deadline(&self) -> Option<Instant> {
         self.last
             .and_then(|wire_seq| self.map.get(&wire_seq))
@@ -244,12 +238,6 @@ impl PendingMap {
             );
         }
     }
-
-    // Check sequence-reuse and kernel timestamp retention without consuming a probe.
-    #[cfg(test)]
-    pub fn contains(&self, wire_seq: u32) -> bool {
-        self.map.contains_key(&wire_seq)
-    }
 }
 
 #[derive(Debug)]
@@ -305,12 +293,6 @@ impl TimedOutMap {
         self.map.values().map(|probe| probe.timeout_at).max()
     }
 
-    // Check sequence-reuse and kernel timestamp retention without consuming a probe.
-    #[cfg(test)]
-    pub fn contains(&self, wire_seq: u32) -> bool {
-        self.map.contains_key(&wire_seq)
-    }
-
     fn evict_oldest(&mut self) {
         while let Some(oldest_key) = self.insertion_order.pop_front() {
             if self.map.remove(&oldest_key).is_some() {
@@ -393,212 +375,69 @@ mod tests {
         }
     }
 
-    fn insert(map: &mut PendingMap, probe: PendingProbe) {
-        map.preflight_insert(probe.wire_seq).unwrap();
-        map.commit_insert(probe);
-    }
-
     #[test]
-    fn pending_map_rejects_over_capacity() {
-        let mut map = PendingMap::new(2);
-        let now = Instant::now();
-        map.preflight_insert(0).unwrap();
-        map.commit_insert(pending(0, now + Duration::from_secs(4)));
-        map.preflight_insert(1).unwrap();
-        map.commit_insert(pending(1, now + Duration::from_secs(4)));
-        assert!(matches!(
-            map.preflight_insert(2),
-            Err(ClientError::PendingLimitExceeded { limit: 2 })
-        ));
-    }
-
-    #[test]
-    fn pending_map_preflight_rejects_sequence_collision() {
-        let mut map = PendingMap::new(2);
-        let now = Instant::now();
-        map.preflight_insert(9).unwrap();
-        map.commit_insert(pending(9, now));
-
-        assert!(matches!(
-            map.preflight_insert(9),
-            Err(ClientError::PendingSequenceCollision { seq: 9 })
-        ));
-        assert_eq!(map.map.len(), 1);
-    }
-
-    #[test]
-    fn pending_map_unlinks_head_middle_and_tail_and_updates_extrema() {
-        let mut map = PendingMap::new(4);
-        let now = Instant::now();
-        insert(&mut map, pending(1, now + Duration::from_secs(1)));
-        insert(&mut map, pending(2, now + Duration::from_secs(2)));
-        insert(&mut map, pending(3, now + Duration::from_secs(3)));
-
-        assert_eq!(
-            map.next_timeout_deadline(),
-            Some(now + Duration::from_secs(1))
-        );
-        assert_eq!(
-            map.latest_timeout_deadline(),
-            Some(now + Duration::from_secs(3))
-        );
-
-        assert!(map.remove(2).is_some());
-        assert_eq!(
-            map.next_timeout_deadline(),
-            Some(now + Duration::from_secs(1))
-        );
-        assert_eq!(
-            map.latest_timeout_deadline(),
-            Some(now + Duration::from_secs(3))
-        );
-
-        assert!(map.remove(1).is_some());
-        assert_eq!(
-            map.next_timeout_deadline(),
-            Some(now + Duration::from_secs(3))
-        );
-        assert_eq!(
-            map.latest_timeout_deadline(),
-            Some(now + Duration::from_secs(3))
-        );
-
-        assert!(map.remove(3).is_some());
-        assert_eq!(map.next_timeout_deadline(), None);
-        assert_eq!(map.latest_timeout_deadline(), None);
-    }
-
-    #[test]
-    fn pending_map_bounded_expiration_matches_exhaustive_order() {
-        let now = Instant::now();
-        let probes = [
-            pending(1, now + Duration::from_secs(1)),
-            pending(2, now + Duration::from_secs(2)),
-            pending(3, now + Duration::from_secs(3)),
-            pending(4, now + Duration::from_secs(4)),
-        ];
-        let mut bounded = PendingMap::new(probes.len());
-        let mut exhaustive = PendingMap::new(probes.len());
-        for probe in probes.iter().cloned() {
-            insert(&mut bounded, probe.clone());
-            insert(&mut exhaustive, probe);
-        }
-
-        let empty = bounded.drain_expired_bounded(now + Duration::from_secs(4), 0);
-        assert!(empty.probes.is_empty());
-        assert!(empty.more_due);
-
-        let mut actual = Vec::new();
-        loop {
-            let batch = bounded.drain_expired_bounded(now + Duration::from_secs(4), 2);
-            actual.extend(batch.probes.into_iter().map(|probe| probe.wire_seq));
-            if !batch.more_due {
-                break;
+    fn pending_removal_and_sequence_reuse_preserve_expiry_and_capacity() {
+        let start = Instant::now();
+        // Remove the head, middle or tail, then reuse that sequence at a later
+        // deadline. Observe expiry and capacity, not private list links.
+        for removed in 0..3 {
+            let mut pending_map = PendingMap::new(3);
+            for seq in 0..3 {
+                pending_map.preflight_insert(seq).unwrap();
+                pending_map
+                    .commit_insert(pending(seq, start + Duration::from_secs(u64::from(seq))));
             }
+            assert!(matches!(
+                pending_map.preflight_insert(3),
+                Err(ClientError::PendingLimitExceeded { .. })
+            ));
+            assert_eq!(pending_map.remove(removed).unwrap().wire_seq, removed);
+            pending_map.preflight_insert(removed).unwrap();
+            let reused_deadline = start + Duration::from_secs(4);
+            pending_map.commit_insert(pending(removed, reused_deadline));
+
+            let remaining = (0..3).filter(|seq| *seq != removed).collect::<Vec<_>>();
+            for (index, seq) in remaining.iter().enumerate() {
+                assert_eq!(
+                    pending_map.next_timeout_deadline(),
+                    Some(start + Duration::from_secs(u64::from(*seq)))
+                );
+                let expired = pending_map.drain_expired_bounded(start + Duration::from_secs(3), 1);
+                assert_eq!(
+                    expired
+                        .probes
+                        .iter()
+                        .map(|probe| probe.wire_seq)
+                        .collect::<Vec<_>>(),
+                    vec![*seq]
+                );
+                assert_eq!(expired.more_due, index == 0);
+            }
+            assert_eq!(pending_map.next_timeout_deadline(), Some(reused_deadline));
+            let expired = pending_map.drain_expired_bounded(reused_deadline, 3);
+            assert_eq!(expired.probes.len(), 1);
+            assert_eq!(expired.probes[0].wire_seq, removed);
+            assert!(!expired.more_due);
+            assert!(pending_map.is_empty());
+            assert_eq!(pending_map.next_timeout_deadline(), None);
+            pending_map.preflight_insert(removed).unwrap();
+            pending_map.commit_insert(pending(removed, reused_deadline));
+            assert_eq!(pending_map.remove(removed).unwrap().wire_seq, removed);
+            assert!(pending_map.is_empty());
         }
-        let expected = exhaustive
-            .drain_expired_bounded(now + Duration::from_secs(4), usize::MAX)
-            .probes
-            .into_iter()
-            .map(|probe| probe.wire_seq)
-            .collect::<Vec<_>>();
-
-        assert_eq!(actual, expected);
-        assert_eq!(actual, vec![1, 2, 3, 4]);
     }
 
+    // Public loss/reply events cannot reveal leaked retention bookkeeping.
     #[test]
-    fn pending_map_sequence_reuse_leaves_no_stale_link() {
-        let mut map = PendingMap::new(1);
-        let now = Instant::now();
-        insert(&mut map, pending(7, now));
-        assert!(map.remove(7).is_some());
-        insert(&mut map, pending(7, now + Duration::from_secs(1)));
-
-        assert!(map.drain_expired_bounded(now, usize::MAX).probes.is_empty());
-        assert_eq!(
-            map.drain_expired_bounded(now + Duration::from_secs(1), usize::MAX)
-                .probes
-                .into_iter()
-                .map(|probe| probe.wire_seq)
-                .collect::<Vec<_>>(),
-            vec![7]
-        );
-    }
-
-    #[test]
-    fn pending_map_commit_uses_only_preflighted_map_capacity() {
-        let mut map = PendingMap::new(2);
-        let now = Instant::now();
-        map.preflight_insert(7).unwrap();
-        let capacity = map.map.capacity();
-
-        map.commit_insert(pending(7, now));
-
-        assert_eq!(map.map.capacity(), capacity);
-        assert_eq!(map.map.len(), 1);
-    }
-
-    #[test]
-    fn pending_map_mixed_removals_preserve_links() {
-        let mut map = PendingMap::new(4);
-        let now = Instant::now();
-        for seq in 1..=4 {
-            insert(
-                &mut map,
-                pending(seq, now + Duration::from_secs(u64::from(seq))),
-            );
-        }
-
-        assert!(map.remove(2).is_some());
-        let expired = map.drain_expired_bounded(now + Duration::from_secs(3), usize::MAX);
-        assert_eq!(
-            expired
-                .probes
-                .into_iter()
-                .map(|probe| probe.wire_seq)
-                .collect::<Vec<_>>(),
-            vec![1, 3]
-        );
-        assert!(map.remove(4).is_some());
-    }
-
-    #[test]
-    fn bounded_probe_tracking_evicts_oldest_entries() {
-        let mut set = CompletedSet::new(3);
-        set.insert(0);
-        set.insert(1);
-        set.insert(2);
-        assert!(set.contains(0));
-        assert!(set.contains(1));
-        assert!(set.contains(2));
-        set.insert(3);
-        assert_eq!(set.set.len(), 3);
-        assert!(!set.contains(0));
-        assert!(set.contains(3));
-
-        let mut map = TimedOutMap::new(2);
-        let now = Instant::now();
-        map.insert(pending(0, now));
-        map.insert(pending(1, now));
-        map.insert(pending(2, now));
-
-        assert_eq!(map.map.len(), 2);
-        assert!(map.remove(0).is_none());
-        assert!(map.remove(1).is_some());
-        assert!(map.remove(2).is_some());
-    }
-
-    #[test]
-    fn timed_out_map_remove_prunes_insertion_order() {
+    fn timed_out_retention_stays_bounded_after_repeated_removals() {
         let mut map = TimedOutMap::new(4);
         let now = Instant::now();
 
         for i in 0..20 {
             map.insert(pending(i, now));
             assert!(map.remove(i).is_some());
-            assert_eq!(map.map.len(), 0);
-            assert_eq!(map.insertion_order.len(), 0);
+            assert!(map.map.len() <= 4);
+            assert!(map.insertion_order.len() <= 4);
         }
     }
 }

