tests: rework the actually useful tests to live in the integration crate

tests: clean up more tests across the project
tests(client): cleanup unnecessary tests and hooks
2026-10-02 13:28:29 +07:00 · 2026-10-02 12:47:27 +07:00 · 2026-10-02 08:33:49 +07:00 · 2026-10-02 00:31:17 +07:00 · 2026-10-02 00:31:17 +07:00 · 2026-10-01 23:25:15 +07:00
152 changed files with 4448 additions and 24370 deletions
@@ -28,7 +28,7 @@ jobs:
          persist-credentials: false

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
        with:
          components: rustfmt
          cache: false
@@ -48,7 +48,7 @@ jobs:
          persist-credentials: false

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
        with:
          components: clippy
          cache: false
@@ -109,7 +109,7 @@ jobs:
          sudo apt-get install --no-install-recommends musl-tools

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
        with:
          target: ${{ matrix.target }}
          cache: false
@@ -147,7 +147,7 @@ jobs:
          persist-credentials: false

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
        with:
          cache: false

@@ -158,3 +158,6 @@ jobs:
            --all-features \
            --no-deps \
            --locked
+
+      - name: Run doctests
+        run: cargo test --workspace --doc --all-features --locked
@@ -42,7 +42,7 @@ jobs:
      # (native builds, no emulation), but buildx still needs a driver that
      # can assemble a multi-platform manifest list.
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4

      - name: Log in to Gitea Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
@@ -76,7 +76,7 @@ jobs:
      # below), never a separate build, so the hash matches everywhere.
      - name: Build and push to Gitea
        id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
@@ -1,4 +1,4 @@
-name: Proto Fuzz Smoke
+name: Fuzz Smoke

 on:
  push:
@@ -33,7 +33,7 @@ jobs:
          persist-credentials: false

      - name: Install stable Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
        with:
          cache: false

@@ -71,7 +71,7 @@ jobs:
        # regression; this is not meant to be exhaustive fuzzing.
        run: |
          set -euo pipefail
-          for target in decode_request decode_open_reply decode_echo_reply decode_params decode_varint; do
+          for target in decode_request decode_open_reply decode_echo_reply decode_params decode_varint server_core_datagrams; do
            echo "::group::fuzz smoke: ${target}"
            RUSTUP_TOOLCHAIN="${FUZZ_TOOLCHAIN}" cargo fuzz run --target "${FUZZ_TARGET}" "${target}" -- \
              -max_total_time=10 \
@@ -30,7 +30,7 @@ jobs:
          persist-credentials: false

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
        with:
          cache: false

@@ -30,7 +30,7 @@ jobs:
          persist-credentials: false

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
        with:
          cache: false

@@ -36,7 +36,7 @@ jobs:
      # It remains here while portable actionlint runs with Gitea CI, but scans
      # both workflow directories through its GitHub Actions rule set.
      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
        with:
          persona: regular
          inputs: |
@@ -56,7 +56,7 @@ jobs:
          sudo apt-get install --no-install-recommends musl-tools

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
        with:
          target: ${{ matrix.target }}
          cache-key: ${{ matrix.task }}-${{ matrix.target }}
@@ -31,7 +31,7 @@ permissions:
 jobs:
  scan-scheduled:
    if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@6e4298ebc4db23e847df9b2e2de2939d6f066c67" # v2.5.1
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0
    with:
      # Example of specifying custom arguments
      scan-args: |-
@@ -40,7 +40,7 @@ jobs:
        ./
  scan-pr:
    if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@6e4298ebc4db23e847df9b2e2de2939d6f066c67" # v2.5.1
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0
    with:
      # Example of specifying custom arguments
      scan-args: |-
@@ -29,7 +29,7 @@ jobs:
          persist-credentials: false

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
        with:
          components: clippy
          cache-key: clippy-sarif
@@ -60,7 +60,7 @@ jobs:
          exit 0

      - name: Upload Clippy SARIF
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
        if: always()
        with:
          sarif_file: rust-clippy-results.sarif
@@ -173,6 +173,7 @@ Use the narrowest useful checks first. For substantive workspace changes, final
 cargo fmt --all -- --check
 cargo check --workspace --all-targets --all-features --locked
 cargo test --workspace --all-targets --all-features --locked
+cargo test --workspace --doc --all-features --locked
 cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 ```

@@ -10,6 +10,12 @@ release. The format is loosely based on

 ## irtt-proto

+### 0.5.1
+
+#### Added
+
+- Added a crate-specific README and runnable API doctests to make the published crate's protocol types and codecs easier to discover and use.
+
 ### 0.5.0

 #### Added
@@ -28,6 +34,18 @@ release. The format is loosely based on

 ## irtt-client

+### 0.5.3
+
+#### Added
+
+- `SocketConfig` can bind UDP sockets to a network interface and set a packet mark on Linux, Android, and Fuchsia, or select a routing FIB on FreeBSD.
+
+### 0.5.2
+
+#### Fixed
+
+- Kernel transmit-timestamp correlation is now invalidated when a probe send fails, preventing a later timestamp from being matched to the wrong probe.
+
 ### 0.5.1

 #### Added
@@ -56,6 +74,12 @@ release. The format is loosely based on

 ## irtt-server

+### 0.5.3
+
+#### Added
+
+- Added a crate-specific README and usage examples for single- and multi-listener servers, plus runnable API doctests.
+
 ### 0.5.2

 #### Changed
@@ -95,6 +119,12 @@ release. The format is loosely based on

 ## irtt-stats

+### 0.5.1
+
+#### Added
+
+- Added a crate-specific README, a finite-versus-continuous statistics example, and runnable API doctests for the published crate.
+
 ### 0.5.0

 #### Fixed
@@ -108,6 +138,12 @@ release. The format is loosely based on

 ## irtt-rs

+### 0.7.1
+
+#### Fixed
+
+- `IRTT_SERVER_NO_DSCP` now accepts ordinary boolean environment values such as `1` and `0`; falsey values leave DSCP marking enabled, while truthy values disable it. The `--no-dscp` command-line flag remains a flag without a value.
+
 ### 0.7.0

 #### Added
@@ -141,9 +141,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"

 [[package]]
 name = "bitflags"
-version = "2.13.1"
+version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"

 [[package]]
 name = "block-buffer"
@@ -201,9 +201,9 @@ dependencies = [

 [[package]]
 name = "cfg-if"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"

 [[package]]
 name = "cfg_aliases"
@@ -213,9 +213,9 @@ checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"

 [[package]]
 name = "clap"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
 dependencies = [
 "clap_builder",
 "clap_derive",
@@ -223,9 +223,9 @@ dependencies = [

 [[package]]
 name = "clap_builder"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
 dependencies = [
 "anstream",
 "anstyle",
@@ -235,21 +235,21 @@ dependencies = [

 [[package]]
 name = "clap_derive"
-version = "4.6.4"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0"
 dependencies = [
 "heck",
 "proc-macro2",
 "quote",
- "syn 3.0.4",
+ "syn 3.0.6",
 ]

 [[package]]
 name = "clap_lex"
-version = "1.1.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+checksum = "1c133bc6a41be0d194c306b5506d15e6feeea7b1d6604bd3f8310dfb2ca96486"

 [[package]]
 name = "cmov"
@@ -313,7 +313,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8b9f2e4c67f833b660cdb0a3523065869fb35570177239812ed4c905aeff87b"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "crossterm_winapi",
 "derive_more",
 "document-features",
@@ -403,7 +403,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "strsim",
- "syn 3.0.4",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -414,7 +414,7 @@ checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
 dependencies = [
 "darling_core",
 "quote",
- "syn 3.0.4",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -479,7 +479,7 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "block2",
 "libc",
 "objc2",
@@ -554,9 +554,9 @@ dependencies = [

 [[package]]
 name = "finl_unicode"
-version = "1.4.0"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9844ddc3a6e533d62bba727eb6c28b5d360921d5175e9ff0f1e621a5c590a4d5"
+checksum = "80bb028c8b4148c9ee0cca68fcd9add6044e81d3619f48577ddf13a263d047a2"

 [[package]]
 name = "fixedbitset"
@@ -678,9 +678,9 @@ dependencies = [

 [[package]]
 name = "hybrid-array"
-version = "0.4.14"
+version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
 dependencies = [
 "typenum",
 ]
@@ -702,27 +702,25 @@ dependencies = [

 [[package]]
 name = "instability"
-version = "0.3.13"
+version = "0.3.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bf84e73fa6f27f299dec58e13223cf70db80da872eb921d4f6138342a0eabc8"
+checksum = "4c3b5acc1e2fd9375041a388da33d1eb8aed5f7a8c0dd3543e3ea2805adfbe20"
 dependencies = [
 "darling",
 "indoc",
 "proc-macro2",
 "quote",
- "syn 3.0.4",
+ "syn 3.0.6",
 ]

 [[package]]
 name = "irtt-client"
-version = "0.5.1"
+version = "0.5.3"
 dependencies = [
 "irtt-proto",
- "irtt-server",
 "nix 0.31.3",
- "proptest",
 "socket2",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 "tokio",
 ]

@@ -738,18 +736,18 @@ dependencies = [

 [[package]]
 name = "irtt-proto"
-version = "0.5.0"
+version = "0.5.1"
 dependencies = [
 "hmac",
 "md-5",
 "proptest",
 "subtle",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]

 [[package]]
 name = "irtt-rs"
-version = "0.7.0"
+version = "0.7.1"
 dependencies = [
 "clap",
 "crossterm",
@@ -764,21 +762,22 @@ dependencies = [

 [[package]]
 name = "irtt-server"
-version = "0.5.2"
+version = "0.5.3"
 dependencies = [
 "getrandom 0.4.3",
 "irtt-proto",
 "nix 0.31.3",
 "socket2",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 "tokio",
 ]

 [[package]]
 name = "irtt-stats"
-version = "0.5.0"
+version = "0.5.1"
 dependencies = [
 "irtt-client",
+ "measurement-stats",
 "proptest",
 ]

@@ -805,9 +804,9 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"

 [[package]]
 name = "js-sys"
-version = "0.3.104"
+version = "0.3.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
+checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
 dependencies = [
 "cfg-if",
 "futures-util",
@@ -822,7 +821,7 @@ checksum = "bde5057d6143cc94e861d90f591b9303d6716c6b9602309150bd068853c10899"
 dependencies = [
 "hashbrown 0.16.1",
 "portable-atomic",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]

 [[package]]
@@ -855,7 +854,7 @@ version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e752191d037c44ad111a8caa762921926658402f01cc1253f7bef2020ece4f5e"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 ]

 [[package]]
@@ -887,9 +886,9 @@ checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"

 [[package]]
 name = "lru"
-version = "0.18.3"
+version = "0.18.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d317b4b9eb398e6acce275758ec6125535505e7a146fb1a9b8bda2451b0ff4c"
+checksum = "ef9ac18847474e638e3702b76c65d4eb93428471a74778ef0f1be711717f89b5"
 dependencies = [
 "hashbrown 0.17.1",
 ]
@@ -914,6 +913,12 @@ dependencies = [
 "digest 0.11.3",
 ]

+[[package]]
+name = "measurement-stats"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0edbfa45a060f44b15568637075ecebbe258c22f86ce6f2b5d58d7a64cbdb689"
+
 [[package]]
 name = "memchr"
 version = "2.8.3"
@@ -943,9 +948,9 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"

 [[package]]
 name = "mio"
-version = "1.2.2"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
 dependencies = [
 "libc",
 "log",
@@ -959,7 +964,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "cfg-if",
 "cfg_aliases",
 "libc",
@@ -972,7 +977,7 @@ version = "0.31.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "cfg-if",
 "cfg_aliases",
 "libc",
@@ -1118,9 +1123,9 @@ dependencies = [

 [[package]]
 name = "pest"
-version = "2.9.0"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a07a60cc7a4d00c91f95c685609d1d2f79050e6804b70ebedd7650f0b839bcf"
+checksum = "45d3aca230fad2e6f6317ca0a72724338c4960cb97168a85cdee66df4a9a21a8"
 dependencies = [
 "memchr",
 "ucd-trie",
@@ -1128,9 +1133,9 @@ dependencies = [

 [[package]]
 name = "pest_derive"
-version = "2.9.0"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3a83744a5c8455b8b3e0dc5031362780a347c878bdd11584d1a8984228cc88d"
+checksum = "284b60557f2c4a2e72ad3f2d34d42685a2fa4a6a61d0d2a10c0ae2a5e916c2cf"
 dependencies = [
 "pest",
 "pest_generator",
@@ -1138,9 +1143,9 @@ dependencies = [

 [[package]]
 name = "pest_generator"
-version = "2.9.0"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0cd3451aa3de60d4b9a1e736885e4dea6b31617598026f12256ad566d63304a"
+checksum = "1d9d1f08a115309ee99268cf85e5228e0e56aa9caf8841ec12866b6be07c3109"
 dependencies = [
 "pest",
 "pest_meta",
@@ -1151,9 +1156,9 @@ dependencies = [

 [[package]]
 name = "pest_meta"
-version = "2.9.0"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e04d3a0849e241d7dfce834c83b1c5edc8622009e8dd51a12ba1927c32f05496"
+checksum = "ed93ba1a9ffcca32130a5188701c81c0c49cf00d4b7c5007d5148951d743adcb"
 dependencies = [
 "pest",
 ]
@@ -1254,7 +1259,7 @@ checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
 dependencies = [
 "bit-set 0.8.0",
 "bit-vec 0.8.0",
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "num-traits",
 "rand 0.9.5",
 "rand_chacha",
@@ -1367,7 +1372,7 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cbb175c433c8e28a809d1f5773a2ae96e68c0ce40db865cbab1020bf33ae479c"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "compact_str",
 "critical-section",
 "hashbrown 0.17.1",
@@ -1377,7 +1382,7 @@ dependencies = [
 "palette",
 "serde",
 "strum",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 "unicode-segmentation",
 "unicode-truncate",
 "unicode-width",
@@ -1432,7 +1437,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66e3d19bcc9130ca376277d93b60767ff121ace3be06f5f95f81dd68956407d1"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "hashbrown 0.17.1",
 "indoc",
 "instability",
@@ -1452,7 +1457,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 ]

 [[package]]
@@ -1495,11 +1500,11 @@ dependencies = [

 [[package]]
 name = "rustix"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "errno",
 "libc",
 "linux-raw-sys",
@@ -1569,7 +1574,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.4",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -1616,9 +1621,9 @@ dependencies = [

 [[package]]
 name = "siphasher"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
+checksum = "33f4fe9184a62d842c9ef383018f3306d8ba224fd9d836f56d7288308847c256"

 [[package]]
 name = "slab"
@@ -1628,9 +1633,9 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"

 [[package]]
 name = "smallvec"
-version = "1.15.2"
+version = "1.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+checksum = "f9395f0f0eee849a9b707b2f06bb92a6a422090e2123bb2ef8e87a0e61892a8e"

 [[package]]
 name = "socket2"
@@ -1705,9 +1710,9 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "3.0.4"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -1733,7 +1738,7 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9048a889effe34a5cddee0af7f53285198b16dca3be510858d38dfdb3e62a04e"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "parking_lot",
 "rustix",
 "signal-hook",
@@ -1769,7 +1774,7 @@ checksum = "4676b37242ccbd1aabf56edb093a4827dc49086c0ffd764a5705899e0f35f8f7"
 dependencies = [
 "anyhow",
 "base64",
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "fancy-regex",
 "filedescriptor",
 "finl_unicode",
@@ -1814,11 +1819,11 @@ dependencies = [

 [[package]]
 name = "thiserror"
-version = "2.0.20"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
 dependencies = [
- "thiserror-impl 2.0.20",
+ "thiserror-impl 2.0.21",
 ]

 [[package]]
@@ -1834,13 +1839,13 @@ dependencies = [

 [[package]]
 name = "thiserror-impl"
-version = "2.0.20"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.4",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -1886,7 +1891,7 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.4",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -1909,9 +1914,9 @@ checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"

 [[package]]
 name = "unicode-ident"
-version = "1.0.24"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"

 [[package]]
 name = "unicode-segmentation"
@@ -1944,9 +1949,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"

 [[package]]
 name = "uuid"
-version = "1.26.0"
+version = "1.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5772d71c9be8a8a6ac2117d949c5b224c1b72241bb611d9a3012edcf8af7812"
+checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
 dependencies = [
 "atomic",
 "getrandom 0.4.3",
@@ -1995,9 +2000,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen"
-version = "0.2.127"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
+checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
 dependencies = [
 "cfg-if",
 "once_cell",
@@ -2008,9 +2013,9 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.127"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
+checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
 dependencies = [
 "quote",
 "wasm-bindgen-macro-support",
@@ -2018,22 +2023,22 @@ dependencies = [

 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.127"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
+checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
 dependencies = [
 "bumpalo",
 "proc-macro2",
 "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
 "wasm-bindgen-shared",
 ]

 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.127"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
+checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
 dependencies = [
 "unicode-ident",
 ]
@@ -2155,18 +2160,18 @@ checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"

 [[package]]
 name = "zerocopy"
-version = "0.8.56"
+version = "0.8.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
+checksum = "6df92bf3d9227be3d53173901ddbffac2babc27ae50f397776ffd6dc33f800cb"
 dependencies = [
 "zerocopy-derive",
 ]

