chore(deps): update github actions

.gitea/workflows/ci.yml

@@ -158,6 +158,3 @@ jobs:
             --all-features \
             --no-deps \
             --locked
-
-      - name: Run doctests
-        run: cargo test --workspace --doc --all-features --locked

.gitea/workflows/docker-publish.yml

@@ -76,7 +76,7 @@ jobs:
       # below), never a separate build, so the hash matches everywhere.
       - name: Build and push to Gitea
         id: build
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64

AGENTS.md

@@ -173,7 +173,6 @@ Use the narrowest useful checks first. For substantive workspace changes, final
 cargo fmt --all -- --check
 cargo check --workspace --all-targets --all-features --locked
 cargo test --workspace --all-targets --all-features --locked
-cargo test --workspace --doc --all-features --locked
 cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 ```
 

README.md

@@ -171,7 +171,6 @@ when to use it instead of `irtt-client`/`irtt-server` directly.
 ```sh
 cargo fmt --all -- --check
 cargo test --workspace --locked
-cargo test --workspace --doc --all-features --locked
 cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 ```
 

crates/irtt-app/src/applet.rs

@@ -22,7 +22,7 @@ pub fn detect_applet_from_argv0(argv0: &str) -> Option<RequestedApplet> {
     match applet_basename(argv0) {
         "irtt-client" => Some(RequestedApplet::Client),
         "irtt-tui" => Some(RequestedApplet::Tui),
-        "irtt-server" => Some(RequestedApplet::Server),
+        "irttd" | "irtt-server" => Some(RequestedApplet::Server),
         "irtt-rs" => None,
         _ => None,
     }
@@ -199,7 +199,6 @@ mod tests {
             detect_applet_from_argv0("irtt-server"),
             Some(RequestedApplet::Server)
         );
-        assert_eq!(detect_applet_from_argv0("irttd"), None);
         assert_eq!(detect_applet_from_argv0("irtt-rs"), None);
         assert_eq!(detect_applet_from_argv0("custom-name"), None);
     }

crates/irtt-app/src/cmd/server/args.rs

@@ -106,22 +106,10 @@ pub struct ServerArgs {
     pub timestamp_allowance: Option<TimestampAllowanceArg>,
 
     /// Refuse to provide requested DSCP marking.
-    //
-    // `FalseyValueParser` rather than clap's default `bool` parser for a flag,
-    // which is what makes IRTT_SERVER_NO_DSCP usable from the environment at
-    // all. A flag's default parser accepts only the literals `true` and
-    // `false`, so the ordinary container/orchestrator spelling
-    // `IRTT_SERVER_NO_DSCP=1` did not enable the flag — it failed argument
-    // parsing and the server refused to start. Falsey semantics are clap's own
-    // documented recipe for a boolean environment flag: `0`, `false`, `no`,
-    // `n`, `off` and empty are off, anything else is on, and an absent
-    // variable is off as before. The command-line flag is unaffected: it still
-    // takes no value and still means "on".
     #[arg(
         long,
         env = "IRTT_SERVER_NO_DSCP",
-        value_parser = clap::builder::FalseyValueParser::new(),
-        long_help = "Refuse to provide requested traffic-class marking. Any requested DSCP is negotiated to zero, so the client is told its echo replies will be unmarked, and they are sent unmarked. The session is not refused.\n\nIRTT_SERVER_NO_DSCP sets the same thing from the environment: 0, false, no, n, off and an empty value leave marking enabled, and any other value disables it."
+        long_help = "Refuse to provide requested traffic-class marking. Any requested DSCP is negotiated to zero, so the client is told its echo replies will be unmarked, and they are sent unmarked. The session is not refused."
     )]
     pub no_dscp: bool,
 }
@@ -560,43 +548,6 @@ mod tests {
         );
     }
 
-    /// `IRTT_SERVER_NO_DSCP` is the one policy variable whose value is a
-    /// boolean rather than a number, a duration or a string, and the
-    /// container/orchestrator deployments this whole environment surface
-    /// exists for spell booleans `1`/`0`. clap's default parser for a flag
-    /// accepts only the literals `true`/`false` and turns everything else
-    /// into a *parse failure*, so `IRTT_SERVER_NO_DSCP=1` used to stop the
-    /// server from starting at all rather than enabling the flag. Falsey
-    /// semantics are what keeps that from being a startup failure.