crates/irtt-client/src/receive.rs

@@ -111,42 +111,3 @@ pub(crate) fn drain_tx_timestamps<S: std::os::fd::AsRawFd>(
 ) -> io::Result<()> {
     linux::drain_tx_timestamps(socket, on_timestamp)
 }
-
-#[cfg(all(test, feature = "tokio"))]
-mod tests {
-    use std::net::UdpSocket;
-
-    use crate::metadata::ReceiveMeta;
-
-    fn connected_loopback_pair() -> (UdpSocket, UdpSocket) {
-        let a = UdpSocket::bind("127.0.0.1:0").unwrap();
-        let b = UdpSocket::bind("127.0.0.1:0").unwrap();
-        a.connect(b.local_addr().unwrap()).unwrap();
-        b.connect(a.local_addr().unwrap()).unwrap();
-        (a, b)
-    }
-
-    #[test]
-    fn tokio_try_receive_preserves_fallback_metadata_and_would_block() {
-        let runtime = tokio::runtime::Builder::new_current_thread()
-            .enable_io()
-            .build()
-            .unwrap();
-
-        runtime.block_on(async {
-            let (sender, receiver) = connected_loopback_pair();
-            receiver.set_nonblocking(true).unwrap();
-            let receiver = tokio::net::UdpSocket::from_std(receiver).unwrap();
-            sender.send(b"tokio").unwrap();
-            receiver.readable().await.unwrap();
-
-            let mut buf = [0_u8; 16];
-            let datagram = super::try_recv_tokio_datagram(&receiver, &mut buf).unwrap();
-            assert_eq!(&buf[..datagram.len], b"tokio");
-            assert_eq!(datagram.meta, ReceiveMeta::default());
-
-            let error = super::try_recv_tokio_datagram(&receiver, &mut buf).unwrap_err();
-            assert_eq!(error.kind(), std::io::ErrorKind::WouldBlock);
-        });
-    }
-}

crates/irtt-client/src/receive/linux.rs

@@ -215,333 +215,3 @@ fn system_time_from_timespec(timespec: TimeSpec) -> Option<SystemTime> {
 /// `cmsghdr` alignment, which 8-byte alignment covers on supported targets.
 #[repr(align(8))]
 struct ControlBuffer([u8; CONTROL_LEN]);
-
-#[cfg(test)]
-mod tests {
-    use std::{
-        io,
-        net::{SocketAddr, UdpSocket},
-        time::{Duration, UNIX_EPOCH},
-    };
-
-    use nix::sys::time::TimeSpec;
-
-    use crate::{
-        event::PacketMeta,
-        receive::{configure_receive_metadata, recv_datagram},
-        socket_options::apply_traffic_class_to_socket,
-        timing::ClientTimestamp,
-    };
-
-    fn connected_ipv4_loopback_pair() -> (UdpSocket, UdpSocket) {
-        let a = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        let b = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        a.connect(b.local_addr().unwrap()).unwrap();
-        b.connect(a.local_addr().unwrap()).unwrap();
-        a.set_read_timeout(Some(Duration::from_millis(200)))
-            .unwrap();
-        b.set_read_timeout(Some(Duration::from_millis(200)))
-            .unwrap();
-        (a, b)
-    }
-
-    fn connected_ipv6_loopback_pair() -> Option<(UdpSocket, UdpSocket)> {
-        let bind_addr = SocketAddr::from(([0, 0, 0, 0, 0, 0, 0, 1], 0));
-        let a = match UdpSocket::bind(bind_addr) {
-            Ok(socket) => socket,
-            Err(error) if is_unavailable_ipv6_loopback(&error) => {
-                eprintln!(
-                    "skipping IPv6 ancillary receive test: IPv6 loopback unavailable: {error}"
-                );
-                return None;
-            }
-            Err(error) => panic!("{error}"),
-        };
-        let b = match UdpSocket::bind(bind_addr) {
-            Ok(socket) => socket,
-            Err(error) if is_unavailable_ipv6_loopback(&error) => {
-                eprintln!(
-                    "skipping IPv6 ancillary receive test: IPv6 loopback unavailable: {error}"
-                );
-                return None;
-            }
-            Err(error) => panic!("{error}"),
-        };
-        match a.connect(b.local_addr().unwrap()) {
-            Ok(()) => {}
-            Err(error) if is_unavailable_ipv6_loopback(&error) => {
-                eprintln!(
-                    "skipping IPv6 ancillary receive test: IPv6 loopback unavailable: {error}"
-                );
-                return None;
-            }
-            Err(error) => panic!("{error}"),
-        }
-        match b.connect(a.local_addr().unwrap()) {
-            Ok(()) => {}
-            Err(error) if is_unavailable_ipv6_loopback(&error) => {
-                eprintln!(
-                    "skipping IPv6 ancillary receive test: IPv6 loopback unavailable: {error}"
-                );
-                return None;
-            }
-            Err(error) => panic!("{error}"),
-        }
-        a.set_read_timeout(Some(Duration::from_millis(200)))
-            .unwrap();
-        b.set_read_timeout(Some(Duration::from_millis(200)))
-            .unwrap();
-        Some((a, b))
-    }
-
-    #[test]
-    fn recvmsg_receive_returns_length_payload_and_timestamp() {
-        let (sender, receiver) = connected_ipv4_loopback_pair();
-        configure_receive_metadata(&receiver, sender.local_addr().unwrap()).unwrap();
-        sender.send(b"hello").unwrap();
-
-        let before = ClientTimestamp::now();
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-        let after = ClientTimestamp::now();
-
-        assert_eq!(datagram.len, 5);
-        assert_eq!(&buf[..datagram.len], b"hello");
-        assert!(datagram.received_at.mono >= before.mono);
-        assert!(datagram.received_at.mono <= after.mono);
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_recvmsg_would_block_clears_readiness() {
-        let runtime = tokio::runtime::Builder::new_current_thread()
-            .enable_io()
-            .enable_time()
-            .build()
-            .unwrap();
-
-        runtime.block_on(async {
-            let (sender, receiver) = connected_ipv4_loopback_pair();
-            configure_receive_metadata(&receiver, sender.local_addr().unwrap()).unwrap();
-            receiver.set_nonblocking(true).unwrap();
-            let receiver = tokio::net::UdpSocket::from_std(receiver).unwrap();
-            let mut buf = [0_u8; 16];
-
-            sender.send(b"first").unwrap();
-            tokio::time::timeout(Duration::from_secs(1), receiver.readable())
-                .await
-                .expect("initial readability timed out")
-                .unwrap();
-
-            let first = super::try_recv_tokio_datagram(&receiver, &mut buf).unwrap();
-            assert_eq!(&buf[..first.len], b"first");
-
-            let error = super::try_recv_tokio_datagram(&receiver, &mut buf).unwrap_err();
-            assert_eq!(error.kind(), io::ErrorKind::WouldBlock);
-
-            assert!(
-                tokio::time::timeout(Duration::from_millis(20), receiver.readable())
-                    .await
-                    .is_err(),
-                "readable completed from stale readiness after recvmsg WouldBlock"
-            );
-
-            sender.send(b"second").unwrap();
-            tokio::time::timeout(Duration::from_secs(1), receiver.readable())
-                .await
-                .expect("second readability timed out")
-                .unwrap();
-
-            let second = super::try_recv_tokio_datagram(&receiver, &mut buf).unwrap();
-            assert_eq!(&buf[..second.len], b"second");
-        });
-    }
-
-    #[test]
-    fn kernel_rx_timestamp_metadata_is_observed_when_kernel_provides_it() {
-        let (sender, receiver) = connected_ipv4_loopback_pair();
-        configure_receive_metadata(&receiver, sender.local_addr().unwrap()).unwrap();
-        sender.send(b"stamp").unwrap();
-
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-        assert_eq!(datagram.len, 5);
-        assert_eq!(&buf[..datagram.len], b"stamp");
-        let Some(timestamp) = datagram.meta.kernel_rx_timestamp else {
-            eprintln!(
-                "skipping kernel timestamp assertion: kernel did not provide SCM_TIMESTAMPING"
-            );
-            return;
-        };
-
-        let duration = timestamp.duration_since(UNIX_EPOCH).unwrap();
-        assert!(duration.as_nanos() > 0);
-    }
-
-    #[test]
-    fn kernel_rx_timestamp_and_traffic_class_coexist() {
-        let (sender, receiver) = connected_ipv4_loopback_pair();
-        configure_receive_metadata(&receiver, sender.local_addr().unwrap()).unwrap();
-        apply_traffic_class_to_socket(&sender, receiver.local_addr().unwrap(), 184).unwrap();
-        sender.send(b"both").unwrap();
-
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-        assert_eq!(&buf[..datagram.len], b"both");
-
-        // Both cmsgs are requested on this socket; the parser must not
-        // depend on the order the kernel emits them in to observe either.
-        if datagram.meta.kernel_rx_timestamp.is_none() {
-            eprintln!("skipping combined assertion: kernel did not provide SCM_TIMESTAMPING");
-            return;
-        }
-        if datagram.meta.traffic_class.is_none() {
-            eprintln!("skipping combined assertion: kernel did not provide IP_TOS");
-            return;
-        }
-        assert!(datagram.meta.kernel_rx_timestamp.is_some());
-        assert_eq!(datagram.meta.traffic_class.unwrap() & 0xfc, 184);
-    }
-
-    #[test]
-    fn ipv4_traffic_class_metadata_is_observed_when_kernel_provides_it() {
-        let (sender, receiver) = connected_ipv4_loopback_pair();
-        configure_receive_metadata(&receiver, sender.local_addr().unwrap()).unwrap();
-        apply_traffic_class_to_socket(&sender, receiver.local_addr().unwrap(), 184).unwrap();
-        sender.send(b"dscp").unwrap();
-
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-        let Some(traffic_class) = datagram.meta.traffic_class else {
-            eprintln!("skipping IPv4 ancillary metadata assertion: kernel did not provide IP_TOS");
-            return;
-        };
-
-        let packet_meta = PacketMeta::from(datagram.meta);
-        assert_eq!(traffic_class & 0xfc, 184);
-        assert_eq!(packet_meta.dscp, Some(46));
-        assert_eq!(packet_meta.ecn, Some(0));
-    }
-
-    #[test]
-    fn ipv6_traffic_class_metadata_is_observed_when_kernel_provides_it() {
-        let Some((sender, receiver)) = connected_ipv6_loopback_pair() else {
-            return;
-        };
-        configure_receive_metadata(&receiver, sender.local_addr().unwrap()).unwrap();
-        apply_traffic_class_to_socket(&sender, receiver.local_addr().unwrap(), 184).unwrap();
-        sender.send(b"dscp").unwrap();
-
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-        let Some(traffic_class) = datagram.meta.traffic_class else {
-            eprintln!(
-                "skipping IPv6 ancillary metadata assertion: kernel did not provide IPV6_TCLASS"
-            );
-            return;
-        };
-
-        let packet_meta = PacketMeta::from(datagram.meta);
-        assert_eq!(traffic_class & 0xfc, 184);
-        assert_eq!(packet_meta.dscp, Some(46));
-        assert_eq!(packet_meta.ecn, Some(0));
-    }
-
-    #[test]
-    fn observed_zero_traffic_class_preserves_some_zero() {
-        let (sender, receiver) = connected_ipv4_loopback_pair();
-        configure_receive_metadata(&receiver, sender.local_addr().unwrap()).unwrap();
-        sender.send(b"zero").unwrap();
-
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-        let Some(traffic_class) = datagram.meta.traffic_class else {
-            eprintln!("skipping observed-zero assertion: kernel did not provide IP_TOS");
-            return;
-        };
-
-        let packet_meta = PacketMeta::from(datagram.meta);
-        assert_eq!(traffic_class, 0);
-        assert_eq!(packet_meta.traffic_class, Some(0));
-        assert_eq!(packet_meta.dscp, Some(0));
-        assert_eq!(packet_meta.ecn, Some(0));
-    }
-
-    #[test]
-    fn timespec_conversion_accepts_valid_unix_timestamp() {
-        let timestamp = super::system_time_from_timespec(TimeSpec::new(1, 2)).unwrap();
-
-        assert_eq!(
-            timestamp.duration_since(UNIX_EPOCH).unwrap(),
-            Duration::new(1, 2)
-        );
-    }
-
-    #[test]
-    fn timespec_conversion_rejects_negative_or_invalid_values() {
-        assert_eq!(super::system_time_from_timespec(TimeSpec::new(-1, 0)), None);
-        assert_eq!(super::system_time_from_timespec(TimeSpec::new(0, -1)), None);
-        assert_eq!(
-            super::system_time_from_timespec(TimeSpec::new(0, 1_000_000_000)),
-            None
-        );
-    }
-
-    fn is_unavailable_ipv6_loopback(error: &io::Error) -> bool {
-        matches!(
-            error.kind(),
-            io::ErrorKind::AddrNotAvailable | io::ErrorKind::Unsupported
-        )
-    }
-
-    #[test]
-    fn try_enable_tx_timestamping_then_drain_reports_ids_through_the_adapter_api() {
-        let (socket, _peer) = connected_ipv4_loopback_pair();
-        // Mirrors production: RX-only first, then a best-effort upgrade.
-        configure_receive_metadata(&socket, socket.peer_addr().unwrap()).unwrap();
-
-        if !super::try_enable_tx_timestamping(&socket) {
-            eprintln!(
-                "skipping adapter-level TX timestamping smoke test: kernel/container denied \
-                 SO_TIMESTAMPING TX flags"
-            );
-            return;
-        }
-
-        if let Err(error) = socket.send(b"one") {
-            eprintln!("skipping adapter-level TX timestamping smoke test: send failed: {error}");
-            return;
-        }
-
-        let deadline = std::time::Instant::now() + Duration::from_secs(2);
-        let mut observed = None;
-        while observed.is_none() && std::time::Instant::now() < deadline {
-            super::drain_tx_timestamps(&socket, |id, timestamp| {
-                observed = Some((id, timestamp));
-            })
-            .unwrap();
-            std::thread::yield_now();
-        }
-
-        let Some((id, timestamp)) = observed else {
-            eprintln!(
-                "skipping adapter-level TX timestamping smoke test: no TX timestamp record \
-                 arrived within the poll deadline"
-            );
-            return;
-        };
-        assert_eq!(id, 0);
-        assert!(timestamp.duration_since(UNIX_EPOCH).unwrap() > Duration::ZERO);
-    }
-
-    #[test]
-    fn drain_tx_timestamps_is_a_bounded_nonblocking_no_op_on_an_untouched_socket() {
-        let (socket, _peer) = connected_ipv4_loopback_pair();
-        configure_receive_metadata(&socket, socket.peer_addr().unwrap()).unwrap();
-
-        let mut calls = 0_usize;
-        super::drain_tx_timestamps(&socket, |_, _| calls += 1).unwrap();
-
-        assert_eq!(calls, 0);
-    }
-}