 [[package]]
 name = "zerocopy-derive"
-version = "0.8.56"
+version = "0.8.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
+checksum = "ac4f328cf2f05d084e496c3e9c3f33ed0a183656a16e1fcec4d464d8373aec82"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -171,6 +171,7 @@ when to use it instead of `irtt-client`/`irtt-server` directly.
 ```sh
 cargo fmt --all -- --check
 cargo test --workspace --locked
+cargo test --workspace --doc --all-features --locked
 cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 ```

@@ -1,6 +1,6 @@
 [package]
 name = "irtt-rs"
-version = "0.7.0"
+version = "0.7.1"
 description = "IRTT-compatible client, TUI, and server applications"
 edition.workspace = true
 license.workspace = true
@@ -47,7 +47,7 @@ server = ["dep:irtt-server", "dep:tokio"]
 tui =["dep:irtt-client", "irtt-client/ancillary", "irtt-client/tokio", "dep:irtt-proto", "dep:irtt-stats", "dep:ratatui", "dep:crossterm"]

 [dependencies]
-clap = { version = "4.6.6", features = ["derive", "env"] }
+clap = { version = "4.6.7", features = ["derive", "env"] }
 crossterm = { version = "0.29.0", optional = true }
 ctrlc = { version = "3.5.2", features = ["termination"] }
 irtt-client = { workspace = true, optional = true }
@@ -22,7 +22,7 @@ pub fn detect_applet_from_argv0(argv0: &str) -> Option<RequestedApplet> {
    match applet_basename(argv0) {
        "irtt-client" => Some(RequestedApplet::Client),
        "irtt-tui" => Some(RequestedApplet::Tui),
-        "irttd" | "irtt-server" => Some(RequestedApplet::Server),
+        "irtt-server" => Some(RequestedApplet::Server),
        "irtt-rs" => None,
        _ => None,
    }
@@ -180,147 +180,3 @@ fn applet_argv(applet_name: &str, args: &[OsString]) -> Vec<OsString> {
    argv.extend(args.iter().cloned());
    argv
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn applet_detection_maps_binary_names() {
-        assert_eq!(
-            detect_applet_from_argv0("/usr/bin/irtt-client"),
-            Some(RequestedApplet::Client)
-        );
-        assert_eq!(
-            detect_applet_from_argv0("irtt-tui"),
-            Some(RequestedApplet::Tui)
-        );
-        assert_eq!(
-            detect_applet_from_argv0("irtt-server"),
-            Some(RequestedApplet::Server)
-        );
-        assert_eq!(detect_applet_from_argv0("irtt-rs"), None);
-        assert_eq!(detect_applet_from_argv0("custom-name"), None);
-    }
-
-    #[test]
-    fn old_irtt_cli_binary_name_is_no_longer_a_recognized_applet() {
-        assert_eq!(detect_applet_from_argv0("irtt-cli"), None);
-        assert_eq!(detect_applet_from_argv0("/usr/bin/irtt-cli"), None);
-    }
-
-    #[test]
-    fn applet_detection_ignores_the_platform_executable_suffix() {
-        let exe = std::env::consts::EXE_SUFFIX;
-
-        assert_eq!(
-            detect_applet_from_argv0(&format!("/opt/irtt/irtt-server{exe}")),
-            Some(RequestedApplet::Server)
-        );
-        assert_eq!(
-            detect_applet_from_argv0(&format!("irtt-client{exe}")),
-            Some(RequestedApplet::Client)
-        );
-
-        // The dispatcher's own name must not be taken for an unknown applet.
-        let dispatcher = format!("irtt-rs{exe}");
-        assert_eq!(detect_applet_from_argv0(&dispatcher), None);
-        assert!(dispatch_from_argv(vec![dispatcher.into(), "--help".into()]).is_ok());
-
-        // A name that merely ends in the suffix letters keeps them.
-        assert!(detect_applet_from_argv0("irtt-serverexe").is_none());
-    }
-
-    #[test]
-    fn windows_executable_suffix_handling_is_assertable_from_any_host() {
-        assert_eq!(
-            strip_suffix_ignoring_case("irtt-server.exe", ".exe"),
-            "irtt-server"
-        );
-        assert_eq!(strip_suffix_ignoring_case("IRTT-RS.EXE", ".exe"), "IRTT-RS");
-        assert_eq!(
-            strip_suffix_ignoring_case("irtt-server", ".exe"),
-            "irtt-server"
-        );
-        assert_eq!(
-            strip_suffix_ignoring_case("irtt-serverexe", ".exe"),
-            "irtt-serverexe"
-        );
-        assert_eq!(strip_suffix_ignoring_case(".exe", ".exe"), ".exe");
-        assert_eq!(
-            strip_suffix_ignoring_case("irtt-server.exe", ""),
-            "irtt-server.exe"
-        );
-        // A multi-byte tail must not split mid-character.
-        assert_eq!(strip_suffix_ignoring_case("irtt-så", ".exe"), "irtt-så");
-    }
-
-    #[test]
-    fn canonical_help_renders_dispatcher_help() {
-        let dispatch = dispatch_from_argv(vec!["irtt-rs".into(), "--help".into()]).unwrap();
-        let AppletDispatch::Help(help) = dispatch else {
-            panic!("expected dispatcher help");
-        };
-        assert!(help.contains("IRTT-compatible multi-applet dispatcher"));
-        assert!(help.contains("client"));
-        if cfg!(feature = "tui") {
-            assert!(help.contains("Run the terminal UI applet"));
-        } else {
-            assert!(help.contains("Terminal UI applet is not available in this build"));
-        }
-        assert!(help.contains("server"));
-        if cfg!(feature = "server") {
-            assert!(help.contains("Run the UDP server applet"));
-        } else {
-            assert!(help.contains("UDP server applet is not available in this build"));
-        }
-    }
-
-    #[test]
-    fn canonical_without_applet_is_an_error() {
-        let err = dispatch_from_argv(vec!["irtt-rs".into()]).unwrap_err();
-        assert!(err.contains("choose an applet"));
-        assert!(err.contains("client"));
-        if cfg!(feature = "tui") {
-            assert!(err.contains("tui"));
-        }
-        assert!(err.contains("server"));
-    }
-
-    #[test]
-    fn canonical_subcommands_dispatch_to_applet_argv() {
-        assert_eq!(
-            dispatch_from_argv(vec!["irtt-rs".into(), "client".into(), "host:2112".into()])
-                .unwrap(),
-            AppletDispatch::Run {
-                applet: RequestedApplet::Client,
-                argv: vec!["irtt-client".into(), "host:2112".into()],
-            }
-        );
-        assert_eq!(
-            dispatch_from_argv(vec!["irtt-rs".into(), "tui".into(), "host:2112".into()]).unwrap(),
-            AppletDispatch::Run {
-                applet: RequestedApplet::Tui,
-                argv: vec!["irtt-tui".into(), "host:2112".into()],
-            }
-        );
-        assert_eq!(
-            dispatch_from_argv(vec!["irtt-rs".into(), "server".into()]).unwrap(),
-            AppletDispatch::Run {
-                applet: RequestedApplet::Server,
-                argv: vec!["irtt-server".into()],
-            }
-        );
-    }
-
-    #[test]
-    fn unknown_irtt_binary_name_is_an_error() {
-        let err = dispatch_from_argv(vec!["/usr/bin/irtt-typo".into()]).unwrap_err();
-        assert!(err.contains("unknown applet name 'irtt-typo'"));
-        assert!(err.contains("irtt-client"));
-        if cfg!(feature = "tui") {
-            assert!(err.contains("irtt-tui"));
-        }
-        assert!(err.contains("irtt-server"));
-    }
-}
@@ -151,195 +151,3 @@ pub enum HeaderMode {
    /// Never print headers.
    Never,
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use clap::{CommandFactory, Parser};
-    use irtt_client::NegotiationPolicy;
-    use irtt_proto::{Clock, ReceivedStats, StampAt};
-
-    fn parse(args: &[&str]) -> Result<ClientArgs, clap::Error> {
-        let mut argv = vec!["irtt-client"];
-        argv.extend_from_slice(args);
-        ClientArgs::try_parse_from(argv)
-    }
-
-    #[test]
-    fn client_parser_keeps_finite_default_duration() {
-        let args = parse(&["127.0.0.1:2112"]).unwrap();
-
-        assert_eq!(args.targets.len(), 1);
-        assert_eq!(args.prepare().unwrap().targets[0].label, "127.0.0.1:2112");
-        assert_eq!(args.pacing, GroupPacingArg::Staggered);
-        assert_eq!(args.duration, DEFAULT_CLIENT_DURATION);
-        assert_eq!(args.interval, Duration::from_secs(1));
-        assert_eq!(args.format, OutputFormat::Table);
-        assert_eq!(args.columns, None);
-        assert_eq!(args.header, HeaderMode::Auto);
-        assert!(!args.targets_stdin);
-        assert!(!args.is_continuous());
-        assert_eq!(args.timestamp_mode(), TimestampArg::Both);
-
-        let config = args.prepare().unwrap().client;
-        assert_eq!(config.duration, Some(DEFAULT_CLIENT_DURATION));
-        assert_eq!(config.received_stats, ReceivedStats::Both);
-        assert_eq!(config.stamp_at, StampAt::Both);
-        assert_eq!(config.clock, Clock::Both);
-        assert_eq!(config.negotiation_policy, NegotiationPolicy::Strict);
-    }
-
-    #[test]
-    fn client_parser_accepts_stream_formats_and_rejects_tui_output() {
-        for format in ["table", "csv", "tsv", "jsonl"] {
-            assert!(parse(&["--format", format, "127.0.0.1:2112"]).is_ok());
-        }
-        assert!(parse(&["--format", "tui", "127.0.0.1:2112"]).is_err());
-    }
-
-    #[test]
-    fn list_columns_does_not_require_server() {
-        let args = parse(&["--list-columns"]).unwrap();
-        assert!(args.targets.is_empty());
-        assert!(args.list_columns);
-        // The parser accepts no target; preparation is where a target becomes
-        // mandatory, and the stream command returns before preparing when
-        // listing columns.
-        let err = args.prepare().unwrap_err();
-        assert!(err.contains("--list-columns"));
-    }
-
-    #[test]
-    fn multiple_positional_targets_parse_as_targets() {
-        let args = parse(&["host-a:2112", "host-b:2112"]).unwrap();
-        let specs = args.prepare().unwrap().targets;
-
-        assert_eq!(specs[0].label, "host-a:2112");
-        assert_eq!(specs[0].managed.server_addr, "host-a:2112");
-        assert_eq!(specs[1].label, "host-b:2112");
-        assert_eq!(specs[1].managed.server_addr, "host-b:2112");
-    }
-
-    #[test]
-    fn repeated_labeled_targets_parse() {
-        let args = parse(&["ams=ams.example.com:2112", "sg=sg.example.com:2112"]).unwrap();
-        let specs = args.prepare().unwrap().targets;
-
-        assert_eq!(specs[0].label, "ams");
-        assert_eq!(specs[0].managed.server_addr, "ams.example.com:2112");
-        assert_eq!(specs[1].label, "sg");
-        assert_eq!(specs[1].managed.server_addr, "sg.example.com:2112");
-    }
-
-    #[test]
-    fn mixed_labeled_and_unlabeled_targets_preserve_argument_order() {
-        let args = parse(&["local.example", "eu=a.example", "backup.example"]).unwrap();
-        let specs = args.prepare().unwrap().targets;
-
-        let labels: Vec<_> = specs.iter().map(|target| target.label.as_str()).collect();
-        assert_eq!(labels, ["local.example", "eu", "backup.example"]);
-    }
-
-    #[test]
-    fn duplicate_labels_are_rejected() {
-        let args = parse(&["host-a:2112", "host-a:2112=host-b:2112"]).unwrap();
-        let err = args.prepare().unwrap_err();
-
-        assert!(err.contains("duplicate target label"));
-    }
-
-    #[test]
-    fn duplicate_positional_target_strings_get_stable_suffixes() {
-        let args = parse(&["host-a:2112", "host-a:2112"]).unwrap();
-        let specs = args.prepare().unwrap().targets;
-
-        assert_eq!(specs[0].label, "host-a:2112");
-        assert_eq!(specs[1].label, "host-a:2112#2");
-    }
-
-    #[test]
-    fn duplicate_target_endpoints_are_allowed() {
-        let args = parse(&["127.0.0.1:2112", "127.0.0.1"]).unwrap();
-        assert_eq!(args.prepare().unwrap().target_count(), 2);
-    }
-
-    #[test]
-    fn invalid_labelled_target_syntax_is_rejected() {
-        assert!(parse(&["=127.0.0.1:2112"]).unwrap().prepare().is_err());
-        assert!(parse(&["label="]).unwrap().prepare().is_err());
-    }
-
-    #[test]
-    fn old_target_option_is_rejected() {
-        assert!(parse(&["--target", "eu=host.example"]).is_err());
-    }
-
-    #[test]
-    fn pacing_option_accepts_supported_values() {
-        assert_eq!(
-            parse(&["--pacing", "staggered", "127.0.0.1:2112"])
-                .unwrap()
-                .pacing,
-            GroupPacingArg::Staggered
-        );
-        assert_eq!(
-            parse(&["--pacing", "burst", "127.0.0.1:2112"])
-                .unwrap()
-                .pacing,
-            GroupPacingArg::Burst
-        );
-    }
-
-    #[test]
-    fn client_help_lists_shared_protocol_options() {
-        let help = ClientArgs::command().render_help().to_string();
-        assert!(help.contains("--format <FORMAT>"));
-        assert!(!help.contains("--target "));
-        assert!(help.contains("--pacing <PACING>"));
-        assert!(help.contains("--columns <COLUMNS>"));
-        assert!(help.contains("--list-columns"));
-        assert!(help.contains("--header <HEADER>"));
-        assert!(help.contains("--tstamp <MODE>"));
-        assert!(help.contains("--stats <STATS>"));
-        assert!(help.contains("--sfill <STRING>"));
-        assert!(help.contains("--dscp <0..=63>"));
-        assert!(help.contains("--ttl <1..=255>"));
-        assert!(help.contains("--loose"));
-    }
-
-    #[test]
-    fn an_empty_hmac_key_is_rejected() {
-        let err = parse(&["--hmac", "", "127.0.0.1:2112"]).unwrap_err();
-        assert!(err.to_string().contains("HMAC key must not be empty"));
-    }
-
-    #[test]
-    fn a_non_empty_hmac_key_is_accepted() {
-        let args = parse(&["--hmac", "secret", "127.0.0.1:2112"]).unwrap();
-        let config = args.prepare().unwrap().client;
-        assert_eq!(config.hmac_key, Some(b"secret".to_vec()));
-    }
-
-    #[test]
-    fn targets_stdin_requires_continuous_mode_and_allows_empty_initial_set() {
-        assert!(parse(&["--targets-stdin"]).unwrap().prepare().is_err());
-        let args = parse(&["--duration", "0", "--targets-stdin"]).unwrap();
-        let setup = args.prepare().unwrap();
-        assert!(setup.targets.is_empty());
-        assert!(setup.stdin_controlled);
-        let config = setup.managed_config();
-        assert_eq!(
-            config.completion,
-            irtt_client::managed::ManagedCompletionPolicy::ExplicitStop
-        );
-        assert_eq!(config.max_live_target_generations, 256);
-    }
-
-    #[test]
-    fn output_format_summary_policy_is_table_only() {
-        assert!(OutputFormat::Table.prints_summary());
-        assert!(!OutputFormat::Csv.prints_summary());
-        assert!(!OutputFormat::Tsv.prints_summary());
-        assert!(!OutputFormat::Jsonl.prints_summary());
-    }
-}
@@ -207,7 +207,7 @@ enum OutputRow {
        client_send_wall: SystemTime,
        bytes: usize,
        send_call: Duration,
-        timer_error: Duration,
+        timer_error: Option<Duration>,
    },
    EchoReply(ReplyRow),
    Loss {
@@ -950,7 +950,7 @@ fn cell_for(row: &OutputRow, column: Column, context: RenderContext<'_>) -> Opti
        },
        Column::TimerErrorUs => match row {
            OutputRow::EchoSent { timer_error, .. } => {
-                Some(CellValue::Unsigned(duration_us(*timer_error)))
+                timer_error.map(|error| CellValue::Unsigned(duration_us(error)))
            }
            _ => None,
        },
@@ -1205,273 +1205,3 @@ fn write_json_string_content(out: &mut String, value: &str) {
        }
    }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use irtt_client::ClientTimestamp;
-    use std::{
-        net::{IpAddr, Ipv4Addr, SocketAddr},
-        time::Instant,
-    };
-
-    fn output_config(format: OutputFormat, columns: Option<&str>) -> OutputConfig {
-        OutputConfig::new(format, columns, HeaderMode::Auto, false).unwrap()
-    }
-
-    fn remote() -> SocketAddr {
-        SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 2112)
-    }
-
-    fn reply() -> ClientEvent {
-        let sent_at = ClientTimestamp {
-            wall: UNIX_EPOCH + Duration::from_secs(1),
-            mono: Instant::now(),
-        };
-        let received_at = ClientTimestamp {
-            wall: sent_at.wall + Duration::from_micros(1200),
-            mono: sent_at.mono + Duration::from_micros(1200),
-        };
-        ClientEvent::EchoReply {
-            seq: 7,
-            remote: remote(),
-            sent_at,
-            received_at,
-            rtt: RttSample {
-                raw: Duration::from_micros(1200),
-                adjusted: None,
-                effective: SignedDuration::from_nanos(1_200_000),
-            },
-            server_timing: None,
-            one_way: None,
-            received_stats: None,
-            bytes: 64,
-            packet_meta: PacketMeta::default(),
-        }
-    }
-
-    #[test]
-    fn list_columns_includes_target() {
-        assert!(OutputConfig::list_columns().contains("target"));
-    }
-
-    #[test]
-    fn default_table_columns_always_include_target_first() {
-        let header = output_config(OutputFormat::Table, None)
-            .render_header()
-            .unwrap();
-
-        assert_eq!(header.split_whitespace().next(), Some("target"));
-    }
-
-    #[test]
-    fn default_structured_columns_always_include_target_first() {
-        for format in [OutputFormat::Csv, OutputFormat::Tsv, OutputFormat::Jsonl] {
-            let columns = default_columns(format, false);
-            assert_eq!(columns.first(), Some(&Column::Target));
-            assert_eq!(columns, ALL_COLUMNS);
-        }
-    }
-
-    #[test]
-    fn columns_default_keyword_matches_omitted_columns() {
-        for format in [
-            OutputFormat::Table,
-            OutputFormat::Csv,
-            OutputFormat::Tsv,
-            OutputFormat::Jsonl,
-        ] {
-            let omitted = output_config(format, None).render_header();
-            let explicit = output_config(format, Some("default")).render_header();
-            assert_eq!(omitted, explicit);
-        }
-    }
-
-    #[test]
-    fn custom_columns_do_not_insert_target() {
-        let config = output_config(OutputFormat::Csv, Some("seq,effective_rtt_us"));
-        let header = config.render_header().unwrap();
-
-        assert!(!header.split(',').any(|column| column == "target"));
-    }
-
-    #[test]
-    fn custom_target_column_renders_label() {
-        let config = output_config(OutputFormat::Csv, Some("target,seq,effective_rtt_us"));
-        let line = config
-            .render_event(&reply(), Some("ams"), Some(&EventRenderStats::default()))
-            .unwrap();
-
-        assert_eq!(
-            config.render_header().as_deref(),
-            Some("target,seq,effective_rtt_us")
-        );
-        assert_eq!(line, "ams,7,1200");
-    }
-
-    #[test]
-    fn default_csv_renders_target_label_in_row() {
-        let config = output_config(OutputFormat::Csv, None);
-        let line = config
-            .render_event(&reply(), Some("ams"), Some(&EventRenderStats::default()))
-            .unwrap();
-
-        assert_eq!(line.split(',').next(), Some("ams"));
-    }
-
-    #[test]
-    fn default_jsonl_renders_target_key_first() {
-        let config = output_config(OutputFormat::Jsonl, None);
-        let line = config
-            .render_event(&reply(), Some("ams"), Some(&EventRenderStats::default()))
-            .unwrap();
-
-        assert!(line.starts_with("{\"target\":\"ams\""));
-    }
-
-    #[test]
-    fn truncate_for_table_leaves_short_value_unchanged() {
-        assert_eq!(truncate_for_table("ams", 18), "ams");
-    }
-
-    #[test]
-    fn truncate_for_table_leaves_exact_width_value_unchanged() {
-        let value = "a".repeat(18);
-        assert_eq!(truncate_for_table(&value, 18), value);
-    }
-
-    #[test]
-    fn truncate_for_table_shortens_long_value_to_width() {
-        let value = "a".repeat(40);
-        let truncated = truncate_for_table(&value, 18);
-
-        assert_eq!(truncated.chars().count(), 18);
-        assert!(truncated.len() <= 18); // ASCII: byte len matches char len
-    }
-
-    #[test]
-    fn truncate_for_table_keeps_prefix_and_appends_ellipsis_deterministically() {
-        let value = "abcdefghijklmnopqrstuvwxyz";
-        let truncated = truncate_for_table(value, 18);
-
-        assert_eq!(truncated, "abcdefghijklmno...");
-        assert_eq!(truncated.chars().count(), 18);
-    }
-
-    #[test]
-    fn truncate_for_table_does_not_split_multibyte_code_points() {
-        // Each character below is multibyte in UTF-8; a byte-index slice
-        // would panic or corrupt the string on a non-boundary cut.
-        let value = "\u{1F600}".repeat(40); // 😀 repeated, well past width 18
-        let truncated = truncate_for_table(&value, 18);
-
-        // Must not panic (validated by test completing) and must remain
-        // valid UTF-8 with exactly 18 chars (15 prefix chars + "...").
-        assert_eq!(truncated.chars().count(), 18);
-        assert!(truncated.ends_with("..."));
-        assert_eq!(truncated.chars().filter(|c| *c == '\u{1F600}').count(), 15);
-    }
-
-    #[test]
-    fn table_row_with_long_target_keeps_next_column_aligned() {
-        let config = output_config(OutputFormat::Table, None);
-        let long_target = "a".repeat(40);
-        let header = config.render_header().unwrap();
-        let line = config
-            .render_event(
-                &reply(),
-                Some(&long_target),
-                Some(&EventRenderStats::default()),
-            )
-            .unwrap();
-
-        // Target column is truncated to its table width (18), so the
-        // "event" column starts at the same offset for both a normal and an
-        // overlong target label.
-        let short_config = output_config(OutputFormat::Table, None);
-        let short_line = short_config
-            .render_event(&reply(), Some("ams"), Some(&EventRenderStats::default()))
-            .unwrap();
-
-        let target_width = Column::Target.table_width();
-        let expected_event_offset = target_width + "  ".len();
-        assert_eq!(&header[expected_event_offset..][..5], "event");
-        // The event column ("echo_reply") starts at the same offset
-        // regardless of whether the target label was short or overlong.
-        assert_eq!(
-            &line[expected_event_offset..][.."echo_reply".len()],
-            "echo_reply"
-        );
-        assert_eq!(
-            &short_line[expected_event_offset..][.."echo_reply".len()],
-            "echo_reply"
-        );
-    }
-
-    #[test]
-    fn csv_preserves_full_long_target_label() {
-        let config = output_config(OutputFormat::Csv, Some("target,seq"));
-        let long_target = "a".repeat(40);
-        let line = config
-            .render_event(
-                &reply(),
-                Some(&long_target),
-                Some(&EventRenderStats::default()),
-            )
-            .unwrap();
-
-        assert_eq!(line, format!("{long_target},7"));
-    }
-
-    #[test]
-    fn tsv_preserves_full_long_target_label() {
-        let config = output_config(OutputFormat::Tsv, Some("target,seq"));
-        let long_target = "b".repeat(40);
-        let line = config
-            .render_event(
-                &reply(),
-                Some(&long_target),
-                Some(&EventRenderStats::default()),
-            )
-            .unwrap();
-
-        assert_eq!(line, format!("{long_target}\t7"));
-    }
-
-    #[test]
-    fn jsonl_preserves_full_long_target_label() {
-        let config = output_config(OutputFormat::Jsonl, Some("target,seq"));
-        let long_target = "c".repeat(40);
-        let line = config
-            .render_event(
-                &reply(),
-                Some(&long_target),
-                Some(&EventRenderStats::default()),
-            )
-            .unwrap();
-
-        assert_eq!(line, format!("{{\"target\":\"{long_target}\",\"seq\":7}}"));
-    }
-
-    #[test]
-    fn explicit_table_columns_with_target_truncate_same_as_default() {
-        let config = output_config(OutputFormat::Table, Some("target,seq"));
-        let long_target = "d".repeat(40);
-        let line = config
-            .render_event(
-                &reply(),
-                Some(&long_target),
-                Some(&EventRenderStats::default()),
-            )
-            .unwrap();
-
-        let target_width = Column::Target.table_width();
-        let expected_prefix: String = long_target
-            .chars()
-            .take(target_width - 3)
-            .chain("...".chars())
-            .collect();
-        assert!(line.starts_with(&expected_prefix));
-        assert_eq!(&line[..target_width], expected_prefix.as_str());
-    }
-}
@@ -938,321 +938,3 @@ fn finite_stats_memory_warning(args: &ClientArgs, target_count: usize) -> Option
    };
    Some(format!("irtt-rs: warning: finite exact statistics may retain about {formatted} for this run; {guidance}"))
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use irtt_client::managed::{
-        ManagedLifecycle, ManagedTargetFailure, ManagedTargetFailureKind,
-        ManagedTargetFailurePhase, ManagedTargetLifecycle, ManagedTargetStatus, TargetId,
-    };
-    use std::{io::BufReader, io::Cursor, sync::Arc};
-
-    #[test]
-    fn stdin_record_reader_removes_only_line_framing() {
-        let mut reader = BufReader::with_capacity(2, Cursor::new(b" first \r\n\nthird\r"));
-        let mut buffer = Vec::with_capacity(MAX_STDIN_RECORD_BYTES + 1);
-
-        assert_eq!(
-            read_stdin_record(&mut reader, &mut buffer).unwrap(),
-            Some(" first ".to_owned())
-        );
-        assert_eq!(
-            read_stdin_record(&mut reader, &mut buffer).unwrap(),
-            Some(String::new())
-        );
-        assert_eq!(
-            read_stdin_record(&mut reader, &mut buffer).unwrap(),
-            Some("third\r".to_owned())
-        );
-        assert_eq!(read_stdin_record(&mut reader, &mut buffer).unwrap(), None);
-    }
-
-    #[test]
-    fn stdin_record_reader_rejects_over_limit_unterminated_record() {
-        let input = vec![b'x'; MAX_STDIN_RECORD_BYTES + 1];
-        let mut reader = BufReader::with_capacity(17, Cursor::new(input));
-        let mut buffer = Vec::with_capacity(MAX_STDIN_RECORD_BYTES + 1);
-
-        let error = read_stdin_record(&mut reader, &mut buffer).unwrap_err();
-        assert_eq!(error.kind(), io::ErrorKind::InvalidData);
-        assert!(error.to_string().contains("maximum size"));
-        assert!(buffer.len() <= MAX_STDIN_RECORD_BYTES + 1);
-    }
-
-    #[test]
-    fn newer_mailbox_value_survives_an_earlier_submitted_acknowledgement() {
-        let mailbox = StdinMailbox::default();
-        mailbox.publish(vec![ManagedTargetConfig::new("a", "127.0.0.1:2112")]);
-        let submitted = mailbox.latest().unwrap();
-        mailbox.publish(vec![ManagedTargetConfig::new("b", "127.0.0.1:2113")]);
-        let pending = mailbox.latest().unwrap();
-
-        mailbox.clear_if_current(submitted.revision);
-
-        assert_eq!(mailbox.latest().unwrap().revision, pending.revision);
-    }
-
-    #[test]
-    fn rejected_update_retries_after_status_publishes_during_acknowledgement() {
-        let mailbox = StdinMailbox::default();
-        mailbox.publish(Vec::new());
-        let target_set = mailbox.latest().unwrap();
-        let saturated = Arc::new(status_with_targets(&[TargetInstance {
-            id: TargetId::from("old"),
-            generation: 1,
-        }]));
-        let capacity_freed = Arc::new(status_with_targets(&[]));
-        // Capacity becomes available after the transaction rejected but before
-        // its acknowledgement reaches the controller. The rejection path must
-        // retain the pre-submission status, not this later snapshot.
-        let mut retry_after =
-            retry_after_capacity_rejection(&mailbox, &target_set, Arc::clone(&saturated));
-
-        assert!(retry_waits_for_status_change(
-            &mut retry_after,
-            &target_set,
-            &saturated
-        ));
-        assert!(!retry_waits_for_status_change(
-            &mut retry_after,
-            &target_set,
-            &capacity_freed
-        ));
-    }
-
-    #[test]
-    fn later_desired_set_supersedes_a_capacity_rejected_candidate_before_retry() {
-        let mailbox = StdinMailbox::default();
-        mailbox.publish(vec![ManagedTargetConfig::new("a", "127.0.0.1:2112")]);
-        let applied = mailbox.latest().unwrap();
-        mailbox.clear_if_current(applied.revision);
-
-        mailbox.publish(vec![ManagedTargetConfig::new("b", "127.0.0.1:2113")]);
-        let rejected = mailbox.latest().unwrap();
-        let saturated = Arc::new(status_with_targets(&[TargetInstance {
-            id: TargetId::from("old"),
-            generation: 1,
-        }]));
-        let mut retry_after = retry_after_capacity_rejection(&mailbox, &rejected, saturated);
-        mailbox.publish(vec![ManagedTargetConfig::new("c", "127.0.0.1:2114")]);
-        let replacement = mailbox.latest().unwrap();
-
-        assert!(!retry_waits_for_status_change(
-            &mut retry_after,
-            &replacement,
-            &Arc::new(status_with_targets(&[TargetInstance {
-                id: TargetId::from("old"),
-                generation: 1,
-            }]))
-        ));
-        assert!(retry_after.is_none());
-        assert_eq!(replacement.targets[0].id.as_str(), "c");
-        mailbox.clear_if_current(replacement.revision);
-        assert!(mailbox.latest().is_none());
-    }
-
-    #[test]
-    fn eof_and_shutdown_stop_without_waiting_for_the_stdin_reader() {
-        let mailbox = StdinMailbox::default();
-        let shutdown_requested = AtomicBool::new(false);
-        assert!(stdin_stop_request(&shutdown_requested, &mailbox).is_none());
-
-        mailbox.finish();
-        assert!(matches!(
-            stdin_stop_request(&shutdown_requested, &mailbox),
-            Some(StdinStop::Eof)
-        ));
-
-        let mailbox = StdinMailbox::default();
-        shutdown_requested.store(true, std::sync::atomic::Ordering::Relaxed);
-        assert!(matches!(
-            stdin_stop_request(&shutdown_requested, &mailbox),
-            Some(StdinStop::Interrupted)
-        ));
-    }
-
-    fn status_with_targets(targets: &[TargetInstance]) -> ManagedStatus {
-        ManagedStatus {
-            lifecycle: ManagedLifecycle::Running,
-            stop_requested: false,
-            applied_command_sequence: 0,
-            desired_target_count: targets.len(),
-            connecting_target_count: 0,
-            opening_target_count: 0,
-            active_target_count: 0,
-            draining_target_count: 0,
-            closing_target_count: 0,
-            terminal_target_count: 0,
-            total_target_outcomes: 0,
-            successful_target_outcomes: 0,
-            failed_target_outcomes: 0,
-            peer_closed_target_outcomes: 0,
-            discarded_target_outcomes: 0,
-            targets: Arc::from(
-                targets
-                    .iter()
-                    .cloned()
-                    .map(|target| ManagedTargetStatus {
-                        target,
-                        desired: true,
-                        lifecycle: ManagedTargetLifecycle::Active,
-                        server_addr: Arc::from("127.0.0.1:2112"),
-                        remote: None,
-                    })
-                    .collect::<Vec<_>>()
-                    .into_boxed_slice(),
-            ),
-            recent_target_outcomes: Arc::from([]),
-            final_outcome: None,
-        }
-    }
-
-    #[test]
-    fn dynamic_accounting_prunes_retired_generations_and_retains_only_shutdown_snapshot() {
-        let retired = TargetInstance {
-            id: TargetId::from("edge"),
-            generation: 1,
-        };
-        let replacement = TargetInstance {
-            id: TargetId::from("edge"),
-            generation: 2,
-        };
-        let live_status = status_with_targets(std::slice::from_ref(&replacement));
-        let empty_status = status_with_targets(&[]);
-        let mut stats = BTreeMap::from([
-            (retired.clone(), StatsCollector::new(stats_config(true))),
-            (replacement.clone(), StatsCollector::new(stats_config(true))),
-        ]);
-
-        reconcile_stdin_stats(&mut stats, &live_status, None);
-        assert_eq!(stats.keys().cloned().collect::<Vec<_>>(), [replacement]);
-
-        let summary_targets = snapshot_stdin_summary_targets(&mut stats, &live_status);
-        stats.insert(retired, StatsCollector::new(stats_config(true)));
-        reconcile_stdin_stats(&mut stats, &empty_status, Some(&summary_targets));
-
-        assert_eq!(
-            stats.keys().cloned().collect::<Vec<_>>(),
-            [TargetInstance {
-                id: TargetId::from("edge"),
-                generation: 2,
-            }]
-        );
-    }
-
-    #[test]
-    fn terminal_deduplication_is_bounded_under_target_churn() {
-        let mut terminal_targets = BoundedTargetSet::new(2);
-        let target = |generation| TargetInstance {
-            id: TargetId::from("edge"),
-            generation,
-        };
-
-        assert!(terminal_targets.insert(target(1)));
-        assert!(terminal_targets.insert(target(2)));
-        assert!(terminal_targets.insert(target(3)));
-        assert!(terminal_targets.insert(target(1)));
-        assert!(!terminal_targets.insert(target(3)));
-    }
-
-    fn long_finite_args() -> ClientArgs {
-        use clap::Parser;
-
-        ClientArgs::try_parse_from([
-            "irtt-client",
-            "--duration",
-            "4200s",
-            "--interval",
-            "100ms",
-            "127.0.0.1:2112",
-        ])
-        .unwrap()
-    }
-
-    /// Smallest target count whose aggregate estimate reaches the warning
-    /// threshold, derived from the stats crate's own estimate rather than from
-    /// any bytes-per-probe assumption held here.
-    fn first_warning_target_count(args: &ClientArgs) -> usize {
-        let probes = expected_probe_count(args.duration, args.interval);
-        (1..=1024)
-            .find(|targets| {
-                let total = probes.saturating_mul(*targets as u64);
-                stats_config(false).estimated_retained_bytes(total)
-                    >= FINITE_STATS_MEMORY_WARNING_BYTES
-            })
-            .expect("a long finite run should cross the warning threshold within 1024 targets")
-    }
-
-    #[test]
-    fn finite_stats_memory_warning_accounts_for_target_count() {
-        let args = long_finite_args();
-        let crossing = first_warning_target_count(&args);
-
-        assert!(
-            crossing > 1,
-            "this run should need more than one target to cross the threshold, \
-             otherwise the test proves nothing about target-count accounting"
-        );
-        assert!(
-            finite_stats_memory_warning(&args, crossing - 1).is_none(),
-            "an aggregate estimate below the threshold should not warn"
-        );
-        assert!(
-            finite_stats_memory_warning(&args, crossing).is_some(),
-            "an aggregate estimate at the threshold should warn"
-        );
-    }
-
-    #[test]
-    fn finite_stats_memory_warning_saturates_target_count_multiplication() {
-        assert!(finite_stats_memory_warning(&long_finite_args(), usize::MAX).is_some());
-    }
-
-    #[test]
-    fn lagged_events_are_counted_saturatingly() {
-        let mut dropped = 0_u64;
-        dropped = dropped.saturating_add(7);
-        dropped = dropped.saturating_add(3);
-        assert_eq!(dropped, 10);
-        assert_eq!(u64::MAX.saturating_add(1), u64::MAX);
-        assert!(dropped_event_warning(dropped)
-            .unwrap()
-            .contains("dropped 10 managed run events"));
-    }
-
-    #[test]
-    fn target_failure_diagnostics_include_primary_and_cleanup_failures() {
-        let target = ManagedTargetOutcome {
-            target: TargetInstance {
-                id: TargetId::from("edge"),
-                generation: 1,
-            },
-            server_addr: Arc::from("127.0.0.1:2112"),
-            remote: None,
-            end_reason: ManagedTargetEndReason::Failed(ManagedTargetFailure {
-                phase: ManagedTargetFailurePhase::Receiving,
-                kind: ManagedTargetFailureKind::Protocol,
-                message: "primary failure".into(),
-            }),
-            packets_sent: 0,
-            replies_received: 0,
-            duplicates: 0,
-            late: 0,
-            warning_events: 0,
-            cleanup_failure: Some(ManagedTargetFailure {
-                phase: ManagedTargetFailurePhase::Closing,
-                kind: ManagedTargetFailureKind::Socket,
-                message: "cleanup failure".into(),
-            }),
-        };
-
-        assert_eq!(
-            target_failure_messages(&target),
-            [
-                "irtt-rs: target edge failed (receiving protocol): primary failure",
-                "irtt-rs: target edge cleanup failed (closing socket): cleanup failure",
-            ]
-        );
-    }
-}
@@ -121,257 +121,3 @@ fn write_time_row(out: &mut String, label: &str, value: &TimeStats) {
    )
    .unwrap();
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use irtt_client::{
-        ClientEvent, ClientTimestamp, PacketMeta, RttSample, ServerTiming, SignedDuration,
-    };
-    use irtt_stats::{StatsCollector, StatsConfig};
-    use std::{
-        net::{IpAddr, Ipv4Addr, SocketAddr},
-        time::{Duration, Instant, UNIX_EPOCH},
-    };
-
-    fn test_timestamp(offset: Duration) -> ClientTimestamp {
-        ClientTimestamp {
-            wall: UNIX_EPOCH + offset,
-            mono: Instant::now() + offset,
-        }
-    }
-
-    fn test_remote() -> SocketAddr {
-        SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 2112)
-    }
-
-    #[test]
-    fn empty_summary_omits_optional_metric_sections() {
-        let summary = StatsCollector::new(StatsConfig::finite()).snapshot();
-        let output = format_summary(&summary);
-
-        assert!(output.contains("Metric"));
-        assert!(output.contains("Min"));
-        assert!(output.contains("Mean"));
-        assert!(output.contains("Median"));
-        assert!(output.contains("Max"));
-        assert!(output.contains("Stddev"));
-        assert!(output.contains("packets: sent=0 received=0 unique=0 lost=0"));
-        assert!(!output.contains("RTT                  0"));
-        assert!(!output.contains("server processing"));
-    }
-
-    #[test]
-    fn summary_formats_counts_and_available_metrics() {
-        let mut collector = StatsCollector::new(StatsConfig::finite());
-        let sent_at = test_timestamp(Duration::from_secs(1));
-        let received_at = test_timestamp(Duration::from_secs(1) + Duration::from_micros(1500));
-
-        collector.process(&ClientEvent::EchoSent {
-            seq: 1,
-            remote: test_remote(),
-            scheduled_at: sent_at.mono,
-            sent_at,
-            bytes: 64,
-            send_call: Duration::from_micros(10),
-            timer_error: Duration::from_micros(2),
-        });
-        collector.process(&ClientEvent::EchoReply {
-            seq: 1,
-            remote: test_remote(),
-            sent_at,
-            received_at,
-            rtt: RttSample {
-                raw: Duration::from_micros(1500),
-                adjusted: Some(SignedDuration::from_nanos(1_200_000)),
-                effective: SignedDuration::from_nanos(1_200_000),
-            },
-            server_timing: Some(ServerTiming {
-                receive_wall_ns: None,
-                receive_mono_ns: None,
-                send_wall_ns: None,
-                send_mono_ns: None,
-                midpoint_wall_ns: None,
-                midpoint_mono_ns: None,
-                processing: Some(Duration::from_micros(300)),
-            }),
-            one_way: None,
-            received_stats: None,
-            bytes: 64,
-            packet_meta: PacketMeta::default(),
-        });
-
-        let output = format_summary(&collector.snapshot());
-
-        assert!(output.contains("packets: sent=1 received=1 unique=1 lost=0 loss=0.00%"));
-        assert!(output.contains("bytes: sent=64 received=64"));
-        assert!(output.contains("RTT"));
-        assert!(output.contains("1.2ms"));
-        assert!(!output.contains("raw RTT"));
-        assert!(!output.contains("adjusted RTT"));
-        assert!(output.contains("server processing"));
-        assert!(output.contains("300.0µs"));
-        assert!(output.contains("send call"));
-        assert!(output.contains("10.0µs"));
-        assert!(output.contains("timer error"));
-        assert!(output.contains("2.0µs"));
-        assert!(!output.contains("medians unavailable"));
-    }
-
-    /// Returns the Median cell of the row with this label.
-    fn median_cell(output: &str, label: &str) -> String {
-        let row = output
-            .lines()
-            .find(|line| line.trim_start().starts_with(label))
-            .unwrap_or_else(|| panic!("summary should contain a {label:?} row:\n{output}"));
-        // Metric, Count, Min, Mean, Median, ...