-    #[test]
-    fn the_no_dscp_environment_variable_accepts_ordinary_boolean_spellings() {
-        for value in ["1", "true", "TRUE", "yes", "on", "enabled"] {
-            with_env(&[("IRTT_SERVER_NO_DSCP", value)], || {
-                let config = parse(&["--bind", "127.0.0.1:2112"])
-                    .expect("a truthy value must not fail argument parsing")
-                    .server_config();
-                assert!(!config.dscp_allowed(), "IRTT_SERVER_NO_DSCP={value}");
-            });
-        }
-
-        for value in ["0", "false", "no", "off", ""] {
-            with_env(&[("IRTT_SERVER_NO_DSCP", value)], || {
-                let config = parse(&["--bind", "127.0.0.1:2112"])
-                    .expect("a falsey value must not fail argument parsing")
-                    .server_config();
-                assert!(config.dscp_allowed(), "IRTT_SERVER_NO_DSCP={value}");
-            });
-        }
-    }
-
-    /// The command-line flag stays a flag: it takes no value, whatever the
-    /// environment parser accepts.
-    #[test]
-    fn the_no_dscp_flag_still_takes_no_command_line_value() {
-        assert!(parse(&["--bind", "127.0.0.1:2112", "--no-dscp=false"]).is_err());
-        assert!(!bound(&["--no-dscp"]).server_config().dscp_allowed());
-    }
-
     #[test]
     fn an_explicit_flag_overrides_the_environment() {
         with_env(&[("IRTT_SERVER_MAX_SESSIONS", "512")], || {

crates/irtt-client/AGENTS.md

@@ -26,30 +26,30 @@ configuration (`try_enable_tx_timestamping` restores it explicitly) and
 timing falls back to userspace `sent_at` as it always has. TX capability
 failure is never a public error and is never logged from the library.
 
-### Best-effort kernel-ID correlation
+### Correlation invariant: kernel ID == wire sequence
 
-The client uses the kernel's automatic `OPT_ID` as the probe's wire-sequence
-correlation ID — no separate correlation map. On the normal successful-send
-path, both counters start at zero after Open and advance together. This is
-not a permanent identity: a kernel ID can theoretically be consumed while a
-send is being prepared and then survive a subsequent send failure, leaving
-kernel IDs one or more steps ahead of `next_wire_seq`. Do not restore an
-assumption that failed or nonblocking sends cannot cause that desynchrony.
+The client uses the kernel's automatic `OPT_ID` directly as the probe's wire
+sequence number — no separate correlation map. This is safe because:
 
-The effect is confined to the optional timing enhancement. A kernel timestamp
-whose ID cannot be matched to a pending or retained timed-out probe is
-discarded, as is any implausible timestamp; `sent_at` remains the ordinary
-userspace fallback. **After every failed probe submission, disable kernel-ID
-correlation for the rest of that session.** A gap means an otherwise plausible
-later ID can name the wrong probe, so subsequent error-queue timestamps must
-be discarded rather than attached by ID. This is safe because:
-
-- **Normal successful sends track together.** `wire_seq` starts at 0 on every
-  successful Open (`SessionMachine::commit_open` builds a fresh
-  `ActiveSession` with `next_wire_seq: 0`) and advances by exactly 1 only via
-  `commit_probe_sent`, after a confirmed successful socket send. TX
-  timestamping is enabled after that same successful Open and before any probe
-  is sent, so the normal zero points line up.
+- **A failed/nonblocking send never consumes an ID.** Linux increments the
+  per-socket ID counter (`sk->sk_tskey`) speculatively while building a
+  datagram and rolls the increment back (`atomic_dec`) on every error path
+  out of `__ip_append_data`/`__ip6_append_data`
+  (`net/ipv4/ip_output.c`, `net/ipv6/ip6_output.c`), guarded by a local
+  `hold_tskey` flag. A `WouldBlock` `try_send` therefore can never leave a
+  gap in, or otherwise advance, the ID the kernel will assign to the next
+  *successful* submission. (`include/net/sock.h`'s `_sock_tx_timestamp`
+  performs the same increment for the non-corked path.) Client-side, the
+  existing send transaction only calls `commit_probe_sent` — which is the
+  only thing that advances `next_wire_seq` — after a successful socket send;
+  a `WouldBlock` result never reaches it.