crates/irtt-client/src/receive/linux/error_queue.rs

@@ -181,448 +181,3 @@ pub(crate) fn try_recv_error_queue_record(fd: RawFd) -> io::Result<Option<ErrorQ
         Err(errno) => Err(io::Error::from(errno)),
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use std::{
-        net::{SocketAddr, UdpSocket},
-        os::fd::AsRawFd,
-        time::{Duration, Instant, UNIX_EPOCH},
-    };
-
-    use nix::sys::{
-        socket::{setsockopt, sockopt},
-        time::TimeSpec,
-    };
-
-    use super::*;
-
-    fn extended_error(
-        errno: u32,
-        origin: u8,
-        info: u32,
-        data: u32,
-    ) -> nix::libc::sock_extended_err {
-        nix::libc::sock_extended_err {
-            ee_errno: errno,
-            ee_origin: origin,
-            ee_type: 0,
-            ee_code: 0,
-            ee_pad: 0,
-            ee_info: info,
-            ee_data: data,
-        }
-    }
-
-    fn timestamps_with_system(system: TimeSpec) -> Timestamps {
-        Timestamps {
-            system,
-            hw_trans: TimeSpec::new(0, 0),
-            hw_raw: TimeSpec::new(0, 0),
-        }
-    }
-
-    fn send_timestamp_error(id: u32) -> ControlMessageOwned {
-        ControlMessageOwned::Ipv4RecvErr(
-            extended_error(
-                nix::libc::ENOMSG as u32,
-                nix::libc::SO_EE_ORIGIN_TIMESTAMPING,
-                SCM_TSTAMP_SND,
-                id,
-            ),
-            None,
-        )
-    }
-
-    #[test]
-    fn classifies_valid_send_timestamp_completion() {
-        let cmsgs = vec![
-            send_timestamp_error(7),
-            ControlMessageOwned::ScmTimestampsns(timestamps_with_system(TimeSpec::new(1, 2))),
-        ];
-
-        let record = classify(cmsgs.into_iter());
-
-        assert_eq!(
-            record,
-            ErrorQueueRecord::TxTimestamp {
-                id: 7,
-                timestamp: UNIX_EPOCH + Duration::new(1, 2),
-            }
-        );
-    }
-
-    #[test]
-    fn classifies_timestamp_origin_without_timestamp_as_malformed() {
-        let cmsgs = vec![send_timestamp_error(3)];
-
-        assert_eq!(
-            classify(cmsgs.into_iter()),
-            ErrorQueueRecord::MalformedOrUnsupportedTimestamp
-        );
-    }
-
-    #[test]
-    fn classifies_timestamp_origin_with_invalid_timespec_as_malformed() {
-        let cmsgs = vec![
-            send_timestamp_error(3),
-            ControlMessageOwned::ScmTimestampsns(timestamps_with_system(TimeSpec::new(-1, 0))),
-        ];
-
-        assert_eq!(
-            classify(cmsgs.into_iter()),
-            ErrorQueueRecord::MalformedOrUnsupportedTimestamp
-        );
-    }
-
-    #[test]
-    fn classifies_non_timestamp_extended_error_as_socket_error() {
-        let cmsgs = vec![ControlMessageOwned::Ipv4RecvErr(
-            extended_error(
-                nix::libc::ECONNREFUSED as u32,
-                nix::libc::SO_EE_ORIGIN_ICMP,
-                0,
-                0,
-            ),
-            None,
-        )];
-
-        assert_eq!(
-            classify(cmsgs.into_iter()),
-            ErrorQueueRecord::SocketError {
-                errno: nix::libc::ECONNREFUSED,
-                origin: nix::libc::SO_EE_ORIGIN_ICMP,
-            }
-        );
-    }
-
-    #[test]
-    fn classifies_timestamping_origin_with_wrong_completion_kind_as_malformed() {
-        // Same origin byte as a send-timestamp completion, but a different
-        // `ee_info` (e.g. SCM_TSTAMP_SCHED/ACK, which this client never
-        // requests). A timestamping-origin record must never become a
-        // fatal SocketError merely because it reports a completion kind we
-        // did not ask for; it stays timing metadata.
-        let cmsgs = vec![ControlMessageOwned::Ipv4RecvErr(
-            extended_error(
-                nix::libc::ENOMSG as u32,
-                nix::libc::SO_EE_ORIGIN_TIMESTAMPING,
-                1,
-                0,
-            ),
-            None,
-        )];
-
-        assert_eq!(
-            classify(cmsgs.into_iter()),
-            ErrorQueueRecord::MalformedOrUnsupportedTimestamp
-        );
-    }
-
-    #[test]
-    fn classifies_timestamping_origin_with_unexpected_errno_as_malformed() {
-        // Origin is the sole discriminator: even an origin==TIMESTAMPING
-        // record with a surprising errno (the kernel always reports ENOMSG
-        // for this origin, but classification must not assume that) is
-        // still timing metadata, never a real socket error.
-        let cmsgs = vec![ControlMessageOwned::Ipv4RecvErr(
-            extended_error(
-                nix::libc::ECONNREFUSED as u32,
-                nix::libc::SO_EE_ORIGIN_TIMESTAMPING,
-                SCM_TSTAMP_SND,
-                0,
-            ),
-            None,
-        )];
-
-        assert_eq!(
-            classify(cmsgs.into_iter()),
-            ErrorQueueRecord::MalformedOrUnsupportedTimestamp
-        );
-    }
-
-    #[test]
-    fn ignores_records_without_any_extended_error() {
-        let cmsgs = vec![ControlMessageOwned::Ipv4Tos(0)];
-
-        assert_eq!(classify(cmsgs.into_iter()), ErrorQueueRecord::Ignored);
-    }
-
-    #[test]
-    fn unknown_cmsgs_do_not_affect_classification() {
-        let cmsgs = vec![
-            ControlMessageOwned::Ipv4Tos(0),
-            send_timestamp_error(4),
-            ControlMessageOwned::ScmTimestampsns(timestamps_with_system(TimeSpec::new(9, 0))),
-        ];
-
-        assert_eq!(
-            classify(cmsgs.into_iter()),
-            ErrorQueueRecord::TxTimestamp {
-                id: 4,
-                timestamp: UNIX_EPOCH + Duration::new(9, 0),
-            }
-        );
-    }
-
-    #[test]
-    fn cmsg_order_does_not_affect_classification() {
-        let forward = classify(
-            vec![
-                send_timestamp_error(9),
-                ControlMessageOwned::ScmTimestampsns(timestamps_with_system(TimeSpec::new(5, 0))),
-            ]
-            .into_iter(),
-        );
-        let reversed = classify(
-            vec![
-                ControlMessageOwned::ScmTimestampsns(timestamps_with_system(TimeSpec::new(5, 0))),
-                send_timestamp_error(9),
-            ]
-            .into_iter(),
-        );
-
-        assert_eq!(forward, reversed);
-    }
-
-    /// Bounded poll for one error-queue record, since software TX timestamp
-    /// delivery is asynchronous even on loopback. Never sleeps hoping
-    /// delivery "probably" happened; it keeps polling until either a
-    /// record appears or the overall deadline passes.
-    fn poll_for_record(fd: RawFd, overall_timeout: Duration) -> Option<ErrorQueueRecord> {
-        let deadline = Instant::now() + overall_timeout;
-        loop {
-            if let Some(record) = try_recv_error_queue_record(fd).unwrap() {
-                return Some(record);
-            }
-            if Instant::now() >= deadline {
-                return None;
-            }
-            std::thread::yield_now();
-        }
-    }
-
-    fn tx_timestamped_loopback_socket() -> Option<(UdpSocket, UdpSocket)> {
-        let socket = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        // Held for the caller's lifetime: if this peer socket were dropped,
-        // its port would close and subsequent sends would fail with
-        // ECONNREFUSED once the kernel reports ICMP port-unreachable.
-        let peer = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        socket.connect(peer.local_addr().unwrap()).unwrap();
-
-        match setsockopt(&socket, sockopt::Timestamping, &TX_TIMESTAMPING_FLAGS) {
-            Ok(()) => Some((socket, peer)),
-            Err(error) => {
-                eprintln!(
-                    "skipping TX timestamping smoke test: kernel/container denied \
-                     SO_TIMESTAMPING TX flags: {error}"
-                );
-                None
-            }
-        }
-    }
-
-    #[test]
-    fn automatic_opt_id_increments_sequentially_across_separate_sends() {
-        let Some((socket, _peer)) = tx_timestamped_loopback_socket() else {
-            return;
-        };
-        let fd = socket.as_raw_fd();
-
-        // Under heavy parallel test load, loopback UDP sends can
-        // occasionally surface a stale ICMP-derived socket error unrelated
-        // to this test's own sockets. That is an environmental condition,
-        // not a claim this test makes about kernel TX timestamp behavior,
-        // so it is a skip rather than a failure.
-        if let Err(error) = socket.send(b"first") {
-            eprintln!("skipping automatic OPT_ID assertion: first send failed: {error}");
-            return;
-        }
-        let Some(first) = poll_for_record(fd, Duration::from_secs(2)) else {
-            eprintln!(
-                "skipping automatic OPT_ID assertion: no TX timestamp record was \
-                 delivered within the poll deadline"
-            );
-            return;
-        };
-        assert!(
-            matches!(first, ErrorQueueRecord::TxTimestamp { id: 0, .. }),
-            "expected first send to report id 0, got {first:?}"
-        );
-
-        if let Err(error) = socket.send(b"second") {
-            eprintln!("skipping automatic OPT_ID assertion: second send failed: {error}");
-            return;
-        }
-        let Some(second) = poll_for_record(fd, Duration::from_secs(2)) else {
-            eprintln!(
-                "skipping automatic OPT_ID assertion: no TX timestamp record was \
-                 delivered for the second send within the poll deadline"
-            );
-            return;
-        };
-        assert!(
-            matches!(second, ErrorQueueRecord::TxTimestamp { id: 1, .. }),
-            "expected second send to report id 1, got {second:?}"
-        );
-    }
-
-    #[test]
-    fn rx_only_sends_before_tx_enable_do_not_consume_the_later_tx_id_namespace() {
-        let socket = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        let peer = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        socket.connect(peer.local_addr().unwrap()).unwrap();
-        setsockopt(
-            &socket,
-            sockopt::Timestamping,
-            &super::super::RX_TIMESTAMPING_FLAGS,