-        // Counting from the right keeps multi-word labels out of the way.
-        row.split_whitespace()
-            .rev()
-            .nth(2)
-            .unwrap_or_else(|| panic!("row {row:?} should have a Median cell"))
-            .to_owned()
-    }
-
-    /// Collects probes whose send-call, timer-error, and server-processing
-    /// values each have a median distinct from their min, mean, and max, so
-    /// the rendered cell can only come from a real median calculation.
-    fn spread_finite_summary(config: StatsConfig) -> Snapshot {
-        let mut collector = StatsCollector::new(config);
-        for (seq, (send_call_us, timer_error_us, processing_us)) in
-            [(10_u64, 2_u64, 100_u64), (40, 12, 700), (20, 4, 300)]
-                .into_iter()
-                .enumerate()
-        {
-            let seq = seq as u32;
-            let offset = Duration::from_secs(1) + Duration::from_millis(u64::from(seq));
-            let sent_at = test_timestamp(offset);
-            let received_at = test_timestamp(offset + Duration::from_micros(1500));
-
-            collector.process(&ClientEvent::EchoSent {
-                seq,
-                remote: test_remote(),
-                scheduled_at: sent_at.mono,
-                sent_at,
-                bytes: 64,
-                send_call: Duration::from_micros(send_call_us),
-                timer_error: Duration::from_micros(timer_error_us),
-            });
-            collector.process(&ClientEvent::EchoReply {
-                seq,
-                remote: test_remote(),
-                sent_at,
-                received_at,
-                rtt: RttSample {
-                    raw: Duration::from_micros(1500),
-                    adjusted: None,
-                    effective: SignedDuration::from_nanos(1_500_000),
-                },
-                server_timing: Some(ServerTiming {
-                    receive_wall_ns: None,
-                    receive_mono_ns: None,
-                    send_wall_ns: None,
-                    send_mono_ns: None,
-                    midpoint_wall_ns: None,
-                    midpoint_mono_ns: None,
-                    processing: Some(Duration::from_micros(processing_us)),
-                }),
-                one_way: None,
-                received_stats: None,
-                bytes: 64,
-                packet_meta: PacketMeta::default(),
-            });
-        }
-        collector.snapshot()
-    }
-
-    #[test]
-    fn finite_summary_shows_medians_for_send_call_timer_error_and_processing() {
-        let output = format_summary(&spread_finite_summary(StatsConfig::finite()));
-
-        // Medians of 10/20/40, 2/4/12, and 100/300/700 µs. None of these
-        // equals the row's min, mean, or max.
-        assert_eq!(median_cell(&output, "send call"), "20.0µs");
-        assert_eq!(median_cell(&output, "timer error"), "4.0µs");
-        assert_eq!(median_cell(&output, "server processing"), "300.0µs");
-    }
-
-    #[test]
-    fn continuous_summary_still_shows_no_medians_for_those_rows() {
-        let output = format_summary(&spread_finite_summary(StatsConfig::continuous()));
-
-        for label in ["send call", "timer error", "server processing"] {
-            assert_eq!(
-                median_cell(&output, label),
-                "-",
-                "continuous mode retains no exact samples for {label}"
-            );
-        }
-    }
-
-    #[test]
-    fn verbose_summary_includes_raw_and_adjusted_rtt_rows() {
-        let mut collector = StatsCollector::new(StatsConfig::finite());
-        let received_at = test_timestamp(Duration::from_secs(1) + Duration::from_micros(1500));
-        collector.process(&ClientEvent::EchoReply {
-            seq: 1,
-            remote: test_remote(),
-            sent_at: test_timestamp(Duration::from_secs(1)),
-            received_at,
-            rtt: RttSample {
-                raw: Duration::from_micros(1500),
-                adjusted: Some(SignedDuration::from_nanos(1_200_000)),
-                effective: SignedDuration::from_nanos(1_200_000),
-            },
-            server_timing: None,
-            one_way: None,
-            received_stats: None,
-            bytes: 64,
-            packet_meta: PacketMeta::default(),
-        });
-
-        let output = format_summary_with_options(
-            &collector.snapshot(),
-            SummaryFormatOptions {
-                verbose: true,
-                ..SummaryFormatOptions::default()
-            },
-        );
-
-        assert!(output.contains("raw RTT"));
-        assert!(output.contains("adjusted RTT"));
-    }
-
-    #[test]
-    fn running_only_note_is_format_option() {
-        let summary = StatsCollector::new(StatsConfig::continuous()).snapshot();
-        let output = format_summary_with_options(
-            &summary,
-            SummaryFormatOptions {
-                show_running_only_note: true,
-                ..SummaryFormatOptions::default()
-            },
-        );
-
-        assert!(output.contains("irtt-rs summary"));
-        assert!(output.contains("medians unavailable"));
-        assert!(output.contains("continuous mode"));
-    }
-
-    #[test]
-    fn signed_stats_can_format_negative_values() {
-        let stats = TimeStats {
-            count: 1,
-            total_ns: -500,
-            min_ns: Some(-500),
-            max_ns: Some(-500),
-            mean_ns: -500.0,
-            median_ns: Some(-500.0),
-            variance_ns2: 0.0,
-        };
-
-        let mut out = String::new();
-        write_time_row(&mut out, "RTT", &stats);
-        assert!(out.contains("-500ns"));
-    }
-}
@@ -115,93 +115,3 @@ pub(crate) fn format_optional_count(value: Option<u64>) -> String {
 fn absent() -> String {
    ABSENT.to_owned()
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn nanosecond_scalars_select_units_at_the_defined_boundaries() {
-        assert_eq!(format_ns_f64(0.0), "0ns");
-        assert_eq!(format_ns_f64(999.0), "999ns");
-        assert_eq!(format_ns_f64(1_000.0), "1.0µs");
-        assert_eq!(format_ns_f64(999_999.0), "1000.0µs");
-        assert_eq!(format_ns_f64(1_000_000.0), "1.0ms");
-        assert_eq!(format_ns_f64(999_999_999.0), "1000.0ms");
-        assert_eq!(format_ns_f64(1_000_000_000.0), "1.000s");
-        assert_eq!(format_ns_f64(1_500_000_000.0), "1.500s");
-    }
-
-    #[test]
-    fn negative_nanosecond_scalars_keep_their_sign() {
-        assert_eq!(format_ns_f64(-500.0), "-500ns");
-        assert_eq!(format_ns_f64(-1_500.0), "-1.5µs");
-        assert_eq!(format_ns_f64(-2_500_000.0), "-2.5ms");
-        assert_eq!(format_ns_f64(-1_000_000_000.0), "-1.000s");
-        assert_eq!(format_ns_i128(-1_500), "-1.5µs");
-    }
-
-    #[test]
-    fn exact_and_floating_nanosecond_scalars_agree() {
-        for value in [0_i128, 1, 999, 1_000, 1_234_567, -1_234_567, 5_000_000_000] {
-            assert_eq!(format_ns_i128(value), format_ns_f64(value as f64));
-        }
-    }
-
-    #[test]
-    fn microseconds_use_the_micro_sign() {
-        assert!(format_ns_f64(1_500.0).ends_with("µs"));
-        assert!(!format_ns_f64(1_500.0).contains("us"));
-    }
-
-    #[test]
-    fn durations_render_as_nanosecond_scalars() {
-        assert_eq!(format_duration(Duration::from_millis(25)), "25.0ms");
-        assert_eq!(format_duration(Duration::from_secs(1)), "1.000s");
-    }
-
-    #[test]
-    #[cfg(feature = "client")]
-    fn signed_durations_render_as_nanosecond_scalars() {
-        assert_eq!(
-            format_signed_duration(SignedDuration::from_nanos(-1_500)),
-            "-1.5µs"
-        );
-    }
-
-    #[test]
-    fn absent_and_non_finite_scalars_render_as_a_placeholder() {
-        assert_eq!(format_optional_ns_i128(None), ABSENT);
-        assert_eq!(format_ns_f64(f64::NAN), ABSENT);
-        assert_eq!(format_ns_f64(f64::INFINITY), ABSENT);
-        assert_eq!(format_percent(f64::NAN), ABSENT);
-    }
-
-    #[test]
-    #[cfg(feature = "client")]
-    fn absent_optional_ns_f64_renders_as_a_placeholder() {
-        assert_eq!(format_optional_ns_f64(None), ABSENT);
-    }
-
-    #[test]
-    #[cfg(feature = "tui")]
-    fn absent_counts_and_ratios_render_as_a_placeholder() {
-        assert_eq!(format_optional_count(None), ABSENT);
-        assert_eq!(format_percent_ratio(1, 0), ABSENT);
-    }
-
-    #[test]
-    fn percentages_have_one_spelling() {
-        assert_eq!(format_percent(0.0), "0.00%");
-        assert_eq!(format_percent(12.345), "12.35%");
-    }
-
-    #[test]
-    #[cfg(feature = "tui")]
-    fn percent_ratios_and_counts_have_one_spelling() {
-        assert_eq!(format_percent_ratio(1, 4), "25.00%");
-        assert_eq!(format_percent_ratio(5, 4), "100.00%");
-        assert_eq!(format_count(42), "42");
-        assert_eq!(format_optional_count(Some(0)), "0");
-    }
-}
@@ -106,10 +106,22 @@ pub struct ServerArgs {
    pub timestamp_allowance: Option<TimestampAllowanceArg>,

    /// Refuse to provide requested DSCP marking.
+    //
+    // `FalseyValueParser` rather than clap's default `bool` parser for a flag,
+    // which is what makes IRTT_SERVER_NO_DSCP usable from the environment at
+    // all. A flag's default parser accepts only the literals `true` and
+    // `false`, so the ordinary container/orchestrator spelling
+    // `IRTT_SERVER_NO_DSCP=1` did not enable the flag — it failed argument
+    // parsing and the server refused to start. Falsey semantics are clap's own
+    // documented recipe for a boolean environment flag: `0`, `false`, `no`,
+    // `n`, `off` and empty are off, anything else is on, and an absent
+    // variable is off as before. The command-line flag is unaffected: it still
+    // takes no value and still means "on".
    #[arg(
        long,
        env = "IRTT_SERVER_NO_DSCP",
-        long_help = "Refuse to provide requested traffic-class marking. Any requested DSCP is negotiated to zero, so the client is told its echo replies will be unmarked, and they are sent unmarked. The session is not refused."
+        value_parser = clap::builder::FalseyValueParser::new(),
+        long_help = "Refuse to provide requested traffic-class marking. Any requested DSCP is negotiated to zero, so the client is told its echo replies will be unmarked, and they are sent unmarked. The session is not refused.\n\nIRTT_SERVER_NO_DSCP sets the same thing from the environment: 0, false, no, n, off and an empty value leave marking enabled, and any other value disables it."
    )]
    pub no_dscp: bool,
 }
@@ -245,357 +257,3 @@ fn parse_duration_units(input: &str) -> Result<Duration, String> {
        )),
    }
 }
-
-#[cfg(test)]
-mod tests {
-    use std::net::{Ipv4Addr, Ipv6Addr};
-
-    use super::*;
-    use crate::cmd::server::env_lock::with_env_lock;
-
-    fn parse(args: &[&str]) -> Result<ServerArgs, clap::Error> {
-        with_env_lock(|| {
-            let mut argv = vec!["irtt-server"];
-            argv.extend_from_slice(args);
-            ServerArgs::try_parse_from(argv)
-        })
-    }
-
-    fn bound(args: &[&str]) -> ServerArgs {
-        let mut argv = vec!["--bind", "127.0.0.1:2112"];
-        argv.extend_from_slice(args);
-        parse(&argv).unwrap()
-    }
-
-    #[test]
-    fn bind_is_optional_and_parses_both_families() {
-        let ipv4 = parse(&["--bind", "127.0.0.1:2112"]).unwrap();
-        assert_eq!(ipv4.bind, [SocketAddr::from((Ipv4Addr::LOCALHOST, 2112))]);
-
-        let ipv6 = parse(&["--bind", "[::1]:2112"]).unwrap();
-        assert_eq!(ipv6.bind, [SocketAddr::from((Ipv6Addr::LOCALHOST, 2112))]);
-
-        assert!(parse(&["--bind", "127.0.0.1"]).is_err());
-        assert!(parse(&["--bind", "localhost:2112"]).is_err());
-        // Still one address per option: comma-separated syntax is not a thing
-        // here, and accepting it silently would be worse than rejecting it.
-        assert!(parse(&["--bind", "127.0.0.1:2112,[::1]:2112"]).is_err());
-    }
-
-    #[test]
-    fn no_explicit_bind_resolves_to_the_wildcard_default_pair() {
-        let args = parse(&[]).unwrap();
-        assert!(
-            args.bind.is_empty(),
-            "the empty list is the parsed representation of \"no explicit bind\""
-        );
-        assert_eq!(
-            args.resolve_binds(),
-            [
-                SocketAddr::from((Ipv6Addr::UNSPECIFIED, 2112)),
-                SocketAddr::from((Ipv4Addr::UNSPECIFIED, 2112)),
-            ],
-            "zero explicit binds means the ordinary port on both wildcard families, IPv6 first"
-        );
-    }
-
-    #[test]
-    fn an_explicit_bind_replaces_the_defaults_rather_than_augmenting_them() {
-        let args = parse(&["--bind", "127.0.0.1:2112"]).unwrap();
-        assert_eq!(
-            args.resolve_binds(),
-            [SocketAddr::from((Ipv4Addr::LOCALHOST, 2112))],
-            "one explicit bind means exactly that one listener, not that listener plus defaults"
-        );
-    }
-
-    #[test]
-    fn repeated_explicit_binds_are_unaffected_by_the_default_resolution() {
-        let args = parse(&["--bind", "127.0.0.1:2112", "--bind", "[::1]:2112"]).unwrap();
-        assert_eq!(args.resolve_binds(), args.bind);
-    }
-
-    #[test]
-    fn bind_is_repeatable_and_keeps_the_requested_order() {
-        let args = parse(&[
-            "--bind",
-            "[::1]:2112",
-            "--bind",
-            "127.0.0.1:2112",
-            "--bind",
-            "127.0.0.1:2113",
-        ])
-        .unwrap();
-
-        assert_eq!(
-            args.bind,
-            [
-                SocketAddr::from((Ipv6Addr::LOCALHOST, 2112)),
-                SocketAddr::from((Ipv4Addr::LOCALHOST, 2112)),
-                SocketAddr::from((Ipv4Addr::LOCALHOST, 2113)),
-            ],
-            "listeners are served in the order they were requested"
-        );
-    }
-
-    #[test]
-    fn the_configuration_is_one_policy_however_many_listeners_there_are() {
-        // Addresses never enter the server configuration: every listener is
-        // built from a clone of this one value.
-        let one = parse(&["--bind", "127.0.0.1:2112", "--max-sessions", "4"])
-            .unwrap()
-            .server_config();
-        let several = parse(&[
-            "--bind",
-            "127.0.0.1:2112",
-            "--bind",
-            "[::1]:2112",
-            "--max-sessions",
-            "4",
-        ])
-        .unwrap()
-        .server_config();
-
-        assert_eq!(one, several);
-        assert_eq!(several.max_sessions(), 4, "and it is a per-listener bound");
-    }
-
-    #[test]
-    fn omitted_policy_options_keep_the_library_defaults() {
-        assert_eq!(bound(&[]).server_config(), ServerConfig::default());
-    }
-
-    #[test]
-    fn policy_options_map_onto_the_server_config() {
-        let config = bound(&[
-            "--hmac",
-            "secret",
-            "--max-sessions",
-            "512",
-            "--max-packet-length",
-            "1472",
-            "--min-interval",
-            "20ms",
-            "--burst",
-            "3",
-            "--idle-timeout",
-            "30s",
-            "--max-duration",
-            "2m",
-        ])
-        .server_config();
-
-        assert_eq!(config.hmac_key(), Some(b"secret".as_slice()));
-        assert_eq!(config.max_sessions(), 512);
-        assert_eq!(config.max_packet_length(), 1472);
-        assert_eq!(config.min_send_interval(), Duration::from_millis(20));
-        assert_eq!(config.burst_allowance(), 3);
-        assert_eq!(config.idle_timeout(), Duration::from_secs(30));
-        assert_eq!(config.max_test_duration(), Some(Duration::from_secs(120)));
-    }
-
-    #[test]
-    fn the_capability_restrictions_map_onto_the_server_config() {
-        let config = bound(&["--timestamp-allowance", "single", "--no-dscp"]).server_config();
-
-        assert_eq!(
-            config.timestamp_allowance(),
-            TimestampAllowance::Single,
-            "a request for both timestamps is negotiated to midpoint"
-        );
-        assert!(!config.dscp_allowed());
-    }
-
-    #[test]
-    fn every_timestamp_allowance_mode_parses() {
-        for (argument, expected) in [
-            ("dual", TimestampAllowance::Dual),
-            ("single", TimestampAllowance::Single),
-            ("none", TimestampAllowance::None),
-        ] {
-            assert_eq!(
-                bound(&["--timestamp-allowance", argument])
-                    .server_config()
-                    .timestamp_allowance(),
-                expected,
-                "--timestamp-allowance {argument}"
-            );
-        }
-
-        assert!(parse(&[
-            "--bind",
-            "127.0.0.1:2112",
-            "--timestamp-allowance",
-            "midpoint"
-        ])
-        .is_err());
-        assert!(parse(&["--bind", "127.0.0.1:2112", "--timestamp-allowance", "both"]).is_err());
-    }
-
-    #[test]
-    fn the_capability_restrictions_are_off_when_their_flags_are_absent() {
-        // Explicitly, and not only through the whole-config comparison above:
-        // these are the two values that would silently change every existing
-        // deployment's negotiation if the CLI restated them.
-        let config = bound(&["--idle-timeout", "30s"]).server_config();
-
-        assert_eq!(config.timestamp_allowance(), TimestampAllowance::Dual);
-        assert!(config.dscp_allowed());
-    }
-
-    #[test]
-    fn explicit_zero_policy_values_are_preserved() {
-        let config = bound(&[
-            "--min-interval",
-            "0",
-            "--idle-timeout",
-            "0ms",
-            "--burst",
-            "0",
-            "--max-sessions",
-            "0",
-            "--max-packet-length",
-            "0",
-        ])
-        .server_config();
-
-        assert_eq!(config.min_send_interval(), Duration::ZERO);
-        assert_eq!(config.idle_timeout(), Duration::ZERO);
-        assert_eq!(config.burst_allowance(), 0);
-        assert_eq!(config.max_sessions(), 0);
-        assert_eq!(config.max_packet_length(), 0);
-    }
-
-    #[test]
-    fn durations_require_a_supported_unit() {
-        assert!(parse(&["--bind", "127.0.0.1:2112", "--idle-timeout", "30"]).is_err());
-        assert!(parse(&["--bind", "127.0.0.1:2112", "--min-interval", "20us"]).is_err());
-        assert!(parse(&["--bind", "127.0.0.1:2112", "--max-duration", "2h"]).is_err());
-        assert!(parse(&["--bind", "127.0.0.1:2112", "--idle-timeout", "ms"]).is_err());
-    }
-
-    #[test]
-    fn an_empty_hmac_key_is_rejected() {
-        let err = parse(&["--bind", "127.0.0.1:2112", "--hmac", ""]).unwrap_err();
-        assert!(err.to_string().contains("HMAC key must not be empty"));
-    }
-
-    #[test]
-    fn a_whitespace_only_hmac_key_is_accepted_literally() {
-        let config = bound(&["--hmac", " "]).server_config();
-        assert_eq!(config.hmac_key(), Some(b" ".as_slice()));
-    }
-
-    #[test]
-    fn a_zero_maximum_duration_is_not_a_spelling_of_no_maximum() {
-        assert!(parse(&["--bind", "127.0.0.1:2112", "--max-duration", "0"]).is_err());
-        assert!(parse(&["--bind", "127.0.0.1:2112", "--max-duration", "0s"]).is_err());
-        assert_eq!(bound(&[]).server_config().max_test_duration(), None);
-    }
-
-    /// Runs `body` with the given environment variables set, restoring
-    /// whatever was there before (present or absent) once `body` returns.
-    /// Held under `with_env_lock` for the whole span, including `body`, so a
-    /// `parse` call elsewhere never observes a partially-applied environment.
-    fn with_env<T>(vars: &[(&str, &str)], body: impl FnOnce() -> T) -> T {
-        with_env_lock(|| {
-            let previous: Vec<(&str, Option<String>)> = vars
-                .iter()
-                .map(|(k, _)| (*k, std::env::var(k).ok()))
-                .collect();
-            for (k, v) in vars {
-                std::env::set_var(k, v);
-            }
-            let result = body();
-            for (k, v) in previous {
-                match v {
-                    Some(v) => std::env::set_var(k, v),
-                    None => std::env::remove_var(k),
-                }
-            }
-            result
-        })
-    }
-
-    #[test]
-    fn environment_variables_supply_policy_when_no_flag_is_given() {
-        with_env(
-            &[
-                ("IRTT_SERVER_MAX_SESSIONS", "512"),
-                ("IRTT_SERVER_MAX_PACKET_LENGTH", "1472"),
-                ("IRTT_SERVER_MIN_INTERVAL", "20ms"),
-                ("IRTT_SERVER_BURST", "3"),
-                ("IRTT_SERVER_IDLE_TIMEOUT", "30s"),
-                ("IRTT_SERVER_MAX_DURATION", "2m"),
-                ("IRTT_SERVER_TIMESTAMP_ALLOWANCE", "single"),
-                ("IRTT_SERVER_HMAC", "secret"),
-                ("IRTT_SERVER_NO_DSCP", "true"),
-            ],
-            || {
-                let config = parse(&["--bind", "127.0.0.1:2112"])
-                    .unwrap()
-                    .server_config();
-                assert_eq!(config.max_sessions(), 512);
-                assert_eq!(config.max_packet_length(), 1472);
-                assert_eq!(config.min_send_interval(), Duration::from_millis(20));
-                assert_eq!(config.burst_allowance(), 3);
-                assert_eq!(config.idle_timeout(), Duration::from_secs(30));
-                assert_eq!(config.max_test_duration(), Some(Duration::from_secs(120)));
-                assert_eq!(config.timestamp_allowance(), TimestampAllowance::Single);
-                assert_eq!(config.hmac_key(), Some(b"secret".as_slice()));
-                assert!(!config.dscp_allowed());
-            },
-        );
-    }
-
-    #[test]
-    fn an_explicit_flag_overrides_the_environment() {
-        with_env(&[("IRTT_SERVER_MAX_SESSIONS", "512")], || {
-            let config = parse(&["--bind", "127.0.0.1:2112", "--max-sessions", "4"])
-                .unwrap()
-                .server_config();
-            assert_eq!(
-                config.max_sessions(),
-                4,
-                "the command-line value wins over the environment"
-            );
-        });
-    }
-
-    #[test]
-    fn the_environment_wins_over_the_built_in_default() {
-        with_env(&[("IRTT_SERVER_BURST", "9")], || {
-            let config = bound(&[]).server_config();
-            assert_eq!(
-                config.burst_allowance(),
-                9,
-                "an unset flag still falls back to the environment before the library default"
-            );
-        });
-    }
-
-    #[test]
-    fn irtt_server_bind_supplies_a_single_address_from_the_environment() {
-        with_env(&[("IRTT_SERVER_BIND", "127.0.0.1:2113")], || {
-            let args = parse(&[]).unwrap();
-            assert_eq!(args.bind, [SocketAddr::from((Ipv4Addr::LOCALHOST, 2113))]);
-        });
-    }
-
-    #[test]
-    fn an_explicit_bind_flag_overrides_irtt_server_bind() {
-        with_env(&[("IRTT_SERVER_BIND", "127.0.0.1:2113")], || {
-            let args = parse(&["--bind", "[::1]:2112"]).unwrap();
-            assert_eq!(args.bind, [SocketAddr::from((Ipv6Addr::LOCALHOST, 2112))]);
-        });
-    }
-
-    #[test]
-    fn leaving_irtt_server_bind_unset_keeps_the_wildcard_default() {
-        let args = parse(&[]).unwrap();
-        assert!(
-            args.bind.is_empty(),
-            "with no --bind and no IRTT_SERVER_BIND, resolve_binds still falls back to the wildcard pair"
-        );
-    }
-}
@@ -1,30 +0,0 @@
-//! Serializes every test in this module tree that touches process
-//! environment variables.
-//!
-//! `ServerArgs` parsing reads `IRTT_SERVER_*` via `clap`'s `env` support, and
-//! `std::env::set_var`/`remove_var` mutate genuinely process-wide state.
-//! Every test that parses `ServerArgs` — whether or not it sets an env var
-//! itself — must go through [`with_env_lock`], or a parse in one test thread
-//! can observe a value another thread's test set only for the duration of
-//! its own assertions. Reentrant per-thread, since a test that sets env vars
-//! typically calls `parse` again from inside its own locked section.
-
-use std::{cell::Cell, sync::Mutex};
-
-static ENV_LOCK: Mutex<()> = Mutex::new(());
-thread_local! {
-    static ENV_LOCK_HELD: Cell<bool> = const { Cell::new(false) };
-}
-
-pub(crate) fn with_env_lock<T>(f: impl FnOnce() -> T) -> T {
-    if ENV_LOCK_HELD.with(Cell::get) {
-        return f();
-    }
-    let _guard = ENV_LOCK
-        .lock()
-        .unwrap_or_else(std::sync::PoisonError::into_inner);
-    ENV_LOCK_HELD.with(|held| held.set(true));
-    let result = f();
-    ENV_LOCK_HELD.with(|held| held.set(false));
-    result
-}
@@ -1,6 +1,4 @@
 pub mod args;
-#[cfg(test)]
-pub(crate) mod env_lock;
 pub mod run;

 pub use args::ServerArgs;
@@ -105,105 +105,3 @@ async fn shutdown_signal(shutdown_requested: &AtomicBool) {
        tokio::time::sleep(SHUTDOWN_POLL_INTERVAL).await;
    }
 }
-
-#[cfg(test)]
-mod tests {
-    use clap::Parser;
-
-    use super::*;
-    use crate::cmd::server::env_lock::with_env_lock;
-
-    /// The ordinary invocation, and the one that keeps the single-listener case
-    /// on the same orchestration path as every other.
-    #[test]
-    fn an_already_requested_shutdown_binds_one_listener_and_returns() {
-        let args = with_env_lock(|| {
-            ServerArgs::try_parse_from(["irtt-server", "--bind", "127.0.0.1:0"]).unwrap()
-        });
-        let shutdown_requested = AtomicBool::new(true);
-
-        run_server(args, &shutdown_requested).unwrap();
-    }
-
-    #[test]
-    fn an_already_requested_shutdown_binds_every_listener_and_returns() {
-        let args = with_env_lock(|| {
-            ServerArgs::try_parse_from([
-                "irtt-server",
-                "--bind",
-                "127.0.0.1:0",
-                "--bind",
-                "127.0.0.1:0",
-            ])
-            .unwrap()
-        });
-        let shutdown_requested = AtomicBool::new(true);
-
-        run_server(args, &shutdown_requested).unwrap();
-    }
-
-    fn default_binds() -> Vec<SocketAddr> {
-        with_env_lock(|| {
-            ServerArgs::try_parse_from(["irtt-server"])
-                .unwrap()
-                .resolve_binds()
-        })
-    }
-
-    #[test]
-    fn implicit_default_losing_an_unsupported_family_falls_back_to_the_other() {
-        let binds = default_binds();
-        let failed = binds[0];
-
-        let remaining = implicit_default_fallback(true, false, &binds, failed).unwrap();
-
-        assert_eq!(remaining, [binds[1]]);
-    }
-
-    #[test]
-    fn a_supported_familys_failure_never_falls_back() {
-        // The family itself works fine here; whatever made this specific
-        // bind fail (port in use, permission, ...) is a real problem this
-        // invocation should surface, not paper over.
-        let binds = default_binds();
-
-        assert_eq!(
-            implicit_default_fallback(true, true, &binds, binds[0]),
-            None,
-            "family_available: true means this is not a family-support problem"
-        );
-    }
-
-    #[test]
-    fn explicit_binds_never_fall_back() {
-        let binds = default_binds();
-
-        assert_eq!(
-            implicit_default_fallback(false, false, &binds, binds[0]),
-            None
-        );
-    }
-
-    #[test]
-    fn a_failure_outside_the_requested_set_does_not_fall_back() {
-        let binds = default_binds();
-        let unrelated = SocketAddr::from(([127, 0, 0, 1], 2113));
-
-        assert_eq!(
-            implicit_default_fallback(true, false, &binds, unrelated),
-            None,
-            "the failing address must actually be one this invocation asked for"
-        );
-    }
-
-    #[test]
-    fn losing_the_only_remaining_default_address_does_not_fall_back() {
-        let single = [SocketAddr::from(([0, 0, 0, 0], 2112))];
-
-        assert_eq!(
-            implicit_default_fallback(true, false, &single, single[0]),
-            None,
-            "no address would be left to retry with"
-        );
-    }
-}
@@ -2,8 +2,6 @@ use std::time::Duration;

 use clap::Parser;

-#[cfg(test)]
-use crate::shared::client::TimestampArg;
 use crate::shared::client::{
    parse_target, parse_test_duration, prepare_managed_run, CommonClientArgs, GroupPacingArg,
    ManagedRunSetup, TargetArg, TargetSelection,
@@ -66,11 +64,6 @@ impl TuiArgs {
    pub fn is_continuous(&self) -> bool {
        self.duration == Duration::ZERO
    }
-
-    #[cfg(test)]
-    pub fn timestamp_mode(&self) -> TimestampArg {
-        self.common.tstamp
-    }
 }

 impl std::ops::Deref for TuiArgs {
@@ -80,208 +73,3 @@ impl std::ops::Deref for TuiArgs {
        &self.common
    }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use clap::{CommandFactory, Parser};
-
-    #[derive(Parser)]
-    struct SharedOnlyArgs {
-        #[command(flatten)]
-        common: CommonClientArgs,
-    }
-
-    fn parse(args: &[&str]) -> Result<TuiArgs, clap::Error> {
-        let mut argv = vec!["irtt-tui"];
-        argv.extend_from_slice(args);
-        TuiArgs::try_parse_from(argv)
-    }
-
-    fn parse_shared(args: &[&str]) -> Result<SharedOnlyArgs, clap::Error> {
-        let mut argv = vec!["shared-only"];
-        argv.extend_from_slice(args);
-        SharedOnlyArgs::try_parse_from(argv)
-    }
-
-    #[test]
-    fn tui_parser_defaults_to_continuous_and_has_no_output_option() {
-        let args = parse(&["127.0.0.1:2112"]).unwrap();
-        assert_eq!(args.targets.len(), 1);
-        assert_eq!(args.prepare().unwrap().targets[0].label, "127.0.0.1:2112");
-        assert_eq!(args.pacing, GroupPacingArg::Staggered);
-        assert_eq!(args.duration, DEFAULT_TUI_DURATION);
-        assert!(args.is_continuous());
-        assert_eq!(args.prepare().unwrap().client.duration, None);
-
-        let finite = parse(&["--duration", "30s", "127.0.0.1:2112"]).unwrap();
-        assert_eq!(finite.duration, Duration::from_secs(30));
-        assert_eq!(
-            finite.prepare().unwrap().client.duration,
-            Some(Duration::from_secs(30))
-        );
-
-        assert!(parse(&["--output", "human", "127.0.0.1:2112"]).is_err());
-        let help = TuiArgs::command().render_help().to_string();
-        assert!(!help.contains("--output"));
-    }
-
-    #[test]
-    fn multiple_positional_targets_parse() {
-        let args = parse(&["host-a:2112", "host-b:2112"]).unwrap();
-        let specs = args.prepare().unwrap().targets;
-
-        assert_eq!(specs[0].label, "host-a:2112");
-        assert_eq!(specs[0].managed.server_addr, "host-a:2112");
-        assert_eq!(specs[1].label, "host-b:2112");
-        assert_eq!(specs[1].managed.server_addr, "host-b:2112");
-    }
-
-    #[test]
-    fn repeated_labeled_targets_parse() {
-        let args = parse(&["ams=ams.example.com:2112", "sg=sg.example.com:2112"]).unwrap();
-        let specs = args.prepare().unwrap().targets;
-
-        assert_eq!(specs[0].label, "ams");
-        assert_eq!(specs[0].managed.server_addr, "ams.example.com:2112");
-        assert_eq!(specs[1].label, "sg");
-        assert_eq!(specs[1].managed.server_addr, "sg.example.com:2112");
-    }
-
-    #[test]
-    fn at_least_one_target_is_required() {
-        // The TUI has no target-free mode, so this is rejected at parse time
-        // rather than during preparation.
-        assert!(parse(&[]).is_err());
-        assert!(parse(&["ams=ams.example.com:2112"]).is_ok());
-    }
-
-    #[test]
-    fn duplicate_labels_are_rejected() {
-        let args = parse(&["host-a:2112", "host-a:2112=host-b:2112"]).unwrap();
-        let err = args.prepare().unwrap_err();
-
-        assert!(err.contains("duplicate target label"));
-    }
-
-    #[test]
-    fn duplicate_positional_target_strings_get_stable_suffixes() {
-        let args = parse(&["host-a:2112", "host-a:2112"]).unwrap();
-        let specs = args.prepare().unwrap().targets;
-
-        assert_eq!(specs[0].label, "host-a:2112");
-        assert_eq!(specs[1].label, "host-a:2112#2");
-    }
-
-    #[test]
-    fn duplicate_target_endpoints_are_allowed() {
-        let args = parse(&["127.0.0.1:2112", "127.0.0.1"]).unwrap();
-        assert_eq!(args.prepare().unwrap().target_count(), 2);
-    }
-
-    #[test]
-    fn invalid_labelled_target_syntax_is_rejected() {
-        assert!(parse(&["=127.0.0.1:2112"]).unwrap().prepare().is_err());
-        assert!(parse(&["label="]).unwrap().prepare().is_err());
-    }
-
-    #[test]
-    fn old_target_option_is_rejected() {
-        assert!(parse(&["--target", "eu=host.example"]).is_err());
-    }
-
-    #[test]
-    fn pacing_option_accepts_supported_values() {
-        assert_eq!(
-            parse(&["--pacing", "staggered", "127.0.0.1:2112"])
-                .unwrap()
-                .pacing,
-            GroupPacingArg::Staggered
-        );
-        assert_eq!(
-            parse(&["--pacing", "burst", "127.0.0.1:2112"])
-                .unwrap()
-                .pacing,
-            GroupPacingArg::Burst
-        );
-    }
-
-    #[test]
-    fn shared_client_options_match_tui_config_mapping() {
-        let shared = [
-            "--interval",
-            "250ms",
-            "--length",
-            "128",
-            "--hmac",
-            "secret",
-            "--clock",
-            "monotonic",
-            "--tstamp",
-            "receive",
-            "--stats",
-            "count",
-            "--sfill",
-            "abc",
-            "--dscp",
-            "46",
-            "--ttl",
-            "64",
-            "--loose",
-        ];
-        let tui_args = [
-            "--duration",
-            "30s",
-            "--interval",
-            "250ms",
-            "--length",
-            "128",
-            "--hmac",
-            "secret",
-            "--clock",
-            "monotonic",
-            "--tstamp",
-            "receive",
-            "--stats",
-            "count",
-            "--sfill",
-            "abc",
-            "--dscp",
-            "46",
-            "--ttl",
-            "64",
-            "--loose",
-            "127.0.0.1:2112",
-        ];
-        let tui = parse(&tui_args).unwrap().prepare().unwrap().client;
-        let common = parse_shared(&shared).unwrap().common;
-        let shared = common.to_client_config(Duration::from_secs(30));
-
-        assert_eq!(shared.duration, tui.duration);
-        assert_eq!(shared.interval, tui.interval);
-        assert_eq!(shared.length, tui.length);
-        assert_eq!(shared.received_stats, tui.received_stats);
-        assert_eq!(shared.stamp_at, tui.stamp_at);
-        assert_eq!(shared.clock, tui.clock);
-        assert_eq!(shared.dscp, tui.dscp);
-        assert_eq!(shared.hmac_key, tui.hmac_key);
-        assert_eq!(shared.server_fill, tui.server_fill);
-        assert_eq!(shared.negotiation_policy, tui.negotiation_policy);
-        assert_eq!(shared.socket_config.ttl, tui.socket_config.ttl);
-    }
-
-    #[test]
-    fn an_empty_hmac_key_is_rejected_via_the_shared_args() {
-        // CommonClientArgs is flattened into both the client and TUI parsers,
-        // so proving rejection once here covers both without duplicating it.
-        let err = parse(&["--hmac", "", "127.0.0.1:2112"]).unwrap_err();
-        assert!(err.to_string().contains("HMAC key must not be empty"));
-    }
-
-    #[test]
-    fn tui_help_lists_multi_target_options() {
-        let help = TuiArgs::command().render_help().to_string();
-        assert!(!help.contains("--target "));
-        assert!(help.contains("--pacing <PACING>"));
-    }
-}
@@ -121,156 +121,3 @@ pub fn prepare_managed_run(
        stdin_controlled: selection.stdin_controlled,
    })
 }
-
-#[cfg(test)]
-mod tests {
-    use clap::Parser;
-
-    use super::*;
-
-    #[derive(Parser)]
-    struct CommonOnlyArgs {
-        #[command(flatten)]
-        common: CommonClientArgs,
-    }
-
-    fn common(args: &[&str]) -> CommonClientArgs {
-        let mut argv = vec!["common-only"];
-        argv.extend_from_slice(args);
-        CommonOnlyArgs::try_parse_from(argv).unwrap().common
-    }
-
-    fn unlabeled(addr: &str) -> TargetArg {
-        TargetArg::new(addr)
-    }
-
-    fn labeled(label: &str, addr: &str) -> TargetArg {
-        TargetArg::new(format!("{label}={addr}"))
-    }
-
-    fn prepare(
-        targets: &[TargetArg],
-        pacing: GroupPacingArg,
-        duration: Duration,
-    ) -> Result<ManagedRunSetup, String> {
-        prepare_managed_run(
-            &common(&[]),
-            duration,
-            TargetSelection {
-                targets,
-                pacing,
-                stdin_controlled: false,
-            },
-        )
-    }
-
-    #[test]
-    fn a_single_target_prepares_one_managed_target_and_a_finite_duration() {
-        let setup = prepare(
-            &[unlabeled("127.0.0.1:2112")],
-            GroupPacingArg::Staggered,
-            Duration::from_secs(30),
-        )
-        .unwrap();
-
-        assert_eq!(setup.target_count(), 1);
-        assert!(!setup.is_multi_target());
-        assert_eq!(setup.targets[0].label, "127.0.0.1:2112");
-        assert_eq!(setup.targets[0].managed.server_addr, "127.0.0.1:2112");
-        assert_eq!(setup.client.duration, Some(Duration::from_secs(30)));
-        assert_eq!(setup.pacing, ManagedPacing::Staggered);
-    }
-
-    #[test]
-    fn a_zero_duration_prepares_a_continuous_client_config() {
-        let setup = prepare(
-            &[unlabeled("127.0.0.1:2112")],
-            GroupPacingArg::Staggered,
-            Duration::ZERO,
-        )
-        .unwrap();
-
-        assert_eq!(setup.client.duration, None);
-    }
-
-    #[test]
-    fn multiple_targets_keep_argument_order_and_share_one_client_config() {
-        let setup = prepare(
-            &[
-                unlabeled("host-a:2112"),
-                unlabeled("host-b:2112"),
-                labeled("sg", "sg.example.test:2112"),
-            ],
-            GroupPacingArg::Burst,
-            Duration::from_secs(10),
-        )
-        .unwrap();
-
-        assert!(setup.is_multi_target());
-        let labels: Vec<_> = setup
-            .targets
-            .iter()
-            .map(|target| target.label.as_str())
-            .collect();
-        assert_eq!(labels, ["host-a:2112", "host-b:2112", "sg"]);
-        assert_eq!(setup.targets[2].managed.server_addr, "sg.example.test:2112");
-        assert_eq!(setup.pacing, ManagedPacing::Burst);
-
-        let config = setup.managed_config();
-        assert_eq!(config.outcome_history_limit, 3);
-        assert_eq!(config.max_live_target_generations, 3);
-        assert_eq!(config.event_capacity, MANAGED_EVENT_CAPACITY);
-        assert_eq!(config.pacing, ManagedPacing::Burst);
-        assert_eq!(config.client, setup.client);
-        assert_eq!(setup.managed_targets().len(), 3);
-    }
-
-    #[test]
-    fn the_shared_client_config_carries_no_target_of_its_own() {
-        // The managed driver replaces the address, and the CLI's key, per
-        // target, so the template must not pin either to one target.
-        let targets = vec![unlabeled("host-a:2112"), unlabeled("host-b:2112")];
-        let setup = prepare_managed_run(
-            &common(&["--hmac", "secret"]),
-            Duration::from_secs(10),
-            TargetSelection {
-                targets: &targets,
-                pacing: GroupPacingArg::Staggered,
-                stdin_controlled: false,
-            },
-        )
-        .unwrap();
-
-        assert_eq!(
-            setup.client.server_addr,
-            ClientConfig::default().server_addr
-        );
-        assert_eq!(setup.client.hmac_key, Some(b"secret".to_vec()));
-        // Per-target authentication is not exposed on the command line, so no
-        // target carries an override of the shared key.
-        assert!(setup
-            .targets
-            .iter()
-            .all(|target| target.managed.auth.is_none()));
-    }
-
-    #[test]
-    fn an_empty_target_set_is_rejected_with_the_list_columns_hint() {
-        let err = prepare(&[], GroupPacingArg::Staggered, Duration::from_secs(10)).unwrap_err();
-
-        assert!(err.contains("at least one target is required"));
-        assert!(err.contains("--list-columns"));
-    }
-
-    #[test]
-    fn a_duplicate_label_is_rejected_before_any_configuration_is_built() {
-        let targets = vec![
-            unlabeled("host-a:2112"),
-            labeled("host-a:2112", "host-b:2112"),
-        ];
-        let err =
-            prepare(&targets, GroupPacingArg::Staggered, Duration::from_secs(10)).unwrap_err();
-
-        assert!(err.contains("duplicate target label"));
-    }
-}
@@ -81,61 +81,3 @@ pub fn request_managed_stop_once(stop_requested: &mut bool) -> bool {
    *stop_requested = true;
    true
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn peer_close_run_error_is_run_mode_and_interruption_aware() {
-        assert_eq!(peer_close_run_error(false, false, 1), None);
-        assert_eq!(peer_close_run_error(true, false, 0), None);