+- **The two counters start together and advance together.** `wire_seq`
+  starts at 0 on every successful Open (`SessionMachine::commit_open` builds
+  a fresh `ActiveSession` with `next_wire_seq: 0`) and advances by exactly 1
+  only via `commit_probe_sent`, which only runs after a confirmed successful
+  send — the same condition under which the kernel's counter advances by 1.
+  TX timestamping is enabled only after that same successful Open and before
+  any probe is sent, so both counters' zero points line up exactly.
 - **One socket, one session, no reopen.** `SessionMachine`'s state machine
   only reaches `Open` from `Connected`, and `commit_open`/`commit_local_close`
   never route back to `Connected`. A `Client`/`AsyncClient` cannot reopen a

crates/irtt-client/src/async_client.rs

@@ -608,14 +608,8 @@ impl AsyncClient {
                 // No sent_at measurement, no machine commit, no schedule
                 // commit: the transaction is fully discarded and retried
                 // with a fresh send_anchor on the next loop iteration.
-                Err(error) if error.kind() == io::ErrorKind::WouldBlock => {
-                    self.machine.invalidate_kernel_tx_correlation();
-                    continue;
-                }
-                Err(error) => {
-                    self.machine.invalidate_kernel_tx_correlation();
-                    return Poll::Ready(Err(ClientError::Socket(error)));
-                }
+                Err(error) if error.kind() == io::ErrorKind::WouldBlock => continue,
+                Err(error) => return Poll::Ready(Err(ClientError::Socket(error))),
             };
 
             #[cfg(not(test))]

crates/irtt-client/src/client.rs

@@ -163,13 +163,12 @@ impl Client {
     ///
     /// On success, returns the negotiated open outcome and transitions the
     /// client into either an open probe session or completed no-test state.
-    /// Open attempts use [`ClientConfig::open_timeouts`]. Malformed or
-    /// unrelated datagrams are ignored until the current attempt's absolute
-    /// deadline, so one attempt may consume several datagrams without
+    /// Open attempts use [`ClientConfig::open_timeouts`]. Malformed, unrelated,
+    /// or unauthenticated datagrams are ignored until the current attempt's
+    /// absolute deadline, so one attempt may consume several datagrams without
     /// retransmitting. Silence or ignored traffic eventually produces
-    /// [`ClientError::OpenTimeout`]. A structurally recognizable malformed or
-    /// incompatible Open reply from the connected peer is terminal; when HMAC
-    /// is configured, that recognition additionally requires authentication.
+    /// [`ClientError::OpenTimeout`], while authenticated incompatibility remains
+    /// terminal.
     ///
     /// When a trusted reply allocates a token but later negotiation or socket
     /// preparation fails, the client sends a best-effort cleanup close and
@@ -524,18 +523,11 @@ impl Client {
             .unwrap_or_else(Instant::now);
         #[cfg(test)]
         if fail_send {
-            runtime.invalidate_kernel_tx_correlation();
             return Err(ClientError::Socket(io::Error::other(
                 "injected probe send failure",
             )));
         }
-        let bytes = match socket.send(&prepared.bytes) {
-            Ok(bytes) => bytes,
-            Err(error) => {
-                runtime.invalidate_kernel_tx_correlation();
-                return Err(ClientError::Socket(error));
-            }
-        };
+        let bytes = socket.send(&prepared.bytes)?;
         #[cfg(not(test))]
         let send_finished_at = Instant::now();
         #[cfg(test)]

crates/irtt-client/src/managed/task.rs

@@ -1613,30 +1613,6 @@ impl ManagedClientTask {
         self.send_gate = self.send_gate.filter(|gate| *gate > now);
     }
 
-    /// The next stagger gate after a send was accepted at `accepted_at`.