-        )
-        .unwrap();
-
-        // Ordinary pre-enable sends: TX_SOFTWARE is not yet requested, so
-        // none of these may leave anything on the error queue for the
-        // later-enabled OPT_ID counter to have skipped past.
-        for _ in 0..3 {
-            if let Err(error) = socket.send(b"pre-enable") {
-                eprintln!("skipping pre-enable send/RX-only smoke test: {error}");
-                return;
-            }
-        }
-        assert_eq!(
-            try_recv_error_queue_record(socket.as_raw_fd()).unwrap(),
-            None,
-            "RX-only sends must never populate MSG_ERRQUEUE"
-        );
-
-        // This mirrors production: RX-only is configured first (e.g. at
-        // connect time), and only later, after a successful Open, is the
-        // socket upgraded to TX_TIMESTAMPING_FLAGS.
-        if setsockopt(&socket, sockopt::Timestamping, &TX_TIMESTAMPING_FLAGS).is_err() {
-            eprintln!(
-                "skipping pre-enable send/RX-only smoke test: kernel/container denied \
-                 SO_TIMESTAMPING TX flags"
-            );
-            return;
-        }
-
-        if let Err(error) = socket.send(b"first-timestamped") {
-            eprintln!(
-                "skipping pre-enable send/RX-only smoke test: post-upgrade send failed: {error}"
-            );
-            return;
-        }
-        let Some(record) = poll_for_record(socket.as_raw_fd(), Duration::from_secs(2)) else {
-            eprintln!(
-                "skipping pre-enable send/RX-only smoke test: no TX timestamp record was \
-                 delivered within the poll deadline"
-            );
-            return;
-        };
-        assert!(
-            matches!(record, ErrorQueueRecord::TxTimestamp { id: 0, .. }),
-            "expected the first send after upgrade to report id 0 (pre-enable sends must not \
-             have consumed part of the namespace), got {record:?}"
-        );
-    }
-
-    #[test]
-    fn normal_rx_scm_timestamping_still_works_after_tx_flags_are_enabled() {
-        let Some((socket, peer)) = tx_timestamped_loopback_socket() else {
-            return;
-        };
-        peer.send_to(b"reply", socket.local_addr().unwrap())
-            .unwrap();
-
-        let mut buf = [0_u8; 16];
-        let Ok(datagram) = super::super::recv_datagram(&socket, &mut buf) else {
-            eprintln!("skipping post-TX-enable RX smoke test: receive failed");
-            return;
-        };
-        assert_eq!(&buf[..datagram.len], b"reply");
-        let Some(timestamp) = datagram.meta.kernel_rx_timestamp else {
-            eprintln!(
-                "skipping post-TX-enable RX smoke test: kernel did not provide SCM_TIMESTAMPING"
-            );
-            return;
-        };
-        assert!(timestamp.duration_since(std::time::UNIX_EPOCH).unwrap() > Duration::ZERO);
-    }
-
-    #[test]
-    fn tx_timestamp_and_normal_reply_streams_do_not_interfere() {
-        let Some((socket, peer)) = tx_timestamped_loopback_socket() else {
-            return;
-        };
-        let fd = socket.as_raw_fd();
-
-        if let Err(error) = socket.send(b"ping") {
-            eprintln!("skipping TX/RX separation smoke test: ping send failed: {error}");
-            return;
-        }
-        let mut incoming = [0_u8; 16];
-        let Ok((len, from)) = peer.recv_from(&mut incoming) else {
-            eprintln!("skipping TX/RX separation smoke test: peer never observed ping");
-            return;
-        };
-        assert_eq!(&incoming[..len], b"ping");
-        peer.send_to(b"pong", from).unwrap();
-
-        // Reading the normal payload must not require, wait for, or be
-        // disturbed by draining MSG_ERRQUEUE first.
-        let mut reply_buf = [0_u8; 16];
-        let Ok(datagram) = super::super::recv_datagram(&socket, &mut reply_buf) else {
-            eprintln!("skipping TX/RX separation smoke test: normal receive failed");
-            return;
-        };
-        assert_eq!(&reply_buf[..datagram.len], b"pong");
-
-        // The TX timestamp for "ping" is still independently available on
-        // the error queue, unconsumed by the normal receive above.
-        let Some(record) = poll_for_record(fd, Duration::from_secs(2)) else {
-            eprintln!("skipping TX/RX separation smoke test: no TX timestamp record arrived");
-            return;
-        };
-        assert!(matches!(
-            record,
-            ErrorQueueRecord::TxTimestamp { id: 0, .. }
-        ));
-    }
-
-    #[test]
-    fn tx_timestamp_correlation_does_not_depend_on_original_payload() {
-        let Some((socket, _peer)) = tx_timestamped_loopback_socket() else {
-            return;
-        };
-
-        // OPT_TSONLY notifications never carry the original payload; a
-        // larger payload must classify identically to the zero-length one
-        // used elsewhere, since correlation is by `id` alone.
-        let payload = vec![0x5A_u8; 512];
-        if let Err(error) = socket.send(&payload) {
-            eprintln!("skipping OPT_TSONLY payload-independence smoke test: send failed: {error}");
-            return;
-        }
-        let Some(record) = poll_for_record(socket.as_raw_fd(), Duration::from_secs(2)) else {
-            eprintln!(
-                "skipping OPT_TSONLY payload-independence smoke test: no TX timestamp record \
-                 arrived"
-            );
-            return;
-        };
-        assert!(matches!(
-            record,
-            ErrorQueueRecord::TxTimestamp { id: 0, .. }
-        ));
-    }
-
-    // NOTE: There is no live test for whether a failed nonblocking `sendmsg`
-    // consumes an automatic OPT_ID. Forcing a reliable, non-flaky `WouldBlock`
-    // on a connected loopback UDP socket (for example through socket-buffer
-    // saturation) has no deterministic OS-level mechanism in this environment,
-    // and the repository's testing policy forbids sleep/saturation-based
-    // flakiness. The correlation is intentionally best effort: a kernel ID can
-    // theoretically be consumed by a send that later fails. The deterministic
-    // adapter test covers only the local half: an injected `WouldBlock` does
-    // not advance the local wire-sequence counter. Any later unmatched kernel
-    // timestamp is discarded and the userspace `sent_at` remains the fallback.
-}

crates/irtt-client/src/session/negotiation.rs

@@ -346,113 +346,3 @@ fn record_restriction(
     restrictions.push(restriction);
     Ok(())
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use irtt_proto::{Clock, ReceivedStats, ServerFill, StampAt};
-
-    fn default_params() -> Params {
-        Params {
-            protocol_version: PROTOCOL_VERSION,
-            duration_ns: 3_000_000_000,
-            interval_ns: 1_000_000_000,
-            length: 256,
-            received_stats: ReceivedStats::Both,
-            stamp_at: StampAt::Both,
-            clock: Clock::Both,
-            // Raw wire TOS/Traffic Class byte for DSCP codepoint 46 (EF).
-            dscp: 184,
-            server_fill: Some(ServerFill {
-                value: "rand".to_owned(),
-            }),
-        }
-    }
-
-    fn assert_rejected(requested: &Params, returned: &Params, policy: NegotiationPolicy) {
-        assert!(matches!(
-            negotiate_params(requested, returned.clone(), policy),
-            Err(ClientError::NegotiationRejected { .. })
-        ));
-    }
-
-    fn assert_negotiates(
-        requested: &Params,
-        returned: &Params,
-        policy: NegotiationPolicy,
-    ) -> NegotiatedParams {
-        negotiate_params(requested, returned.clone(), policy)
-            .unwrap_or_else(|err| panic!("expected negotiation success, got {err:?}"))
-    }
-
-    fn rejection_reason(
-        requested: &Params,
-        returned: &Params,
-        policy: NegotiationPolicy,
-    ) -> String {
-        match negotiate_params(requested, returned.clone(), policy) {
-            Err(ClientError::NegotiationRejected { reason }) => reason,
-            other => panic!("expected negotiation rejection, got {other:?}"),
-        }
-    }
-
-    #[test]
-    fn loose_duration_negotiation_uses_run_duration_semantics() {
-        let requested = default_params();
-
-        let mut returned = requested.clone();
-        returned.duration_ns = requested.duration_ns / 2;
-        let negotiated = assert_negotiates(&requested, &returned, NegotiationPolicy::Loose);
-        assert_eq!(
-            negotiated.restrictions,
-            vec![NegotiationRestriction::DurationReduced {
-                requested_ns: requested.duration_ns,
-                negotiated_ns: returned.duration_ns,
-            }]
-        );
-
-        let mut returned = requested.clone();
-        returned.duration_ns = requested.duration_ns + 1;
-        assert_eq!(
-            rejection_reason(&requested, &returned, NegotiationPolicy::Loose),
-            "duration increased"
-        );
-
-        let mut returned = requested.clone();
-        returned.duration_ns = 0;
-        assert_eq!(
-            rejection_reason(&requested, &returned, NegotiationPolicy::Loose),
-            "server returned continuous duration for finite request"
-        );
-
-        let mut continuous_requested = requested.clone();
-        continuous_requested.duration_ns = 0;
-        let mut finite_returned = continuous_requested.clone();
-        finite_returned.duration_ns = 1_000_000_000;
-        let negotiated = assert_negotiates(
-            &continuous_requested,
-            &finite_returned,
-            NegotiationPolicy::Loose,
-        );
-        assert_eq!(
-            negotiated.restrictions,
-            vec![NegotiationRestriction::DurationReduced {
-                requested_ns: 0,
-                negotiated_ns: finite_returned.duration_ns,
-            }]
-        );
-
-        assert_rejected(
-            &continuous_requested,
-            &finite_returned,
-            NegotiationPolicy::Strict,
-        );
-
-        assert!(negotiate_params(
-            &continuous_requested,
-            continuous_requested.clone(),
-            NegotiationPolicy::Strict
-        )
-        .is_ok());
-    }
-}