-        assert_eq!(peer_close_run_error(true, true, 1), None);
-        assert_eq!(
-            peer_close_run_error(true, false, 1).as_deref(),
-            Some("continuous run ended because of peer closure (1 target session)")
-        );
-        assert_eq!(
-            peer_close_run_error(true, false, 3).as_deref(),
-            Some("continuous run ended because of peer closure (3 target sessions)")
-        );
-    }
-
-    #[test]
-    fn grouped_peer_close_stop_policy_is_run_mode_and_one_shot() {
-        let mut stop_requested = false;
-        assert!(!request_managed_stop_for_peer_close(
-            false,
-            false,
-            1,
-            &mut stop_requested,
-        ));
-        assert!(!request_managed_stop_for_peer_close(
-            true,
-            true,
-            1,
-            &mut stop_requested,
-        ));
-        assert!(!request_managed_stop_for_peer_close(
-            true,
-            false,
-            0,
-            &mut stop_requested,
-        ));
-        assert!(!stop_requested);
-
-        assert!(request_managed_stop_for_peer_close(
-            true,
-            false,
-            1,
-            &mut stop_requested,
-        ));
-        assert!(stop_requested);
-        assert!(!request_managed_stop_for_peer_close(
-            true,
-            false,
-            1,
-            &mut stop_requested,
-        ));
-    }
-}
@@ -322,170 +322,3 @@ pub fn parse_stdin_target_set(
    let args = elements.into_iter().map(TargetArg::new).collect::<Vec<_>>();
    prepare_managed_targets(target_specs_with_empty(&args, true)?)
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn target(input: &str) -> TargetArg {
-        TargetArg::new(input)
-    }
-
-    fn specs(inputs: &[&str]) -> Result<Vec<TargetSpec>, String> {
-        target_specs(&inputs.iter().map(|input| target(input)).collect::<Vec<_>>())
-    }
-
-    #[test]
-    fn legacy_target_syntax_and_ipv6_remain_supported() {
-        let parsed = specs(&[
-            "host.example",
-            "host.example:2112",
-            "[::1]:2112",
-            "eu=host.example",
-        ])
-        .unwrap();
-        assert_eq!(parsed[0].label, "host.example");
-        assert_eq!(parsed[1].label, "host.example:2112");
-        assert_eq!(parsed[2].label, "[::1]:2112");
-        assert_eq!(parsed[3].label, "eu");
-        assert!(parsed
-            .iter()
-            .all(|target| matches!(target.auth, TargetAuth::Inherit)));
-    }
-
-    #[test]
-    fn target_hmac_supports_inherit_override_disable_and_base64_padding() {
-        let parsed = specs(&[
-            "default=default.example",
-            "private=private.example@hmac=YWJjZA==",
-            "public=public.example@hmac=",
-        ])
-        .unwrap();
-        assert!(matches!(parsed[0].auth, TargetAuth::Inherit));
-        assert_eq!(parsed[1].auth, TargetAuth::Override(b"YWJjZA==".to_vec()));
-        assert!(matches!(parsed[2].auth, TargetAuth::Disable));
-    }
-
-    #[test]
-    fn target_delimiters_are_escaped_contextually() {
-        let parsed = specs(&["eu\\=west=host\\@hmac=literal@hmac=a\\@b\\,c\\=d\\\\e"]).unwrap();
-        assert_eq!(parsed[0].label, "eu=west");
-        assert_eq!(parsed[0].addr, "host@hmac=literal");
-        assert_eq!(parsed[0].auth, TargetAuth::Override(b"a@b,c=d\\e".to_vec()));
-    }
-
-    #[test]
-    fn positional_commas_are_not_reserved() {
-        let parsed = specs(&["edge=host,region@hmac=key,part"]).unwrap();
-        assert_eq!(parsed[0].addr, "host,region");
-        assert_eq!(parsed[0].auth, TargetAuth::Override(b"key,part".to_vec()));
-    }
-
-    #[test]
-    fn parser_diagnostics_and_debug_do_not_reveal_hmac_values() {
-        let secret = "very-secret-value";
-        let error = specs(&[&format!("target=host@hmac={secret}\\q")]).unwrap_err();
-        assert!(!error.contains(secret));
-        assert!(!format!("{:?}", target(&format!("target=host@hmac={secret}"))).contains(secret));
-        assert!(
-            !format!("{:?}", TargetAuth::Override(secret.as_bytes().to_vec())).contains(secret)
-        );
-    }
-
-    #[test]
-    fn target_specs_suffix_repeated_unlabeled_and_reject_duplicate_labels() {
-        let parsed = specs(&["host-a:2112", "host-a:2112"]).unwrap();
-        assert_eq!(parsed[0].label, "host-a:2112");
-        assert_eq!(parsed[1].label, "host-a:2112#2");
-        assert_eq!(
-            specs(&["host-a:2112", "host-a:2112=host-b:2112"]).unwrap_err(),
-            "duplicate target label"
-        );
-    }
-
-    #[test]
-    fn target_specs_preserve_argument_order_and_unlabeled_counts() {
-        let parsed = specs(&["local", "eu=eu.example", "foo", "us=us.example", "foo"]).unwrap();
-        let labels: Vec<_> = parsed.iter().map(|target| target.label.as_str()).collect();
-        assert_eq!(labels, ["local", "eu", "foo", "us", "foo#2"]);
-        let addresses: Vec<_> = parsed.iter().map(|target| target.addr.as_str()).collect();
-        assert_eq!(
-            addresses,
-            ["local", "eu.example", "foo", "us.example", "foo"]
-        );
-    }
-
-    #[test]
-    fn target_specs_reject_generated_suffix_collisions() {
-        assert_eq!(
-            specs(&[
-                "host.example",
-                "host.example",
-                "host.example#2=other.example"
-            ])
-            .unwrap_err(),
-            "duplicate target label"
-        );
-    }
-
-    #[test]
-    fn malformed_target_syntax_is_rejected_without_echoing_input() {
-        for input in ["=host", "label=", "host@hmac=value\\q", "host\\x"] {
-            assert!(specs(&[input]).is_err(), "{input}");
-        }
-    }
-
-    #[test]
-    fn target_preparation_maps_auth_to_managed_config() {
-        let prepared =
-            prepare_managed_targets(specs(&["a=one@hmac=key", "b=two@hmac="]).unwrap()).unwrap();
-        assert_eq!(
-            prepared[0]
-                .managed
-                .auth
-                .as_ref()
-                .unwrap()
-                .hmac_key
-                .as_deref(),
-            Some(b"key".as_slice())
-        );
-        assert_eq!(prepared[1].managed.auth.as_ref().unwrap().hmac_key, None);
-    }
-
-    #[test]
-    fn target_preparation_preserves_duplicate_endpoints() {
-        let prepared =
-            prepare_managed_targets(specs(&["a=example.test", "b=example.test"]).unwrap()).unwrap();
-        assert_eq!(prepared[0].managed.server_addr, "example.test");
-        assert_eq!(prepared[1].managed.server_addr, "example.test");
-    }
-
-    #[test]
-    fn stdin_target_sets_frame_commas_without_trimming_payload() {
-        let parsed = parse_stdin_target_set("a=one@hmac=x\\,y,b=two", 128).unwrap();
-        assert_eq!(
-            parsed[0].managed.auth.as_ref().unwrap().hmac_key.as_deref(),
-            Some(b"x,y".as_slice())
-        );
-        assert_eq!(parsed[1].label, "b");
-        assert_eq!(
-            parse_stdin_target_set(" []", 128).unwrap()[0]
-                .managed
-                .server_addr,
-            " []"
-        );
-        assert_eq!(
-            parse_stdin_target_set("[] ", 128).unwrap()[0]
-                .managed
-                .server_addr,
-            "[] "
-        );
-        assert!(parse_stdin_target_set("", 128).is_err());
-        assert!(parse_stdin_target_set("a=one,b=two", 1).is_err());
-    }
-
-    #[test]
-    fn stdin_empty_set_is_exactly_bracket_pair() {
-        assert!(parse_stdin_target_set("[]", 128).unwrap().is_empty());
-    }
-}
@@ -0,0 +1,89 @@
+#![cfg(all(feature = "client", feature = "server", feature = "tui"))]
+
+#[path = "../../irtt-integration-tests/tests/support/in_tree_server.rs"]
+mod in_tree_server;
+
+use irtt_server::ServerConfig;
+use std::process::Command;
+
+// The actual binaries own dispatch, argument handling, exit policy and output.
+// A real authenticated server also detects broken argument-to-config mapping.
+#[test]
+fn applets_dispatch_validate_arguments_and_export_a_real_client_run() {
+    let dispatcher = env!("CARGO_BIN_EXE_irtt-rs");
+    for binary in [
+        dispatcher,
+        env!("CARGO_BIN_EXE_irtt-client"),
+        env!("CARGO_BIN_EXE_irtt-server"),
+        env!("CARGO_BIN_EXE_irtt-tui"),
+    ] {
+        assert!(Command::new(binary)
+            .arg("--help")
+            .output()
+            .unwrap()
+            .status
+            .success());
+        assert!(!Command::new(binary)
+            .arg("--invalid-option")
+            .output()
+            .unwrap()
+            .status
+            .success());
+    }
+    for option in ["--dscp", "--ttl"] {
+        assert!(!Command::new(dispatcher)
+            .args(["client", option, "256", "127.0.0.1:9"])
+            .output()
+            .unwrap()
+            .status
+            .success());
+    }
+    let server =
+        in_tree_server::InTreeServer::start(ServerConfig::default().with_hmac_key(b"cli-test"));
+    let output = Command::new(dispatcher)
+        .args([
+            "client",
+            "--duration",
+            "100ms",
+            "--interval",
+            "20ms",
+            "--hmac",
+            "cli-test",
+            "--length",
+            "128",
+            "--sfill",
+            "pattern:ab",
+            "--clock",
+            "wall",
+            "--tstamp",
+            "both",
+            "--stats",
+            "both",
+            "--ttl",
+            "64",
+            "--format",
+            "jsonl",
+            "--columns",
+            "target,event,bytes",
+            &format!("edge={}", server.addr),
+        ])
+        .output()
+        .unwrap();
+    assert!(
+        output.status.success(),
+        "{}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let stdout = String::from_utf8(output.stdout).unwrap();
+    let rows: Vec<_> = stdout.lines().collect();
+    assert!(!rows.is_empty());
+    assert!(rows.iter().all(|row| row.starts_with('{')
+        && row.ends_with('}')
+        && row.contains("\"target\":\"edge\"")));
+    assert!(rows
+        .iter()
+        .any(|row| row.contains("\"event\":\"echo_reply\"") && row.contains("\"bytes\":128")));
+    assert!(rows
+        .iter()
+        .any(|row| row.contains("\"event\":\"session_closed\"")));
+}
@@ -26,30 +26,30 @@ configuration (`try_enable_tx_timestamping` restores it explicitly) and
 timing falls back to userspace `sent_at` as it always has. TX capability
 failure is never a public error and is never logged from the library.

-### Correlation invariant: kernel ID == wire sequence
+### Best-effort kernel-ID correlation

-The client uses the kernel's automatic `OPT_ID` directly as the probe's wire
-sequence number — no separate correlation map. This is safe because:
+The client uses the kernel's automatic `OPT_ID` as the probe's wire-sequence
+correlation ID — no separate correlation map. On the normal successful-send
+path, both counters start at zero after Open and advance together. This is
+not a permanent identity: a kernel ID can theoretically be consumed while a
+send is being prepared and then survive a subsequent send failure, leaving
+kernel IDs one or more steps ahead of `next_wire_seq`. Do not restore an
+assumption that failed or nonblocking sends cannot cause that desynchrony.

- **A failed/nonblocking send never consumes an ID.** Linux increments the
-  per-socket ID counter (`sk->sk_tskey`) speculatively while building a
-  datagram and rolls the increment back (`atomic_dec`) on every error path
-  out of `__ip_append_data`/`__ip6_append_data`
-  (`net/ipv4/ip_output.c`, `net/ipv6/ip6_output.c`), guarded by a local
-  `hold_tskey` flag. A `WouldBlock` `try_send` therefore can never leave a
-  gap in, or otherwise advance, the ID the kernel will assign to the next
-  *successful* submission. (`include/net/sock.h`'s `_sock_tx_timestamp`
-  performs the same increment for the non-corked path.) Client-side, the
-  existing send transaction only calls `commit_probe_sent` — which is the
-  only thing that advances `next_wire_seq` — after a successful socket send;
-  a `WouldBlock` result never reaches it.
- **The two counters start together and advance together.** `wire_seq`
-  starts at 0 on every successful Open (`SessionMachine::commit_open` builds
-  a fresh `ActiveSession` with `next_wire_seq: 0`) and advances by exactly 1
-  only via `commit_probe_sent`, which only runs after a confirmed successful
-  send — the same condition under which the kernel's counter advances by 1.
-  TX timestamping is enabled only after that same successful Open and before
-  any probe is sent, so both counters' zero points line up exactly.
+The effect is confined to the optional timing enhancement. A kernel timestamp
+whose ID cannot be matched to a pending or retained timed-out probe is
+discarded, as is any implausible timestamp; `sent_at` remains the ordinary
+userspace fallback. **After every failed probe submission, disable kernel-ID
+correlation for the rest of that session.** A gap means an otherwise plausible
+later ID can name the wrong probe, so subsequent error-queue timestamps must
+be discarded rather than attached by ID. This is safe because:
+
+- **Normal successful sends track together.** `wire_seq` starts at 0 on every
+  successful Open (`SessionMachine::commit_open` builds a fresh
+  `ActiveSession` with `next_wire_seq: 0`) and advances by exactly 1 only via
+  `commit_probe_sent`, after a confirmed successful socket send. TX
+  timestamping is enabled after that same successful Open and before any probe
+  is sent, so the normal zero points line up.
 - **One socket, one session, no reopen.** `SessionMachine`'s state machine
  only reaches `Open` from `Connected`, and `commit_open`/`commit_local_close`
  never route back to `Connected`. A `Client`/`AsyncClient` cannot reopen a
@@ -127,7 +127,8 @@ remains anchored to before the send, on purpose, so the existing pre-send
 timeout/overflow/no-send contract is unchanged. Only the *measurement*
 `sent_at` moved to after the send. A `WouldBlock` `try_send` (Tokio) never
 samples a `sent_at`, never calls `finalize_probe_commit`'s matching
-`commit_probe_sent`, and never advances the machine or schedule; each retry
+`commit_probe_sent`, and never advances the machine; the managed runner advances cadence only
+  after an accepted send; each retry
 gets its own fresh pre-send anchor, and only a successful attempt's anchor
 and `sent_at` are ever retained.

@@ -1,6 +1,6 @@
 [package]
 name = "irtt-client"
-version = "0.5.1"
+version = "0.5.3"
 description = "IRTT-compatible Rust client library"
 edition.workspace = true
 license.workspace = true
@@ -14,7 +14,7 @@ categories = ["network-programming"]
 [dependencies]
 irtt-proto.workspace = true
 socket2 = { version = "0.6.5", features = ["all"] }
-thiserror = "2.0.20"
+thiserror = "2.0.21"
 tokio = { version = "1.53.1", default-features = false, features = ["rt", "net", "time", "sync"], optional = true}

 [target.'cfg(target_os = "linux")'.dependencies]
@@ -42,10 +42,3 @@ doc-scrape-examples = true
 name = "managed_client"
 required-features = ["tokio"]
 doc-scrape-examples = true
-
-[dev-dependencies]
-# Keep the packaged client testable against the latest published server while
-# workspace tests continue to exercise the local source through this path.
-irtt-server = { version = "0.5.1", path = "../irtt-server" }
-proptest = "1.11.0"
-tokio = { version = "1.53.1", default-features = false, features = ["rt", "sync"] }
@@ -22,6 +22,13 @@ binaries are built on.
  runtime, and `BlockingManagedClient` for synchronous callers, which owns its
  own dedicated current-thread runtime.

+`Client` and `AsyncClient` send one probe whenever called. They expose the
+negotiated parameters, pending-probe status, and timeout deadlines; callers
+own cadence and run duration. The managed driver provides fixed cadence,
+missed-slot handling, finite runs, and staggered or burst pacing. Low-level
+`EchoSent` events leave `scheduled_at` and `timer_error` absent; the managed
+driver supplies those schedule measurements.
+
 Tokio stays optional: the default build has no runtime and no Tokio
 dependency at all.

@@ -18,7 +18,7 @@

 use std::time::{Duration, Instant};

-use irtt_client::{Client, ClientConfig, ClientEvent};
+use irtt_client::{Client, ClientConfig, ClientEvent, OpenOutcome};

 const RUN_DURATION: Duration = Duration::from_secs(2);

@@ -45,32 +45,42 @@ fn main() {
        }
    };

-    match client.open() {
-        Ok(outcome) => println!("session opened: {outcome:?}"),
+    let negotiated = match client.open() {
+        Ok(OpenOutcome::Started {
+            event, negotiated, ..
+        }) => {
+            println!("session opened: {event:?}");
+            negotiated
+        }
+        Ok(OpenOutcome::NoTestCompleted { event, .. }) => {
+            println!("{event:?}");
+            return;
+        }
        Err(err) => {
            eprintln!("open failed (is a server running at 127.0.0.1:2112?): {err}");
            return;
        }
-    }
+    };

-    // The run itself lasts `duration`, but a lost probe isn't classified as
-    // `EchoLoss` until `probe_timeout()` after it was sent; wait at least
-    // that much past the run's own end so a loss near the end can still be
-    // observed and printed before this example gives up and closes.
-    let deadline = Instant::now() + RUN_DURATION + client.probe_timeout();
-    while Instant::now() < deadline && !client.is_run_complete() {
-        // send_probe is caller-paced: only call it once its own schedule
-        // says a probe is due, rather than as fast as the loop spins.
-        if client
-            .next_send_deadline()
-            .is_some_and(|send_at| Instant::now() >= send_at)
-        {
-            // A failed send retains its prepared probe without advancing the
-            // schedule, so a persistent error (e.g. the interface going
-            // down) would otherwise make this loop retry silently until the
-            // safety deadline instead of reporting it.
+    // This loop owns cadence and duration. The transport sends whenever called.
+    let interval = Duration::from_nanos(negotiated.params.interval_ns as u64);
+    let start = Instant::now();
+    let end = start + Duration::from_nanos(negotiated.params.duration_ns as u64);
+    let deadline = end + client.probe_timeout();
+    let mut next_send = start;
+    while Instant::now() < deadline && !client.is_peer_closed() {
+        let now = Instant::now();
+        if now >= end && !client.has_pending_probes() {
+            break;
+        }
+        if now < end && now >= next_send {
            match client.send_probe() {
-                Ok(events) => events.iter().for_each(print_event),
+                Ok(events) => {
+                    events.iter().for_each(print_event);
+                    while next_send <= Instant::now() {
+                        next_send += interval;
+                    }
+                }
                Err(err) => {
                    eprintln!("send failed: {err}");
                    break;
@@ -93,6 +103,9 @@ fn main() {
        }
    }

+    if client.is_peer_closed() {
+        return;
+    }
    match client.close() {
        Ok(events) => events.iter().for_each(print_event),
        Err(err) => eprintln!("close failed: {err}"),
@@ -18,7 +18,7 @@

 use std::time::{Duration, Instant};

-use irtt_client::{AsyncClient, ClientConfig, ClientEvent};
+use irtt_client::{AsyncClient, ClientConfig, ClientEvent, OpenOutcome};

 /// Upper bound on how long the receive wait can go without also calling
 /// `poll_timeouts()`. `AsyncClient` does not expose the earliest pending
@@ -58,24 +58,43 @@ async fn run() {
        }
    };

-    match client.open().await {
-        Ok(outcome) => println!("session opened: {outcome:?}"),
+    let negotiated = match client.open().await {
+        Ok(OpenOutcome::Started {
+            event, negotiated, ..
+        }) => {
+            println!("session opened: {event:?}");
+            negotiated
+        }
+        Ok(OpenOutcome::NoTestCompleted { event, .. }) => {
+            println!("{event:?}");
+            return;
+        }
        Err(err) => {
            eprintln!("open failed (is a server running at 127.0.0.1:2112?): {err}");
            return;
        }
-    }
+    };

-    while !client.is_run_complete() {
+    // This loop owns cadence and duration. The transport sends whenever called.
+    let interval = Duration::from_nanos(negotiated.params.interval_ns as u64);
+    let start = Instant::now();
+    let end = start + Duration::from_nanos(negotiated.params.duration_ns as u64);
+    let deadline = end + client.probe_timeout();
+    let mut next_send = start;
+    while Instant::now() < deadline && !client.is_peer_closed() {
+        if Instant::now() >= end && !client.has_pending_probes() {
+            break;
+        }
        // Bound the receive wait by the next send/timeout deadline, rather
        // than awaiting recv() unconditionally: a lost or rate-limited reply
        // must not stall pacing or timeout classification indefinitely.
-        let wake_at = client
-            .next_send_deadline()
+        let wake_at = (next_send < end)
+            .then_some(next_send)
            .into_iter()
+            .chain(client.next_probe_timeout_deadline())
            .chain(std::iter::once(Instant::now() + TIMEOUT_POLL_INTERVAL))
            .min()
-            .expect("the fixed poll-interval deadline is always present");
+            .unwrap();

        let recv_result = tokio::select! {
            events = client.recv() => Some(events),
@@ -91,16 +110,14 @@ async fn run() {
            }
        }

-        if client
-            .next_send_deadline()
-            .is_some_and(|send_at| Instant::now() >= send_at)
-        {
-            // A failed send retains its prepared probe without advancing the
-            // schedule, so a persistent error (e.g. the interface going
-            // down) would otherwise make this loop retry forever instead of
-            // reporting it.
+        if Instant::now() < end && Instant::now() >= next_send {
            match client.send_probe().await {
-                Ok(events) => events.iter().for_each(print_event),
+                Ok(events) => {
+                    events.iter().for_each(print_event);
+                    while next_send <= Instant::now() {
+                        next_send += interval;
+                    }
+                }
                Err(err) => {
                    eprintln!("send failed: {err}");
                    break;
@@ -116,6 +133,9 @@ async fn run() {
        }
    }

+    if client.is_peer_closed() {
+        return;
+    }
    match client.close().await {
        Ok(events) => events.iter().for_each(print_event),
        Err(err) => eprintln!("close failed: {err}"),
@@ -7,20 +7,10 @@ use std::{
    time::{Duration, Instant},
 };

-#[cfg(test)]
-use std::{
-    cell::{Cell, RefCell},
-    collections::VecDeque,
-};
-
 use tokio::time;

 use crate::{
-    client::{
-        echo_sent_event,
-        schedule::{instant_abs_diff, ProbeSchedule},
-        validate_datagram_length,
-    },
+    client::{echo_sent_event, validate_datagram_length},
    config::ClientConfig,
    error::ClientError,
    event::{ClientEvent, OpenOutcome},
@@ -54,13 +44,9 @@ const OPEN_POLL_WORK_BUDGET: usize = 64;
 /// this crate already bounds open-attempt work keeps that impossible.
 const RECV_POLL_WORK_BUDGET: usize = 64;

-#[cfg(test)]
-use crate::client::ProbeSendTimestamps;
-
 #[derive(Debug)]
 struct PreparedAsyncOpen {
    machine: PreparedOpenAcceptance,
-    schedule: Option<ProbeSchedule>,
    recv_buffer_len: Option<usize>,
    negotiated_traffic_class: Option<u8>,
 }
@@ -99,7 +85,7 @@ impl AsyncOpenCleanup {
 /// Owned state for one asynchronous open transaction.
 ///
 /// This state deliberately contains no reference to [`AsyncClient`], allowing
-/// a future managed target to store the client and opening state side by side.
+/// a managed target to store the client and opening state side by side.
 #[derive(Debug)]
 pub(crate) struct AsyncOpenState {
    attempt: usize,
@@ -156,11 +142,6 @@ impl AsyncOpenState {
        self.stopped_after_current_attempt
    }

-    #[cfg(test)]
-    pub(crate) fn has_retained_cleanup(&self) -> bool {
-        self.cleanup.is_some()
-    }
-
    fn deadline(&self) -> Instant {
        self.deadline
            .expect("an open attempt has an active deadline")
@@ -173,80 +154,40 @@ impl AsyncOpenState {
    }
 }

-#[cfg(test)]
-#[derive(Debug)]
-enum InjectedSend {
-    WouldBlock,
-    Error,
-    ReportedLength(usize),
-}
-
-#[cfg(test)]
-#[derive(Debug, Default)]
-struct AsyncClientTestHooks {
-    sends: RefCell<VecDeque<InjectedSend>>,
-    send_attempts: Cell<usize>,
-    receive_would_block: Cell<usize>,
-    /// Number of subsequent receive attempts (`poll_open` or `poll_recv`)
-    /// that should report `io::ErrorKind::Interrupted` instead of performing
-    /// a real nonblocking receive, deterministically exercising interrupted-
-    /// syscall retry behavior.
-    inject_recv_interrupted: Cell<usize>,
-    fail_open_dscp: Cell<bool>,
-    fail_cleanup_send: Cell<bool>,
-    fail_peer_close_dscp: Cell<bool>,
-    fail_dscp_restore: Cell<bool>,
-    pause_open_cleanup_before_send: Cell<bool>,
-    pause_open_before_writable: Cell<bool>,
-    pause_open_before_readable: Cell<bool>,
-    pause_probe_before_writable: Cell<bool>,
-    pause_close_before_writable: Cell<bool>,
-    pause_close_after_would_block: Cell<bool>,
-    probe_timestamps: RefCell<VecDeque<ProbeSendTimestamps>>,
-    close_sent_at: Cell<Option<ClientTimestamp>>,
-}
-
-#[cfg(test)]
-impl AsyncClientTestHooks {
-    fn try_send(&self, socket: &tokio::net::UdpSocket, packet: &[u8]) -> io::Result<usize> {
-        self.send_attempts.set(self.send_attempts.get() + 1);
-        if let Some(injected) = self.sends.borrow_mut().pop_front() {
-            return match injected {
-                InjectedSend::WouldBlock => Err(io::Error::from(io::ErrorKind::WouldBlock)),
-                InjectedSend::Error => Err(io::Error::other("injected send failure")),
-                InjectedSend::ReportedLength(bytes) => Ok(bytes),
-            };
-        }
-        socket.try_send(packet)
-    }
-
-    fn take_probe_timestamps(&self) -> Option<ProbeSendTimestamps> {
-        self.probe_timestamps.borrow_mut().pop_front()
-    }
-
-    /// Consumes one pending injected interruption, if any, reporting whether
-    /// the caller should report `io::ErrorKind::Interrupted` instead of
-    /// attempting a real receive.
-    fn take_injected_interrupted(&self) -> bool {
-        let remaining = self.inject_recv_interrupted.get();
-        if remaining == 0 {
-            return false;
-        }
-        self.inject_recv_interrupted.set(remaining - 1);
-        true
-    }
-}
-
 /// Low-level Tokio IRTT client for one connected UDP target.
 ///
 /// `AsyncClient` does not construct, own, or store a Tokio runtime. Its async
 /// methods are polled by the caller and require a current Tokio runtime with I/O
 /// and time enabled.
+///
+/// # Example
+///
+/// Use this low-level adapter when the application already owns Tokio and wants
+/// to drive the session lifecycle itself. This example type-checks without
+/// contacting a server.
+///
+/// ```no_run
+/// use irtt_client::{AsyncClient, ClientConfig};
+///
+/// # async fn run() -> Result<(), Box<dyn std::error::Error>> {
+/// let mut client = AsyncClient::connect(ClientConfig::default()).await?;
+/// let outcome = client.open().await?;
+/// println!("opened: {outcome:?}");
+/// let sent = client.send_probe().await?;
+/// println!("sent: {sent:?}");
+/// let received = client.recv().await?;
+/// println!("received: {received:?}");
+/// let timed_out = client.poll_timeouts()?;
+/// println!("timeouts: {timed_out:?}");
+/// let closed = client.close().await?;
+/// println!("closed: {closed:?}");
+/// # Ok(())
+/// # }
+/// ```
 #[derive(Debug)]
 pub struct AsyncClient {
    socket: tokio::net::UdpSocket,
    machine: SessionMachine,
-    schedule: Option<ProbeSchedule>,
    remote: SocketAddr,
    recv_buffer: Vec<u8>,
    applied_traffic_class: Option<u8>,
@@ -255,8 +196,6 @@ pub struct AsyncClient {
    /// See `Client::tx_timestamping_enabled` in `client.rs` for the
    /// invariant this tracks; it is the same adapter-owned capability flag.
    tx_timestamping_enabled: bool,
-    #[cfg(test)]
-    test_hooks: AsyncClientTestHooks,
 }

 impl AsyncClient {
@@ -277,15 +216,12 @@ impl AsyncClient {
        Ok(Self {
            socket,
            machine,
-            schedule: None,
            remote,
            recv_buffer: vec![0_u8; recv_buffer_size(false, None)?],
            applied_traffic_class: None,
            prepared_open: Some(prepared_open),
            prepared_probe: None,
            tx_timestamping_enabled: false,
-            #[cfg(test)]
-            test_hooks: AsyncClientTestHooks::default(),
        })
    }

@@ -297,16 +233,16 @@ impl AsyncClient {
    /// ignored without resending the request.
    ///
    /// Dropping this future before trusted acceptance leaves the local machine
-    /// connected with no committed schedule or negotiated adapter state. If it
-    /// is dropped during best-effort post-token cleanup, cleanup may remain
-    /// incomplete because this low-level client never detaches cleanup work.
+    /// connected with no negotiated adapter state. If it is dropped during
+    /// best-effort post-token cleanup, cleanup may remain incomplete because
+    /// this low-level client never detaches cleanup work.
    pub async fn open(&mut self) -> Result<OpenOutcome, ClientError> {
        let mut state = AsyncOpenState::new();
        poll_fn(|cx| self.poll_open(&mut state, cx)).await
    }

-    /// Send one caller-paced probe with transactional protocol and schedule
-    /// commits.
+    /// Send one echo probe now, committing protocol state only after acceptance.
+    /// The caller owns pacing and run duration.
    ///
    /// A prepared packet is retained across readiness false positives,
    /// cancellation, and socket errors so a later call retries the same logical
@@ -387,10 +323,6 @@ impl AsyncClient {
            }

            if !state.request_submitted {
-                #[cfg(test)]
-                if self.test_hooks.pause_open_before_writable.replace(false) {
-                    return Poll::Pending;
-                }
                match poll_writable_until(&self.socket, state.deadline_timer(), cx) {
                    Poll::Pending => return Poll::Pending,
                    Poll::Ready(Err(error)) => return Poll::Ready(Err(error)),
@@ -405,9 +337,6 @@ impl AsyncClient {
                    .prepared_open
                    .as_ref()
                    .expect("connected clients retain their prepared open request");
-                #[cfg(test)]
-                let send_result = self.test_hooks.try_send(&self.socket, &request.bytes);
-                #[cfg(not(test))]
                let send_result = self.socket.try_send(&request.bytes);
                match send_result {
                    Ok(bytes) => {
@@ -421,10 +350,6 @@ impl AsyncClient {
                }
            }

-            #[cfg(test)]
-            if self.test_hooks.pause_open_before_readable.replace(false) {
-                return Poll::Pending;
-            }
            match poll_readable_until(&self.socket, state.deadline_timer(), cx) {
                Poll::Pending => return Poll::Pending,
                Poll::Ready(Err(error)) => return Poll::Ready(Err(error)),
@@ -438,10 +363,6 @@ impl AsyncClient {
                Poll::Ready(Ok(true)) => {}
            }

-            #[cfg(test)]
-            if self.test_hooks.take_injected_interrupted() {
-                continue;
-            }
            let datagram = match try_recv_tokio_datagram(&self.socket, &mut state.buffer) {
                Ok(datagram) => datagram,
                // WouldBlock is a readiness false positive; Interrupted
@@ -489,7 +410,7 @@ impl AsyncClient {
                    continue;
                }
            };
-            let prepared = match self.prepare_async_open(machine, datagram.received_at) {
+            let prepared = match self.prepare_async_open(machine) {
                Ok(prepared) => prepared,
                Err(failure) => {
                    state.cleanup = Some(AsyncOpenCleanup::Adapter(failure));
@@ -514,19 +435,11 @@ impl AsyncClient {
        }
        if self.prepared_probe.is_none() {
            match self.machine.prepare_probe() {
-                Ok(prepared) => self.prepared_probe = prepared,
+                Ok(prepared) => self.prepared_probe = Some(prepared),
                Err(error) => return Poll::Ready(Err(error)),
            }
        }
-        if self.prepared_probe.is_none() {
-            return Poll::Ready(Ok(Vec::new()));
-        }
-
        loop {
-            #[cfg(test)]
-            if self.test_hooks.pause_probe_before_writable.replace(false) {
-                return Poll::Pending;
-            }
            match self.socket.poll_send_ready(cx) {
                Poll::Pending => return Poll::Pending,
                Poll::Ready(Ok(())) => {}
@@ -535,23 +448,6 @@ impl AsyncClient {
                }
            }

-            #[cfg(test)]
-            let test_timestamps = self.test_hooks.take_probe_timestamps();
-            #[cfg(not(test))]
-            let permission_at = Instant::now();
-            #[cfg(test)]
-            let permission_at = test_timestamps
-                .map(|timestamps| timestamps.permission_at)
-                .unwrap_or_else(Instant::now);
-
-            let schedule = self
-                .schedule
-                .as_mut()
-                .expect("open sessions always have a probe schedule");
-            if !schedule.permit_probe_at(permission_at) {
-                self.prepared_probe = None;
-                return Poll::Ready(Ok(Vec::new()));
-            }
            let prepared = self
                .prepared_probe
                .as_ref()
@@ -560,11 +456,6 @@ impl AsyncClient {
                Ok(preflight) => preflight,
                Err(error) => return Poll::Ready(Err(error)),
            };
-            let schedule_commit =
-                match schedule.preflight_caller_commit(machine_preflight.next_packets_sent) {
-                    Ok(commit) => commit,
-                    Err(error) => return Poll::Ready(Err(error)),
-                };
            let mut events = Vec::new();
            if let Err(source) = events.try_reserve(1) {
                return Poll::Ready(Err(ClientError::AllocationFailed {
@@ -572,20 +463,14 @@ impl AsyncClient {
                    source,
                }));
            }
-
            let expected_bytes = prepared.bytes.len();
-            let scheduled_at = schedule_commit.scheduled_at;
+
            // Private pre-send anchor: finalizes all fallible commit work
            // (timeout deadline arithmetic, kernel TX lower bound) before
            // the send attempt. A WouldBlock retry samples a fresh one on
            // the next loop iteration; only the successful attempt's anchor
            // is retained (via `machine_commit`/`commit_probe_sent` below).
-            #[cfg(not(test))]
            let send_anchor = ClientTimestamp::now();
-            #[cfg(test)]
-            let send_anchor = test_timestamps
-                .map(|timestamps| timestamps.send_anchor)
-                .unwrap_or_else(ClientTimestamp::now);
            let machine_commit = match self
                .machine
                .finalize_probe_commit(machine_preflight, send_anchor)
@@ -593,61 +478,40 @@ impl AsyncClient {
                Ok(commit) => commit,
                Err(error) => return Poll::Ready(Err(error)),
            };
-            #[cfg(not(test))]
            let send_call_start = Instant::now();
-            #[cfg(test)]
-            let send_call_start = test_timestamps
-                .map(|timestamps| timestamps.send_call_start)
-                .unwrap_or_else(Instant::now);
-            #[cfg(test)]
-            let send_result = self.test_hooks.try_send(&self.socket, &prepared.bytes);
-            #[cfg(not(test))]
            let send_result = self.socket.try_send(&prepared.bytes);
            let bytes = match send_result {
                Ok(bytes) => bytes,
-                // No sent_at measurement, no machine commit, no schedule
-                // commit: the transaction is fully discarded and retried
+                // No measurement or machine commit: retry the transaction
                // with a fresh send_anchor on the next loop iteration.
-                Err(error) if error.kind() == io::ErrorKind::WouldBlock => continue,
-                Err(error) => return Poll::Ready(Err(ClientError::Socket(error))),
+                Err(error) if error.kind() == io::ErrorKind::WouldBlock => {
+                    self.machine.invalidate_kernel_tx_correlation();
+                    continue;
+                }
+                Err(error) => {
+                    self.machine.invalidate_kernel_tx_correlation();
+                    return Poll::Ready(Err(ClientError::Socket(error)));
+                }
            };
-
-            #[cfg(not(test))]
            let send_finished_at = Instant::now();
-            #[cfg(test)]
-            let send_finished_at = test_timestamps
-                .map(|timestamps| timestamps.send_finished_at)
-                .unwrap_or_else(Instant::now);
+
            // Public post-send measurement, captured only after the
-            // successful send above. The subsequent machine/schedule commit
+            // successful send above. The subsequent machine commit
            // is infallible.
-            #[cfg(not(test))]
            let sent_at = ClientTimestamp::now();
-            #[cfg(test)]
-            let sent_at = test_timestamps
-                .map(|timestamps| timestamps.sent_at)
-                .unwrap_or_else(ClientTimestamp::now);
            let sent = self
                .machine
                .commit_probe_sent(machine_commit, sent_at, bytes);
-            schedule.commit(schedule_commit);
            self.prepared_probe = None;
-
            let send_call = send_finished_at.saturating_duration_since(send_call_start);
-            let timer_error = instant_abs_diff(sent_at.mono, scheduled_at);
+
            if let Err(error) = validate_datagram_length(expected_bytes, bytes) {
                return Poll::Ready(Err(error));
            }
            if let Err(error) = self.drain_tx_timestamps() {
                return Poll::Ready(Err(error));
            }
-            events.push(echo_sent_event(
-                self.remote,
-                sent,
-                send_call,
-                scheduled_at,
-                timer_error,
-            ));
+            events.push(echo_sent_event(self.remote, sent, send_call));
            return Poll::Ready(Ok(events));
        }
    }
@@ -668,17 +532,7 @@ impl AsyncClient {
                    return Poll::Ready(Err(ClientError::Socket(error)));
                }
            }
-            #[cfg(test)]
-            if self.test_hooks.receive_would_block.get() > 0 {
-                self.test_hooks
-                    .receive_would_block
-                    .set(self.test_hooks.receive_would_block.get() - 1);
-                continue;
-            }
-            #[cfg(test)]
-            if self.test_hooks.take_injected_interrupted() {
-                continue;
-            }
+
            let datagram = match try_recv_tokio_datagram(&self.socket, &mut self.recv_buffer) {
                Ok(datagram) => datagram,
                // See `RECV_POLL_WORK_BUDGET`: both a readiness false
@@ -712,9 +566,8 @@ impl AsyncClient {
                Err(error) => return Poll::Ready(Err(error)),
            };
            if self.machine.is_peer_closed() {
-                self.schedule = None;
                self.prepared_probe = None;
-                if self.clear_peer_close_dscp().is_ok() {
+                if clear_dscp_on_tokio_socket(&self.socket, self.remote).is_ok() {
                    self.applied_traffic_class = None;
                }
            }
@@ -747,10 +600,6 @@ impl AsyncClient {
            let previous_traffic_class = self.applied_traffic_class;
            let expected_bytes = prepared.bytes.len();

-            #[cfg(test)]
-            if self.test_hooks.pause_close_before_writable.replace(false) {
-                return Poll::Pending;
-            }
            match self.socket.poll_send_ready(cx) {
                Poll::Pending => return Poll::Pending,
                Poll::Ready(Ok(())) => {}
@@ -758,19 +607,11 @@ impl AsyncClient {
                    return Poll::Ready(Err(ClientError::Socket(error)));
                }
            }