-    ///
-    /// The gate advances on its **own** cadence rather than being re-anchored
-    /// on every observed accept time. Anchoring on `accepted_at` folds each
-    /// send's wakeup latency into the next slot and then into every slot after
-    /// it, so the gate — and with it the whole group's send cadence — drifts
-    /// later without bound while the per-target schedules stay on their
-    /// absolute grid. The drift is not hypothetical: it shows up as a
-    /// monotonically growing `EchoSent::timer_error` and, once it exceeds one
-    /// interval, as probe slots the schedule then skips.
-    ///
-    /// `accepted_at` is still the anchor in the two cases where continuing the
-    /// old cadence would be wrong: there is no previous gate, or the pacer has
-    /// fallen a full slot behind it. Re-anchoring there is what keeps a gate
-    /// stranded in the past from releasing a burst of catch-up sends once the
-    /// group starts moving again.
-    fn next_stagger_gate(&self, spacing: Duration, accepted_at: Instant) -> Option<Instant> {
-        let base = match self.send_gate {
-            Some(gate) if gate <= accepted_at && accepted_at.duration_since(gate) < spacing => gate,
-            _ => accepted_at,
-        };
-        base.checked_add(spacing)
-    }
-
     fn record_stagger_acceptance(
         &mut self,
         result: SendResult,
@@ -1650,7 +1626,7 @@ impl ManagedClientTask {
             return;
         };
         self.last_stagger_send = Some(accepted_at);
-        self.send_gate = self.next_stagger_gate(spacing, accepted_at);
+        self.send_gate = accepted_at.checked_add(spacing);
         #[cfg(test)]
         if let Some(observations) = &self.stagger_observations {
             observations.lock().unwrap().push((_active, spacing));

crates/irtt-client/src/managed/tests.rs

@@ -1895,78 +1895,6 @@ fn stagger_gate_tracks_active_membership() {
     second.finish();
 }
 
-/// The stagger gate must not fold each send's observed wakeup latency into
-/// every later slot.
-///
-/// The gate is the binding constraint on when the *group* may send next (see
-/// `next_deadline`), while each target's own schedule stays on an absolute
-/// grid anchored at its open. Re-anchoring the gate on every observed accept
-/// time therefore made the whole group's cadence drift later without bound:
-/// `EchoSent::timer_error` grew monotonically, and once the drift exceeded one
-/// interval `skip_missed_probe_slots_at` started dropping probe slots
-/// outright. Measured before this was fixed, a single-target 20 s run at a
-/// 50 ms interval sent 381 probes instead of 400.
-///
-/// This asserts the invariant directly rather than through a real-time run,
-/// because reproducing accumulation behaviorally needs seconds of wall clock
-/// and a jitter assumption. Two properties, both durable:
-///
-/// - while the pacer keeps up, N accepted sends advance the gate by exactly
-///   N spacings from the first anchor, whatever lateness each send is
-///   observed with;
-/// - a gate the pacer has fallen a full spacing behind re-anchors on the
-///   accept time instead, so a stranded gate cannot release a burst of
-///   catch-up sends.
-#[test]
-fn the_stagger_gate_advances_by_one_spacing_per_send_without_accumulating_lateness() {
-    // No socket is involved: the gate is driven directly and the task is never
-    // polled, so an unreachable address is all a valid target set needs here.
-    let (mut task, _) = ManagedClient::task(
-        config(ManagedPacing::Staggered),
-        vec![target("only", "127.0.0.1:9".parse().unwrap())],
-    )
-    .unwrap();
-
-    let spacing = Duration::from_millis(50);
-    let start = Instant::now();
-    let lateness = Duration::from_millis(3);
-
-    task.record_stagger_acceptance(
-        SendResult::Ready { accepted: true },
-        Some((1, spacing)),
-        start,
-    );
-    assert_eq!(task.send_gate, Some(start + spacing), "first send anchors");
-
-    // Every later send is observed `lateness` after the gate that released it.
-    // The gate must still advance one spacing per send from `start`, not
-    // `spacing + lateness`.