crates/irtt-client/src/socket.rs

@@ -158,166 +158,3 @@ pub(crate) fn connect_tokio_udp_socket(
     socket.set_nonblocking(true)?;
     Ok(tokio::net::UdpSocket::from_std(socket)?)
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn normalize_server_addr_adds_default_ports() {
-        assert_eq!(normalize_server_addr("127.0.0.1"), "127.0.0.1:2112");
-        assert_eq!(normalize_server_addr("127.0.0.1:1234"), "127.0.0.1:1234");
-        assert_eq!(normalize_server_addr("localhost"), "localhost:2112");
-        assert_eq!(normalize_server_addr("localhost:1234"), "localhost:1234");
-        assert_eq!(normalize_server_addr("::1"), "[::1]:2112");
-        assert_eq!(normalize_server_addr("[::1]"), "[::1]:2112");
-        assert_eq!(normalize_server_addr("[::1]:1234"), "[::1]:1234");
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_ipv6_only_is_applied_before_bind() {
-        let config = SocketConfig {
-            ipv6_only: true,
-            ..SocketConfig::default()
-        };
-        let remote = SocketAddr::from(([0, 0, 0, 0, 0, 0, 0, 1], DEFAULT_PORT));
-
-        let socket = create_prebind_udp_socket(&config, remote).unwrap();
-
-        assert!(socket.only_v6().unwrap());
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_ipv6_socket_preserves_v6only_and_explicit_bind() {
-        let bind_addr = SocketAddr::from(([0, 0, 0, 0, 0, 0, 0, 1], 0));
-        let peer = match UdpSocket::bind(bind_addr) {
-            Ok(peer) => peer,
-            Err(error) if ipv6_loopback_unavailable(&error) => {
-                eprintln!("skipping IPv6 Tokio socket test: IPv6 loopback unavailable: {error}");
-                return;
-            }
-            Err(error) => panic!("{error}"),
-        };
-        let remote = peer.local_addr().unwrap();
-        let config = SocketConfig {
-            bind_addr: Some(bind_addr),
-            ipv6_only: true,
-            ..SocketConfig::default()
-        };
-
-        tokio_runtime().block_on(async {
-            let socket = connect_tokio_udp_socket(&config, remote).unwrap();
-
-            assert!(socket2::SockRef::from(&socket).only_v6().unwrap());
-            assert!(socket.local_addr().unwrap().is_ipv6());
-            assert_eq!(socket.local_addr().unwrap().ip(), bind_addr.ip());
-            assert_eq!(socket.peer_addr().unwrap(), remote);
-        });
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_ipv4_socket_preserves_family_bind_peer_and_ttl() {
-        let peer = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        let remote = peer.local_addr().unwrap();
-        let bind_addr = SocketAddr::from(([127, 0, 0, 1], 0));
-        let config = SocketConfig {
-            bind_addr: Some(bind_addr),
-            ttl: Some(64),
-            ..SocketConfig::default()
-        };
-
-        tokio_runtime().block_on(async {
-            let socket = connect_tokio_udp_socket(&config, remote).unwrap();
-
-            assert!(socket.local_addr().unwrap().is_ipv4());
-            assert_eq!(socket.local_addr().unwrap().ip(), bind_addr.ip());
-            assert_eq!(socket.peer_addr().unwrap(), remote);
-            assert_eq!(socket2::SockRef::from(&socket).ttl_v4().unwrap(), 64);
-        });
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_resolver_filters_address_families() {
-        let mut config = ClientConfig {
-            server_addr: "localhost:2112".to_owned(),
-            ..ClientConfig::default()
-        };
-        config.socket_config.ipv4_only = true;
-
-        tokio_runtime().block_on(async {
-            let remote = resolve_remote_tokio(&config).await.unwrap();
-
-            assert!(remote.is_ipv4());
-        });
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_resolver_selects_ipv6_for_ipv6_only_hostname() {
-        let mut config = ClientConfig {
-            server_addr: "localhost:2112".to_owned(),
-            ..ClientConfig::default()
-        };
-        config.socket_config.ipv6_only = true;
-
-        tokio_runtime().block_on(async {
-            let remote = resolve_remote_tokio(&config).await.unwrap();
-            assert!(remote.is_ipv6());
-        });
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_resolver_rejects_disallowed_literal_family() {
-        let mut config = ClientConfig {
-            server_addr: "127.0.0.1:2112".to_owned(),
-            ..ClientConfig::default()
-        };
-        config.socket_config.ipv6_only = true;
-
-        tokio_runtime().block_on(async {
-            assert!(matches!(
-                resolve_remote_tokio(&config).await,
-                Err(ClientError::Resolve { .. })
-            ));
-        });
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_resolver_rejects_mixed_family_restrictions() {
-        let mut config = ClientConfig {
-            server_addr: "127.0.0.1:2112".to_owned(),
-            ..ClientConfig::default()
-        };
-        config.socket_config.ipv4_only = true;
-        config.socket_config.ipv6_only = true;
-
-        tokio_runtime().block_on(async {
-            assert!(matches!(
-                resolve_remote_tokio(&config).await,
-                Err(ClientError::Resolve { .. })
-            ));
-        });
-    }
-
-    #[cfg(feature = "tokio")]
-    fn tokio_runtime() -> tokio::runtime::Runtime {
-        tokio::runtime::Builder::new_current_thread()
-            .enable_io()
-            .build()
-            .unwrap()
-    }
-
-    #[cfg(feature = "tokio")]
-    fn ipv6_loopback_unavailable(error: &std::io::Error) -> bool {
-        matches!(
-            error.kind(),
-            std::io::ErrorKind::AddrNotAvailable | std::io::ErrorKind::Unsupported
-        )
-    }
-}

crates/irtt-client/tests/client.rs

@@ -0,0 +1,8 @@
+use irtt_client::*;
+use std::{
+    net::SocketAddr,
+    time::{Duration, Instant},
+};
+
+#[path = "client/mod.rs"]
+mod client;

crates/irtt-client/tests/client/close.rs

@@ -2,8 +2,7 @@ use super::*;
 
 #[test]
 fn open_fails_after_close() {
-    let config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    let params = params_from_config(&config).unwrap();
+    let params = default_params();
     let server = start_fake_server(move |socket, tx| {
         let (_, peer) = recv_request(&socket, &tx);
         let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
@@ -123,7 +122,7 @@ fn close_flagged_duplicate_emits_duplicate_then_closes() {
         }
     });
     let mut client = Client::connect(ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },
@@ -181,7 +180,7 @@ fn close_flagged_retained_timeout_emits_late_then_closes() {
     });
     let mut client = Client::connect(ClientConfig {
         probe_timeout: Duration::from_millis(50),
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },
@@ -276,7 +275,7 @@ fn close_flagged_evicted_sequence_emits_late_then_closes() {
     });
     let mut client = Client::connect(ClientConfig {
         max_pending_probes: 1,
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },
@@ -340,7 +339,7 @@ fn close_flagged_untracked_sequence_emits_warning_then_closes() {
         }
     });
     let mut client = Client::connect(ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },
@@ -398,7 +397,7 @@ fn wrong_token_close_flag_does_not_close_session() {
         }
     });
     let mut client = Client::connect(ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },
@@ -453,7 +452,7 @@ fn close_flagged_echo_reply_emits_reply_then_closes_without_sending_close() {
         }
     });
     let config = ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },

crates/irtt-client/tests/client/hmac.rs

@@ -0,0 +1,76 @@
+use super::*;
+
+#[test]
+fn hmac_open_ignores_missing_hmac_before_valid_reply() {
+    let key = b"secret".to_vec();
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.hmac_key = Some(key.clone());
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let missing = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        let valid = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&key));
+        socket.send_to(&missing, peer).unwrap();
+        socket.send_to(&valid, peer).unwrap();
+    });
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    assert_eq!(server.rx.iter().take(1).count(), 1);
+    assert!(server.rx.try_recv().is_err());
+    server.join();
+}
+
+#[test]
+fn hmac_open_ignores_bad_hmac_before_valid_reply() {
+    let key = b"secret".to_vec();
+    let wrong_key = b"wrong".to_vec();
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.hmac_key = Some(key.clone());
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let bad = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&wrong_key));
+        let valid = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&key));
+        socket.send_to(&bad, peer).unwrap();
+        socket.send_to(&valid, peer).unwrap();
+    });
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    assert_eq!(server.rx.iter().take(1).count(), 1);
+    assert!(server.rx.try_recv().is_err());
+    server.join();
+}
+
+#[test]
+fn post_token_hmac_negotiation_failure_sends_authenticated_cleanup_close() {
+    let key = b"secret".to_vec();
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.hmac_key = Some(key.clone());
+    let mut returned = default_params();
+    returned.interval_ns += 1;
+    let server_key = key.clone();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &returned, Some(&server_key));
+        socket.send_to(&reply, peer).unwrap();
+        let _ = recv_request(&socket, &tx);
+    });
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+
+    assert!(matches!(
+        client.open(),
+        Err(ClientError::NegotiationRejected { .. })
+    ));
+    let packets: Vec<_> = server.rx.iter().take(2).collect();
+    let cleanup = &packets[1];
+    assert_eq!(cleanup[3], flags::FLAG_CLOSE | FLAG_HMAC);
+    verify_packet_hmac(&key, cleanup).unwrap();
+    assert_eq!(
+        u64::from_le_bytes(cleanup[4 + HMAC_SIZE..12 + HMAC_SIZE].try_into().unwrap()),
+        TOKEN
+    );
+    server.join();
+}

crates/irtt-client/tests/client/mod.rs

@@ -0,0 +1,22 @@
+use super::*;
+use irtt_client::NegotiationPolicy;
+use irtt_client::{NegotiatedParams, RunMode, WarningKind, MAX_UDP_PAYLOAD_LENGTH};
+use irtt_proto::{flags, Params, TimestampFields};
+use irtt_proto::{
+    flags::FLAG_HMAC, flags::FLAG_OPEN, flags::FLAG_REPLY, verify_packet_hmac, Clock, HMAC_SIZE,
+    MAGIC,
+};
+use std::thread;
+#[cfg(all(target_os = "linux", feature = "ancillary"))]
+use std::time::SystemTime;
+
+mod support;
+use support::*;
+
+mod close;
+mod config;
+mod hmac;
+mod no_test;
+mod open;
+mod probes_replies;
+mod ttl;

crates/irtt-client/tests/client/no_test.rs

@@ -4,7 +4,7 @@ use super::*;
 fn no_test_rejects_non_close_open_reply() {
     let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
     config.run_mode = RunMode::NoTest;
-    let params = params_from_config(&config).unwrap();
+    let params = default_params();
     let server = start_fake_server(move |socket, tx| {
         let (_, peer) = recv_request(&socket, &tx);
         socket
@@ -27,7 +27,6 @@ fn no_test_rejects_non_close_open_reply() {
         u64::from_le_bytes(packets[1][4..12].try_into().unwrap()),
         TOKEN
     );
-    assert!(client.runtime.prepare_open_request().is_ok());
     server.join();
 }
 