-            if let Err(error) = self.clear_close_dscp() {
+            if let Err(error) = clear_dscp_on_tokio_socket(&self.socket, self.remote) {
                return Poll::Ready(Err(error));
            }
-            let mut rollback = DscpRollback::armed(
-                &self.socket,
-                self.remote,
-                previous_traffic_class,
-                #[cfg(test)]
-                &self.test_hooks.fail_dscp_restore,
-            );
-            #[cfg(test)]
-            let send_result = self.test_hooks.try_send(&self.socket, prepared.bytes);
-            #[cfg(not(test))]
+            let mut rollback =
+                DscpRollback::armed(&self.socket, self.remote, previous_traffic_class);
            let send_result = self.socket.try_send(prepared.bytes);
            let bytes = match send_result {
                Ok(bytes) => bytes,
@@ -778,28 +619,18 @@ impl AsyncClient {
                    if let Err(error) = rollback.restore() {
                        return Poll::Ready(Err(error));
                    }
-                    #[cfg(test)]
-                    if self.test_hooks.pause_close_after_would_block.replace(false) {
-                        return Poll::Pending;
-                    }
+
                    continue;
                }
                Err(error) => return Poll::Ready(Err(ClientError::Socket(error))),
            };

-            #[cfg(not(test))]
            let close_sent_at = ClientTimestamp::now();
-            #[cfg(test)]
-            let close_sent_at = self
-                .test_hooks
-                .close_sent_at
-                .take()
-                .unwrap_or_else(ClientTimestamp::now);
+
            let event = self
                .machine
                .commit_local_close(prepared.commit, close_sent_at);
            rollback.disarm();
-            self.schedule = None;
            self.prepared_probe = None;
            self.applied_traffic_class = None;

@@ -811,33 +642,19 @@ impl AsyncClient {
        }
    }

-    /// Return the next scheduled probe deadline.
-    pub fn next_send_deadline(&self) -> Option<Instant> {
-        if !self.machine.is_open() {
-            return None;
-        }
-        self.schedule.as_ref()?.next_send_deadline()
-    }
-
-    pub(crate) fn probe_interval(&self) -> Option<Duration> {
-        if !self.machine.is_open() {
-            return None;
-        }
-        self.schedule.as_ref().map(ProbeSchedule::interval)
-    }
-
    /// Return the configured local probe timeout.
    pub fn probe_timeout(&self) -> Duration {
        self.machine.probe_timeout()
    }

-    /// Return whether the current run has completed.
-    pub fn is_run_complete(&self) -> bool {
-        self.machine.is_terminal()
-            || self
-                .schedule
-                .as_ref()
-                .is_some_and(|schedule| schedule.is_finished() && self.machine.pending_is_empty())
+    /// Negotiated parameters of the currently open session.
+    pub fn negotiated_params(&self) -> Option<&crate::NegotiatedParams> {
+        self.machine.negotiated_params()
+    }
+
+    /// Whether any sent probes still await a reply or timeout.
+    pub fn has_pending_probes(&self) -> bool {
+        !self.machine.pending_is_empty()
    }

    /// Return whether an authenticated peer close ended the session.
@@ -853,7 +670,8 @@ impl AsyncClient {
        self.machine.packets_sent()
    }

-    pub(crate) fn next_probe_timeout_deadline(&self) -> Option<Instant> {
+    /// Earliest timeout deadline among probes still awaiting a reply.
+    pub fn next_probe_timeout_deadline(&self) -> Option<Instant> {
        self.machine.next_probe_timeout_deadline()
    }

@@ -865,64 +683,17 @@ impl AsyncClient {
        self.prepared_probe = None;
    }

-    #[cfg(test)]
-    pub(crate) fn retain_open_cleanup_once(&self) {
-        self.test_hooks.fail_open_dscp.set(true);
-        self.test_hooks.pause_open_cleanup_before_send.set(true);
-    }
-
-    #[cfg(test)]
-    pub(crate) fn poll_recv_ready_for_test(&self, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
-        self.socket.poll_recv_ready(cx)
-    }
-
-    #[cfg(test)]
-    pub(crate) fn remove_pending_for_test(
-        &mut self,
-        wire_seq: u32,
-    ) -> Option<crate::probe::PendingProbe> {
-        self.machine.remove_pending_for_test(wire_seq)
-    }
-
-    #[cfg(test)]
-    pub(crate) fn replace_pending_for_test(&mut self, probe: crate::probe::PendingProbe) {
-        self.machine.replace_pending_for_test(probe);
-    }
-
-    pub(crate) fn skip_missed_probe_slots_at(&mut self, now: Instant) -> Result<(), ClientError> {
-        let Some(schedule) = self.schedule.as_mut() else {
-            return Ok(());
-        };
-        let Some(deadline) = schedule.next_send_deadline() else {
-            return Ok(());
-        };
-        if deadline > now {
-            return Ok(());
-        }
-        let commit = schedule.preflight_managed_commit(deadline, now)?;
-        schedule.commit(commit);
-        Ok(())
-    }
-
    fn prepare_async_open(
        &mut self,
        machine: PreparedOpenAcceptance,
-        opened_at: ClientTimestamp,
    ) -> Result<PreparedAsyncOpen, Box<PreparedAsyncOpenFailure>> {
        let Some(negotiated) = machine.normal_negotiated() else {
            return Ok(PreparedAsyncOpen {
                machine,
-                schedule: None,
                recv_buffer_len: None,
                negotiated_traffic_class: None,
            });
        };
-        let schedule = match ProbeSchedule::new(opened_at.mono, negotiated) {
-            Ok(schedule) => schedule,
-            Err(primary) => {
-                return Err(Box::new(PreparedAsyncOpenFailure { primary, machine }));
-            }
-        };
        let recv_buffer_len = match recv_buffer_size(self.machine.has_hmac(), Some(negotiated)) {
            Ok(size) => size,
            Err(primary) => {
@@ -950,17 +721,7 @@ impl AsyncClient {
                machine,
            }));
        }
-        #[cfg(test)]
-        let dscp_result = if self.test_hooks.fail_open_dscp.replace(false) {
-            Err(ClientError::SocketOption {
-                operation: "set negotiated DSCP",
-                remote: self.remote,
-                source: io::Error::other("injected negotiated DSCP failure"),
-            })
-        } else {
-            apply_traffic_class_to_tokio_socket(&self.socket, self.remote, negotiated_traffic_class)
-        };
-        #[cfg(not(test))]
+
        let dscp_result = apply_traffic_class_to_tokio_socket(
            &self.socket,
            self.remote,
@@ -973,7 +734,6 @@ impl AsyncClient {

        Ok(PreparedAsyncOpen {
            machine,
-            schedule: Some(schedule),
            recv_buffer_len: Some(recv_buffer_len),
            negotiated_traffic_class: Some(negotiated_traffic_class),
        })
@@ -984,7 +744,7 @@ impl AsyncClient {
            self.recv_buffer.resize(recv_buffer_len, 0);
        }
        let outcome = self.machine.commit_open(prepared.machine);
-        self.schedule = prepared.schedule;
+
        self.applied_traffic_class = prepared.negotiated_traffic_class;
        self.prepared_open = None;
        self.tx_timestamping_enabled = try_enable_tx_timestamping(&self.socket);
@@ -1017,23 +777,6 @@ impl AsyncClient {
        else {
            return Poll::Ready(Err(state.cleanup.take().unwrap().into_primary()));
        };
-
-        #[cfg(test)]
-        if self
-            .test_hooks
-            .pause_open_cleanup_before_send
-            .replace(false)
-        {
-            return Poll::Pending;
-        }
-
-        #[cfg(test)]
-        if self.test_hooks.fail_cleanup_send.replace(false) {
-            return Poll::Ready(Err(state.cleanup.take().unwrap().into_primary()));
-        }
-        #[cfg(test)]
-        let send_result = self.test_hooks.try_send(&self.socket, packet);
-        #[cfg(not(test))]
        let send_result = self.socket.try_send(packet);
        match send_result {
            Ok(_) => return Poll::Ready(Err(state.cleanup.take().unwrap().into_primary())),
@@ -1055,22 +798,6 @@ impl AsyncClient {
        }
    }

-    fn clear_peer_close_dscp(&self) -> Result<(), ClientError> {
-        #[cfg(test)]
-        if self.test_hooks.fail_peer_close_dscp.replace(false) {
-            return Err(ClientError::SocketOption {
-                operation: "clear DSCP before close",
-                remote: self.remote,
-                source: io::Error::other("injected peer-close DSCP cleanup failure"),
-            });
-        }
-        clear_dscp_on_tokio_socket(&self.socket, self.remote)
-    }
-
-    fn clear_close_dscp(&self) -> Result<(), ClientError> {
-        clear_dscp_on_tokio_socket(&self.socket, self.remote)
-    }
-
    fn restore_dscp_best_effort(&self, previous_traffic_class: Option<u8>) {
        let _ = match previous_traffic_class {
            Some(traffic_class) => {
@@ -1086,8 +813,6 @@ struct DscpRollback<'a> {
    remote: SocketAddr,
    previous_traffic_class: Option<u8>,
    armed: bool,
-    #[cfg(test)]
-    fail_restore: &'a Cell<bool>,
 }

 impl<'a> DscpRollback<'a> {
@@ -1095,15 +820,12 @@ impl<'a> DscpRollback<'a> {
        socket: &'a tokio::net::UdpSocket,
        remote: SocketAddr,
        previous_traffic_class: Option<u8>,
-        #[cfg(test)] fail_restore: &'a Cell<bool>,
    ) -> Self {
        Self {
            socket,
            remote,
            previous_traffic_class,
            armed: true,
-            #[cfg(test)]
-            fail_restore,
        }
    }

@@ -1111,14 +833,7 @@ impl<'a> DscpRollback<'a> {
        if !self.armed {
            return Ok(());
        }
-        #[cfg(test)]
-        if self.fail_restore.replace(false) {
-            return Err(ClientError::SocketOption {
-                operation: "restore negotiated DSCP",
-                remote: self.remote,
-                source: io::Error::other("injected DSCP restore failure"),
-            });
-        }
+
        match self.previous_traffic_class {
            Some(traffic_class) => {
                apply_traffic_class_to_tokio_socket(self.socket, self.remote, traffic_class)?
@@ -1171,6 +886,3 @@ fn poll_readable_until(
        },
    }
 }
-
-#[cfg(test)]
-mod tests;
@@ -1,82 +0,0 @@
-//! A real `irtt-server` running in-process, for tests that need to prove
-//! `AsyncClient` and the blocking `Client` are equivalent against a real peer.
-//!
-//! This duplicates `crates/irtt-integration-tests/tests/support/in_tree_server.rs`
-//! rather than depending on it: this module backs private (`super::*`) unit
-//! tests here, while the integration crate covers black-box client/server
-//! behavior, and neither can depend on the other's test-only code.
-
-use std::{
-    net::{IpAddr, Ipv4Addr, SocketAddr},
-    sync::mpsc,
-    thread::{self, JoinHandle},
-    time::Duration,
-};
-
-use irtt_server::{Server, ServerConfig};
-use tokio::sync::oneshot;
-
-const STARTUP_TIMEOUT: Duration = Duration::from_secs(2);
-
-pub struct InTreeServer {
-    pub addr: SocketAddr,
-    shutdown: Option<oneshot::Sender<()>>,
-    done: Option<JoinHandle<Result<(), irtt_server::ServerRuntimeError>>>,
-}
-
-impl InTreeServer {
-    pub fn start(config: ServerConfig) -> Self {
-        let (startup_tx, startup_rx) = mpsc::sync_channel(1);
-        let (shutdown_tx, shutdown_rx) = oneshot::channel();
-        let done = thread::spawn(move || {
-            let runtime = tokio::runtime::Builder::new_current_thread()
-                .enable_all()
-                .build()
-                .expect("failed to build in-tree test server runtime");
-            runtime.block_on(async move {
-                let bind_addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0);
-                let mut server = Server::bind(bind_addr, config).await?;
-                startup_tx
-                    .send(server.local_addr()?)
-                    .expect("test stopped waiting for in-tree server startup");
-                server
-                    .run(async {
-                        let _ = shutdown_rx.await;
-                    })
-                    .await
-            })
-        });
-
-        let addr = match startup_rx.recv_timeout(STARTUP_TIMEOUT) {
-            Ok(addr) => addr,
-            Err(error) => {
-                let _ = shutdown_tx.send(());
-                let result = done.join().expect("in-tree test server thread panicked");
-                panic!("in-tree test server failed before startup ({error}): {result:?}");
-            }
-        };
-
-        Self {
-            addr,
-            shutdown: Some(shutdown_tx),
-            done: Some(done),
-        }
-    }
-
-    fn stop_inner(&mut self) {
-        if let Some(shutdown) = self.shutdown.take() {
-            let _ = shutdown.send(());
-        }
-        if let Some(done) = self.done.take() {
-            done.join()
-                .expect("in-tree test server thread panicked")
-                .expect("in-tree test server stopped with an error");
-        }
-    }
-}
-
-impl Drop for InTreeServer {
-    fn drop(&mut self) {
-        self.stop_inner();
-    }
-}
@@ -4,12 +4,6 @@ use std::{
    time::{Duration, Instant},
 };

-#[cfg(test)]
-use std::cell::Cell;
-
-#[cfg(test)]
-use irtt_proto::{flags, Params, TimestampFields, PROTOCOL_VERSION};
-
 use crate::{
    config::{ClientConfig, RecvBudget},
    error::ClientError,
@@ -24,23 +18,9 @@ use crate::{
    timing::ClientTimestamp,
 };

-pub(crate) mod schedule;
-
-use schedule::{instant_abs_diff, ProbeSchedule};
-
-#[derive(Debug, Clone, Copy)]
-enum ProbeScheduleMode {
-    CallerPaced,
-    #[cfg(test)]
-    Managed {
-        scheduled_at: Instant,
-    },
-}
-
 #[derive(Debug)]
 struct PreparedClientOpen {
    machine: PreparedOpenAcceptance,
-    schedule: Option<ProbeSchedule>,
    recv_buffer_len: Option<usize>,
    negotiated_traffic_class: Option<u8>,
    previous_traffic_class: Option<u8>,
@@ -53,60 +33,40 @@ struct PreparedClientOpenFailure {
    machine: PreparedOpenAcceptance,
 }

-#[cfg(test)]
-#[derive(Debug, Default)]
-struct ClientTestHooks {
-    fail_open_dscp: Cell<bool>,
-    fail_open_timeout_restore: Cell<bool>,
-    fail_close_event_reserve: Cell<bool>,
-    fail_close_dscp_clear: Cell<bool>,
-    fail_close_send: Cell<bool>,
-    close_reported_len: Cell<Option<usize>>,
-    close_send_attempts: Cell<usize>,
-    close_sent_at: Cell<Option<ClientTimestamp>>,
-    fail_cleanup_send: Cell<bool>,
-    recv_buffer_len_override: Cell<Option<usize>>,
-    fail_dscp_restore: Cell<bool>,
-    last_restored_read_timeout: Cell<Option<Duration>>,
-    prepared_active_session_before_dscp: Cell<bool>,
-    /// Number of subsequent receive attempts that should report
-    /// `io::ErrorKind::Interrupted` before a real receive is attempted.
-    /// Decremented on every injected receive; `0` means inject nothing.
-    inject_recv_interrupted: Cell<usize>,
-}
-
-#[cfg(test)]
-#[derive(Debug, Clone, Copy)]
-pub(crate) struct ProbeSendTimestamps {
-    pub(crate) permission_at: Instant,
-    /// Private pre-send anchor: timeout deadline / kernel TX lower bound.
-    pub(crate) send_anchor: ClientTimestamp,
-    pub(crate) send_call_start: Instant,
-    pub(crate) send_finished_at: Instant,
-    /// Public post-send measurement: RTT / OWD fallback / timer_error.
-    pub(crate) sent_at: ClientTimestamp,
-}
-
-#[cfg(test)]
-use crate::{
-    session::machine::{
-        compute_one_way, compute_rtt, params_from_config, sequence_is_after, sequence_is_before,
-        unix_epoch_ns_i64, update_highest_received,
-    },
-    session::negotiate_params,
-    NegotiatedParams, RunMode, SignedDuration, WarningKind, MAX_UDP_PAYLOAD_LENGTH,
-};
-
 /// Low-level synchronous IRTT client.
 ///
 /// `Client` exposes the protocol steps directly: connect a UDP socket, open a
 /// session, send probes, receive replies, poll timeouts, and close. Callers
 /// that do not need to own this loop can use the unified managed API in
 /// [`crate::managed`] when the `tokio` feature is enabled.
+///
+/// # Example
+///
+/// `Client` is the runtime-free adapter. The caller drives receives and timeout
+/// polling between sends; see the standalone example for a complete loop.
+/// This example type-checks without contacting a server:
+///
+/// ```no_run
+/// use irtt_client::{Client, ClientConfig};
+///
+/// # fn run() -> Result<(), Box<dyn std::error::Error>> {
+/// let mut client = Client::connect(ClientConfig::default())?;
+/// let outcome = client.open()?;
+/// println!("opened: {outcome:?}");
+/// let sent = client.send_probe()?;
+/// println!("sent: {sent:?}");
+/// let received = client.recv_once()?;
+/// println!("received: {received:?}");
+/// let timed_out = client.poll_timeouts()?;
+/// println!("timeouts: {timed_out:?}");
+/// let closed = client.close()?;
+/// println!("closed: {closed:?}");
+/// # Ok(())
+/// # }
+/// ```
 #[derive(Debug)]
 pub struct Client {
    runtime: SessionMachine,
-    schedule: Option<ProbeSchedule>,
    socket: UdpSocket,
    remote: SocketAddr,
    recv_buffer: Vec<u8>,
@@ -118,14 +78,6 @@ pub struct Client {
    /// unnecessary error-queue drains are skipped once it is known there is
    /// nothing to drain.
    tx_timestamping_enabled: bool,
-    #[cfg(test)]
-    test_hooks: ClientTestHooks,
-    #[cfg(test)]
-    probe_reported_len: Option<usize>,
-    #[cfg(test)]
-    probe_send_error: bool,
-    #[cfg(test)]
-    probe_send_timestamps: Option<ProbeSendTimestamps>,
 }

 impl Client {
@@ -142,20 +94,11 @@ impl Client {

        Ok(Self {
            runtime,
-            schedule: None,
            socket,
            remote,
            recv_buffer: vec![0_u8; recv_buffer_size(false, None)?],
            applied_traffic_class: None,
            tx_timestamping_enabled: false,
-            #[cfg(test)]
-            test_hooks: ClientTestHooks::default(),
-            #[cfg(test)]
-            probe_reported_len: None,
-            #[cfg(test)]
-            probe_send_error: false,
-            #[cfg(test)]
-            probe_send_timestamps: None,
        })
    }

@@ -163,12 +106,13 @@ impl Client {
    ///
    /// On success, returns the negotiated open outcome and transitions the
    /// client into either an open probe session or completed no-test state.
-    /// Open attempts use [`ClientConfig::open_timeouts`]. Malformed, unrelated,
-    /// or unauthenticated datagrams are ignored until the current attempt's
-    /// absolute deadline, so one attempt may consume several datagrams without
+    /// Open attempts use [`ClientConfig::open_timeouts`]. Malformed or
+    /// unrelated datagrams are ignored until the current attempt's absolute
+    /// deadline, so one attempt may consume several datagrams without
    /// retransmitting. Silence or ignored traffic eventually produces
-    /// [`ClientError::OpenTimeout`], while authenticated incompatibility remains
-    /// terminal.
+    /// [`ClientError::OpenTimeout`]. A structurally recognizable malformed or
+    /// incompatible Open reply from the connected peer is terminal; when HMAC
+    /// is configured, that recognition additionally requires authentication.
    ///
    /// When a trusted reply allocates a token but later negotiation or socket
    /// preparation fails, the client sends a best-effort cleanup close and
@@ -177,8 +121,9 @@ impl Client {
    pub fn open(&mut self) -> Result<OpenOutcome, ClientError> {
        let result = self.open_transaction();
        if result.is_err() {
-            let _ =
-                self.restore_open_read_timeout(self.runtime.config().socket_config.recv_timeout);
+            let _ = self
+                .socket
+                .set_read_timeout(self.runtime.config().socket_config.recv_timeout);
        }
        result
    }
@@ -188,19 +133,11 @@ impl Client {
    /// The close event means the client has sent its close packet and stopped
    /// tracking the session locally; it is not a server acknowledgement. If the
    /// send fails, the negotiated DSCP is restored best-effort and the session
-    /// and probe schedule remain open.
+    /// remains open.
    pub fn close(&mut self) -> Result<Vec<ClientEvent>, ClientError> {
        let prepared = self.runtime.prepare_close()?;
        let mut events = Vec::new();
-        #[cfg(test)]
-        if self.test_hooks.fail_close_event_reserve.replace(false) {
-            events
-                .try_reserve(usize::MAX)
-                .map_err(|source| ClientError::AllocationFailed {
-                    operation: "close event result",
-                    source,
-                })?;
-        }
+
        events
            .try_reserve(1)
            .map_err(|source| ClientError::AllocationFailed {
@@ -211,51 +148,74 @@ impl Client {
        let expected_bytes = prepared.bytes.len();

        self.clear_close_dscp()?;
-        let bytes = match self.send_close_datagram(prepared.bytes) {
+        let bytes = match self.socket.send(prepared.bytes) {
            Ok(bytes) => bytes,
            Err(err) => {
                self.restore_dscp_best_effort(previous_traffic_class);
                return Err(ClientError::Socket(err));
            }
        };
-        #[cfg(not(test))]
        let sent_at = ClientTimestamp::now();
-        #[cfg(test)]
-        let sent_at = self
-            .test_hooks
-            .close_sent_at
-            .take()
-            .unwrap_or_else(ClientTimestamp::now);
-        let event = self.runtime.commit_local_close(prepared.commit, sent_at);
-        self.schedule = None;
-        self.applied_traffic_class = None;

+        let event = self.runtime.commit_local_close(prepared.commit, sent_at);
+
+        self.applied_traffic_class = None;
        validate_datagram_length(expected_bytes, bytes)?;
        events.push(event);
        Ok(events)
    }

-    /// Return the monotonic deadline for the next probe send, if another probe
-    /// is scheduled.
-    pub fn next_send_deadline(&self) -> Option<Instant> {
-        if !self.runtime.is_open() {
-            return None;
-        }
-        self.schedule.as_ref()?.next_send_deadline()
-    }
-
    /// Return the local timeout used to classify pending probes as lost.
    pub fn probe_timeout(&self) -> Duration {
        self.runtime.probe_timeout()
    }

-    /// Send one echo probe if the negotiated run is still active.
+    /// Send one echo probe now. The caller owns pacing and run duration.
    ///
-    /// Returns an `EchoSent` event when a probe is sent. Returns an empty event
-    /// list when the run duration has elapsed and no further probe should be
-    /// sent.
+    /// The negotiated interval and duration do not gate low-level sends.
    pub fn send_probe(&mut self) -> Result<Vec<ClientEvent>, ClientError> {
-        self.send_probe_transaction(ProbeScheduleMode::CallerPaced)
+        let remote = self.remote;
+        let (runtime, socket) = (&mut self.runtime, &self.socket);
+        let prepared = runtime.prepare_probe()?;
+        let machine_preflight = runtime.preflight_probe_commit(&prepared)?;
+        let mut events = Vec::new();
+        events
+            .try_reserve(1)
+            .map_err(|source| ClientError::AllocationFailed {
+                operation: "probe event result",
+                source,
+            })?;
+        let expected_bytes = prepared.bytes.len();
+
+        // All fallible probe-commit preflight (timeout deadline arithmetic,
+        // capacity/collision checks already done above) is finalized from
+        // this PRIVATE pre-send anchor, before the socket send. It is not
+        // the public measurement `sent_at` captured further below.
+        let send_anchor = ClientTimestamp::now();
+        let machine_commit = runtime.finalize_probe_commit(machine_preflight, send_anchor)?;
+        let send_call_start = Instant::now();
+
+        let bytes = match socket.send(&prepared.bytes) {
+            Ok(bytes) => bytes,
+            Err(error) => {
+                runtime.invalidate_kernel_tx_correlation();
+                return Err(ClientError::Socket(error));
+            }
+        };
+        let send_finished_at = Instant::now();
+
+        // The public measurement timestamp: paired wall/monotonic sample
+        // captured immediately after the successful socket send completed.
+        // This, not `send_anchor` above, is the RTT/OWD-fallback/timer_error
+        // endpoint. The infallible machine commit below never fails.
+        let sent_at = ClientTimestamp::now();
+        let sent = runtime.commit_probe_sent(machine_commit, sent_at, bytes);
+        let send_call = send_finished_at.saturating_duration_since(send_call_start);
+        validate_datagram_length(expected_bytes, bytes)?;
+        self.drain_tx_timestamps()?;
+
+        events.push(echo_sent_event(remote, sent, send_call));
+        Ok(events)
    }

    /// Receive and classify at most one datagram from the socket.
@@ -268,37 +228,6 @@ impl Client {
        self.recv_once_inner()
    }

-    /// Receive one datagram into `self.recv_buffer`. In test builds, a
-    /// pending `inject_recv_interrupted` count reports
-    /// `io::ErrorKind::Interrupted` instead of performing a real receive,
-    /// deterministically exercising interrupted-syscall retry behavior.
-    fn recv_datagram_once(&mut self) -> Result<ReceivedDatagram, io::Error> {
-        #[cfg(test)]
-        {
-            let remaining = self.test_hooks.inject_recv_interrupted.get();
-            if remaining > 0 {
-                self.test_hooks.inject_recv_interrupted.set(remaining - 1);
-                return Err(io::Error::from(io::ErrorKind::Interrupted));
-            }
-        }
-        recv_datagram(&self.socket, &mut self.recv_buffer)
-    }
-
-    /// Same as [`Self::recv_datagram_once`], receiving into a caller-supplied
-    /// buffer instead of `self.recv_buffer` (used before the negotiated
-    /// receive buffer size is known, i.e. during Open).
-    fn recv_datagram_once_into(&self, buf: &mut [u8]) -> Result<ReceivedDatagram, io::Error> {
-        #[cfg(test)]
-        {
-            let remaining = self.test_hooks.inject_recv_interrupted.get();
-            if remaining > 0 {
-                self.test_hooks.inject_recv_interrupted.set(remaining - 1);
-                return Err(io::Error::from(io::ErrorKind::Interrupted));
-            }
-        }
-        recv_datagram(&self.socket, buf)
-    }
-
    fn recv_once_inner(&mut self) -> Result<Vec<ClientEvent>, ClientError> {
        let Some(datagram) = self.recv_datagram_retrying_interrupted()? else {
            return Ok(vec![]);
@@ -314,11 +243,8 @@ impl Client {
            datagram.received_at,
            datagram.meta,
        )?;
-        if self.runtime.is_peer_closed() {
-            self.schedule = None;
-            if self.clear_close_dscp().is_ok() {
-                self.applied_traffic_class = None;
-            }
+        if self.runtime.is_peer_closed() && self.clear_close_dscp().is_ok() {
+            self.applied_traffic_class = None;
        }
        Ok(events)
    }
@@ -351,7 +277,7 @@ impl Client {
        let mut timeout_narrowed = false;

        let result = loop {
-            match self.recv_datagram_once() {
+            match recv_datagram(&self.socket, &mut self.recv_buffer) {
                Ok(datagram) => break Ok(Some(datagram)),
                Err(err)
                    if matches!(
@@ -424,17 +350,19 @@ impl Client {
        self.runtime.poll_timeouts_at(now)
    }

-    /// Return whether the current run has completed.
-    ///
-    /// A normal run is complete once no more probes will be sent and all
-    /// pending probes have either replied or timed out. No-test and closed
-    /// sessions are also considered complete.
-    pub fn is_run_complete(&self) -> bool {
-        self.runtime.is_terminal()
-            || self
-                .schedule
-                .as_ref()
-                .is_some_and(|schedule| schedule.is_finished() && self.runtime.pending_is_empty())
+    /// Negotiated parameters of the currently open session.
+    pub fn negotiated_params(&self) -> Option<&crate::NegotiatedParams> {
+        self.runtime.negotiated_params()
+    }
+
+    /// Earliest timeout deadline among probes still awaiting a reply.
+    pub fn next_probe_timeout_deadline(&self) -> Option<Instant> {
+        self.runtime.next_probe_timeout_deadline()
+    }
+
+    /// Whether any sent probes still await a reply or timeout.
+    pub fn has_pending_probes(&self) -> bool {
+        !self.runtime.pending_is_empty()
    }

    /// Return whether the session was closed by a peer close-flagged reply.
@@ -447,123 +375,6 @@ impl Client {
        self.runtime.is_peer_closed()
    }

-    #[cfg(test)]
-    pub(crate) fn send_managed_probe(
-        &mut self,
-        scheduled_at: Instant,
-    ) -> Result<Vec<ClientEvent>, ClientError> {
-        self.send_probe_transaction(ProbeScheduleMode::Managed { scheduled_at })
-    }
-
-    fn send_probe_transaction(
-        &mut self,
-        mode: ProbeScheduleMode,
-    ) -> Result<Vec<ClientEvent>, ClientError> {
-        self.runtime.ensure_open()?;
-        #[cfg(test)]
-        let test_timestamps = self.probe_send_timestamps.take();
-        #[cfg(test)]
-        let fail_send = std::mem::take(&mut self.probe_send_error);
-        let remote = self.remote;
-        let (runtime, schedule, socket) = (&mut self.runtime, &mut self.schedule, &self.socket);
-        let schedule = schedule
-            .as_mut()
-            .expect("open sessions always have a probe schedule");
-        #[cfg(not(test))]
-        let permission_at = Instant::now();
-        #[cfg(test)]
-        let permission_at = test_timestamps
-            .map(|timestamps| timestamps.permission_at)
-            .unwrap_or_else(Instant::now);
-        if !schedule.permit_probe_at(permission_at) {
-            return Ok(Vec::new());
-        }
-
-        let Some(prepared) = runtime.prepare_probe()? else {
-            return Ok(Vec::new());
-        };
-        let machine_preflight = runtime.preflight_probe_commit(&prepared)?;
-        let schedule_commit = match mode {
-            ProbeScheduleMode::CallerPaced => {
-                schedule.preflight_caller_commit(machine_preflight.next_packets_sent)?
-            }
-            #[cfg(test)]
-            ProbeScheduleMode::Managed { scheduled_at } => {
-                schedule.preflight_managed_commit(scheduled_at, permission_at)?
-            }
-        };
-        let mut events = Vec::new();
-        events
-            .try_reserve(1)
-            .map_err(|source| ClientError::AllocationFailed {
-                operation: "probe event result",
-                source,
-            })?;
-
-        let expected_bytes = prepared.bytes.len();
-        let scheduled_at = schedule_commit.scheduled_at;
-        #[cfg(test)]
-        let reported_bytes = self.probe_reported_len.take();
-        // All fallible probe-commit preflight (timeout deadline arithmetic,
-        // capacity/collision checks already done above) is finalized from
-        // this PRIVATE pre-send anchor, before the socket send. It is not
-        // the public measurement `sent_at` captured further below.
-        #[cfg(not(test))]
-        let send_anchor = ClientTimestamp::now();
-        #[cfg(test)]
-        let send_anchor = test_timestamps
-            .map(|timestamps| timestamps.send_anchor)
-            .unwrap_or_else(ClientTimestamp::now);
-        let machine_commit = runtime.finalize_probe_commit(machine_preflight, send_anchor)?;
-        #[cfg(not(test))]
-        let send_call_start = Instant::now();
-        #[cfg(test)]
-        let send_call_start = test_timestamps
-            .map(|timestamps| timestamps.send_call_start)
-            .unwrap_or_else(Instant::now);
-        #[cfg(test)]
-        if fail_send {
-            return Err(ClientError::Socket(io::Error::other(
-                "injected probe send failure",
-            )));
-        }
-        let bytes = socket.send(&prepared.bytes)?;
-        #[cfg(not(test))]
-        let send_finished_at = Instant::now();
-        #[cfg(test)]
-        let send_finished_at = test_timestamps
-            .map(|timestamps| timestamps.send_finished_at)
-            .unwrap_or_else(Instant::now);
-        // The public measurement timestamp: paired wall/monotonic sample
-        // captured immediately after the successful socket send completed.
-        // This, not `send_anchor` above, is the RTT/OWD-fallback/timer_error
-        // endpoint. The infallible machine/schedule commit below never fails.
-        #[cfg(not(test))]
-        let sent_at = ClientTimestamp::now();
-        #[cfg(test)]
-        let sent_at = test_timestamps
-            .map(|timestamps| timestamps.sent_at)
-            .unwrap_or_else(ClientTimestamp::now);
-        let sent = runtime.commit_probe_sent(machine_commit, sent_at, bytes);
-        schedule.commit(schedule_commit);
-
-        let send_call = send_finished_at.saturating_duration_since(send_call_start);
-        let timer_error = instant_abs_diff(sent_at.mono, scheduled_at);
-        #[cfg(test)]
-        let bytes = reported_bytes.unwrap_or(bytes);
-        validate_datagram_length(expected_bytes, bytes)?;
-        self.drain_tx_timestamps()?;
-
-        events.push(echo_sent_event(
-            remote,
-            sent,
-            send_call,
-            scheduled_at,
-            timer_error,
-        ));
-        Ok(events)
-    }
-
    fn open_transaction(&mut self) -> Result<OpenOutcome, ClientError> {
        let request = self.runtime.prepare_open_request()?;
        let mut buf = [0_u8; MAX_OPEN_PACKET_SIZE];
@@ -587,7 +398,7 @@ impl Client {
                }
                self.socket.set_read_timeout(Some(remaining))?;

-                let datagram = match self.recv_datagram_once_into(&mut buf) {
+                let datagram = match recv_datagram(&self.socket, &mut buf) {
                    Ok(datagram) => datagram,
                    // WouldBlock/TimedOut mean the attempt's own deadline
                    // elapsed; Interrupted (EINTR) means the syscall was
@@ -630,7 +441,7 @@ impl Client {
                        return Err(failure.primary);
                    }
                };
-                let prepared = match self.prepare_client_open(machine, datagram.received_at) {
+                let prepared = match self.prepare_client_open(machine) {
                    Ok(prepared) => prepared,
                    Err(failure) => {
                        self.send_cleanup_close_best_effort(failure.machine.cleanup_close_packet());
@@ -647,32 +458,21 @@ impl Client {
    fn prepare_client_open(
        &self,
        machine: PreparedOpenAcceptance,
-        opened_at: ClientTimestamp,
    ) -> Result<PreparedClientOpen, Box<PreparedClientOpenFailure>> {
        let Some(negotiated) = machine.normal_negotiated() else {
            return Ok(PreparedClientOpen {
                machine,
-                schedule: None,
                recv_buffer_len: None,
                negotiated_traffic_class: None,
                previous_traffic_class: self.applied_traffic_class,
                post_open_recv_timeout: self.runtime.config().socket_config.recv_timeout,
            });
        };
-        let schedule = match ProbeSchedule::new(opened_at.mono, negotiated) {
-            Ok(schedule) => schedule,
-            Err(primary) => return Err(Box::new(PreparedClientOpenFailure { primary, machine })),
-        };
        let recv_buffer_len = match recv_buffer_size(self.runtime.has_hmac(), Some(negotiated)) {
            Ok(size) => size,
            Err(primary) => return Err(Box::new(PreparedClientOpenFailure { primary, machine })),
        };
-        #[cfg(test)]
-        let recv_buffer_len = self
-            .test_hooks
-            .recv_buffer_len_override
-            .get()
-            .unwrap_or(recv_buffer_len);
+
        let negotiated_traffic_class = match u8::try_from(negotiated.params.dscp) {
            Ok(traffic_class) => traffic_class,
            Err(_) => {
@@ -687,7 +487,6 @@ impl Client {

        Ok(PreparedClientOpen {
            machine,
-            schedule: Some(schedule),
            recv_buffer_len: Some(recv_buffer_len),
            negotiated_traffic_class: Some(negotiated_traffic_class),
            previous_traffic_class: self.applied_traffic_class,
@@ -701,7 +500,6 @@ impl Client {
    ) -> Result<OpenOutcome, ClientError> {
        let PreparedClientOpen {
            machine,
-            schedule,
            recv_buffer_len,
            negotiated_traffic_class,
            previous_traffic_class,
@@ -722,17 +520,15 @@ impl Client {
            }
            self.recv_buffer.resize(recv_buffer_len, 0);

-            #[cfg(test)]
-            self.test_hooks
-                .prepared_active_session_before_dscp
-                .set(machine.has_prepared_active_session());
-            if let Err(primary) = self.apply_open_dscp(negotiated_traffic_class) {
+            if let Err(primary) =
+                apply_traffic_class_to_socket(&self.socket, self.remote, negotiated_traffic_class)
+            {
                self.recv_buffer.truncate(previous_len);
                self.restore_dscp_best_effort(previous_traffic_class);
                self.send_cleanup_close_best_effort(machine.cleanup_close_packet());
                return Err(primary);
            }
-            if let Err(source) = self.restore_open_read_timeout(post_open_recv_timeout) {
+            if let Err(source) = self.socket.set_read_timeout(post_open_recv_timeout) {
                let primary = ClientError::ReadTimeoutRestore { source };
                self.recv_buffer.truncate(previous_len);
                self.restore_dscp_best_effort(previous_traffic_class);
@@ -741,17 +537,16 @@ impl Client {
            }

            let outcome = self.runtime.commit_open(machine);
-            self.schedule = schedule;
+
            self.applied_traffic_class = Some(negotiated_traffic_class);
            self.tx_timestamping_enabled = try_enable_tx_timestamping(&self.socket);
            Ok(outcome)
        } else {
-            debug_assert!(schedule.is_none());
-            if let Err(source) = self.restore_open_read_timeout(post_open_recv_timeout) {
+            if let Err(source) = self.socket.set_read_timeout(post_open_recv_timeout) {
                return Err(ClientError::ReadTimeoutRestore { source });
            }
            let outcome = self.runtime.commit_open(machine);
-            self.schedule = None;
+
            self.applied_traffic_class = None;
            self.tx_timestamping_enabled = try_enable_tx_timestamping(&self.socket);
            Ok(outcome)
@@ -776,10 +571,6 @@ impl Client {
    }

    fn restore_dscp_best_effort(&self, previous_traffic_class: Option<u8>) {
-        #[cfg(test)]
-        if self.test_hooks.fail_dscp_restore.replace(false) {
-            return;
-        }
        let _ = match previous_traffic_class {
            Some(traffic_class) => {
                apply_traffic_class_to_socket(&self.socket, self.remote, traffic_class)
@@ -789,85 +580,29 @@ impl Client {
    }

    fn clear_close_dscp(&self) -> Result<(), ClientError> {
-        #[cfg(test)]
-        if self.test_hooks.fail_close_dscp_clear.replace(false) {
-            return Err(ClientError::SocketOption {
-                operation: "clear negotiated DSCP",
-                remote: self.remote,
-                source: io::Error::other("injected negotiated DSCP clear failure"),
-            });
-        }
        clear_dscp_on_socket(&self.socket, self.remote)
    }

    fn send_cleanup_close_best_effort(&self, packet: Option<&[u8]>) {
        if let Some(packet) = packet {
-            #[cfg(test)]
-            if self.test_hooks.fail_cleanup_send.replace(false) {
-                return;
-            }
            let _ = self.socket.send(packet);
        }
    }
-
-    fn apply_open_dscp(&self, traffic_class: u8) -> Result<(), ClientError> {
-        #[cfg(test)]
-        if self.test_hooks.fail_open_dscp.replace(false) {
-            return Err(ClientError::SocketOption {
-                operation: "set negotiated DSCP",
-                remote: self.remote,
-                source: io::Error::other("injected negotiated DSCP failure"),
-            });
-        }
-        apply_traffic_class_to_socket(&self.socket, self.remote, traffic_class)
-    }
-
-    fn restore_open_read_timeout(&self, timeout: Option<Duration>) -> io::Result<()> {
-        #[cfg(test)]
-        self.test_hooks.last_restored_read_timeout.set(timeout);
-        #[cfg(test)]
-        if self.test_hooks.fail_open_timeout_restore.replace(false) {
-            return Err(io::Error::other(
-                "injected configured read timeout restoration failure",
-            ));
-        }
-        self.socket.set_read_timeout(timeout)
-    }
-
-    fn send_close_datagram(&self, packet: &[u8]) -> io::Result<usize> {