-    for slot in 1..=8_u32 {
-        let released_at = start + spacing * slot;
-        task.record_stagger_acceptance(
-            SendResult::Ready { accepted: true },
-            Some((1, spacing)),
-            released_at + lateness,
-        );
-        assert_eq!(
-            task.send_gate,
-            Some(start + spacing * (slot + 1)),
-            "slot {slot} accumulated observed lateness into the gate"
-        );
-    }
-
-    // A full spacing behind is no longer the same cadence, so the gate
-    // re-anchors rather than staying stranded in the past.
-    let stalled_gate = task.send_gate.expect("the gate is set");
-    let resumed_at = stalled_gate + spacing;
-    task.record_stagger_acceptance(
-        SendResult::Ready { accepted: true },
-        Some((1, spacing)),
-        resumed_at,
-    );
-    assert_eq!(task.send_gate, Some(resumed_at + spacing));
-}
-
 #[test]
 fn timeout_discovery_inspects_at_most_one_budget_of_targets() {
     let target_count = TIMEOUT_WORK_BUDGET + 1;

crates/irtt-client/src/probe.rs

@@ -39,8 +39,7 @@ pub(crate) struct PendingProbe {
     /// eligible only for upstream one-way delay after local plausibility
     /// validation against `tx_not_before_wall` (see `compute_one_way`'s
     /// `preferred_send_wall`). `sent_at` remains the userspace fallback for
-    /// upstream one-way delay when this is absent, implausible, or kernel-ID
-    /// correlation was invalidated by a failed probe submission.
+    /// upstream one-way delay when this is absent or implausible.
     pub kernel_tx_timestamp: Option<SystemTime>,
 }
 

crates/irtt-client/src/receive/linux.rs

@@ -12,17 +12,14 @@
 //! After a successful Open, the client adapter best-effort upgrades the
 //! socket from [`RX_TIMESTAMPING_FLAGS`] to [`error_queue::TX_TIMESTAMPING_FLAGS`]
 //! via [`try_enable_tx_timestamping`]. When that succeeds, the automatic
-//! `SOF_TIMESTAMPING_OPT_ID` counter normally tracks the probe wire sequence
-//! after successful sends, so it is used as a best-effort correlation ID.
-//! A kernel ID can theoretically be consumed by a send that later fails,
-//! desynchronizing that correlation. [`drain_tx_timestamps`] discards
-//! unmatched or implausible records; the userspace `sent_at` timestamp remains
-//! the fallback. After a probe send failure, correlation is disabled for that
-//! session so later IDs cannot be misattributed. It performs a small bounded,
-//! nonblocking read of
-//! `MSG_ERRQUEUE` so the adapter can opportunistically collect timestamps
-//! without ever waiting for one. The observed kernel TX wall time is retained
-//! as metadata only; it is not consumed by any measurement in this change.
+//! `SOF_TIMESTAMPING_OPT_ID` counter the kernel assigns to each successfully
+//! submitted datagram is used directly as the probe's wire sequence number
+//! (see the client crate's `AGENTS.md` for the correlation invariant this
+//! relies on). [`drain_tx_timestamps`] performs a small bounded, nonblocking
+//! read of `MSG_ERRQUEUE` so the adapter can opportunistically collect those
+//! timestamps without ever waiting for one. The observed kernel TX wall time
+//! is retained as metadata only; it is not consumed by any measurement in
+//! this change.
 
 use std::{
     io::{self, IoSliceMut},

crates/irtt-client/src/receive/linux/error_queue.rs

@@ -624,14 +624,22 @@ mod tests {
         ));
     }
 
-    // NOTE: There is no live test for whether a failed nonblocking `sendmsg`
-    // consumes an automatic OPT_ID. Forcing a reliable, non-flaky `WouldBlock`
-    // on a connected loopback UDP socket (for example through socket-buffer
-    // saturation) has no deterministic OS-level mechanism in this environment,
-    // and the repository's testing policy forbids sleep/saturation-based
-    // flakiness. The correlation is intentionally best effort: a kernel ID can
-    // theoretically be consumed by a send that later fails. The deterministic
-    // adapter test covers only the local half: an injected `WouldBlock` does
-    // not advance the local wire-sequence counter. Any later unmatched kernel
-    // timestamp is discarded and the userspace `sent_at` remains the fallback.