@@ -35,7 +34,7 @@ fn no_test_rejects_non_close_open_reply() {
 fn no_test_rejects_non_zero_token_with_close_reply() {
     let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
     config.run_mode = RunMode::NoTest;
-    let params = params_from_config(&config).unwrap();
+    let params = default_params();
     let server = no_test_server(params, TOKEN);
     config.server_addr = server.addr.to_string();
     let mut client = Client::connect(config).unwrap();
@@ -50,7 +49,7 @@ fn no_test_rejects_non_zero_token_with_close_reply() {
 fn no_test_strict_negotiation_rejects_changed_params() {
     let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
     config.run_mode = RunMode::NoTest;
-    let mut params = params_from_config(&config).unwrap();
+    let mut params = default_params();
     params.dscp = 1;
     let server = no_test_server(params, 0);
     config.server_addr = server.addr.to_string();
@@ -67,7 +66,7 @@ fn no_test_loose_negotiation_accepts_restricted_params() {
     let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
     config.run_mode = RunMode::NoTest;
     config.negotiation_policy = NegotiationPolicy::Loose;
-    let requested = params_from_config(&config).unwrap();
+    let requested = default_params();
     let mut params = requested.clone();
     params.duration_ns /= 2;
     let server = no_test_server(params.clone(), 0);
@@ -77,7 +76,7 @@ fn no_test_loose_negotiation_accepts_restricted_params() {
     assert_eq!(negotiated.params, params);
     assert_eq!(
         negotiated.restrictions,
-        vec![crate::NegotiationRestriction::DurationReduced {
+        vec![irtt_client::NegotiationRestriction::DurationReduced {
             requested_ns: requested.duration_ns,
             negotiated_ns: params.duration_ns,
         }]
@@ -89,7 +88,7 @@ fn no_test_loose_negotiation_accepts_restricted_params() {
 fn send_probe_fails_after_no_test_completed() {
     let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
     config.run_mode = RunMode::NoTest;
-    let params = params_from_config(&config).unwrap();
+    let params = default_params();
     let server = no_test_server(params, 0);
     config.server_addr = server.addr.to_string();
     let mut client = Client::connect(config).unwrap();
@@ -105,7 +104,7 @@ fn send_probe_fails_after_no_test_completed() {
 fn open_fails_after_no_test_completed() {
     let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
     config.run_mode = RunMode::NoTest;
-    let params = params_from_config(&config).unwrap();
+    let params = default_params();
     let server = no_test_server(params, 0);
     config.server_addr = server.addr.to_string();
     let mut client = Client::connect(config).unwrap();

crates/irtt-client/tests/client/open.rs

@@ -1,9 +1,29 @@
 use super::*;
 
+// Untrusted returned intervals must be rejected before managed scheduling,
+// even when loose negotiation permits legitimate server restrictions.
+#[test]
+fn loose_open_rejects_nonpositive_returned_intervals() {
+    for interval_ns in [0, -1] {
+        let mut returned = default_params();
+        returned.interval_ns = interval_ns;
+        let server = open_success_server(returned);
+        let config = ClientConfig {
+            negotiation_policy: NegotiationPolicy::Loose,
+            ..default_test_config(server.addr)
+        };
+        let mut client = Client::connect(config).unwrap();
+        assert!(
+            matches!(client.open(), Err(ClientError::NegotiationRejected { .. })),
+            "returned interval {interval_ns} must be rejected"
+        );
+        server.join();
+    }
+}
+
 #[test]
 fn open_fails_when_already_open() {
-    let config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    let params = params_from_config(&config).unwrap();
+    let params = default_params();
     let server = open_success_server(params);
     let mut client = Client::connect(default_test_config(server.addr)).unwrap();
     assert_open_started(client.open().unwrap());
@@ -36,7 +56,7 @@ fn open_retries_after_first_timeout() {
 fn protocol_version_mismatch_fails() {
     let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
     config.negotiation_policy = NegotiationPolicy::Loose;
-    let mut params = params_from_config(&config).unwrap();
+    let mut params = default_params();
     params.protocol_version = 2;
     let server = open_success_server(params);
     let mut client = Client::connect(default_test_config(server.addr)).unwrap();
@@ -45,14 +65,12 @@ fn protocol_version_mismatch_fails() {
         Err(ClientError::ProtocolVersionMismatch { received: 2, .. })
     ));
     assert_eq!(server.rx.iter().take(1).count(), 1);
-    assert!(client.runtime.prepare_open_request().is_ok());
     server.join();
 }
 
 #[test]
 fn server_rejection_fails_in_normal_mode() {
-    let config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    let params = params_from_config(&config).unwrap();
+    let params = default_params();
     let server = start_fake_server(move |socket, tx| {
         let (_, peer) = recv_request(&socket, &tx);
         let reply = open_reply(FLAG_OPEN | FLAG_REPLY | flags::FLAG_CLOSE, 0, &params, None);
@@ -61,7 +79,6 @@ fn server_rejection_fails_in_normal_mode() {
     let mut client = Client::connect(default_test_config(server.addr)).unwrap();
     assert!(matches!(client.open(), Err(ClientError::ServerRejected)));
     assert_eq!(server.rx.iter().take(1).count(), 1);
-    assert!(client.runtime.prepare_open_request().is_ok());
     server.join();
 }
 
@@ -132,25 +149,6 @@ fn post_token_negotiation_failure_sends_cleanup_close() {
         u64::from_le_bytes(packets[1][4..12].try_into().unwrap()),
         TOKEN
     );
-    assert!(client.runtime.prepare_open_request().is_ok());
-    server.join();
-}
-
-#[test]
-fn successful_open_restores_configured_receive_timeout() {
-    let config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    let params = params_from_config(&config).unwrap();
-    let server = open_success_server(params);
-    let mut config = default_test_config(server.addr);
-    config.socket_config.recv_timeout = Some(Duration::from_millis(75));
-    let mut client = Client::connect(config).unwrap();
-
-    assert_open_started(client.open().unwrap());
-
-    assert_eq!(
-        client.socket.read_timeout().unwrap(),
-        Some(Duration::from_millis(75))
-    );
     server.join();
 }
 
@@ -159,7 +157,7 @@ fn open_timeout_after_all_timeouts() {
     let server = timeout_server(Duration::from_millis(700));
     let config = ClientConfig {
         open_timeouts: vec![Duration::from_millis(200), Duration::from_millis(200)],
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(50)),
             ..Default::default()
         },
@@ -168,10 +166,6 @@ fn open_timeout_after_all_timeouts() {
     let mut client = Client::connect(config).unwrap();
     assert!(matches!(client.open(), Err(ClientError::OpenTimeout)));
     assert_eq!(server.rx.iter().take(2).count(), 2);
-    assert_eq!(
-        client.socket.read_timeout().unwrap(),
-        Some(Duration::from_millis(50))
-    );
     server.join();
 }
 
@@ -222,7 +216,7 @@ fn only_ignored_open_datagrams_eventually_time_out() {
     });
     let config = ClientConfig {
         open_timeouts: vec![Duration::from_millis(200), Duration::from_millis(200)],
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(50)),
             ..Default::default()
         },
@@ -233,10 +227,6 @@ fn only_ignored_open_datagrams_eventually_time_out() {
     assert!(matches!(client.open(), Err(ClientError::OpenTimeout)));
     assert_eq!(server.rx.iter().take(2).count(), 2);
     assert!(server.rx.try_recv().is_err());
-    assert_eq!(
-        client.socket.read_timeout().unwrap(),
-        Some(Duration::from_millis(50))
-    );
     server.join();
 }
 
@@ -259,7 +249,6 @@ fn trusted_zero_token_normal_reply_is_terminal() {
         Err(ClientError::Protocol(irtt_proto::ProtoError::ZeroToken))
     ));
     assert_eq!(server.rx.iter().take(1).count(), 1);
-    assert!(client.runtime.prepare_open_request().is_ok());
 
     server.join();
 }

crates/irtt-client/tests/client/probes_replies/mod.rs

@@ -2,7 +2,7 @@ use super::*;
 use support::echo_packet_len;
 
 #[cfg(not(all(target_os = "linux", feature = "ancillary")))]
-fn assert_packet_meta_unavailable(packet_meta: &crate::event::PacketMeta) {
+fn assert_packet_meta_unavailable(packet_meta: &irtt_client::PacketMeta) {
     assert_eq!(packet_meta.traffic_class, None);
     assert_eq!(packet_meta.dscp, None);
     assert_eq!(packet_meta.ecn, None);
@@ -25,4 +25,3 @@ mod reply_classification;
 mod reply_decode;
 mod reply_metadata;
 mod timeouts;
-mod timing_math;

crates/irtt-client/tests/client/probes_replies/packet_length.rs

@@ -1,62 +1,5 @@
 use super::*;
 
-#[test]
-fn minimal_negotiated_layout_works() {
-    let params = Params {
-        protocol_version: 1,
-        duration_ns: 3_000_000_000,
-        interval_ns: 1_000_000_000,
-        received_stats: ReceivedStats::None,
-        stamp_at: StampAt::None,
-        clock: Clock::Both,
-        ..Params::default()
-    };
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
-        socket.send_to(&reply, peer).unwrap();
-
-        socket
-            .set_read_timeout(Some(Duration::from_secs(2)))
-            .unwrap();
-        let mut buf = [0_u8; 2048];
-        if let Ok((size, _)) = socket.recv_from(&mut buf) {
-            tx.send(buf[..size].to_vec()).unwrap();
-            let seq = u32::from_le_bytes(buf[12..16].try_into().unwrap());
-            let ts = TimestampFields::default();
-            let reply_packet = echo_reply_packet(TOKEN, seq, &params, &ts, None);
-            socket.send_to(&reply_packet, peer).unwrap();
-        }
-    });
-    let config = ClientConfig {
-        received_stats: ReceivedStats::None,
-        stamp_at: StampAt::None,
-        socket_config: crate::SocketConfig {
-            recv_timeout: Some(Duration::from_millis(200)),
-            ..Default::default()
-        },
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.send_probe().unwrap();
-    thread::sleep(Duration::from_millis(30));
-    let events = client.recv_once().unwrap();
-    assert_eq!(events.len(), 1);
-    if let ClientEvent::EchoReply {
-        received_stats,
-        server_timing,
-        ..
-    } = &events[0]
-    {
-        assert!(received_stats.is_none());
-        assert!(server_timing.is_none());
-    } else {
-        panic!("expected EchoReply");
-    }
-    server.join();
-}
-
 // ---------- Regression tests ----------
 