-        #[cfg(test)]
-        {
-            self.test_hooks
-                .close_send_attempts
-                .set(self.test_hooks.close_send_attempts.get() + 1);
-            if self.test_hooks.fail_close_send.replace(false) {
-                return Err(io::Error::other("injected close send failure"));
-            }
-        }
-        let bytes = self.socket.send(packet)?;
-        #[cfg(test)]
-        if let Some(reported) = self.test_hooks.close_reported_len.take() {
-            return Ok(reported);
-        }
-        Ok(bytes)
-    }
 }

 pub(crate) fn echo_sent_event(
    remote: SocketAddr,
    sent: ProbeSent,
    send_call: Duration,
-    scheduled_at: Instant,
-    timer_error: Duration,
 ) -> ClientEvent {
    ClientEvent::EchoSent {
        seq: sent.seq,
        remote,
-        scheduled_at,
+        scheduled_at: None,
        sent_at: sent.sent_at,
        bytes: sent.bytes,
        send_call,
-        timer_error,
+        timer_error: None,
    }
 }

@@ -878,47 +613,3 @@ pub(crate) fn validate_datagram_length(expected: usize, actual: usize) -> Result
        Err(ClientError::DatagramLengthMismatch { expected, actual })
    }
 }
-
-#[cfg(test)]
-impl Client {
-    fn send_probe_at(
-        &mut self,
-        timestamps: ProbeSendTimestamps,
-    ) -> Result<Vec<ClientEvent>, ClientError> {
-        self.probe_send_timestamps = Some(timestamps);
-        self.send_probe()
-    }
-
-    fn send_managed_probe_at(
-        &mut self,
-        scheduled_at: Instant,
-        timestamps: ProbeSendTimestamps,
-    ) -> Result<Vec<ClientEvent>, ClientError> {
-        self.probe_send_timestamps = Some(timestamps);
-        self.send_managed_probe(scheduled_at)
-    }
-}
-
-#[cfg(test)]
-fn bounded_receive_timeout(
-    deadline: Option<Instant>,
-    configured_timeout: Option<Duration>,
-    max_wait: Duration,
-    now: Instant,
-) -> Option<Duration> {
-    if max_wait.is_zero() {
-        return None;
-    }
-    let mut timeout = configured_timeout.unwrap_or(max_wait).min(max_wait);
-    if let Some(deadline) = deadline {
-        let remaining = deadline.checked_duration_since(now)?;
-        if remaining.is_zero() {
-            return None;
-        }
-        timeout = timeout.min(remaining);
-    }
-    (!timeout.is_zero()).then_some(timeout)
-}
-
-#[cfg(test)]
-mod tests;
@@ -1,318 +0,0 @@
-use std::time::{Duration, Instant};
-
-use crate::{error::ClientError, session::NegotiatedParams};
-
-#[derive(Debug)]
-pub(crate) struct ProbeSchedule {
-    start_at: Instant,
-    end_at: Option<Instant>,
-    interval: Duration,
-    next_send_at: Option<Instant>,
-}
-
-#[derive(Debug)]
-pub(crate) struct ScheduleCommit {
-    pub(crate) scheduled_at: Instant,
-    pub(crate) next_send_at: Option<Instant>,
-}
-
-impl ProbeSchedule {
-    pub(crate) fn new(
-        start_at: Instant,
-        negotiated: &NegotiatedParams,
-    ) -> Result<Self, ClientError> {
-        let interval_ns = u64::try_from(negotiated.params.interval_ns)
-            .expect("validated positive negotiated interval");
-        let interval = Duration::from_nanos(interval_ns);
-        let end_at = if negotiated.params.duration_ns > 0 {
-            let duration_ns = u64::try_from(negotiated.params.duration_ns)
-                .expect("validated positive negotiated duration");
-            Some(
-                start_at
-                    .checked_add(Duration::from_nanos(duration_ns))
-                    .ok_or_else(|| ClientError::NegotiationRejected {
-                        reason: "duration is too large to schedule".to_owned(),
-                    })?,
-            )
-        } else {
-            None
-        };
-
-        Ok(Self {
-            start_at,
-            end_at,
-            interval,
-            next_send_at: Some(start_at),
-        })
-    }
-
-    pub(crate) fn next_send_deadline(&self) -> Option<Instant> {
-        self.next_send_at
-    }
-
-    #[cfg(feature = "tokio")]
-    pub(crate) fn interval(&self) -> Duration {
-        self.interval
-    }
-
-    pub(crate) fn permit_probe_at(&mut self, now: Instant) -> bool {
-        if self.next_send_at.is_none() {
-            return false;
-        }
-        if self.end_at.is_some_and(|end| now >= end) {
-            self.next_send_at = None;
-            return false;
-        }
-        true
-    }
-
-    pub(crate) fn preflight_caller_commit(
-        &self,
-        next_packets_sent: u64,
-    ) -> Result<ScheduleCommit, ClientError> {
-        let scheduled_at = self
-            .next_send_at
-            .expect("a caller schedule commit requires a permitted probe");
-        let interval_ns =
-            u64::try_from(self.interval.as_nanos()).map_err(|_| ClientError::DurationOverflow)?;
-        let next_send_at = next_probe_deadline(self.start_at, interval_ns, next_packets_sent)?;
-        Ok(self.finish_commit(scheduled_at, next_send_at))
-    }
-
-    #[cfg(any(feature = "tokio", test))]
-    pub(crate) fn preflight_managed_commit(
-        &self,
-        scheduled_at: Instant,
-        permission_at: Instant,
-    ) -> Result<ScheduleCommit, ClientError> {
-        let (scheduled_at, next_send_at, _) =
-            advance_cadence(scheduled_at, self.interval, permission_at)?;
-        Ok(self.finish_commit(scheduled_at, next_send_at))
-    }
-
-    pub(crate) fn commit(&mut self, commit: ScheduleCommit) {
-        self.next_send_at = commit.next_send_at;
-    }
-
-    pub(crate) fn is_finished(&self) -> bool {
-        self.next_send_at.is_none()
-    }
-
-    fn finish_commit(&self, scheduled_at: Instant, next_send_at: Instant) -> ScheduleCommit {
-        ScheduleCommit {
-            scheduled_at,
-            next_send_at: if self.end_at.is_some_and(|end| next_send_at >= end) {
-                None
-            } else {
-                Some(next_send_at)
-            },
-        }
-    }
-}
-
-fn next_probe_deadline(
-    start: Instant,
-    interval_ns: u64,
-    packets_sent: u64,
-) -> Result<Instant, ClientError> {
-    let offset_ns = interval_ns
-        .checked_mul(packets_sent)
-        .ok_or(ClientError::DurationOverflow)?;
-    start
-        .checked_add(Duration::from_nanos(offset_ns))
-        .ok_or(ClientError::DurationOverflow)
-}
-
-#[cfg(any(feature = "tokio", test))]
-pub(crate) fn advance_cadence(
-    deadline: Instant,
-    interval: Duration,
-    now: Instant,
-) -> Result<(Instant, Instant, u128), ClientError> {
-    if interval.is_zero() {
-        return Err(ClientError::InvalidConfig {
-            reason: "probe interval must be greater than zero".to_owned(),
-        });
-    }
-
-    let elapsed_slots = now
-        .checked_duration_since(deadline)
-        .map_or(0, |elapsed| elapsed.as_nanos() / interval.as_nanos());
-    let scheduled_offset = duration_from_nanos(
-        interval
-            .as_nanos()
-            .checked_mul(elapsed_slots)
-            .ok_or(ClientError::DurationOverflow)?,
-    )?;
-    let next_offset = duration_from_nanos(
-        interval
-            .as_nanos()
-            .checked_mul(
-                elapsed_slots
-                    .checked_add(1)
-                    .ok_or(ClientError::DurationOverflow)?,
-            )
-            .ok_or(ClientError::DurationOverflow)?,
-    )?;
-    let scheduled_at = deadline
-        .checked_add(scheduled_offset)
-        .ok_or(ClientError::DurationOverflow)?;
-    let next_at = deadline
-        .checked_add(next_offset)
-        .ok_or(ClientError::DurationOverflow)?;
-    Ok((scheduled_at, next_at, elapsed_slots))
-}
-
-#[cfg(any(feature = "tokio", test))]
-fn duration_from_nanos(nanos: u128) -> Result<Duration, ClientError> {
-    const NANOS_PER_SECOND: u128 = 1_000_000_000;
-    let seconds =
-        u64::try_from(nanos / NANOS_PER_SECOND).map_err(|_| ClientError::DurationOverflow)?;
-    let subsec_nanos = u32::try_from(nanos % NANOS_PER_SECOND)
-        .expect("nanosecond remainder is always less than one second");
-    Ok(Duration::new(seconds, subsec_nanos))
-}
-
-pub(crate) fn instant_abs_diff(left: Instant, right: Instant) -> Duration {
-    left.checked_duration_since(right)
-        .or_else(|| right.checked_duration_since(left))
-        .unwrap_or(Duration::ZERO)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use irtt_proto::Params;
-
-    fn negotiated(interval_ns: i64, duration_ns: i64) -> NegotiatedParams {
-        NegotiatedParams {
-            params: Params {
-                interval_ns,
-                duration_ns,
-                ..Params::default()
-            },
-            restrictions: Vec::new(),
-        }
-    }
-
-    #[test]
-    fn initial_deadline_is_the_opening_time() {
-        let opened_at = Instant::now();
-
-        let schedule = ProbeSchedule::new(opened_at, &negotiated(10_000_000, 0)).unwrap();
-
-        assert_eq!(schedule.next_send_deadline(), Some(opened_at));
-        assert!(!schedule.is_finished());
-    }
-
-    #[test]
-    fn caller_preflight_keeps_absolute_cadence_without_mutation() {
-        let start = Instant::now();
-        let schedule = ProbeSchedule::new(start, &negotiated(10_000_000, 0)).unwrap();
-
-        let commit = schedule.preflight_caller_commit(3).unwrap();
-
-        assert_eq!(commit.scheduled_at, start);
-        assert_eq!(commit.next_send_at, Some(start + Duration::from_millis(30)));
-        assert_eq!(schedule.next_send_deadline(), Some(start));
-    }
-
-    #[test]
-    fn caller_commit_advances_exactly_one_cadence_slot() {
-        let start = Instant::now();
-        let mut schedule = ProbeSchedule::new(start, &negotiated(10_000_000, 0)).unwrap();
-
-        let commit = schedule.preflight_caller_commit(1).unwrap();
-        assert_eq!(schedule.next_send_deadline(), Some(start));
-
-        schedule.commit(commit);
-        assert_eq!(
-            schedule.next_send_deadline(),
-            Some(start + Duration::from_millis(10))
-        );
-    }
-
-    #[test]
-    fn finite_duration_uses_an_exclusive_end_boundary() {
-        let start = Instant::now();
-        let mut schedule = ProbeSchedule::new(start, &negotiated(10_000_000, 20_000_000)).unwrap();
-
-        let first = schedule.preflight_caller_commit(1).unwrap();
-        schedule.commit(first);
-        assert_eq!(
-            schedule.next_send_deadline(),
-            Some(start + Duration::from_millis(10))
-        );
-
-        let second = schedule.preflight_caller_commit(2).unwrap();
-        schedule.commit(second);
-
-        assert!(schedule.is_finished());
-        assert_eq!(schedule.next_send_deadline(), None);
-        assert!(!schedule.permit_probe_at(start + Duration::from_millis(20)));
-    }
-
-    #[test]
-    fn permit_at_exclusive_end_finishes_schedule_without_a_send() {
-        let start = Instant::now();
-        let mut schedule = ProbeSchedule::new(start, &negotiated(10_000_000, 20_000_000)).unwrap();
-
-        assert!(!schedule.permit_probe_at(start + Duration::from_millis(20)));
-        assert!(schedule.is_finished());
-        assert_eq!(schedule.next_send_deadline(), None);
-    }
-
-    #[test]
-    fn managed_preflight_skips_missed_slots_without_mutation() {
-        let start = Instant::now();
-        let schedule = ProbeSchedule::new(start, &negotiated(10_000_000, 0)).unwrap();
-        let sent_at = start + Duration::from_millis(45);
-
-        let commit = schedule.preflight_managed_commit(start, sent_at).unwrap();
-
-        assert_eq!(commit.scheduled_at, start + Duration::from_millis(40));
-        assert_eq!(commit.next_send_at, Some(start + Duration::from_millis(50)));
-        assert_eq!(schedule.next_send_deadline(), Some(start));
-    }
-
-    #[test]
-    fn delayed_managed_commit_does_not_replay_catch_up_slots() {
-        let start = Instant::now();
-        let mut schedule = ProbeSchedule::new(start, &negotiated(10_000_000, 0)).unwrap();
-        let delayed_send = start + Duration::from_millis(45);
-
-        let commit = schedule
-            .preflight_managed_commit(start, delayed_send)
-            .unwrap();
-        schedule.commit(commit);
-
-        assert_eq!(
-            schedule.next_send_deadline(),
-            Some(start + Duration::from_millis(50))
-        );
-        assert!(schedule.next_send_deadline().unwrap() > delayed_send);
-    }
-
-    #[test]
-    fn deadline_arithmetic_overflow_is_detected_before_commit() {
-        let start = Instant::now();
-        let schedule = ProbeSchedule::new(start, &negotiated(2, 0)).unwrap();
-
-        assert!(matches!(
-            schedule.preflight_caller_commit(u64::MAX),
-            Err(ClientError::DurationOverflow)
-        ));
-        assert_eq!(schedule.next_send_deadline(), Some(start));
-    }
-
-    #[test]
-    fn timer_error_is_adapter_owned() {
-        let scheduled_at = Instant::now();
-        let sent_at = scheduled_at + Duration::from_millis(7);
-
-        assert_eq!(
-            instant_abs_diff(sent_at, scheduled_at),
-            Duration::from_millis(7)
-        );
-    }
-}
@@ -1,208 +0,0 @@
-use super::*;
-use crate::socket_options::socket_traffic_class;
-
-#[test]
-#[cfg(not(any(
-    target_os = "fuchsia",
-    target_os = "redox",
-    target_os = "solaris",
-    target_os = "illumos",
-    target_os = "haiku",
-)))]
-fn normal_open_applies_negotiated_traffic_class_after_open_and_close_clears_it() {
-    let mut params = default_params();
-    // Raw wire TOS/Traffic Class byte for DSCP codepoint 46 (EF): a
-    // compliant server echoes back the raw byte it received, unchanged.
-    params.dscp = 184;
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
-        socket.send_to(&reply, peer).unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let mut config = default_test_config(server.addr);
-    config.dscp = 46;
-    let mut client = Client::connect(config).unwrap();
-
-    assert_eq!(
-        socket_traffic_class(&client.socket, client.remote).unwrap() & 0xfc,
-        0
-    );
-    assert_open_started(client.open().unwrap());
-    assert_eq!(
-        socket_traffic_class(&client.socket, client.remote).unwrap() & 0xfc,
-        184
-    );
-
-    client.close().unwrap();
-    assert_eq!(
-        socket_traffic_class(&client.socket, client.remote).unwrap(),
-        0
-    );
-    server.join();
-}
-
-#[test]
-#[cfg(not(any(
-    target_os = "fuchsia",
-    target_os = "redox",
-    target_os = "solaris",
-    target_os = "illumos",
-    target_os = "haiku",
-)))]
-fn normal_open_uses_negotiated_traffic_class_not_requested_dscp() {
-    let mut returned = default_params();
-    returned.dscp = 0;
-    let server = open_success_server(returned);
-
-    let mut config = default_test_config(server.addr);
-    config.dscp = 46;
-    config.negotiation_policy = NegotiationPolicy::Loose;
-    let mut client = Client::connect(config).unwrap();
-
-    let negotiated = assert_open_started(client.open().unwrap());
-    assert_eq!(negotiated.params.dscp, 0);
-    assert_eq!(
-        negotiated.restrictions,
-        vec![crate::NegotiationRestriction::DscpChanged {
-            requested: 46,
-            negotiated: 0,
-        }]
-    );
-    assert_eq!(
-        socket_traffic_class(&client.socket, client.remote).unwrap(),
-        0
-    );
-    server.join();
-}
-
-#[test]
-#[cfg(not(any(
-    target_os = "fuchsia",
-    target_os = "redox",
-    target_os = "solaris",
-    target_os = "illumos",
-    target_os = "haiku",
-)))]
-fn failed_close_send_restores_negotiated_traffic_class_and_keeps_session_open() {
-    let mut params = default_params();
-    // Raw wire TOS/Traffic Class byte for DSCP codepoint 46 (EF).
-    params.dscp = 184;
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
-                peer,
-            )
-            .unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let mut config = default_test_config(server.addr);
-    config.dscp = 46;
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.test_hooks.fail_close_send.set(true);
-
-    let error = client.close().unwrap_err();
-
-    assert!(matches!(error, ClientError::Socket(_)));
-    assert!(client.runtime.is_open());
-    assert!(client.schedule.is_some());
-    assert_eq!(client.applied_traffic_class, Some(184));
-    assert_eq!(
-        socket_traffic_class(&client.socket, client.remote).unwrap() & 0xfc,
-        184
-    );
-    client.close().unwrap();
-    server.join();
-}
-
-#[test]
-fn failed_close_keeps_send_error_primary_when_dscp_restoration_also_fails() {
-    let params = default_params();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
-                peer,
-            )
-            .unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.test_hooks.fail_close_send.set(true);
-    client.test_hooks.fail_dscp_restore.set(true);
-
-    let error = client.close().unwrap_err();
-
-    assert!(matches!(error, ClientError::Socket(_)));
-    assert!(error.to_string().contains("injected close send failure"));
-    assert!(client.runtime.is_open());
-    assert!(client.schedule.is_some());
-    assert_eq!(client.applied_traffic_class, Some(0));
-    client.close().unwrap();
-    server.join();
-}
-
-#[test]
-#[cfg(not(any(
-    target_os = "fuchsia",
-    target_os = "redox",
-    target_os = "solaris",
-    target_os = "illumos",
-    target_os = "haiku",
-)))]
-fn authenticated_peer_close_clears_schedule_and_negotiated_traffic_class() {
-    let mut params = default_params();
-    // Raw wire TOS/Traffic Class byte for DSCP codepoint 46 (EF).
-    params.dscp = 184;
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
-                peer,
-            )
-            .unwrap();
-        let (request, _) = recv_request(&socket, &tx);
-        let seq = u32::from_le_bytes(request[12..16].try_into().unwrap());
-        socket
-            .send_to(
-                &echo_reply_packet_with_flags(
-                    TOKEN,
-                    seq,
-                    &params,
-                    &TimestampFields::default(),
-                    None,
-                    FLAG_REPLY | flags::FLAG_CLOSE,
-                ),
-                peer,
-            )
-            .unwrap();
-    });
-    let mut config = default_test_config(server.addr);
-    config.dscp = 46;
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.send_probe().unwrap();
-
-    let events = client.recv_once().unwrap();
-
-    assert!(matches!(
-        events.as_slice(),
-        [
-            ClientEvent::EchoReply { .. },
-            ClientEvent::SessionClosed { .. }
-        ]
-    ));
-    assert!(client.schedule.is_none());
-    assert_eq!(client.applied_traffic_class, None);
-    assert_eq!(
-        socket_traffic_class(&client.socket, client.remote).unwrap(),
-        0
-    );
-    server.join();
-}
@@ -1,225 +0,0 @@
-use super::*;
-
-#[test]
-fn hmac_open_success() {
-    let key = b"secret".to_vec();
-    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    config.hmac_key = Some(key.clone());
-    let params = params_from_config(&config).unwrap();
-    let server = start_fake_server(move |socket, tx| {
-        let (request, peer) = recv_request(&socket, &tx);
-        verify_packet_hmac(&key, &request).unwrap();
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&key));
-        socket.send_to(&reply, peer).unwrap();
-    });
-    config.server_addr = server.addr.to_string();
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    server.join();
-}
-
-#[test]
-fn hmac_open_ignores_missing_hmac_before_valid_reply() {
-    let key = b"secret".to_vec();
-    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    config.hmac_key = Some(key.clone());
-    let params = params_from_config(&config).unwrap();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let missing = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
-        let valid = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&key));
-        socket.send_to(&missing, peer).unwrap();
-        socket.send_to(&valid, peer).unwrap();
-    });
-    config.server_addr = server.addr.to_string();
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    assert_eq!(server.rx.iter().take(1).count(), 1);
-    assert!(server.rx.try_recv().is_err());
-    server.join();
-}
-
-#[test]
-fn hmac_open_ignores_bad_hmac_before_valid_reply() {
-    let key = b"secret".to_vec();
-    let wrong_key = b"wrong".to_vec();
-    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    config.hmac_key = Some(key.clone());
-    let params = params_from_config(&config).unwrap();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let bad = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&wrong_key));
-        let valid = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&key));
-        socket.send_to(&bad, peer).unwrap();
-        socket.send_to(&valid, peer).unwrap();
-    });
-    config.server_addr = server.addr.to_string();
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    assert_eq!(server.rx.iter().take(1).count(), 1);
-    assert!(server.rx.try_recv().is_err());
-    server.join();
-}
-
-#[test]
-fn post_token_hmac_negotiation_failure_sends_authenticated_cleanup_close() {
-    let key = b"secret".to_vec();
-    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    config.hmac_key = Some(key.clone());
-    let mut returned = params_from_config(&config).unwrap();
-    returned.interval_ns += 1;
-    let server_key = key.clone();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &returned, Some(&server_key));
-        socket.send_to(&reply, peer).unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    config.server_addr = server.addr.to_string();
-    let mut client = Client::connect(config).unwrap();
-
-    assert!(matches!(
-        client.open(),
-        Err(ClientError::NegotiationRejected { .. })
-    ));
-    let packets: Vec<_> = server.rx.iter().take(2).collect();
-    let cleanup = &packets[1];
-    assert_eq!(cleanup[3], flags::FLAG_CLOSE | FLAG_HMAC);
-    verify_packet_hmac(&key, cleanup).unwrap();
-    assert_eq!(
-        u64::from_le_bytes(cleanup[4 + HMAC_SIZE..12 + HMAC_SIZE].try_into().unwrap()),
-        TOKEN
-    );
-    server.join();
-}
-
-#[test]
-fn hmac_close_packet_includes_valid_hmac() {
-    let key = b"secret".to_vec();
-    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    config.hmac_key = Some(key.clone());
-    let params = params_from_config(&config).unwrap();
-    let server_key = key.clone();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&server_key));
-        socket.send_to(&reply, peer).unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    config.server_addr = server.addr.to_string();
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.close().unwrap();
-    let packets: Vec<_> = server.rx.iter().take(2).collect();
-    let close = &packets[1];
-    assert_eq!(close[3], flags::FLAG_CLOSE | FLAG_HMAC);
-    verify_packet_hmac(&key, close).unwrap();
-    assert_eq!(
-        u64::from_le_bytes(close[4 + HMAC_SIZE..12 + HMAC_SIZE].try_into().unwrap()),
-        TOKEN
-    );
-    server.join();
-}
-
-#[test]
-fn bad_hmac_reply_is_dropped() {
-    let key = b"secret".to_vec();
-    let wrong_key = b"wrong".to_vec();
-    let params = default_params();
-    let server_key = key.clone();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&server_key));
-        socket.send_to(&reply, peer).unwrap();
-
-        socket
-            .set_read_timeout(Some(Duration::from_secs(2)))
-            .unwrap();
-        let mut buf = [0_u8; 2048];
-        if let Ok((size, _)) = socket.recv_from(&mut buf) {
-            tx.send(buf[..size].to_vec()).unwrap();
-            let seq = u32::from_le_bytes(
-                buf[4 + HMAC_SIZE + 8..4 + HMAC_SIZE + 12]
-                    .try_into()
-                    .unwrap(),
-            );
-            let ts = TimestampFields::default();
-            let reply_packet = echo_reply_packet_with_flags(
-                TOKEN,
-                seq,
-                &params,
-                &ts,
-                Some(&wrong_key),
-                FLAG_REPLY | flags::FLAG_CLOSE,
-            );
-            socket.send_to(&reply_packet, peer).unwrap();
-        }
-    });
-    let config = ClientConfig {
-        hmac_key: Some(key),
-        socket_config: crate::SocketConfig {
-            recv_timeout: Some(Duration::from_millis(200)),
-            ..Default::default()
-        },
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.send_probe().unwrap();
-    thread::sleep(Duration::from_millis(30));
-    let events = client.recv_once().unwrap();
-    assert_eq!(events.len(), 1);
-    assert!(matches!(&events[0], ClientEvent::Warning { .. }));
-    assert!(!client.is_peer_closed());
-    client.close().unwrap();
-    server.join();
-}
-
-#[test]
-fn hmac_echo_request_reply_works() {
-    let key = b"testkey".to_vec();
-    let params = default_params();
-    let server_key = key.clone();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&server_key));
-        socket.send_to(&reply, peer).unwrap();
-
-        socket
-            .set_read_timeout(Some(Duration::from_secs(2)))
-            .unwrap();
-        let mut buf = [0_u8; 2048];
-        if let Ok((size, _)) = socket.recv_from(&mut buf) {
-            tx.send(buf[..size].to_vec()).unwrap();
-            verify_packet_hmac(&server_key, &buf[..size]).unwrap();
-            let seq = u32::from_le_bytes(
-                buf[4 + HMAC_SIZE + 8..4 + HMAC_SIZE + 12]
-                    .try_into()
-                    .unwrap(),
-            );
-            let ts = TimestampFields {
-                recv_mono: Some(100),
-                send_mono: Some(200),
-                ..Default::default()
-            };
-            let reply_packet = echo_reply_packet(TOKEN, seq, &params, &ts, Some(&server_key));
-            socket.send_to(&reply_packet, peer).unwrap();
-        }
-    });
-    let config = ClientConfig {
-        hmac_key: Some(key),
-        socket_config: crate::SocketConfig {
-            recv_timeout: Some(Duration::from_millis(200)),
-            ..Default::default()
-        },
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.send_probe().unwrap();
-    thread::sleep(Duration::from_millis(50));
-    let events = client.recv_once().unwrap();
-    assert_eq!(events.len(), 1);
-    assert!(matches!(&events[0], ClientEvent::EchoReply { .. }));
-    server.join();
-}
@@ -1,21 +0,0 @@
-use super::*;
-use crate::config::{NegotiationPolicy, DEFAULT_OPEN_TIMEOUTS};
-use irtt_proto::{
-    flags::FLAG_HMAC, flags::FLAG_OPEN, flags::FLAG_REPLY, verify_packet_hmac, Clock,
-    ReceivedStats, StampAt, HMAC_SIZE, MAGIC,
-};
-use std::{thread, time::SystemTime};
-
-mod support;
-use support::*;
-
-mod close;
-mod config;
-mod dscp;
-mod hmac;
-mod negotiation;
-mod no_test;
-mod open;
-mod probes_replies;
-mod sequence;
-mod ttl;
@@ -1,289 +0,0 @@
-use super::*;
-use crate::NegotiationRestriction;
-
-fn assert_negotiates(
-    requested: &Params,
-    returned: &Params,
-    policy: NegotiationPolicy,
-) -> NegotiatedParams {
-    negotiate_params(requested, returned.clone(), policy)
-        .unwrap_or_else(|err| panic!("expected negotiation success, got {err:?}"))
-}
-
-fn rejection_reason(requested: &Params, returned: &Params, policy: NegotiationPolicy) -> String {
-    match negotiate_params(requested, returned.clone(), policy) {
-        Err(ClientError::NegotiationRejected { reason }) => reason,
-        other => panic!("expected negotiation rejection, got {other:?}"),
-    }
-}
-
-#[test]
-fn strict_negotiation_accepts_identical_params() {
-    let config = ClientConfig::default();
-    let params = params_from_config(&config).unwrap();
-    let negotiated = assert_negotiates(&params, &params, NegotiationPolicy::Strict);
-    assert_eq!(negotiated.params, params);
-    assert!(negotiated.restrictions.is_empty());
-}
-
-#[test]
-fn strict_negotiation_rejects_changed_params() {
-    let config = ClientConfig {
-        dscp: 46,
-        ..ClientConfig::default()
-    };
-    let requested = params_from_config(&config).unwrap();
-    assert_eq!(
-        requested.dscp, 184,
-        "codepoint 46 must become raw wire byte 184"
-    );
-    let mut returned = requested.clone();
-    returned.dscp = 0;
-    assert_eq!(
-        rejection_reason(&requested, &returned, NegotiationPolicy::Strict),
-        NegotiationRestriction::DscpChanged {
-            requested: 46,
-            negotiated: 0,
-        }
-        .message()
-    );
-}
-
-#[test]
-fn loose_negotiation_accepts_server_restricted_params() {
-    let config = ClientConfig::default();
-    let mut requested = params_from_config(&config).unwrap();
-    requested.length = 128;
-    let mut returned = requested.clone();
-    returned.duration_ns /= 2;
-    returned.length = 0;
-    let negotiated = assert_negotiates(&requested, &returned, NegotiationPolicy::Loose);
-    assert_eq!(
-        negotiated.restrictions,
-        vec![
-            NegotiationRestriction::DurationReduced {
-                requested_ns: requested.duration_ns,
-                negotiated_ns: returned.duration_ns,
-            },
-            NegotiationRestriction::LengthReduced {
-                requested: requested.length,
-                negotiated: returned.length,
-            },
-        ]
-    );
-}
-
-#[test]
-fn loose_negotiation_rejects_non_positive_returned_interval() {
-    let config = ClientConfig::default();
-    let requested = params_from_config(&config).unwrap();
-
-    for interval_ns in [0, -1] {
-        let mut returned = requested.clone();
-        returned.interval_ns = interval_ns;
-        assert_eq!(
-            rejection_reason(&requested, &returned, NegotiationPolicy::Loose),
-            "interval must be positive"
-        );
-    }
-}
-
-#[test]
-fn loose_negotiation_accepts_documented_duration_combinations() {
-    let finite_config = ClientConfig::default();
-    let requested_finite = params_from_config(&finite_config).unwrap();
-
-    let returned_same_finite = requested_finite.clone();
-    assert!(assert_negotiates(
-        &requested_finite,
-        &returned_same_finite,
-        NegotiationPolicy::Loose
-    )
-    .restrictions
-    .is_empty());
-
-    let mut returned_shorter_finite = requested_finite.clone();
-    returned_shorter_finite.duration_ns /= 2;
-    assert_eq!(
-        assert_negotiates(
-            &requested_finite,
-            &returned_shorter_finite,
-            NegotiationPolicy::Loose
-        )
-        .restrictions,
-        vec![NegotiationRestriction::DurationReduced {
-            requested_ns: requested_finite.duration_ns,
-            negotiated_ns: returned_shorter_finite.duration_ns,
-        }]
-    );
-
-    let continuous_config = ClientConfig {
-        duration: None,
-        ..ClientConfig::default()
-    };
-    let requested_continuous = params_from_config(&continuous_config).unwrap();
-
-    let returned_continuous = requested_continuous.clone();
-    assert!(assert_negotiates(
-        &requested_continuous,
-        &returned_continuous,
-        NegotiationPolicy::Loose
-    )
-    .restrictions
-    .is_empty());
-
-    let mut returned_finite = requested_continuous.clone();
-    returned_finite.duration_ns = 1_000_000_000;
-    assert_eq!(
-        assert_negotiates(
-            &requested_continuous,
-            &returned_finite,
-            NegotiationPolicy::Loose
-        )
-        .restrictions,
-        vec![NegotiationRestriction::DurationReduced {
-            requested_ns: requested_continuous.duration_ns,
-            negotiated_ns: returned_finite.duration_ns,
-        }]
-    );
-}
-
-#[test]
-fn loose_negotiation_rejects_finite_request_returned_continuous() {
-    let config = ClientConfig::default();
-    let requested = params_from_config(&config).unwrap();
-    let mut returned = requested.clone();
-    returned.duration_ns = 0;
-
-    assert_eq!(
-        rejection_reason(&requested, &returned, NegotiationPolicy::Loose),
-        "server returned continuous duration for finite request"
-    );
-}
-
-#[test]
-fn loose_negotiation_rejects_negative_returned_length() {
-    let config = ClientConfig::default();
-    let requested = params_from_config(&config).unwrap();
-    let mut returned = requested.clone();
-    returned.length = -1;
-    assert_eq!(
-        rejection_reason(&requested, &returned, NegotiationPolicy::Loose),
-        "length must be non-negative"
-    );
-}
-
-#[test]
-fn strict_negotiation_rejects_negative_returned_length() {
-    let config = ClientConfig::default();
-    let requested = params_from_config(&config).unwrap();
-    let mut returned = requested.clone();
-    returned.length = -1;
-    assert_eq!(
-        rejection_reason(&requested, &returned, NegotiationPolicy::Strict),
-        "length must be non-negative"
-    );
-}
-
-#[test]
-fn loose_negotiation_rejects_runtime_invalid_returned_dscp() {
-    let config = ClientConfig {
-        dscp: 46,
-        ..ClientConfig::default()
-    };
-    let requested = params_from_config(&config).unwrap();
-    assert_eq!(
-        requested.dscp, 184,
-        "codepoint 46 must become raw wire byte 184"
-    );
-
-    for dscp in [-1, 256] {
-        let mut returned = requested.clone();
-        returned.dscp = dscp;
-        assert_eq!(
-            rejection_reason(&requested, &returned, NegotiationPolicy::Loose),
-            "dscp must be in range 0..=255"
-        );
-    }
-
-    // A raw returned value of 184 must be accepted even though it exceeds the
-    // 0..=63 codepoint range; it is the correctly negotiated wire value for
-    // codepoint 46 and is not subject to the codepoint bound at all.
-    let returned = requested.clone();
-    assert!(
-        assert_negotiates(&requested, &returned, NegotiationPolicy::Loose)
-            .restrictions
-            .is_empty()
-    );
-}
-
-#[test]
-fn loose_negotiation_records_dscp_disabled_by_server() {
-    let config = ClientConfig {
-        dscp: 46,
-        ..ClientConfig::default()
-    };
-    let requested = params_from_config(&config).unwrap();
-    let mut returned = requested.clone();
-    returned.dscp = 0;
-
-    let negotiated = assert_negotiates(&requested, &returned, NegotiationPolicy::Loose);
-
-    assert_eq!(
-        negotiated.restrictions,
-        vec![NegotiationRestriction::DscpChanged {
-            requested: 46,
-            negotiated: 0,
-        }]
-    );
-}
-
-#[test]
-fn strict_negotiation_rejects_dscp_disabled_by_server_as_specific_restriction() {
-    let config = ClientConfig {
-        dscp: 46,
-        ..ClientConfig::default()
-    };
-    let requested = params_from_config(&config).unwrap();
-    let mut returned = requested.clone();
-    returned.dscp = 0;
-
-    assert_eq!(
-        rejection_reason(&requested, &returned, NegotiationPolicy::Strict),
-        NegotiationRestriction::DscpChanged {
-            requested: 46,
-            negotiated: 0,
-        }
-        .message()
-    );
-}
-
-#[test]
-fn negotiation_rejects_unsupported_dscp_changes() {
-    let config = ClientConfig {
-        dscp: 46,
-        ..ClientConfig::default()
-    };
-    let requested = params_from_config(&config).unwrap();
-    let mut returned = requested.clone();
-    returned.dscp = 8;
-
-    assert_eq!(
-        rejection_reason(&requested, &returned, NegotiationPolicy::Loose),
-        "server returned unsupported DSCP change"
-    );
-    assert_eq!(
-        rejection_reason(&requested, &returned, NegotiationPolicy::Strict),
-        "server returned unsupported DSCP change"
-    );
-
-    let zero_config = ClientConfig::default();
-    let zero_requested = params_from_config(&zero_config).unwrap();
-    let mut returned = zero_requested.clone();
-    returned.dscp = 46;
-
-    assert_eq!(
-        rejection_reason(&zero_requested, &returned, NegotiationPolicy::Loose),
-        "server returned unsupported DSCP change"
-    );
-}
@@ -1,522 +0,0 @@
-use super::*;
-
-#[test]
-fn successful_open_handshake() {
-    let config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    let params = params_from_config(&config).unwrap();
-    let server = open_success_server(params.clone());
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-
-    let negotiated = assert_open_started(client.open().unwrap());
-    assert_eq!(negotiated.params, params);
-    assert!(client.schedule.is_some());
-    assert_eq!(client.applied_traffic_class, Some(0));
-    server.join();
-}
-
-#[test]
-fn successful_open_restores_configured_receive_timeout() {
-    let config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    let params = params_from_config(&config).unwrap();
-    let server = open_success_server(params);
-    let mut config = default_test_config(server.addr);
-    config.socket_config.recv_timeout = Some(Duration::from_millis(75));
-    let mut client = Client::connect(config).unwrap();
-
-    assert_open_started(client.open().unwrap());
-
-    assert_eq!(
-        client.test_hooks.last_restored_read_timeout.get(),
-        Some(Duration::from_millis(75))
-    );
-    server.join();
-}
-
-#[test]
-fn open_fails_when_already_open() {
-    let config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    let params = params_from_config(&config).unwrap();
-    let server = open_success_server(params);
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    assert_open_started(client.open().unwrap());
-    assert!(matches!(client.open(), Err(ClientError::AlreadyOpen)));
-    server.join();
-}
-
-#[test]
-fn open_retries_after_first_timeout() {
-    let server = start_fake_server(|socket, tx| {
-        let (first, _) = recv_request(&socket, &tx);
-        let (_, peer) = recv_request(&socket, &tx);
-        let params = Params::decode(&first[4..]).unwrap();
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
-        assert_eq!(first[3] & FLAG_OPEN, FLAG_OPEN);
-        socket.send_to(&reply, peer).unwrap();
-    });
-    let config = ClientConfig {
-        open_timeouts: vec![Duration::from_millis(200), Duration::from_millis(500)],
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    let outcome = client.open().unwrap();
-    assert_open_started(outcome);
-    assert_eq!(server.rx.iter().take(2).count(), 2);
-    server.join();
-}
-
-#[test]
-fn open_survives_interrupted_receive_within_same_attempt() {
-    let server = start_fake_server(|socket, tx| {
-        let (first, peer) = recv_request(&socket, &tx);
-        let params = Params::decode(&first[4..]).unwrap();
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
-        socket.send_to(&reply, peer).unwrap();
-    });
-    let config = ClientConfig {
-        open_timeouts: vec![Duration::from_millis(500)],
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    // Several interrupted receive attempts before the real reply arrives
-    // must not be treated as a timeout, must not retransmit the open
-    // request, and must not advance to a next configured attempt.
-    client.test_hooks.inject_recv_interrupted.set(5);
-
-    let outcome = client.open().unwrap();
-    assert_open_started(outcome);
-    // Exactly one request reached the server: interruptions were absorbed
-    // inside the single configured attempt.
-    assert_eq!(server.rx.iter().take(1).count(), 1);
-    server.join();
-}
-
-#[test]
-fn open_interrupted_receive_does_not_extend_the_attempt_deadline() {
-    // A fake server that never replies: with a short attempt timeout, the
-    // real question is whether interruptions can push the effective wait
-    // past the configured deadline. They must not: the deadline stays
-    // absolute across any number of interruptions.
-    let server = start_fake_server(|socket, tx| {
-        let _ = recv_request(&socket, &tx);
-    });
-    let config = ClientConfig {
-        open_timeouts: vec![Duration::from_millis(200)],
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    // Each interruption carries no timing information of its own, so the
-    // loop must keep re-checking the real deadline rather than treating an
-    // interruption as "more time available" or a reason to fail outright.
-    client.test_hooks.inject_recv_interrupted.set(20);
-
-    let started = Instant::now();
-    let result = client.open();
-    let elapsed = started.elapsed();
-
-    assert!(matches!(result, Err(ClientError::OpenTimeout)));
-    assert!(
-        elapsed < Duration::from_millis(800),
-        "interrupted receives must not extend the attempt deadline, took {elapsed:?}"
-    );
-    server.join();
-}
-
-#[test]
-fn open_timeout_after_all_timeouts() {
-    let server = timeout_server(Duration::from_millis(700));
-    let config = ClientConfig {
-        open_timeouts: vec![Duration::from_millis(200), Duration::from_millis(200)],
-        socket_config: crate::SocketConfig {
-            recv_timeout: Some(Duration::from_millis(50)),
-            ..Default::default()
-        },
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert!(matches!(client.open(), Err(ClientError::OpenTimeout)));