+    // NOTE: a live test proving that a failed nonblocking `sendmsg` does not
+    // consume an automatic OPT_ID is not included here. Forcing a reliable,
+    // non-flaky `WouldBlock` on a connected loopback UDP socket (e.g. via
+    // socket-buffer saturation) has no deterministic OS-level mechanism
+    // available in this environment, and the repository's testing policy
+    // explicitly forbids faking coverage with sleep/saturation-based
+    // flakiness. That safety is instead established from Linux kernel
+    // source: `_sock_tx_timestamp` (include/net/sock.h) and
+    // `__ip_append_data`/`__ip6_append_data` (net/ipv4/ip_output.c,
+    // net/ipv6/ip6_output.c) increment `sk->sk_tskey` speculatively before
+    // a datagram is fully built and explicitly `atomic_dec` it back out on
+    // every error path (tracked via a local `hold_tskey` flag), so a failed
+    // send can never leave a gap in — or otherwise advance — the ID space
+    // the kernel hands out to successfully submitted datagrams. See the
+    // client crate's `AGENTS.md` for the full citation. The client-side
+    // half of this invariant (a `WouldBlock` `try_send` never advances the
+    // local wire-sequence counter used as the correlation ID) is covered by
+    // a deterministic test in the adapter module that injects `WouldBlock`.
 }

crates/irtt-client/src/session/machine.rs

@@ -60,7 +60,6 @@ struct ActiveSession {
     pending: PendingMap,
     timed_out: TimedOutMap,
     completed: CompletedSet,
-    kernel_tx_correlation_valid: bool,
 }
 
 #[derive(Debug)]
@@ -424,27 +423,15 @@ impl SessionMachine {
         }
     }
 
-    /// Disable Linux kernel TX timestamp correlation after a probe send fails.
-    ///
-    /// A failed submission can consume a kernel `SOF_TIMESTAMPING_OPT_ID`
-    /// without advancing the wire sequence. Existing associated timestamps
-    /// remain valid observations; later error-queue timestamps cannot be
-    /// associated safely and are ignored for the rest of this session.
-    pub(crate) fn invalidate_kernel_tx_correlation(&mut self) {
-        if let MachineState::Open(session) = &mut self.state {
-            session.kernel_tx_correlation_valid = false;
-        }
-    }
-
     /// Record an observed Linux kernel TX timestamp for `wire_seq`, the
     /// automatic `SOF_TIMESTAMPING_OPT_ID` the kernel assigned when the
     /// datagram was submitted.
     ///
-    /// `wire_seq` normally matches that correlation ID after successful
-    /// sends. This is best effort rather than an invariant: a kernel ID can
-    /// theoretically be consumed by a send that later fails, leaving the
-    /// counters desynchronized. An unmatched or implausible ID is discarded;
-    /// the probe's userspace `sent_at` remains the fallback.
+    /// `wire_seq` doubles as that correlation ID: both counters start at
+    /// zero for a session's first timestamped send and advance by exactly
+    /// one only on a confirmed successful submission, so they stay
+    /// identical for the life of one open session (see the client crate's
+    /// `AGENTS.md` for the full invariant).
     ///
     /// Updates a still-pending or already-timed-out probe in place. Never
     /// resurrects a completed, evicted, or unknown probe, and never touches
@@ -456,9 +443,6 @@ impl SessionMachine {
         let MachineState::Open(session) = &mut self.state else {
             return;
         };
-        if !session.kernel_tx_correlation_valid {
-            return;
-        }
         if let Some(probe) = session.pending.get_mut(wire_seq) {
             probe.kernel_tx_timestamp.get_or_insert(timestamp);
             return;
@@ -652,7 +636,6 @@ impl SessionMachine {
             pending: PendingMap::new(self.config.max_pending_probes),
             timed_out: TimedOutMap::new(self.config.max_pending_probes),
             completed: CompletedSet::new(self.config.max_pending_probes),
-            kernel_tx_correlation_valid: true,
         }));
 
         let event = ClientEvent::SessionStarted {
@@ -1248,7 +1231,6 @@ mod tests {
             pending: PendingMap::new(max_pending_probes),
             timed_out: TimedOutMap::new(max_pending_probes),
             completed: CompletedSet::new(max_pending_probes),
-            kernel_tx_correlation_valid: true,
         }));
         machine
     }
@@ -2891,25 +2873,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn invalidated_kernel_tx_correlation_uses_userspace_send_time() {
-        let mono = Instant::now();
-        let mut machine = upstream_probe(send_wall_ms(1_000), mono);
-
-        // A failed send can consume a kernel ID without advancing wire_seq.