 #[test]
@@ -81,7 +24,7 @@ fn short_echo_reply_does_not_emit_echo_reply() {
     });
     let config = ClientConfig {
         length: 64,
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },
@@ -127,7 +70,7 @@ fn overlong_datagram_detection_uses_extra_receive_byte() {
     });
     let config = ClientConfig {
         length: 4096,
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },
@@ -170,7 +113,7 @@ fn exact_length_echo_reply_still_emits_echo_reply() {
     });
     let config = ClientConfig {
         length: 4096,
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },

crates/irtt-client/tests/client/probes_replies/reply_classification.rs

@@ -23,7 +23,7 @@ fn duplicate_reply_emits_duplicate_event() {
         }
     });
     let config = ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },
@@ -77,7 +77,7 @@ fn out_of_order_reply_emits_late_event() {
         socket.send_to(&reply0, peer).unwrap();
     });
     let config = ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },

crates/irtt-client/tests/client/probes_replies/reply_decode.rs

@@ -5,7 +5,7 @@ fn recv_once_returns_empty_on_timeout() {
     let params = default_params();
     let server = open_success_server(params);
     let config = ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(50)),
             ..Default::default()
         },
@@ -18,66 +18,6 @@ fn recv_once_returns_empty_on_timeout() {
     server.join();
 }
 
-#[test]
-fn recv_once_decodes_echo_reply_and_emits_event() {
-    let params = default_params();
-    let (mut client, server) = open_client_with_echo_server(&params);
-
-    client.send_probe().unwrap();
-    thread::sleep(Duration::from_millis(50));
-
-    let events = client.recv_once().unwrap();
-    assert_eq!(events.len(), 1);
-    match &events[0] {
-        ClientEvent::EchoReply {
-            seq,
-            rtt,
-            received_stats,
-            server_timing,
-            bytes,
-            packet_meta,
-            ..
-        } => {
-            assert_eq!(*seq, 0);
-            assert_eq!(*bytes, echo_packet_len(false, &params));
-            assert!(rtt.raw > Duration::ZERO);
-            assert_eq!(
-                rtt.effective,
-                rtt.adjusted
-                    .unwrap_or_else(|| SignedDuration::from_duration(rtt.raw))
-            );
-            assert!(received_stats.is_some());
-            let stats = received_stats.as_ref().unwrap();
-            assert_eq!(stats.count, Some(42));
-            assert_eq!(stats.window, Some(0x07));
-            assert!(server_timing.is_some());
-            let st = server_timing.as_ref().unwrap();
-            assert!(st.processing.is_some());
-            #[cfg(not(all(target_os = "linux", feature = "ancillary")))]
-            {
-                assert_eq!(packet_meta.traffic_class, None);
-                assert_eq!(packet_meta.dscp, None);
-                assert_eq!(packet_meta.ecn, None);
-                assert_eq!(packet_meta.kernel_rx_timestamp, None);
-            }
-            #[cfg(all(target_os = "linux", feature = "ancillary"))]
-            {
-                assert_eq!(
-                    packet_meta.dscp,
-                    packet_meta.traffic_class.map(|tc| tc >> 2)
-                );
-                assert_eq!(
-                    packet_meta.ecn,
-                    packet_meta.traffic_class.map(|tc| tc & 0b11)
-                );
-            }
-        }
-        other => panic!("expected EchoReply, got {other:?}"),
-    }
-    client.close().unwrap();
-    server.join();
-}
-
 #[test]
 fn recv_once_decodes_only_received_bytes_after_longer_datagram() {
     let params = default_params();
@@ -113,7 +53,7 @@ fn recv_once_decodes_only_received_bytes_after_longer_datagram() {
         socket.send_to(&shorter, peer).unwrap();
     });
     let config = ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },

crates/irtt-client/tests/client/probes_replies/reply_metadata.rs

@@ -14,13 +14,13 @@ fn echo_reply_metadata_propagates_observed_dscp_with_ancillary() {
         let (size, _) = socket.recv_from(&mut buf).unwrap();
         tx.send(buf[..size].to_vec()).unwrap();
         let seq = u32::from_le_bytes(buf[12..16].try_into().unwrap());
-        crate::socket_options::apply_traffic_class_to_socket(&socket, peer, 184).unwrap();
+        socket2::SockRef::from(&socket).set_tos_v4(184).unwrap();
         let reply_packet =
             echo_reply_packet(TOKEN, seq, &params, &TimestampFields::default(), None);
         socket.send_to(&reply_packet, peer).unwrap();
     });
     let config = ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },

crates/irtt-client/tests/client/probes_replies/timeouts.rs

@@ -1,12 +1,52 @@
 use super::*;
 
+#[test]
+fn probe_timeout_overflow_transmits_no_echo() {
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        socket
+            .set_read_timeout(Some(Duration::from_secs(2)))
+            .unwrap();
+        let (_, peer) = recv_request(&socket, &tx);
+        socket
+            .send_to(
+                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
+                peer,
+            )
+            .unwrap();
+        // CLOSE is a completion barrier: any incorrectly transmitted ECHO
+        // precedes it on this connected loopback socket.
+        let _ = recv_request(&socket, &tx);
+    });
+    let config = ClientConfig {
+        probe_timeout: Duration::MAX,
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    assert!(matches!(
+        client.send_probe(),
+        Err(ClientError::DurationOverflow)
+    ));
+    assert!(!client.has_pending_probes());
+    client.close().unwrap();
+    let packets: Vec<_> = server.rx.iter().collect();
+    assert_eq!(packets.len(), 2);
+    assert_eq!(
+        packets[1][3],
+        flags::FLAG_CLOSE,
+        "overflow must not transmit an ECHO"
+    );
+    server.join();
+}
+
 #[test]
 fn poll_timeouts_emits_echo_loss() {
     let params = default_params();
     let server = silent_open_server(params);
     let config = ClientConfig {
         probe_timeout: Duration::from_millis(100),
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(50)),
             ..Default::default()
         },
@@ -57,7 +97,7 @@ fn late_reply_after_timeout_preserves_measurement_metadata() {
     });
     let config = ClientConfig {
         probe_timeout: Duration::from_millis(40),
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },
@@ -119,7 +159,7 @@ fn pending_full_does_not_send_packet() {
     let config = ClientConfig {
         duration: Some(Duration::from_secs(60)),
         max_pending_probes: 2,
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(50)),
             ..Default::default()
         },

crates/irtt-client/tests/client/support.rs

@@ -253,7 +253,7 @@ pub(super) fn assert_no_test_completed(outcome: OpenOutcome) -> NegotiatedParams
 pub(super) fn open_client_with_echo_server(params: &Params) -> (Client, FakeServer) {
     let server = echo_server(params.clone());
     let config = ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
             recv_timeout: Some(Duration::from_millis(200)),
             ..Default::default()
         },

crates/irtt-client/tests/client/ttl.rs

@@ -0,0 +1,22 @@
+use super::*;
+
+#[test]
+fn connect_accepts_valid_ttl_config_values() {
+    for ttl in [None, Some(1), Some(255)] {
+        let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 9)));
+        config.socket_config.ttl = ttl;
+        Client::connect(config).unwrap();
+    }
+}
+
+#[test]
+fn connect_rejects_invalid_ttl_values() {
+    for ttl in [0, 256] {
+        let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 9)));
+        config.socket_config.ttl = Some(ttl);
+        assert!(matches!(
+            Client::connect(config),
+            Err(ClientError::InvalidConfig { .. })
+        ));
+    }
+}