-    assert_eq!(server.rx.iter().take(2).count(), 2);
-    assert_eq!(
-        client.test_hooks.last_restored_read_timeout.get(),
-        Some(Duration::from_millis(50))
-    );
-    server.join();
-}
-
-#[test]
-fn protocol_version_mismatch_fails() {
-    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    config.negotiation_policy = NegotiationPolicy::Loose;
-    let mut params = params_from_config(&config).unwrap();
-    params.protocol_version = 2;
-    let server = open_success_server(params);
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    assert!(matches!(
-        client.open(),
-        Err(ClientError::ProtocolVersionMismatch { received: 2, .. })
-    ));
-    assert_eq!(server.rx.iter().take(1).count(), 1);
-    assert!(client.runtime.prepare_open_request().is_ok());
-    server.join();
-}
-
-#[test]
-fn server_rejection_fails_in_normal_mode() {
-    let config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    let params = params_from_config(&config).unwrap();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY | flags::FLAG_CLOSE, 0, &params, None);
-        socket.send_to(&reply, peer).unwrap();
-    });
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    assert!(matches!(client.open(), Err(ClientError::ServerRejected)));
-    assert_eq!(server.rx.iter().take(1).count(), 1);
-    assert!(client.runtime.prepare_open_request().is_ok());
-    server.join();
-}
-
-#[test]
-fn multiple_untrusted_datagrams_before_valid_reply_use_one_attempt() {
-    let params = default_params();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let valid = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
-        let mut wrong_type = valid.clone();
-        wrong_type[3] = FLAG_REPLY;
-        let mut reserved_flags = valid.clone();
-        reserved_flags[3] |= 0x10;
-        let mut bad_magic = valid.clone();
-        bad_magic[0] ^= 0xff;
-        let unexpected_hmac =
-            open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(b"unexpected"));
-
-        for packet in [
-            vec![0_u8],
-            bad_magic,
-            wrong_type,
-            reserved_flags,
-            unexpected_hmac,
-            valid,
-        ] {
-            socket.send_to(&packet, peer).unwrap();
-        }
-    });
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-
-    assert_open_started(client.open().unwrap());
-    assert_eq!(server.rx.iter().take(1).count(), 1);
-    assert!(server.rx.try_recv().is_err());
-    assert!(client.schedule.is_some());
-    server.join();
-}
-
-#[test]
-fn ignored_datagrams_do_not_restart_the_attempt_deadline() {
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        thread::sleep(Duration::from_millis(150));
-        socket.send_to(&[0_u8], peer).unwrap();
-        thread::sleep(Duration::from_millis(150));
-        socket.send_to(&[0_u8], peer).unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let config = ClientConfig {
-        open_timeouts: vec![Duration::from_millis(250), Duration::from_millis(250)],
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    let started = Instant::now();
-
-    assert!(matches!(client.open(), Err(ClientError::OpenTimeout)));
-    let requests: Vec<_> = server.rx.iter().take(2).collect();
-    assert_eq!(requests.len(), 2);
-    assert!(
-        started.elapsed() < Duration::from_millis(700),
-        "ignored datagrams restarted an attempt deadline"
-    );
-    server.join();
-}
-
-#[test]
-fn only_ignored_open_datagrams_eventually_time_out() {
-    let server = start_fake_server(move |socket, tx| {
-        for _ in 0..2 {
-            let (_, peer) = recv_request(&socket, &tx);
-            socket.send_to(&[0_u8], peer).unwrap();
-            socket.send_to(&MAGIC, peer).unwrap();
-        }
-        thread::sleep(Duration::from_millis(300));
-    });
-    let config = ClientConfig {
-        open_timeouts: vec![Duration::from_millis(200), Duration::from_millis(200)],
-        socket_config: crate::SocketConfig {
-            recv_timeout: Some(Duration::from_millis(50)),
-            ..Default::default()
-        },
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-
-    assert!(matches!(client.open(), Err(ClientError::OpenTimeout)));
-    assert_eq!(server.rx.iter().take(2).count(), 2);
-    assert!(server.rx.try_recv().is_err());
-    assert_eq!(
-        client.test_hooks.last_restored_read_timeout.get(),
-        Some(Duration::from_millis(50))
-    );
-    server.join();
-}
-
-#[test]
-fn trusted_zero_token_normal_reply_is_terminal() {
-    let params = default_params();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        // encode_open_reply rejects a zero token without FLAG_CLOSE, so this
-        // deliberately non-compliant reply is built by encoding a normal
-        // reply with a placeholder token and then zeroing the token field.
-        let mut reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
-        reply[HMAC_OFFSET..HMAC_OFFSET + 8].copy_from_slice(&0_u64.to_le_bytes());
-        socket.send_to(&reply, peer).unwrap();
-    });
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-
-    assert!(matches!(
-        client.open(),
-        Err(ClientError::Protocol(irtt_proto::ProtoError::ZeroToken))
-    ));
-    assert_eq!(server.rx.iter().take(1).count(), 1);
-    assert!(client.runtime.prepare_open_request().is_ok());
-    assert!(client.schedule.is_none());
-    server.join();
-}
-
-#[test]
-fn opening_deadline_overflow_occurs_before_send() {
-    let server = timeout_server(Duration::from_millis(250));
-    let config = ClientConfig {
-        open_timeouts: vec![Duration::MAX],
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-
-    assert!(matches!(client.open(), Err(ClientError::DurationOverflow)));
-    assert!(server.rx.try_recv().is_err());
-    server.join();
-}
-
-#[test]
-fn schedule_duration_overflow_cannot_partially_open() {
-    let server = start_fake_server(|_socket, _tx| {});
-    let client = Client::connect(default_test_config(server.addr)).unwrap();
-    let reply = irtt_proto::OpenReply {
-        flags: FLAG_OPEN | FLAG_REPLY,
-        token: TOKEN,
-        params: params_from_config(client.runtime.config()).unwrap(),
-    };
-    let mut latest = Instant::now();
-    let mut step = Duration::MAX;
-    while !step.is_zero() {
-        if let Some(candidate) = latest.checked_add(step) {
-            latest = candidate;
-        }
-        step /= 2;
-    }
-    let opened_at = ClientTimestamp {
-        mono: latest,
-        wall: SystemTime::now(),
-    };
-    let machine = client
-        .runtime
-        .prepare_open_acceptance(reply, opened_at)
-        .unwrap();
-    let previous_recv_len = client.recv_buffer.len();
-
-    let failure = client.prepare_client_open(machine, opened_at).unwrap_err();
-
-    assert!(matches!(
-        failure.primary,
-        ClientError::NegotiationRejected { .. }
-    ));
-    assert!(failure.machine.cleanup_close_packet().is_some());
-    assert!(client.runtime.prepare_open_request().is_ok());
-    assert!(client.schedule.is_none());
-    assert_eq!(client.applied_traffic_class, None);
-    assert_eq!(client.recv_buffer.len(), previous_recv_len);
-    server.join();
-}
-
-#[test]
-fn post_token_negotiation_failure_sends_cleanup_close() {
-    let mut returned = default_params();
-    returned.interval_ns += 1;
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &returned, None),
-                peer,
-            )
-            .unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-
-    assert!(matches!(
-        client.open(),
-        Err(ClientError::NegotiationRejected { .. })
-    ));
-    let packets: Vec<_> = server.rx.iter().take(2).collect();
-    assert_eq!(packets[1][3], flags::FLAG_CLOSE);
-    assert_eq!(
-        u64::from_le_bytes(packets[1][4..12].try_into().unwrap()),
-        TOKEN
-    );
-    assert!(client.runtime.prepare_open_request().is_ok());
-    server.join();
-}
-
-#[test]
-fn cleanup_send_failure_does_not_replace_primary_open_error() {
-    let mut returned = default_params();
-    returned.interval_ns += 1;
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &returned, None),
-                peer,
-            )
-            .unwrap();
-    });
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    client.test_hooks.fail_cleanup_send.set(true);
-
-    assert!(matches!(
-        client.open(),
-        Err(ClientError::NegotiationRejected { .. })
-    ));
-    assert!(client.runtime.prepare_open_request().is_ok());
-    server.join();
-}
-
-#[test]
-fn receive_buffer_reservation_failure_precedes_dscp_application() {
-    let mut returned = default_params();
-    // Raw wire TOS/Traffic Class byte for DSCP codepoint 46 (EF), matching
-    // what the client below requests so negotiation succeeds unchanged.
-    returned.dscp = 184;
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &returned, None),
-                peer,
-            )
-            .unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let mut config = default_test_config(server.addr);
-    config.dscp = 46;
-    let mut client = Client::connect(config).unwrap();
-    client
-        .test_hooks
-        .recv_buffer_len_override
-        .set(Some(usize::MAX));
-    client.test_hooks.fail_open_dscp.set(true);
-
-    assert!(matches!(
-        client.open(),
-        Err(ClientError::AllocationFailed {
-            operation: "negotiated receive buffer",
-            ..
-        })
-    ));
-    assert!(client.test_hooks.fail_open_dscp.get());
-    assert!(client.runtime.prepare_open_request().is_ok());
-    assert!(client.schedule.is_none());
-    assert_eq!(client.applied_traffic_class, None);
-    server.join();
-}
-
-#[test]
-fn dscp_application_failure_leaves_machine_connected() {
-    let params = default_params();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
-                peer,
-            )
-            .unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    client.test_hooks.fail_open_dscp.set(true);
-
-    assert!(matches!(
-        client.open(),
-        Err(ClientError::SocketOption {
-            operation: "set negotiated DSCP",
-            ..
-        })
-    ));
-    assert!(client.test_hooks.prepared_active_session_before_dscp.get());
-    assert!(client.runtime.prepare_open_request().is_ok());
-    assert!(client.schedule.is_none());
-    assert_eq!(client.applied_traffic_class, None);
-    server.join();
-}
-
-#[test]
-fn read_timeout_restoration_failure_leaves_machine_connected() {
-    let params = default_params();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
-                peer,
-            )
-            .unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    client.test_hooks.fail_open_timeout_restore.set(true);
-
-    assert!(matches!(
-        client.open(),
-        Err(ClientError::ReadTimeoutRestore { .. })
-    ));
-    assert!(client.runtime.prepare_open_request().is_ok());
-    assert!(client.schedule.is_none());
-    assert_eq!(client.applied_traffic_class, None);
-    server.join();
-}
-
-#[test]
-fn dscp_rollback_failure_keeps_timeout_restoration_primary() {
-    let params = default_params();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
-                peer,
-            )
-            .unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    client.test_hooks.fail_open_timeout_restore.set(true);
-    client.test_hooks.fail_dscp_restore.set(true);
-
-    let error = client.open().unwrap_err();
-
-    assert!(matches!(error, ClientError::ReadTimeoutRestore { .. }));
-    assert!(client.runtime.prepare_open_request().is_ok());
-    assert!(client.schedule.is_none());
-    assert_eq!(client.applied_traffic_class, None);
-    server.join();
-}
@@ -1,80 +0,0 @@
-use super::*;
-
-/// An interrupted receive (`io::ErrorKind::Interrupted`, e.g. `EINTR`) must be
-/// invisible to the caller: retried transparently, with the eventual reply
-/// classified exactly as if no interruption had occurred.
-#[test]
-fn interrupted_receive_is_retried_and_the_reply_is_still_classified() {
-    let params = default_params();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
-        socket.send_to(&reply, peer).unwrap();
-
-        let mut buf = [0_u8; 2048];
-        let (size, _) = socket.recv_from(&mut buf).unwrap();
-        let seq = u32::from_le_bytes(buf[12..16].try_into().unwrap());
-        let _ = size;
-        let ts = TimestampFields::default();
-        let reply_packet = echo_reply_packet(TOKEN, seq, &params, &ts, None);
-        socket.send_to(&reply_packet, peer).unwrap();
-    });
-    let config = ClientConfig {
-        socket_config: crate::SocketConfig {
-            recv_timeout: Some(Duration::from_secs(2)),
-            ..Default::default()
-        },
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-
-    client.send_probe().unwrap();
-    thread::sleep(Duration::from_millis(50));
-
-    client.test_hooks.inject_recv_interrupted.set(10);
-    let events = client.recv_once().unwrap();
-
-    assert_eq!(events.len(), 1);
-    assert!(
-        matches!(&events[0], ClientEvent::EchoReply { seq: 0, .. }),
-        "expected a normal EchoReply despite interrupted receive attempts, got {:?}",
-        events[0]
-    );
-
-    client.close().unwrap();
-    server.join();
-}
-
-/// One logical receive keeps one timeout budget: repeated interruptions must
-/// not extend a `recv_once` call past its configured receive timeout.
-#[test]
-fn interrupted_receive_does_not_extend_the_configured_timeout() {
-    let params = default_params();
-    let server = silent_open_server(params);
-    let config = ClientConfig {
-        socket_config: crate::SocketConfig {
-            recv_timeout: Some(Duration::from_millis(100)),
-            ..Default::default()
-        },
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-
-    // No reply is ever coming; only interrupted attempts occur before the
-    // real socket takes over and legitimately times out.
-    client.test_hooks.inject_recv_interrupted.set(20);
-    let started = Instant::now();
-    let events = client.recv_once().unwrap();
-    let elapsed = started.elapsed();
-
-    assert!(events.is_empty());
-    assert!(
-        elapsed < Duration::from_millis(500),
-        "interrupted receives must not extend the configured receive timeout, took {elapsed:?}"
-    );
-
-    client.close().unwrap();
-    server.join();
-}
@@ -1,487 +0,0 @@
-use super::*;
-
-fn probe_timestamps(permission_at: Instant, sent_at: ClientTimestamp) -> ProbeSendTimestamps {
-    ProbeSendTimestamps {
-        permission_at,
-        send_anchor: sent_at,
-        sent_at,
-        send_call_start: sent_at.mono,
-        send_finished_at: sent_at.mono,
-    }
-}
-
-#[test]
-fn send_probe_fails_before_open() {
-    let server = start_fake_server(|_socket, _tx| {});
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    assert!(matches!(client.send_probe(), Err(ClientError::NotOpen)));
-    server.join();
-}
-
-#[test]
-fn send_probe_sends_valid_echo_request() {
-    let params = default_params();
-    let server = silent_open_server(params.clone());
-    let config = ClientConfig {
-        socket_config: crate::SocketConfig {
-            recv_timeout: Some(Duration::from_millis(200)),
-            ..Default::default()
-        },
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert!(client.next_send_deadline().is_none());
-    assert_open_started(client.open().unwrap());
-    let events = client.send_probe().unwrap();
-    assert_eq!(events.len(), 1);
-    match &events[0] {
-        ClientEvent::EchoSent {
-            seq, remote, bytes, ..
-        } => {
-            assert_eq!(*seq, 0);
-            assert_eq!(*remote, server.addr);
-            assert_eq!(*bytes, echo_packet_len(false, &params));
-        }
-        other => panic!("expected EchoSent, got {other:?}"),
-    }
-    thread::sleep(Duration::from_millis(30));
-    let packets: Vec<_> = server.rx.try_iter().collect();
-    let echo_reqs: Vec<_> = packets
-        .iter()
-        .filter(|p| p.len() >= 4 && p[3] & FLAG_OPEN == 0)
-        .collect();
-    let echo_req = echo_reqs.first().unwrap();
-    assert_eq!(&echo_req[..3], &MAGIC);
-    assert_eq!(echo_req[3], 0x00);
-    let req_token = u64::from_le_bytes(echo_req[4..12].try_into().unwrap());
-    assert_eq!(req_token, TOKEN);
-    let seq = u32::from_le_bytes(echo_req[12..16].try_into().unwrap());
-    assert_eq!(seq, 0);
-    client.close().unwrap();
-    server.join();
-}
-
-#[test]
-fn blocking_short_probe_commits_before_presentation_length_error() {
-    let params = default_params();
-    let server = silent_open_server(params.clone());
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    assert_open_started(client.open().unwrap());
-
-    let expected = echo_packet_len(false, &params);
-    let initial_deadline = client.next_send_deadline().unwrap();
-    client.probe_reported_len = Some(expected - 1);
-
-    assert!(matches!(
-        client.send_probe(),
-        Err(ClientError::DatagramLengthMismatch {
-            expected: error_expected,
-            actual,
-        }) if error_expected == expected && actual + 1 == expected
-    ));
-    assert_eq!(client.runtime.packets_sent(), 1);
-    assert_eq!(
-        client.next_send_deadline(),
-        Some(initial_deadline + client.runtime.config().interval)
-    );
-
-    client.close().unwrap();
-    server.join();
-}
-
-#[test]
-fn blocking_failed_probe_send_preserves_machine_and_schedule() {
-    let params = default_params();
-    let server = silent_open_server(params);
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    assert_open_started(client.open().unwrap());
-
-    let initial_deadline = client.next_send_deadline().unwrap();
-    client.probe_send_error = true;
-
-    assert!(matches!(client.send_probe(), Err(ClientError::Socket(_))));
-    assert_eq!(client.runtime.packets_sent(), 0);
-    assert_eq!(client.next_send_deadline(), Some(initial_deadline));
-
-    assert!(matches!(
-        client.send_probe().unwrap().as_slice(),
-        [ClientEvent::EchoSent { seq: 0, .. }]
-    ));
-
-    client.close().unwrap();
-    server.join();
-}
-
-#[test]
-fn blocking_timeout_finalization_overflow_does_not_send_or_commit() {
-    let params = default_params();
-    let server = silent_open_server(params);
-    let config = ClientConfig {
-        probe_timeout: Duration::MAX,
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-
-    let initial_deadline = client.next_send_deadline().unwrap();
-    let sent_at = ClientTimestamp {
-        mono: Instant::now(),
-        wall: SystemTime::now(),
-    };
-
-    assert!(matches!(
-        client.send_probe_at(probe_timestamps(initial_deadline, sent_at)),
-        Err(ClientError::DurationOverflow)
-    ));
-    assert_eq!(client.runtime.packets_sent(), 0);
-    assert_eq!(client.next_send_deadline(), Some(initial_deadline));
-    thread::sleep(Duration::from_millis(30));
-    assert!(server
-        .rx
-        .try_iter()
-        .all(|packet| packet.len() >= 4 && packet[3] & FLAG_OPEN != 0));
-
-    client.close().unwrap();
-    server.join();
-}
-
-#[test]
-fn blocking_probe_separates_permission_committed_send_and_send_call_timing() {
-    let duration = Duration::from_secs(1);
-    let interval = Duration::from_millis(100);
-    let params = Params {
-        duration_ns: 1_000_000_000,
-        interval_ns: 100_000_000,
-        ..default_params()
-    };
-    let server = silent_open_server(params.clone());
-    let config = ClientConfig {
-        duration: Some(duration),
-        interval,
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-
-    let opened_mono = Instant::now()
-        .checked_sub(Duration::from_secs(2))
-        .expect("test host monotonic clock has at least two seconds of history");
-    client.schedule = Some(
-        ProbeSchedule::new(
-            opened_mono,
-            &NegotiatedParams {
-                params,
-                restrictions: Vec::new(),
-            },
-        )
-        .unwrap(),
-    );
-    let permission_at = opened_mono + Duration::from_millis(500);
-    // Distinct pre-send anchor and post-send `sent_at`: the anchor drives
-    // the operational timeout deadline, while `sent_at` (captured after the
-    // send call) is the public measurement/timer_error endpoint. They are
-    // deliberately decoupled by this PR.
-    let send_anchor = ClientTimestamp {
-        wall: SystemTime::now(),
-        mono: opened_mono + Duration::from_millis(525),
-    };
-    let sent_at = ClientTimestamp {
-        wall: SystemTime::now(),
-        mono: opened_mono + Duration::from_millis(534),
-    };
-    let timestamps = ProbeSendTimestamps {
-        permission_at,
-        send_anchor,
-        sent_at,
-        send_call_start: opened_mono + Duration::from_millis(526),
-        send_finished_at: opened_mono + Duration::from_millis(533),
-    };
-
-    let events = client.send_probe_at(timestamps).unwrap();
-
-    assert!(matches!(
-        events.as_slice(),
-        [ClientEvent::EchoSent {
-            scheduled_at,
-            sent_at: event_sent_at,
-            send_call,
-            timer_error,
-            ..
-        }] if *scheduled_at == opened_mono
-            && *event_sent_at == sent_at
-            && *send_call == Duration::from_millis(7)
-            && *timer_error == Duration::from_millis(534)
-    ));
-    assert_eq!(client.next_send_deadline(), Some(opened_mono + interval));
-    assert_eq!(client.runtime.packets_sent(), 1);
-    // The timeout deadline is anchored to the pre-send `send_anchor`, not
-    // to the post-send `sent_at` captured 9ms later.
-    let timeout_at = send_anchor.mono + client.probe_timeout();
-    assert_ne!(timeout_at, sent_at.mono + client.probe_timeout());
-    assert!(client
-        .poll_timeouts_at(timeout_at - Duration::from_nanos(1))
-        .unwrap()
-        .is_empty());
-    assert!(matches!(
-        client.poll_timeouts_at(timeout_at).unwrap().as_slice(),
-        [ClientEvent::EchoLoss {
-            sent_at: loss_sent_at,
-            ..
-        }] if *loss_sent_at == sent_at
-    ));
-
-    client.close().unwrap();
-    server.join();
-}
-
-#[test]
-fn blocking_send_call_excludes_wrapped_history_cleanup() {
-    let params = default_params();
-    let server = silent_open_server(params);
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    assert_open_started(client.open().unwrap());
-
-    let scheduled_at = client.next_send_deadline().unwrap();
-    let sent_at = ClientTimestamp {
-        wall: SystemTime::now(),
-        mono: scheduled_at + Duration::from_millis(5),
-    };
-    client.runtime.seed_wrapped_probe_history_for_test(sent_at);
-    let timestamps = ProbeSendTimestamps {
-        permission_at: scheduled_at,
-        send_anchor: sent_at,
-        sent_at,
-        send_call_start: scheduled_at + Duration::from_millis(6),
-        send_finished_at: scheduled_at + Duration::from_millis(13),
-    };
-
-    let events = client.send_probe_at(timestamps).unwrap();
-
-    assert!(matches!(
-        events.as_slice(),
-        [ClientEvent::EchoSent {
-            seq: 0,
-            send_call,
-            ..
-        }] if *send_call == Duration::from_millis(7)
-    ));
-    assert!(!client.runtime.has_timed_out_metadata());
-
-    client.close().unwrap();
-    server.join();
-}
-
-#[test]
-fn send_probe_respects_finite_duration_exclusive_end() {
-    let params = Params {
-        protocol_version: 1,
-        duration_ns: 1_000_000_000,
-        interval_ns: 500_000_000,
-        received_stats: ReceivedStats::Both,
-        stamp_at: StampAt::Both,
-        clock: Clock::Both,
-        ..Params::default()
-    };
-    let server = silent_open_server(params.clone());
-    let config = ClientConfig {
-        duration: Some(Duration::from_secs(1)),
-        interval: Duration::from_millis(500),
-        socket_config: crate::SocketConfig {
-            recv_timeout: Some(Duration::from_millis(200)),
-            ..Default::default()
-        },
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-
-    let start = client.next_send_deadline().unwrap();
-    let interval = Duration::from_millis(500);
-
-    let now0 = ClientTimestamp {
-        mono: start,
-        wall: SystemTime::now(),
-    };
-    assert!(client
-        .send_probe_at(probe_timestamps(now0.mono, now0))
-        .is_ok());
-
-    let now1 = ClientTimestamp {
-        mono: start + interval,
-        wall: SystemTime::now(),
-    };
-    assert!(client
-        .send_probe_at(probe_timestamps(now1.mono, now1))
-        .is_ok());
-
-    let now2 = ClientTimestamp {
-        mono: start + Duration::from_secs(1),
-        wall: SystemTime::now(),
-    };
-    let events = client
-        .send_probe_at(probe_timestamps(now2.mono, now2))
-        .unwrap();
-    assert!(events.is_empty());
-    assert!(client.next_send_deadline().is_none());
-
-    client.close().unwrap();
-    server.join();
-}
-
-#[test]
-fn managed_probe_skips_missed_schedule_slots() {
-    let interval = Duration::from_millis(10);
-    let params = Params {
-        protocol_version: 1,
-        duration_ns: 0,
-        interval_ns: 10_000_000,
-        received_stats: ReceivedStats::Both,
-        stamp_at: StampAt::Both,
-        clock: Clock::Both,
-        ..Params::default()
-    };
-    let server = echo_server(params);
-    let config = ClientConfig {
-        duration: None,
-        interval,
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-
-    let first_deadline = client.next_send_deadline().unwrap();
-    let permission_at = first_deadline + Duration::from_millis(45);
-    let delayed_send = ClientTimestamp {
-        mono: first_deadline + Duration::from_millis(48),
-        wall: SystemTime::now(),
-    };
-    let timestamps = ProbeSendTimestamps {
-        permission_at,
-        send_anchor: delayed_send,
-        sent_at: delayed_send,
-        send_call_start: first_deadline + Duration::from_millis(49),
-        send_finished_at: first_deadline + Duration::from_millis(55),
-    };
-    let events = client
-        .send_managed_probe_at(first_deadline, timestamps)
-        .unwrap();
-
-    assert_eq!(events.len(), 1);
-    assert!(matches!(
-        events[0],
-        ClientEvent::EchoSent {
-            seq: 0,
-            scheduled_at,
-            sent_at,
-            send_call,
-            timer_error,
-            ..
-        } if scheduled_at == first_deadline + Duration::from_millis(40)
-            && sent_at == delayed_send
-            && send_call == Duration::from_millis(6)
-            && timer_error == Duration::from_millis(8)
-    ));
-    assert_eq!(
-        client.next_send_deadline(),
-        Some(first_deadline + Duration::from_millis(50))
-    );
-
-    client.close().unwrap();
-    server.join();
-}
-
-#[test]
-fn managed_probe_skip_preserves_finite_run_end() {
-    let interval = Duration::from_millis(10);
-    let duration = Duration::from_millis(50);
-    let params = Params {
-        protocol_version: 1,
-        duration_ns: 50_000_000,
-        interval_ns: 10_000_000,
-        received_stats: ReceivedStats::Both,
-        stamp_at: StampAt::Both,
-        clock: Clock::Both,
-        ..Params::default()
-    };
-    let server = echo_server(params);
-    let config = ClientConfig {
-        duration: Some(duration),
-        interval,
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-
-    let first_deadline = client.next_send_deadline().unwrap();
-    let delayed_send = ClientTimestamp {
-        mono: first_deadline + Duration::from_millis(45),
-        wall: SystemTime::now(),
-    };
-    let first = client
-        .send_managed_probe_at(
-            first_deadline,
-            probe_timestamps(delayed_send.mono, delayed_send),
-        )
-        .unwrap();
-    let second_sent_at = ClientTimestamp {
-        mono: first_deadline + Duration::from_millis(46),
-        wall: SystemTime::now(),
-    };
-    let second = client
-        .send_managed_probe_at(
-            first_deadline + duration,
-            probe_timestamps(second_sent_at.mono, second_sent_at),
-        )
-        .unwrap();
-
-    assert_eq!(first.len(), 1);
-    assert!(second.is_empty());
-    assert!(client.next_send_deadline().is_none());
-
-    client.close().unwrap();
-    server.join();
-}
-
-#[test]
-fn receive_wait_is_bounded_by_next_ten_millisecond_deadline() {
-    let now = Instant::now();
-    let deadline = now + Duration::from_millis(10);
-
-    assert_eq!(
-        bounded_receive_timeout(
-            Some(deadline),
-            Some(Duration::from_millis(20)),
-            Duration::from_millis(20),
-            now,
-        ),
-        Some(Duration::from_millis(10))
-    );
-    assert_eq!(
-        bounded_receive_timeout(
-            Some(now),
-            Some(Duration::from_millis(20)),
-            Duration::from_millis(20),
-            now,
-        ),
-        None
-    );
-}
-
-#[test]
-fn connect_rejects_invalid_probe_limits() {
-    for config in [
-        ClientConfig {
-            max_pending_probes: 0,
-            ..ClientConfig::default()
-        },
-        ClientConfig {
-            probe_timeout: Duration::ZERO,
-            ..ClientConfig::default()
-        },
-    ] {
-        assert!(matches!(
-            Client::connect(config),
-            Err(ClientError::InvalidConfig { .. })
-        ));
-    }
-}
@@ -1,192 +0,0 @@
-use super::*;
-use crate::metadata::ReceiveMeta;
-
-#[test]
-fn server_processing_greater_than_raw_does_not_underflow() {
-    let base = Instant::now();
-    let rtt = compute_rtt(
-        &ClientTimestamp {
-            mono: base,
-            wall: SystemTime::now(),
-        },
-        &ClientTimestamp {
-            mono: base + Duration::from_nanos(1),
-            wall: SystemTime::now(),
-        },
-        &TimestampFields {
-            recv_mono: Some(0),
-            send_mono: Some(1_000_000_000),
-            ..Default::default()
-        },
-    );
-    assert_eq!(rtt.adjusted, Some(SignedDuration::from_nanos(-999_999_999)));
-    assert_eq!(rtt.effective, SignedDuration::from_nanos(-999_999_999));
-}
-
-#[test]
-fn effective_rtt_uses_raw_when_adjusted_rtt_is_unavailable() {
-    let base = Instant::now();
-    let rtt = compute_rtt(
-        &ClientTimestamp {
-            mono: base,
-            wall: SystemTime::now(),
-        },
-        &ClientTimestamp {
-            mono: base + Duration::from_nanos(42),
-            wall: SystemTime::now(),
-        },
-        &TimestampFields::default(),
-    );
-
-    assert_eq!(rtt.adjusted, None);
-    assert_eq!(rtt.effective, SignedDuration::from_duration(rtt.raw));
-}
-
-#[test]
-fn unix_epoch_ns_i64_rejects_out_of_range_wall_time() {
-    let i64_max_ns = u64::try_from(i64::MAX).unwrap();
-    let max = SystemTime::UNIX_EPOCH + Duration::from_nanos(i64_max_ns);
-    let overflow = max + Duration::from_nanos(1);
-
-    assert_eq!(unix_epoch_ns_i64(max), Some(i64::MAX));
-    assert_eq!(unix_epoch_ns_i64(overflow), None);
-}
-
-#[test]
-fn compute_one_way_omits_samples_when_client_wall_time_overflows_i64() {
-    let i64_max_ns = u64::try_from(i64::MAX).unwrap();
-    let overflow_wall =
-        SystemTime::UNIX_EPOCH + Duration::from_nanos(i64_max_ns) + Duration::from_nanos(1);
-    let sent_at = ClientTimestamp {
-        mono: Instant::now(),
-        wall: overflow_wall,
-    };
-    let received_at = ClientTimestamp {
-        mono: sent_at.mono + Duration::from_millis(40),
-        wall: overflow_wall + Duration::from_millis(40),
-    };
-    let ts = TimestampFields {
-        recv_wall: Some(i64::MAX),
-        send_wall: Some(i64::MAX),
-        ..Default::default()
-    };
-
-    assert_eq!(
-        compute_one_way(
-            &sent_at,
-            sent_at.wall,
-            &received_at,
-            None,
-            &ReceiveMeta::default(),
-            &ts
-        ),
-        None
-    );
-}
-
-#[test]
-fn compute_one_way_returns_available_direction_samples() {
-    let sent_at = ClientTimestamp {
-        mono: Instant::now(),
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(10),
-    };
-    let received_at = ClientTimestamp {
-        mono: sent_at.mono + Duration::from_millis(40),
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(10) + Duration::from_millis(40),
-    };
-    let ts = TimestampFields {
-        recv_wall: Some(10_000_000_000 + 15_000_000),
-        send_wall: Some(10_000_000_000 + 25_000_000),
-        ..Default::default()
-    };
-
-    let sample = compute_one_way(
-        &sent_at,
-        sent_at.wall,
-        &received_at,
-        None,
-        &ReceiveMeta::default(),
-        &ts,
-    )
-    .unwrap();
-    assert_eq!(
-        sample.client_to_server,
-        Some(SignedDuration::from_nanos(15_000_000))
-    );
-    assert_eq!(
-        sample.server_to_client,
-        Some(SignedDuration::from_nanos(15_000_000))
-    );
-}
-
-#[test]
-fn compute_one_way_preserves_negative_client_to_server_delay() {
-    let sent_at = ClientTimestamp {
-        mono: Instant::now(),
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(10),
-    };
-    let received_at = ClientTimestamp {
-        mono: sent_at.mono + Duration::from_millis(40),
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(10) + Duration::from_millis(40),
-    };
-    let ts = TimestampFields {
-        recv_wall: Some(10_000_000_000 - 5_000_000),
-        send_wall: Some(10_000_000_000 + 25_000_000),
-        ..Default::default()
-    };
-
-    let sample = compute_one_way(
-        &sent_at,
-        sent_at.wall,
-        &received_at,
-        None,
-        &ReceiveMeta::default(),
-        &ts,
-    )
-    .unwrap();
-
-    assert_eq!(
-        sample.client_to_server,
-        Some(SignedDuration::from_nanos(-5_000_000))
-    );
-    assert_eq!(
-        sample.server_to_client,
-        Some(SignedDuration::from_nanos(15_000_000))
-    );
-}
-
-#[test]
-fn compute_one_way_preserves_negative_server_to_client_delay() {
-    let sent_at = ClientTimestamp {
-        mono: Instant::now(),
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(10),
-    };
-    let received_at = ClientTimestamp {
-        mono: sent_at.mono + Duration::from_millis(40),
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(10) + Duration::from_millis(40),
-    };
-    let ts = TimestampFields {
-        recv_wall: Some(10_000_000_000 + 15_000_000),
-        send_wall: Some(10_000_000_000 + 45_000_000),
-        ..Default::default()
-    };
-
-    let sample = compute_one_way(
-        &sent_at,
-        sent_at.wall,
-        &received_at,
-        None,
-        &ReceiveMeta::default(),
-        &ts,
-    )
-    .unwrap();
-
-    assert_eq!(
-        sample.client_to_server,
-        Some(SignedDuration::from_nanos(15_000_000))
-    );
-    assert_eq!(
-        sample.server_to_client,
-        Some(SignedDuration::from_nanos(-5_000_000))
-    );
-}
@@ -1,27 +0,0 @@
-use super::*;
-
-#[test]
-fn sequence_ordering_handles_normal_and_wrapped_values() {
-    assert!(sequence_is_after(11, 10));
-    assert!(sequence_is_before(9, 10));
-    assert!(!sequence_is_after(10, 10));
-    assert!(!sequence_is_before(10, 10));
-
-    assert!(sequence_is_after(0, u32::MAX - 1));
-    assert!(!sequence_is_before(0, u32::MAX - 1));
-    assert!(sequence_is_after(1, u32::MAX));
-    assert!(!sequence_is_before(1, u32::MAX));
-
-    assert!(sequence_is_before(u32::MAX, 1));
-    assert!(!sequence_is_after(u32::MAX, 1));
-}
-
-#[test]
-fn highest_received_seq_updates_across_wrap() {
-    let mut highest = Some(u32::MAX);
-
-    update_highest_received(&mut highest, 0);
-    assert_eq!(highest, Some(0));
-    update_highest_received(&mut highest, u32::MAX);
-    assert_eq!(highest, Some(0));
-}
@@ -1,49 +0,0 @@
-use crate::socket_options::socket_ttl;
-
-use super::*;
-
-#[test]
-fn connect_accepts_valid_ttl_config_values() {
-    for ttl in [None, Some(1), Some(255)] {
-        let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 9)));
-        config.socket_config.ttl = ttl;
-        Client::connect(config).unwrap();
-    }
-}
-
-#[test]
-fn connect_applies_configured_ipv4_ttl_before_open_and_close_preserves_it() {
-    let params = Params {
-        protocol_version: PROTOCOL_VERSION,
-        duration_ns: 3_000_000_000,
-        interval_ns: 1_000_000_000,
-        received_stats: ReceivedStats::Both,
-        stamp_at: StampAt::Both,
-        clock: Clock::Both,
-        ..Params::default()
-    };
-    let server = open_success_server(params.clone());
-    let mut config = default_test_config(server.addr);
-    config.socket_config.ttl = Some(64);
-    let mut client = Client::connect(config).unwrap();
-
-    assert_eq!(socket_ttl(&client.socket, client.remote).unwrap(), 64);
-
-    client.open().unwrap();
-    server.join();
-
-    client.close().unwrap();
-    assert_eq!(socket_ttl(&client.socket, client.remote).unwrap(), 64);
-}
-
-#[test]
-fn connect_rejects_invalid_ttl_values() {
-    for ttl in [0, 256] {
-        let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 9)));
-        config.socket_config.ttl = Some(ttl);
-        assert!(matches!(
-            Client::connect(config),
-            Err(ClientError::InvalidConfig { .. })
-        ));
-    }
-}
@@ -46,6 +46,31 @@ pub(crate) const DEFAULT_MAX_PENDING: usize = 4096;
 /// request and the local client behavior used to drive the UDP socket. Values
 /// that are negotiated by the server are available after opening the session
 /// through [`NegotiatedParams`](crate::NegotiatedParams).
+///
+/// # Example
+///
+/// Configure a finite run with larger probes and accept documented server
+/// restrictions. Use `duration: None` for continuous mode, or
+/// [`RunMode::NoTest`] for negotiation without probes.
+///
+/// ```
+/// use std::time::Duration;
+///
+/// use irtt_client::{ClientConfig, NegotiationPolicy};
+///
+/// let config = ClientConfig {
+///     server_addr: "example.net:2112".into(),
+///     duration: Some(Duration::from_secs(10)),
+///     interval: Duration::from_millis(250),
+///     length: 1200,
+///     negotiation_policy: NegotiationPolicy::Loose,
+///     ..ClientConfig::default()
+/// };
+///
+/// assert_eq!(config.duration, Some(Duration::from_secs(10)));
+/// assert_eq!(config.interval, Duration::from_millis(250));
+/// assert_eq!(config.length, 1200);
+/// ```
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ClientConfig {
    /// Remote server name or address.
@@ -60,12 +85,18 @@ pub struct ClientConfig {
    /// `None` requests continuous mode and is encoded on the wire as a zero
    /// duration. Use [`RunMode::NoTest`] when the caller wants negotiation only
    /// without sending probes.
+    ///
+    /// The managed driver stops sending after the negotiated duration.
+    /// Low-level adapters leave run duration to the caller.
    pub duration: Option<Duration>,
    /// Requested spacing between probe sends.
    ///
    /// The interval is encoded as nanoseconds in the open request and must be
    /// greater than zero. The server may return a different interval depending
    /// on the negotiated policy and server restrictions.
+    ///
+    /// The managed driver uses the negotiated interval for cadence.
+    /// Low-level adapters send whenever called.
    pub interval: Duration,
    /// Requested echo packet payload length, in bytes.
    ///
@@ -176,6 +207,29 @@ impl Default for ClientConfig {
 /// These settings affect how the client binds, resolves, and receives from the
 /// socket. They do not change the IRTT protocol parameters negotiated with the
 /// server.
+///
+/// # Example
+///
+/// Bind to a chosen local endpoint and set the outgoing IPv4 TTL:
+///
+/// ```
+/// use std::net::{Ipv4Addr, SocketAddr};
+///
+/// use irtt_client::{ClientConfig, SocketConfig};
+///
+/// let config = ClientConfig {
+///     socket_config: SocketConfig {
+///         bind_addr: Some(SocketAddr::from((Ipv4Addr::UNSPECIFIED, 0))),
+///         ttl: Some(32),
+///         ipv4_only: true,
+///         ..SocketConfig::default()
+///     },
+///     ..ClientConfig::default()
+/// };
+///
+/// assert_eq!(config.socket_config.ttl, Some(32));
+/// assert!(config.socket_config.ipv4_only);
+/// ```
 #[derive(Debug, Clone, PartialEq, Eq, Default)]
 pub struct SocketConfig {
    /// Local address to bind before connecting the UDP socket.
@@ -183,6 +237,15 @@ pub struct SocketConfig {
    /// `None` binds to an unspecified address with an ephemeral port matching
    /// the selected remote address family.
    pub bind_addr: Option<SocketAddr>,
+    /// Network interface to bind this socket to (`SO_BINDTODEVICE`).
+    #[cfg(any(target_os = "android", target_os = "fuchsia", target_os = "linux"))]
+    pub bind_to_device: Option<String>,
+    /// Firewall mark applied to outgoing packets (`SO_MARK`).
+    #[cfg(any(target_os = "android", target_os = "fuchsia", target_os = "linux"))]
+    pub mark: Option<u32>,