-        // A later timestamp whose ID happens to match a pending wire sequence
-        // must not be associated after that gap.
-        machine.invalidate_kernel_tx_correlation();
-        machine.record_kernel_tx_timestamp(0, send_wall_ms(1_005));
-
-        let events = upstream_reply(&mut machine, 1_020, send_wall_ms(1_040), mono);
-
-        assert_eq!(
-            reply_one_way(&events).unwrap().client_to_server,
-            Some(SignedDuration::from_nanos(20_000_000))
-        );
-    }
-
     #[test]
     fn upstream_one_way_delay_falls_back_without_kernel_tx() {
         let mono = Instant::now();
@@ -3232,7 +3195,6 @@ mod tests {
                 pending: PendingMap::new(MAX_PENDING_PROBES),
                 timed_out: TimedOutMap::new(MAX_PENDING_PROBES),
                 completed: CompletedSet::new(MAX_PENDING_PROBES),
-                kernel_tx_correlation_valid: true,
             }));
             (machine, params)
         }

crates/irtt-server/AGENTS.md

@@ -500,14 +500,13 @@ session policy lives.
   unmarked reply into a *dropped* one, because an unappliable marking stops the
   send. Verify a platform before extending that list.
 - A genuinely dual-stack `[::]` listener still emits **unmarked** IPv4-mapped
-  replies on Linux. When reply DSCP/traffic-class marking for IPv4 peers
-  matters, configure the normal same-port `[::]:PORT` plus `0.0.0.0:PORT`
-  listener pair instead; `ServerSet` makes the IPv6 half IPv6-only for that
-  pair. Do not force `IPV6_V6ONLY` on every lone IPv6 listener, and do not
-  weaken the rule that an unappliable marking stops the send. The crate forbids
-  unsafe code; there is no raw `setsockopt` and no `sendmsg`/`cmsg` machinery.
-  Keep the target lists identical to the pinned `socket2` version's own gates
-  — check its source rather than copying another crate's older matrix.
+  replies, and this is known. It is not fixed by choosing the option per reply,
+  for the macOS reason above, and it predates wildcard source selection. Leave it
+  until it is worth its own slice, and do not "fix" it by weakening the rule that
+  an unappliable marking stops the send. The crate forbids unsafe code;
+  there is no raw `setsockopt` and no `sendmsg`/`cmsg` machinery. Keep the
+  target lists identical to the pinned `socket2` version's own gates — check
+  its source rather than copying another crate's older matrix.
 
 ## Rate, lifetime and server-initiated close
 

crates/irtt-server/src/set.rs

@@ -91,14 +91,6 @@ impl ServerSet {
     /// An IPv4-mapped address such as `[::ffff:0.0.0.0]` is an IPv4 listener
     /// here, not an IPv6 one, matching how the runtime already reads it.
     ///
-    /// A lone explicit dual-stack `[::]:PORT` listener is not the recommended
-    /// configuration when reply DSCP/traffic-class marking for IPv4 peers
-    /// matters: Linux serves those peers as IPv4-mapped and cannot retain the
-    /// negotiated marking on their replies. Request the normal same-port
-    /// `[::]:PORT` and `0.0.0.0:PORT` pair instead. This method makes the IPv6
-    /// half IPv6-only for that pair only; a lone IPv6 listener retains its
-    /// normal socket behavior.
-    ///
     /// # Errors
     ///
     /// Returns [`ServerSetError::NoListeners`] if `addrs` is empty — a set

docs/irtt-rs.md

@@ -31,7 +31,7 @@ The build also produces dedicated binaries: `irtt-client`, `irtt-tui`, and
 what it is invoked or copied as — it does not consult argv0 dispatch logic.