crates/irtt-client/tests/linux_transport.rs

@@ -0,0 +1,259 @@
+//! Real Linux socket observations through the public client adapters.
+#![cfg(all(target_os = "linux", feature = "ancillary"))]
+
+use std::{
+    io::IoSliceMut,
+    net::{SocketAddr, UdpSocket},
+    sync::mpsc,
+    thread,
+    time::{Duration, SystemTime, UNIX_EPOCH},
+};
+
+use irtt_client::{Client, ClientConfig, ClientEvent, NegotiationPolicy, SocketConfig};
+use irtt_proto::{decode_request, Clock, DecodedRequestKind, ReceivedStats, StampAt};
+use irtt_server::{ServerConfig, ServerCore};
+use nix::sys::socket::{recvmsg, ControlMessageOwned, MsgFlags};
+
+const TEST_TTL: u32 = 37;
+
+// A compliant packet peer uses the real server core. Its receive-side IP_TOS
+// observation is independent of the client/server parameter agreement.
+fn peer(dscp_allowed: bool, probes: usize) -> (SocketAddr, thread::JoinHandle<Vec<u8>>) {
+    let socket = UdpSocket::bind("127.0.0.1:0").unwrap();
+    socket
+        .set_read_timeout(Some(Duration::from_secs(3)))
+        .unwrap();
+    socket2::SockRef::from(&socket)
+        .set_recv_tos_v4(true)
+        .unwrap();
+    nix::sys::socket::setsockopt(&socket, nix::sys::socket::sockopt::Ipv4RecvTtl, &true).unwrap();
+    let addr = socket.local_addr().unwrap();
+    let task = thread::spawn(move || {
+        let mut core = ServerCore::new(
+            ServerConfig::default()
+                .with_min_send_interval(Duration::ZERO)
+                .with_dscp_allowed(dscp_allowed),
+        );
+        let mut markings = Vec::new();
+        // OPEN, every ECHO, then CLOSE.
+        for _ in 0..probes + 2 {
+            let mut bytes = [0; 2048];
+            let mut control = nix::cmsg_space!(u8, i32);
+            let mut iov = [IoSliceMut::new(&mut bytes)];
+            let msg = recvmsg::<nix::sys::socket::SockaddrIn>(
+                std::os::fd::AsRawFd::as_raw_fd(&socket),
+                &mut iov,
+                Some(&mut control),
+                MsgFlags::empty(),
+            )
+            .unwrap();
+            let size = msg.bytes;
+            let source = msg.address.unwrap();
+            let marking = msg
+                .cmsgs()
+                .unwrap()
+                .find_map(|message| match message {
+                    ControlMessageOwned::Ipv4Tos(tos) => Some(tos),
+                    _ => None,
+                })
+                .expect("Linux must report IP_TOS");
+            let ttl = msg
+                .cmsgs()
+                .unwrap()
+                .find_map(|message| match message {
+                    ControlMessageOwned::Ipv4Ttl(ttl) => Some(ttl),
+                    _ => None,
+                })
+                .expect("Linux must report IP_TTL");
+            assert_eq!(
+                ttl, TEST_TTL as i32,
+                "configured TTL must survive OPEN, ECHO and CLOSE"
+            );
+            markings.push(marking);
+            let source = SocketAddr::from((source.ip(), source.port()));
+            if let Some(reply) = core.handle_datagram(source, &bytes[..size]).unwrap() {
+                socket.send_to(reply.bytes(), source).unwrap();
+            }
+        }
+        assert_eq!(core.session_count(), 0);
+        markings
+    });
+    (addr, task)
+}
+
+fn config(addr: SocketAddr) -> ClientConfig {
+    ClientConfig {
+        server_addr: addr.to_string(),
+        dscp: 46,
+        negotiation_policy: NegotiationPolicy::Loose,
+        duration: None,
+        interval: Duration::from_millis(10),
+        clock: Clock::Both,
+        stamp_at: StampAt::Both,
+        received_stats: ReceivedStats::Both,
+        length: 128,
+        open_timeouts: vec![Duration::from_secs(1)],
+        socket_config: SocketConfig {
+            ttl: Some(TEST_TTL),
+            recv_timeout: Some(Duration::from_secs(1)),
+            ..SocketConfig::default()
+        },
+        ..ClientConfig::default()
+    }
+}
+
+// TX timestamps have no separate public field: the upstream OWD exposes the
+// selected send endpoint. Reconstruct it and require a real kernel endpoint
+// rather than accepting the userspace fallback. RTT must still use sent_at.
+fn assert_kernel_send_endpoint(event: &ClientEvent, before_send: SystemTime) {
+    let ClientEvent::EchoReply {
+        sent_at,
+        received_at,
+        rtt,
+        server_timing: Some(timing),
+        one_way: Some(one_way),
+        packet_meta,
+        ..
+    } = event
+    else {
+        panic!("expected measured reply: {event:?}")
+    };
+    let ns = |wall: SystemTime| {
+        i128::try_from(wall.duration_since(UNIX_EPOCH).unwrap().as_nanos()).unwrap()
+    };
+    let selected =
+        i128::from(timing.receive_wall_ns.unwrap()) - one_way.client_to_server.unwrap().as_nanos();
+    assert!(selected >= ns(before_send));
+    // TX_SOFTWARE may arrive before or after send returns; only equality
+    // identifies the userspace fallback. Receipt remains the upper bound.
+    assert_ne!(
+        selected,
+        ns(sent_at.wall),
+        "TX timestamp was not observed; userspace fallback is insufficient"
+    );
+    assert!(selected <= ns(received_at.wall));
+    let selected_receive =
+        i128::from(timing.send_wall_ns.unwrap()) + one_way.server_to_client.unwrap().as_nanos();
+    assert_eq!(
+        selected_receive,
+        ns(packet_meta
+            .kernel_rx_timestamp
+            .expect("Linux RX timestamp required")),
+        "downstream OWD must use the kernel receive endpoint"
+    );
+    assert_eq!(rtt.raw, received_at.mono.duration_since(sent_at.mono));
+}
+
+#[test]
+fn blocking_probes_use_kernel_tx_timing_and_negotiated_packet_marking() {
+    for allowed in [true, false] {
+        const PROBES: usize = 3;
+        let (addr, peer) = peer(allowed, PROBES);
+        let mut client = Client::connect(config(addr)).unwrap();
+        client.open().unwrap();
+        assert_eq!(
+            client.negotiated_params().unwrap().params.dscp,
+            if allowed { 184 } else { 0 }
+        );
+        for _ in 0..PROBES {
+            let before = SystemTime::now();
+            client.send_probe().unwrap();
+            let events = client.recv_once().unwrap();
+            assert_eq!(events.len(), 1);
+            assert_kernel_send_endpoint(&events[0], before);
+        }
+        client.close().unwrap();
+        let markings = peer.join().unwrap();
+        assert_eq!(markings[0], 0, "OPEN is unmarked");
+        assert_eq!(
+            &markings[1..=PROBES],
+            vec![if allowed { 184 } else { 0 }; PROBES]
+        );
+        assert_eq!(
+            markings[PROBES + 1],
+            0,
+            "local CLOSE clears the negotiated marking"
+        );
+    }
+}
+
+#[cfg(feature = "tokio")]
+#[test]
+fn async_probes_use_kernel_tx_timing_and_negotiated_packet_marking() {
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .unwrap();
+    for allowed in [true, false] {
+        const PROBES: usize = 3;
+        let (addr, peer) = peer(allowed, PROBES);
+        runtime.block_on(async {
+            tokio::time::timeout(Duration::from_secs(5), async {
+                let mut client = irtt_client::AsyncClient::connect(config(addr))
+                    .await
+                    .unwrap();
+                client.open().await.unwrap();
+                assert_eq!(
+                    client.negotiated_params().unwrap().params.dscp,
+                    if allowed { 184 } else { 0 }
+                );
+                for _ in 0..PROBES {
+                    let before = SystemTime::now();
+                    client.send_probe().await.unwrap();
+                    let events = client.recv().await.unwrap();
+                    assert_eq!(events.len(), 1);
+                    assert_kernel_send_endpoint(&events[0], before);
+                }
+                client.close().await.unwrap();
+            })
+            .await
+            .expect("async transport observations timed out");
+        });
+        let markings = peer.join().unwrap();
+        assert_eq!(markings[0], 0);
+        assert_eq!(
+            &markings[1..=PROBES],
+            vec![if allowed { 184 } else { 0 }; PROBES]
+        );
+        assert_eq!(markings[PROBES + 1], 0);
+    }
+}
+
+// Real ICMP refusal remains a socket error, never optional timestamp metadata.
+// The bound peer closes only after the client has accepted a valid OPEN.
+#[test]
+fn a_closed_udp_peer_surfaces_a_socket_error() {
+    let socket = UdpSocket::bind("127.0.0.1:0").unwrap();
+    let addr = socket.local_addr().unwrap();
+    socket
+        .set_read_timeout(Some(Duration::from_secs(3)))
+        .unwrap();
+    let (close_tx, close_rx) = mpsc::channel();
+    let task = thread::spawn(move || {
+        let mut core = ServerCore::new(ServerConfig::default());
+        let mut bytes = [0; 2048];
+        let (size, source) = socket.recv_from(&mut bytes).unwrap();
+        assert!(matches!(
+            decode_request(&bytes[..size]).unwrap().kind,
+            DecodedRequestKind::Open { .. }
+        ));
+        let reply = core
+            .handle_datagram(source, &bytes[..size])
+            .unwrap()
+            .unwrap();
+        socket.send_to(reply.bytes(), source).unwrap();
+        close_rx.recv_timeout(Duration::from_secs(3)).unwrap();
+        drop(socket);
+    });
+    let mut client = Client::connect(config(addr)).unwrap();
+    client.open().unwrap();
+    close_tx.send(()).unwrap();
+    task.join().unwrap();
+    // Refusal can arrive during send's TX drain or the following receive.
+    let result = client.send_probe().and_then(|_| client.recv_once());
+    assert!(
+        matches!(result, Err(irtt_client::ClientError::Socket(ref error))
+        if error.kind() == std::io::ErrorKind::ConnectionRefused),
+        "{result:?}"
+    );
+}

crates/irtt-client/tests/managed_control.rs

@@ -0,0 +1,160 @@
+#![cfg(feature = "tokio")]
+
+use std::{
+    future::Future,
+    pin::pin,
+    task::{Context, Poll, Waker},
+    time::Duration,
+};
+
+use irtt_client::managed::*;
+
+fn config() -> ManagedClientConfig {
+    ManagedClientConfig {
+        completion: ManagedCompletionPolicy::ExplicitStop,
+        command_capacity: 3,
+        ..ManagedClientConfig::default()
+    }
+}
+
+#[test]
+fn stop_resolves_every_accepted_update_and_closes_admission() {
+    let (task, handle) = ManagedClient::task(config(), vec![]).unwrap();
+    let receipts: Vec<_> = (0..3)
+        .map(|index| {
+            handle
+                .update_targets(vec![ManagedTargetConfig::new(
+                    format!("queued-{index}"),
+                    "127.0.0.1:9",
+                )])
+                .unwrap()
+        })
+        .collect();
+    assert!(matches!(
+        handle.update_targets(vec![]),
+        Err(ManagedCommandError::QueueFull)
+    ));
+
+    let stop = handle.stop();
+    assert!(matches!(
+        handle.update_targets(vec![]),
+        Err(ManagedCommandError::Stopping)
+    ));
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .unwrap();
+    runtime.block_on(async {
+        tokio::time::timeout(Duration::from_secs(2), async {
+            let outcome = task.await;
+            stop.await;
+            for receipt in receipts {
+                assert!(matches!(
+                    receipt.await,
+                    Err(ManagedCommandApplyError::Stopping)
+                ));
+            }
+            assert_eq!(outcome.end_reason, ManagedEndReason::StopRequested);
+            assert_eq!(outcome.applied_command_sequence, 0);
+            assert_eq!(outcome.total_target_outcomes, 0);
+            let status = handle.status();
+            assert_eq!(status.lifecycle, ManagedLifecycle::Completed);
+            assert!(status.stop_requested);
+            assert_eq!(status.final_outcome.as_deref(), Some(&outcome));
+            assert!(matches!(
+                handle.update_targets(vec![]),
+                Err(ManagedCommandError::DriverClosed)
+            ));
+            handle.stop().await;
+        })
+        .await
+        .expect("stop must resolve every buffered update and repeated stop receipt");
+    });
+}
+
+#[test]
+fn failed_driver_resolves_every_accepted_update_with_its_terminal_failure() {
+    let (task, handle) = ManagedClient::task(config(), vec![]).unwrap();
+    let receipts: Vec<_> = (0..3)
+        .map(|index| {
+            handle
+                .update_targets(vec![ManagedTargetConfig::new(
+                    format!("queued-{index}"),
+                    "127.0.0.1:9",
+                )])
+                .unwrap()
+        })
+        .collect();
+    let mut context = Context::from_waker(Waker::noop());
+    let Poll::Ready(outcome) = pin!(task).as_mut().poll(&mut context) else {
+        panic!("polling without Tokio must fail immediately");
+    };
+    assert_eq!(
+        outcome.end_reason,
+        ManagedEndReason::DriverFailed(ManagedDriverFailure::NoTokioRuntime)
+    );
+    for receipt in receipts {
+        assert!(matches!(
+            pin!(receipt).as_mut().poll(&mut context),
+            Poll::Ready(Err(ManagedCommandApplyError::DriverFailed(
+                ManagedDriverFailure::NoTokioRuntime
+            )))
+        ));
+    }
+    let status = handle.status();
+    assert_eq!(status.lifecycle, ManagedLifecycle::Failed);
+    assert_eq!(status.final_outcome.as_deref(), Some(&outcome));
+    assert!(matches!(
+        handle.update_targets(vec![]),
+        Err(ManagedCommandError::DriverClosed)
+    ));
+    assert!(pin!(handle.stop()).as_mut().poll(&mut context).is_ready());
+}
+
+#[test]
+fn concurrent_submission_and_stop_or_seal_never_lose_an_accepted_receipt() {
+    let (task, handle) = ManagedClient::task(config(), vec![]).unwrap();
+    let barrier = std::sync::Arc::new(std::sync::Barrier::new(2));
+    let submit_barrier = std::sync::Arc::clone(&barrier);
+    let submit_handle = handle.clone();
+    let (sender, receiver) = std::sync::mpsc::channel();
+    let submit = std::thread::spawn(move || {
+        submit_barrier.wait();
+        sender.send(submit_handle.update_targets(vec![])).unwrap();
+    });
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .unwrap();
+    // Stop is latched before the driver starts, while submission may cross
+    // admission before stop, after stop, or after terminal sealing.
+    barrier.wait();
+    let stop = handle.stop();
+    runtime.block_on(async {
+        tokio::time::timeout(Duration::from_secs(2), async {
+            let outcome = task.await;
+            stop.await;
+            assert_eq!(outcome.end_reason, ManagedEndReason::StopRequested);
+            assert_eq!(outcome.applied_command_sequence, 0);
+            assert_eq!(outcome.total_target_outcomes, 0);
+            let result = receiver
+                .recv_timeout(Duration::from_secs(2))
+                .expect("concurrent submission must return");
+            submit.join().unwrap();
+            match result {
+                Ok(receipt) => assert!(matches!(
+                    receipt.await,
+                    Err(ManagedCommandApplyError::Stopping)
+                )),
+                Err(ManagedCommandError::Stopping | ManagedCommandError::DriverClosed) => {}
+                Err(error) => panic!("unexpected concurrent submission result: {error:?}"),
+            }
+            assert!(matches!(
+                handle.update_targets(vec![]),
+                Err(ManagedCommandError::DriverClosed)
+            ));
+        })
+        .await
+        .expect("every accepted concurrent submission must receive a terminal disposition");
+    });
+}