 
 `irtt-rs` itself inspects argv0 first: if invoked (or symlinked/copied) under
-one of the recognized applet names — `irtt-client`, `irtt-tui`, or
+one of the recognized applet names — `irtt-client`, `irtt-tui`, `irttd`, or
 `irtt-server` — it runs that applet directly, without needing a subcommand.
 Any other name starting with `irtt-` (other than `irtt-rs` itself) is
 rejected as an unknown applet name before subcommand parsing is even

docs/irtt-server.md

@@ -60,17 +60,7 @@ served.
 A port of `0` selects an unused port per listener, so two such binds get two
 different ports.
 
-With no `--bind` at all, see [Description](#description) above for the
-default wildcard pair and the address-family fallback it allows.
-
-When reply DSCP/traffic-class marking for IPv4 peers matters, do not configure
-one explicit dual-stack `[::]:PORT` listener by itself. On Linux, IPv4 peers
-served through that socket are IPv4-mapped and their replies cannot retain the
-negotiated marking. Configure the ordinary paired `[::]:PORT` and
-`0.0.0.0:PORT` listeners instead; the IPv6 listener is made IPv6-only for that
-same-port pair, so each family uses the correct socket option. This is a
-configuration workaround, not a reason to force `IPV6_V6ONLY` for every lone
-IPv6 listener.
+With no `--bind` at all, see [Default bind](#default-bind) above.
 
 ### `--hmac KEY`
 
@@ -146,35 +136,6 @@ and they are sent unmarked. The session is not refused.
 Durations everywhere in this command accept an integer followed by a unit:
 `ms`, `s`, or `m`.
 
-## ENVIRONMENT
-
-Every option above can also be supplied through an environment variable, for
-deployments that configure by environment rather than by command line
-(containers, orchestrators, unit files). A flag given on the command line
-overrides the corresponding variable entirely; an unset variable leaves the
-built-in default in place.
-
-| Variable | Option |
-| --- | --- |
-| `IRTT_SERVER_BIND` | `--bind`, one address only |
-| `IRTT_SERVER_HMAC` | `--hmac` |
-| `IRTT_SERVER_MAX_SESSIONS` | `--max-sessions` |
-| `IRTT_SERVER_MAX_PACKET_LENGTH` | `--max-packet-length` |
-| `IRTT_SERVER_MIN_INTERVAL` | `--min-interval` |
-| `IRTT_SERVER_BURST` | `--burst` |
-| `IRTT_SERVER_IDLE_TIMEOUT` | `--idle-timeout` |
-| `IRTT_SERVER_MAX_DURATION` | `--max-duration` |
-| `IRTT_SERVER_TIMESTAMP_ALLOWANCE` | `--timestamp-allowance` |
-| `IRTT_SERVER_NO_DSCP` | `--no-dscp` |
-
-`IRTT_SERVER_BIND` takes exactly one address, the same as a single `--bind`;
-there is no way to request several listeners from the environment. Serving
-more than one address needs repeated `--bind` options.
-
-`IRTT_SERVER_NO_DSCP` is the only boolean. `0`, `false`, `no`, `n`, `off` and
-an empty value leave traffic-class marking enabled; any other value disables
-it, and an unset variable leaves it enabled.
-
 ## OUTPUT
 
 Each bound endpoint is printed on startup, once every listener is up, which

docs/irtt-tui.md

@@ -62,14 +62,6 @@ presentation bounds on top of the client's own statistics retention (see
 total memory is dominated by whichever of the two is larger for your target
 count.
 
-A **finite** `--duration` TUI run retains exact statistics samples exactly as
-`irtt-client(1)` does in finite mode, so its retained state grows with the
-probe count rather than approaching a bound. Unlike `irtt-client`, the TUI
-prints **no** memory warning when that estimate gets large: it owns the
-alternate screen, and a stderr warning there would be invisible or would
-corrupt the display. Size a long finite TUI run from the figures in
-`irtt-client(1)` MEASUREMENTS AND MEMORY, or use the continuous default.
-
 ## EXIT BEHAVIOR
 
 Quitting with `q` or `Ctrl-C` is an interrupted, successful exit. Otherwise,