+    /// FreeBSD FIB used for routing this socket (`SO_SETFIB`).
+    #[cfg(target_os = "freebsd")]
+    pub fib: Option<u32>,
    /// Optional IPv4 TTL or IPv6 hop limit applied to sent packets.
    ///
    /// `None` leaves the platform default unchanged. Values must fit in the
@@ -216,7 +279,8 @@ pub enum NegotiationPolicy {
 /// Mode requested during the IRTT open exchange.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum RunMode {
-    /// Open a session and send echo probes for the negotiated run duration.
+    /// Open a probe session. The managed driver runs for the negotiated duration;
+    /// low-level adapters leave sending and stopping to the caller.
    Normal,
    /// Complete negotiation without running the echo probe test.
    NoTest,
@@ -92,8 +92,9 @@ pub enum ClientEvent {
        seq: u32,
        /// Resolved remote socket address.
        remote: SocketAddr,
-        /// Monotonic deadline at which the probe was scheduled to be sent.
-        scheduled_at: Instant,
+        /// Intended send deadline, supplied by the managed runner.
+        /// Low-level adapters leave this absent.
+        scheduled_at: Option<Instant>,
        /// Paired client wall/monotonic timestamp captured immediately after
        /// the successful UDP send completed. This is the RTT and userspace
        /// upstream one-way-delay fallback endpoint. The operational probe
@@ -106,8 +107,8 @@ pub enum ClientEvent {
        /// scheduler commit work.
        send_call: Duration,
        /// Absolute difference between the scheduled send time and the
-        /// post-send `sent_at` timestamp above.
-        timer_error: Duration,
+        /// post-send `sent_at` timestamp above; absent for low-level sends.
+        timer_error: Option<Duration>,
    },

    /// First in-window reply for a pending echo request.
@@ -260,6 +261,19 @@ pub struct RttSample {
 /// processing time or comparing wall-clock timestamps from different hosts. It
 /// should not be used to represent raw elapsed wall-clock or monotonic time,
 /// which is non-negative and represented by [`Duration`].
+///
+/// # Example
+///
+/// Signed timing values retain a negative result instead of clamping clock
+/// skew or server processing adjustments to zero:
+///
+/// ```
+/// use irtt_client::SignedDuration;
+///
+/// let adjusted_rtt = SignedDuration::from_nanos(-250_000);
+/// assert!(adjusted_rtt.is_negative());
+/// assert_eq!(adjusted_rtt.as_micros(), -250);
+/// ```
 #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
 pub struct SignedDuration {
    ns: i128,
@@ -18,7 +18,10 @@
 //! wants full control over its own event loop, should start from. With the
 //! `tokio` feature, `AsyncClient` provides the corresponding low-level Tokio
 //! adapter for a caller that owns a runtime and drives socket readiness
-//! itself. [`managed`] sits above both: `ManagedClientTask` /
+//! itself. Both adapters send one probe whenever called; callers own cadence
+//! and run duration, using `negotiated_params()` after Open. [`managed`] owns
+//! negotiated-interval scheduling, finite runs, and staggered/burst pacing:
+//! `ManagedClientTask` /
 //! `ManagedClientHandle` (`tokio` feature) run and control one or more
 //! targets under a Tokio runtime, and `BlockingManagedClient` (`tokio`
 //! feature) wraps that in a synchronous owner backed by its own dedicated
@@ -157,22 +157,14 @@ impl BlockingManagedClient {
    }

    fn join_worker(&mut self) -> Result<ManagedOutcome, BlockingManagedJoinError> {
-        join_worker(
-            self.worker
-                .take()
-                .expect("blocking managed worker is joined at most once"),
-        )
+        self.worker
+            .take()
+            .expect("blocking managed worker is joined at most once")
+            .join()
+            .map_err(|_| BlockingManagedJoinError::WorkerPanicked)
    }
 }

-pub(super) fn join_worker(
-    worker: JoinHandle<ManagedOutcome>,
-) -> Result<ManagedOutcome, BlockingManagedJoinError> {
-    worker
-        .join()
-        .map_err(|_| BlockingManagedJoinError::WorkerPanicked)
-}
-
 impl Drop for BlockingManagedClient {
    fn drop(&mut self) {
        if self.worker.is_some() {
@@ -16,5 +16,5 @@ pub use model::*;
 #[cfg(feature = "tokio")]
 pub use task::*;

-#[cfg(all(feature = "tokio", test))]
-mod blocking_tests;
+#[cfg(feature = "tokio")]
+mod schedule;
@@ -449,199 +449,3 @@ pub(crate) fn classify_client_error(
        message: Arc::from(error.to_string()),
    }
 }
-
-#[cfg(test)]
-mod tests {
-    use std::{collections::TryReserveError, io};
-
-    use super::*;
-
-    fn io_error() -> io::Error {
-        io::Error::other("boom")
-    }
-
-    fn try_reserve_error() -> TryReserveError {
-        Vec::<u8>::new().try_reserve(usize::MAX).unwrap_err()
-    }
-
-    fn classification_cases() -> Vec<(ClientError, ManagedTargetFailureKind)> {
-        vec![
-            (
-                ClientError::Resolve {
-                    addr: "example.invalid:2112".to_owned(),
-                },
-                ManagedTargetFailureKind::Resolve,
-            ),
-            (
-                ClientError::Socket(io_error()),
-                ManagedTargetFailureKind::Socket,
-            ),
-            (
-                ClientError::DatagramLengthMismatch {
-                    expected: 64,
-                    actual: 32,
-                },
-                ManagedTargetFailureKind::Socket,
-            ),
-            (
-                ClientError::SocketOption {
-                    operation: "set read timeout",
-                    remote: "127.0.0.1:2112".parse().unwrap(),
-                    source: io_error(),
-                },
-                ManagedTargetFailureKind::SocketOption,
-            ),
-            (
-                ClientError::ReadTimeoutRestore { source: io_error() },
-                ManagedTargetFailureKind::SocketOption,
-            ),
-            (
-                ClientError::Protocol(irtt_proto::ProtoError::BadMagic),
-                ManagedTargetFailureKind::Protocol,
-            ),
-            (
-                ClientError::ProtocolVersionMismatch {
-                    requested: 1,
-                    received: 2,
-                },
-                ManagedTargetFailureKind::Protocol,
-            ),
-            (ClientError::ZeroToken, ManagedTargetFailureKind::Protocol),
-            (
-                ClientError::UnexpectedNoTestReply,
-                ManagedTargetFailureKind::Protocol,
-            ),
-            (
-                ClientError::NonZeroNoTestToken { token: 7 },
-                ManagedTargetFailureKind::Protocol,
-            ),
-            (
-                ClientError::ServerRejected,
-                ManagedTargetFailureKind::Protocol,
-            ),
-            (
-                ClientError::NegotiationRejected {
-                    reason: "duration".to_owned(),
-                },
-                ManagedTargetFailureKind::Protocol,
-            ),
-            (ClientError::OpenTimeout, ManagedTargetFailureKind::Timeout),
-            (
-                ClientError::InvalidConfig {
-                    reason: "interval".to_owned(),
-                },
-                ManagedTargetFailureKind::Configuration,
-            ),
-            (
-                ClientError::OpenTimeoutTooSmall {
-                    timeout: Duration::from_millis(1),
-                    minimum: Duration::from_millis(10),
-                },
-                ManagedTargetFailureKind::Configuration,
-            ),
-            (
-                ClientError::NoOpenTimeouts,
-                ManagedTargetFailureKind::Configuration,
-            ),
-            (
-                ClientError::AllocationFailed {
-                    operation: "pending probes",
-                    source: try_reserve_error(),
-                },
-                ManagedTargetFailureKind::ResourceExhausted,
-            ),
-            (
-                ClientError::CounterOverflow {
-                    counter: "packets_sent",
-                },
-                ManagedTargetFailureKind::ResourceExhausted,
-            ),
-            (
-                ClientError::DurationOverflow,
-                ManagedTargetFailureKind::ResourceExhausted,
-            ),
-            (
-                ClientError::PendingLimitExceeded { limit: 8 },
-                ManagedTargetFailureKind::ResourceExhausted,
-            ),
-            (
-                ClientError::NoTokioRuntime,
-                ManagedTargetFailureKind::InvalidState,
-            ),
-            (ClientError::NotOpen, ManagedTargetFailureKind::InvalidState),
-            (
-                ClientError::AlreadyOpen,
-                ManagedTargetFailureKind::InvalidState,
-            ),
-            (
-                ClientError::AlreadyCompleted,
-                ManagedTargetFailureKind::InvalidState,
-            ),
-            (
-                ClientError::AlreadyClosed,
-                ManagedTargetFailureKind::InvalidState,
-            ),
-            (
-                ClientError::StalePreparedProbe {
-                    prepared_seq: 3,
-                    next_wire_seq: 4,
-                },
-                ManagedTargetFailureKind::InvalidState,
-            ),
-            (
-                ClientError::PendingSequenceCollision { seq: 9 },
-                ManagedTargetFailureKind::InvalidState,
-            ),
-        ]
-    }
-
-    #[test]
-    fn every_client_error_classifies_to_its_documented_kind() {
-        for (error, expected) in classification_cases() {
-            let failure = classify_client_error(ManagedTargetFailurePhase::Opening, &error);
-            assert_eq!(
-                failure.kind, expected,
-                "unexpected classification for {error:?}"
-            );
-            assert_eq!(failure.phase, ManagedTargetFailurePhase::Opening);
-            assert_eq!(&*failure.message, error.to_string());
-        }
-    }
-
-    #[test]
-    fn classification_preserves_the_reported_phase() {
-        for phase in [
-            ManagedTargetFailurePhase::Connecting,
-            ManagedTargetFailurePhase::Opening,
-            ManagedTargetFailurePhase::Sending,
-            ManagedTargetFailurePhase::Receiving,
-            ManagedTargetFailurePhase::Timing,
-            ManagedTargetFailurePhase::Closing,
-        ] {
-            let failure = classify_client_error(phase, &ClientError::OpenTimeout);
-            assert_eq!(failure.phase, phase);
-        }
-    }
-
-    #[test]
-    fn phase_and_kind_display_without_debug_spelling() {
-        assert_eq!(
-            ManagedTargetFailurePhase::Connecting.to_string(),
-            "connecting"
-        );
-        assert_eq!(ManagedTargetFailurePhase::Closing.to_string(), "closing");
-        assert_eq!(
-            ManagedTargetFailureKind::SocketOption.to_string(),
-            "socket option"
-        );
-        assert_eq!(
-            ManagedTargetFailureKind::ResourceExhausted.to_string(),
-            "resource exhausted"
-        );
-        assert_eq!(
-            ManagedTargetFailureKind::InvalidState.to_string(),
-            "invalid state"
-        );
-        assert_eq!(ManagedTargetFailureKind::Other.to_string(), "other");
-    }
-}
@@ -0,0 +1,154 @@
+use std::time::{Duration, Instant};
+
+use crate::{error::ClientError, session::NegotiatedParams};
+
+#[derive(Debug)]
+pub(crate) struct ProbeSchedule {
+    end_at: Option<Instant>,
+    interval: Duration,
+    next_send_at: Option<Instant>,
+}
+
+#[derive(Debug)]
+pub(crate) struct ScheduleCommit {
+    pub(crate) scheduled_at: Instant,
+    pub(crate) next_send_at: Option<Instant>,
+}
+
+impl ProbeSchedule {
+    pub(crate) fn new(
+        start_at: Instant,
+        negotiated: &NegotiatedParams,
+    ) -> Result<Self, ClientError> {
+        let interval_ns = u64::try_from(negotiated.params.interval_ns)
+            .expect("validated positive negotiated interval");
+        let interval = Duration::from_nanos(interval_ns);
+        let end_at = if negotiated.params.duration_ns > 0 {
+            let duration_ns = u64::try_from(negotiated.params.duration_ns)
+                .expect("validated positive negotiated duration");
+            Some(
+                start_at
+                    .checked_add(Duration::from_nanos(duration_ns))
+                    .ok_or_else(|| ClientError::NegotiationRejected {
+                        reason: "duration is too large to schedule".to_owned(),
+                    })?,
+            )
+        } else {
+            None
+        };
+
+        Ok(Self {
+            end_at,
+            interval,
+            next_send_at: Some(start_at),
+        })
+    }
+
+    pub(crate) fn next_send_deadline(&self) -> Option<Instant> {
+        self.next_send_at
+    }
+
+    pub(crate) fn interval(&self) -> Duration {
+        self.interval
+    }
+
+    pub(crate) fn permit_probe_at(&mut self, now: Instant) -> bool {
+        if self.next_send_at.is_none() {
+            return false;
+        }
+        if self.end_at.is_some_and(|end| now >= end) {
+            self.next_send_at = None;
+            return false;
+        }
+        true
+    }
+
+    pub(crate) fn preflight_managed_commit(
+        &self,
+        scheduled_at: Instant,
+        permission_at: Instant,
+    ) -> Result<ScheduleCommit, ClientError> {
+        let (scheduled_at, next_send_at) =
+            advance_cadence(scheduled_at, self.interval, permission_at)?;
+        Ok(ScheduleCommit {
+            scheduled_at,
+            next_send_at: if self.end_at.is_some_and(|end| next_send_at >= end) {
+                None
+            } else {
+                Some(next_send_at)
+            },
+        })
+    }
+
+    pub(crate) fn commit(&mut self, commit: ScheduleCommit) {
+        self.next_send_at = commit.next_send_at;
+    }
+
+    /// Reclaim slots crossed while a successful socket submission was in flight.
+    /// This follows the send commit; it never advances a failed submission.
+    pub(crate) fn skip_missed_slots_at(&mut self, now: Instant) -> Result<(), ClientError> {
+        if let Some(deadline) = self.next_send_at.filter(|deadline| *deadline <= now) {
+            let commit = self.preflight_managed_commit(deadline, now)?;
+            self.commit(commit);
+        }
+        Ok(())
+    }
+
+    pub(crate) fn is_finished(&self) -> bool {
+        self.next_send_at.is_none()
+    }
+}
+
+pub(crate) fn advance_cadence(
+    deadline: Instant,
+    interval: Duration,
+    now: Instant,
+) -> Result<(Instant, Instant), ClientError> {
+    if interval.is_zero() {
+        return Err(ClientError::InvalidConfig {
+            reason: "probe interval must be greater than zero".to_owned(),
+        });
+    }
+
+    let elapsed_slots = now
+        .checked_duration_since(deadline)
+        .map_or(0, |elapsed| elapsed.as_nanos() / interval.as_nanos());
+    let scheduled_offset = duration_from_nanos(
+        interval
+            .as_nanos()
+            .checked_mul(elapsed_slots)
+            .ok_or(ClientError::DurationOverflow)?,
+    )?;
+    let next_offset = duration_from_nanos(
+        interval
+            .as_nanos()
+            .checked_mul(
+                elapsed_slots
+                    .checked_add(1)
+                    .ok_or(ClientError::DurationOverflow)?,
+            )
+            .ok_or(ClientError::DurationOverflow)?,
+    )?;
+    let scheduled_at = deadline
+        .checked_add(scheduled_offset)
+        .ok_or(ClientError::DurationOverflow)?;
+    let next_at = deadline
+        .checked_add(next_offset)
+        .ok_or(ClientError::DurationOverflow)?;
+    Ok((scheduled_at, next_at))
+}
+
+fn duration_from_nanos(nanos: u128) -> Result<Duration, ClientError> {
+    const NANOS_PER_SECOND: u128 = 1_000_000_000;
+    let seconds =
+        u64::try_from(nanos / NANOS_PER_SECOND).map_err(|_| ClientError::DurationOverflow)?;
+    let subsec_nanos = u32::try_from(nanos % NANOS_PER_SECOND)
+        .expect("nanosecond remainder is always less than one second");
+    Ok(Duration::new(seconds, subsec_nanos))
+}
+
+pub(crate) fn instant_abs_diff(left: Instant, right: Instant) -> Duration {
+    left.checked_duration_since(right)
+        .or_else(|| right.checked_duration_since(left))
+        .unwrap_or(Duration::ZERO)
+}
@@ -25,6 +25,8 @@ use crate::{
    ClientConfig, ClientError, ClientEvent, OpenOutcome,
 };

+use super::schedule::{instant_abs_diff, ProbeSchedule};
+
 use super::{
    classify_client_error, ManagedClientConfig, ManagedCommandAcknowledgement,
    ManagedCommandApplyError, ManagedCommandError, ManagedCompletionPolicy, ManagedConfigError,
@@ -44,6 +46,42 @@ const POST_DEADLINE_RECEIVE_BUDGET: usize = TARGET_WORK_BUDGET;
 const MAX_BROADCAST_CHANNEL_CAPACITY: usize = usize::MAX >> 1;

 /// Entry point for constructing a unified Tokio managed task.
+///
+/// # Example
+///
+/// Construct the task and its separate control handle, subscribe before
+/// starting the task, then run it under the caller's Tokio runtime. A reachable
+/// server is required at runtime, so this example only type-checks.
+///
+/// ```no_run
+/// use irtt_client::{ClientConfig, ClientEvent};
+/// use irtt_client::managed::{
+///     ManagedClient, ManagedClientConfig, ManagedEvent, ManagedTargetConfig,
+/// };
+///
+/// # async fn run() -> Result<(), Box<dyn std::error::Error>> {
+/// let config = ManagedClientConfig {
+///     client: ClientConfig {
+///         duration: Some(std::time::Duration::from_secs(10)),
+///         ..ClientConfig::default()
+///     },
+///     ..ManagedClientConfig::default()
+/// };
+/// let targets = vec![ManagedTargetConfig::new("edge", "127.0.0.1:2112")];
+/// let (task, handle) = ManagedClient::task(config, targets)?;
+/// let mut events = handle.subscribe()?;
+/// let driver = tokio::spawn(task);
+///
+/// while let Ok(event) = events.recv().await {
+///     if let ManagedEvent::Client { event: ClientEvent::EchoReply { .. }, .. } = event {
+///         println!("received a probe reply");
+///     }
+/// }
+/// let outcome = driver.await?;
+/// println!("run ended: {:?}", outcome.end_reason);
+/// # Ok(())
+/// # }
+/// ```
 #[derive(Debug, Default)]
 pub struct ManagedClient;

@@ -139,73 +177,6 @@ pub struct ManagedClientHandle {
    max_live_target_generations: usize,
    status: watch::Receiver<Arc<ManagedStatus>>,
    events: broadcast::WeakSender<ManagedEvent>,
-    #[cfg(test)]
-    update_submission_hook: Option<Arc<UpdateSubmissionTestHook>>,
-}
-
-#[cfg(test)]
-#[derive(Default)]
-struct UpdateSubmissionTestHook {
-    state: std::sync::Mutex<UpdateSubmissionTestState>,
-    arrived: std::sync::Condvar,
-    released: std::sync::Condvar,
-}
-
-#[cfg(test)]
-#[derive(Default)]
-struct UpdateSubmissionTestState {
-    armed: bool,
-    arrived: bool,
-    released: bool,
-}
-
-#[cfg(test)]
-impl UpdateSubmissionTestHook {
-    fn arm(&self) {
-        self.state
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner)
-            .armed = true;
-    }
-
-    fn pause_after_admission(&self) {
-        let mut state = self
-            .state
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        if !state.armed {
-            return;
-        }
-        state.arrived = true;
-        self.arrived.notify_all();
-        while !state.released {
-            state = self
-                .released
-                .wait(state)
-                .unwrap_or_else(std::sync::PoisonError::into_inner);
-        }
-    }
-
-    fn wait_until_arrived(&self) {
-        let state = self
-            .state
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        let (state, timeout) = self
-            .arrived
-            .wait_timeout_while(state, Duration::from_secs(2), |state| !state.arrived)
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        assert!(state.arrived && !timeout.timed_out());
-    }
-
-    fn release(&self) {
-        let mut state = self
-            .state
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        state.released = true;
-        self.released.notify_all();
-    }
 }

 impl fmt::Debug for ManagedClientHandle {
@@ -267,11 +238,6 @@ impl ManagedClientHandle {
            });
        }

-        #[cfg(test)]
-        if let Some(hook) = &self.update_submission_hook {
-            hook.pause_after_admission();
-        }
-
        // Observing `Open` only permits attempting submission. A successful
        // `try_send` transfers command ownership to the driver. A concurrent
        // stop may move admission to `Stopping` before this send, allowing the
@@ -364,10 +330,6 @@ impl Future for ManagedStopReceipt {
 type ConnectFuture =
    Pin<Box<dyn Future<Output = Result<AsyncClient, ClientError>> + Send + 'static>>;
 type WakeFuture = Pin<Box<dyn Future<Output = Option<watch::Receiver<()>>> + Send + 'static>>;
-#[cfg(test)]
-type EventObservations = Arc<std::sync::Mutex<Vec<(ManagedEvent, Arc<ManagedStatus>)>>>;
-#[cfg(test)]
-type StaggerObservations = Arc<std::sync::Mutex<Vec<(usize, Duration)>>>;

 fn arm_wake(mut receiver: watch::Receiver<()>) -> WakeFuture {
    Box::pin(async move {
@@ -468,6 +430,7 @@ impl TargetCounters {
 }

 struct TargetRuntime {
+    schedule: Option<ProbeSchedule>,
    instance: TargetInstance,
    config: ManagedTargetConfig,
    desired: bool,
@@ -486,17 +449,7 @@ impl TargetRuntime {
    /// The client owns `packets_sent`; this runtime only mirrors it so a
    /// terminal outcome can report it after the client is gone.
    fn sync_packets_sent(&mut self, client: &AsyncClient) {
-        self.record_packets_sent(client.packets_sent());
-    }
-
-    /// Adopt an already-read authoritative sent count.
-    fn record_packets_sent(&mut self, packets_sent: u64) {
-        self.counters.packets_sent = packets_sent;
-    }
-
-    /// Account for one client event against this target's durable counters.
-    fn observe(&mut self, event: &ClientEvent) {
-        self.counters.observe(event);
+        self.counters.packets_sent = client.packets_sent();
    }

    /// Build this target's durable outcome.
@@ -681,24 +634,6 @@ pub struct ManagedClientTask {
    final_outcome: Option<Arc<ManagedOutcome>>,
    next_generation: u64,
    applied_command_sequence: u64,
-    #[cfg(test)]
-    event_observations: Option<EventObservations>,
-    #[cfg(test)]
-    stagger_observations: Option<StaggerObservations>,
-    #[cfg(test)]
-    drain_test_hook: DrainTestHook,
-    #[cfg(test)]
-    timeout_inspections: usize,
-    #[cfg(test)]
-    deadline_inspections: usize,
-}
-
-#[cfg(test)]
-#[derive(Default)]
-struct DrainTestHook {
-    defer_work_until_deadline: bool,
-    fail_receive: bool,
-    fail_close: bool,
 }

 impl ManagedClientTask {
@@ -709,13 +644,6 @@ impl ManagedClientTask {
    }

    fn publish_event(&self, event: ManagedEvent) {
-        #[cfg(test)]
-        if let Some(observations) = &self.event_observations {
-            observations
-                .lock()
-                .unwrap_or_else(std::sync::PoisonError::into_inner)
-                .push((event.clone(), Arc::clone(&self.resources().status.borrow())));
-        }
        if let Some(events) = &self.resources().events {
            let _ = events.send(event);
        }
@@ -798,7 +726,7 @@ impl ManagedClientTask {

    fn publish_client_events(&mut self, index: usize, events: Vec<ClientEvent>) {
        for event in events {
-            self.targets[index].observe(&event);
+            self.targets[index].counters.observe(&event);
            self.publish_event(ManagedEvent::Client {
                target: self.targets[index].instance.clone(),
                event,
@@ -955,6 +883,7 @@ impl ManagedClientTask {
            };
            created_instances.push(instance.clone());
            self.targets.push(TargetRuntime {
+                schedule: None,
                instance,
                server_addr: Arc::from(planned.target.server_addr.clone()),
                config: planned.target,
@@ -1207,7 +1136,25 @@ impl ManagedClientTask {
                        self.targets[index].state = TargetState::Opening { client, open };
                        false
                    }
-                    Poll::Ready(Ok(OpenOutcome::Started { event, .. })) => {
+                    Poll::Ready(Ok(OpenOutcome::Started {
+                        event, negotiated, ..
+                    })) => {
+                        let ClientEvent::SessionStarted { at: opened_at, .. } = &event else {
+                            unreachable!("Started carries SessionStarted");
+                        };
+                        match ProbeSchedule::new(opened_at.mono, &negotiated) {
+                            Ok(schedule) => self.targets[index].schedule = Some(schedule),
+                            Err(error) => {
+                                return self.begin_open_session_failure(
+                                    index,
+                                    client,
+                                    ManagedTargetFailurePhase::Timing,
+                                    error,
+                                    now,
+                                    OpenSessionFailureCleanup::Close,
+                                )
+                            }
+                        }
                        self.publish_client_events(index, vec![event]);
                        if self.state == DriverState::Stopping
                            || self.effective_retirement(index).is_some()
@@ -1304,7 +1251,15 @@ impl ManagedClientTask {
                    self.finish_target(index, ManagedTargetEndReason::PeerClosed, None);
                    return false;
                }
-                if client.is_run_complete() {
+                if self.targets[index]
+                    .schedule
+                    .as_mut()
+                    .is_some_and(|schedule| {
+                        schedule.permit_probe_at(now);
+                        schedule.is_finished()
+                    })
+                    && !client.has_pending_probes()
+                {
                    self.targets[index].sync_packets_sent(&client);
                    return self.begin_drain(
                        index,
@@ -1324,22 +1279,6 @@ impl ManagedClientTask {
                mut cleanup_failure,
                mut post_deadline_receives_remaining,
            } => {
-                #[cfg(test)]
-                let defer_work = self.drain_test_hook.defer_work_until_deadline && now < deadline;
-                #[cfg(not(test))]
-                let defer_work = false;
-                if defer_work {
-                    self.targets[index].state = TargetState::Draining {
-                        client,
-                        drain_started_at,
-                        deadline,
-                        primary_end,
-                        cleanup_failure,
-                        post_deadline_receives_remaining,
-                    };
-                    return false;
-                }
-
                if client
                    .next_probe_timeout_deadline()
                    .is_some_and(|timeout| timeout <= now)
@@ -1355,10 +1294,6 @@ impl ManagedClientTask {
                    return true;
                }

-                #[cfg(test)]
-                let injected_receive_failure = self.take_drain_receive_failure();
-                #[cfg(not(test))]
-                let injected_receive_failure = None;
                let mut retained_state_changed = false;
                let received = match client.poll_recv(cx) {
                    Poll::Pending => false,
@@ -1375,13 +1310,7 @@ impl ManagedClientTask {
                        return self.begin_close(index, client, primary_end, cleanup_failure, now);
                    }
                };
-                if let Some(error) = injected_receive_failure {
-                    self.targets[index].sync_packets_sent(&client);
-                    cleanup_failure.get_or_insert_with(|| {
-                        classify_client_error(ManagedTargetFailurePhase::Receiving, &error)
-                    });
-                    return self.begin_close(index, client, primary_end, cleanup_failure, now);
-                }
+
                if client.is_peer_closed() {
                    self.targets[index].sync_packets_sent(&client);
                    self.finish_target(index, ManagedTargetEndReason::PeerClosed, cleanup_failure);
@@ -1459,17 +1388,7 @@ impl ManagedClientTask {
                Poll::Ready(Ok(events)) => {
                    self.targets[index].sync_packets_sent(&client);
                    self.publish_client_events(index, events);
-                    #[cfg(test)]
-                    let injected_close_failure = self.take_drain_close_failure().map(|error| {
-                        classify_client_error(ManagedTargetFailurePhase::Closing, &error)
-                    });
-                    #[cfg(not(test))]
-                    let injected_close_failure = None;
-                    self.finish_target(
-                        index,
-                        primary_end,
-                        cleanup_failure.or(injected_close_failure),
-                    );
+                    self.finish_target(index, primary_end, cleanup_failure);
                    false
                }
                Poll::Ready(Err(error)) => {
@@ -1550,26 +1469,6 @@ impl ManagedClientTask {
        true
    }

-    #[cfg(test)]
-    fn take_drain_receive_failure(&mut self) -> Option<ClientError> {
-        if !mem::take(&mut self.drain_test_hook.fail_receive) {
-            return None;
-        }
-        Some(ClientError::Socket(std::io::Error::other(
-            "injected drain receive failure",
-        )))
-    }
-
-    #[cfg(test)]
-    fn take_drain_close_failure(&mut self) -> Option<ClientError> {
-        if !mem::take(&mut self.drain_test_hook.fail_close) {
-            return None;
-        }
-        Some(ClientError::Socket(std::io::Error::other(
-            "injected drain close failure",
-        )))
-    }
-
    fn active_count(&self) -> usize {
        self.targets
            .iter()
@@ -1577,23 +1476,25 @@ impl ManagedClientTask {
            .count()
    }

-    fn active_stagger_spacing(&self) -> Option<(usize, Duration)> {
+    fn active_stagger_spacing(&self) -> Option<Duration> {
        let mut active = 0;
        let mut minimum: Option<Duration> = None;
        for target in &self.targets {
            if !target.desired || target.retirement.is_some() {
                continue;
            }
-            let TargetState::Active { client } = &target.state else {
+            let TargetState::Active { .. } = &target.state else {
                continue;
            };
            active += 1;
-            let interval = client
-                .probe_interval()
-                .expect("active managed targets have a committed probe schedule");
+            let interval = target
+                .schedule
+                .as_ref()
+                .expect("active managed targets have a probe schedule")
+                .interval();
            minimum = minimum.into_iter().chain(Some(interval)).min();
        }
-        minimum.map(|interval| (active, stagger_spacing(interval, active)))
+        minimum.map(|interval| stagger_spacing(interval, active))
    }

    fn stagger_target_added(&mut self, now: Instant) {
@@ -1604,7 +1505,7 @@ impl ManagedClientTask {
        let candidate = self
            .last_stagger_send
            .zip(self.active_stagger_spacing())
-            .and_then(|(last, (_, spacing))| last.checked_add(spacing))
+            .and_then(|(last, spacing)| last.checked_add(spacing))
            .filter(|gate| *gate > now);
        self.send_gate = candidate.map(|candidate| existing.min(candidate));
    }
@@ -1613,24 +1514,44 @@ impl ManagedClientTask {
        self.send_gate = self.send_gate.filter(|gate| *gate > now);
    }

+    /// The next stagger gate after a send was accepted at `accepted_at`.
+    ///
+    /// The gate advances on its **own** cadence rather than being re-anchored
+    /// on every observed accept time. Anchoring on `accepted_at` folds each
+    /// send's wakeup latency into the next slot and then into every slot after
+    /// it, so the gate — and with it the whole group's send cadence — drifts
+    /// later without bound while the per-target schedules stay on their
+    /// absolute grid. The drift is not hypothetical: it shows up as a
+    /// monotonically growing `EchoSent::timer_error` and, once it exceeds one
+    /// interval, as probe slots the schedule then skips.
+    ///
+    /// `accepted_at` is still the anchor in the two cases where continuing the
+    /// old cadence would be wrong: there is no previous gate, or the pacer has
+    /// fallen a full slot behind it. Re-anchoring there is what keeps a gate
+    /// stranded in the past from releasing a burst of catch-up sends once the
+    /// group starts moving again.
+    fn next_stagger_gate(&self, spacing: Duration, accepted_at: Instant) -> Option<Instant> {
+        let base = match self.send_gate {
+            Some(gate) if gate <= accepted_at && accepted_at.duration_since(gate) < spacing => gate,
+            _ => accepted_at,
+        };
+        base.checked_add(spacing)
+    }
+
    fn record_stagger_acceptance(
        &mut self,
        result: SendResult,
-        stagger_spacing: Option<(usize, Duration)>,
+        stagger_spacing: Option<Duration>,
        accepted_at: Instant,
    ) {
        if !result.accepted() {
            return;
        }
-        let Some((_active, spacing)) = stagger_spacing else {
+        let Some(spacing) = stagger_spacing else {
            return;
        };
        self.last_stagger_send = Some(accepted_at);
-        self.send_gate = accepted_at.checked_add(spacing);
-        #[cfg(test)]
-        if let Some(observations) = &self.stagger_observations {
-            observations.lock().unwrap().push((_active, spacing));
-        }
+        self.send_gate = self.next_stagger_gate(spacing, accepted_at);
    }

    fn poll_one_send(
@@ -1638,7 +1559,7 @@ impl ManagedClientTask {
        index: usize,
        cx: &mut Context<'_>,
        now: Instant,
-        stagger_spacing: Option<(usize, Duration)>,
+        stagger_spacing: Option<Duration>,
    ) -> SendResult {
        if !self.targets[index].desired || self.targets[index].retirement.is_some() {
            self.targets[index].send_waiting = false;
@@ -1649,6 +1570,9 @@ impl ManagedClientTask {
            self.targets[index].state = state;
            return SendResult::NotAttempted;
        };
+        // A burst pass may span several slots; validate this target against
+        // fresh time rather than the pass's earlier scheduling snapshot.
+        let now = now.max(Instant::now());
        if client
            .next_probe_timeout_deadline()
            .is_some_and(|deadline| deadline <= now)
@@ -1657,7 +1581,21 @@ impl ManagedClientTask {
            self.targets[index].state = TargetState::Active { client };
            return SendResult::NotAttempted;
        }
-        if client
+        let schedule = self.targets[index]
+            .schedule
+            .as_mut()
+            .expect("active managed targets have a probe schedule");
+        if !schedule.permit_probe_at(now) {
+            self.targets[index].send_waiting = false;
+            if client.has_pending_probes() {
+                self.targets[index].state = TargetState::Active { client };
+                return SendResult::NotAttempted;
+            }
+            self.targets[index].sync_packets_sent(&client);
+            self.begin_drain(index, client, ManagedTargetEndReason::TestComplete, now);
+            return SendResult::Ready { accepted: false };
+        }
+        if schedule
            .next_send_deadline()
            .is_none_or(|deadline| deadline > now)
        {
@@ -1665,8 +1603,25 @@ impl ManagedClientTask {
            self.targets[index].state = TargetState::Active { client };
            return SendResult::NotAttempted;
        }
+        let schedule = self.targets[index].schedule.as_ref().unwrap();
+        let commit =
+            match schedule.preflight_managed_commit(schedule.next_send_deadline().unwrap(), now) {
+                Ok(commit) => commit,
+                Err(error) => {
+                    self.begin_open_session_failure(
+                        index,
+                        client,
+                        ManagedTargetFailurePhase::Timing,
+                        error,
+                        now,
+                        OpenSessionFailureCleanup::Drain,
+                    );
+                    return SendResult::Failed { accepted: false };
+                }
+            };
+        let scheduled_at = commit.scheduled_at;
        let before = client.packets_sent();
-        let result = client.poll_send_probe(cx);
+        let mut result = client.poll_send_probe(cx);
        let after = client.packets_sent();
        let accepted = after > before;
        let send_result = match &result {
@@ -1675,11 +1630,38 @@ impl ManagedClientTask {
            Poll::Ready(Err(_)) => SendResult::Failed { accepted },
        };
        self.record_stagger_acceptance(send_result, stagger_spacing, Instant::now());
-        let schedule_error = accepted
-            .then(|| client.skip_missed_probe_slots_at(Instant::now()))
-            .transpose()
-            .err();
-        self.targets[index].record_packets_sent(after);
+        if accepted {
+            self.targets[index]
+                .schedule
+                .as_mut()
+                .unwrap()
+                .commit(commit);
+            if let Poll::Ready(Ok(events)) = &mut result {
+                for event in events {
+                    if let ClientEvent::EchoSent {
+                        scheduled_at: intended,
+                        sent_at,
+                        timer_error,
+                        ..
+                    } = event
+                    {
+                        *intended = Some(scheduled_at);
+                        *timer_error = Some(instant_abs_diff(sent_at.mono, scheduled_at));
+                    }
+                }
+            }
+        }
+        let schedule_error = if accepted {
+            self.targets[index]
+                .schedule
+                .as_mut()
+                .unwrap()
+                .skip_missed_slots_at(Instant::now())
+                .err()
+        } else {
+            None
+        };
+        self.targets[index].counters.packets_sent = after;
        match result {
            Poll::Pending => {
                self.targets[index].send_waiting = true;
@@ -1694,7 +1676,7 @@ impl ManagedClientTask {
                    let TargetState::Active { client } =
                        mem::replace(&mut self.targets[index].state, TargetState::Terminal)
                    else {
-                        unreachable!("probe sender remained active while publishing send events");
+                        unreachable!("sender remained active")
                    };
                    self.begin_open_session_failure(
                        index,
@@ -1709,6 +1691,7 @@ impl ManagedClientTask {
                    SendResult::Ready { accepted }
                }
            }
+
            Poll::Ready(Err(error)) => {
                self.targets[index].send_waiting = false;
                self.begin_open_session_failure(
@@ -1803,10 +1786,6 @@ impl ManagedClientTask {
            }
            let index = self.timeout_cursor;
            self.timeout_cursor = (self.timeout_cursor + 1) % target_len;
-            #[cfg(test)]
-            {
-                self.timeout_inspections += 1;
-            }
            if self.target_has_due_timeout(index, now) {
                let generation = self.targets[index].instance.generation;
                let step = self.poll_target_timeout(index, now);
@@ -1862,20 +1841,9 @@ impl ManagedClientTask {
                        .next_probe_timeout_deadline()
                        .is_some_and(|deadline| deadline <= now)
            }
-            TargetState::Draining {
-                client,
-                deadline: _deadline,
-                ..
-            } => {
-                #[cfg(test)]
-                let defer_work = self.drain_test_hook.defer_work_until_deadline && now < *_deadline;
-                #[cfg(not(test))]
-                let defer_work = false;
-                !defer_work
-                    && client
-                        .next_probe_timeout_deadline()
-                        .is_some_and(|timeout| timeout <= now)
-            }
+            TargetState::Draining { client, .. } => client
+                .next_probe_timeout_deadline()
+                .is_some_and(|timeout| timeout <= now),
            _ => false,
        }
    }
@@ -1955,11 +1923,7 @@ impl ManagedClientTask {
            .all(|target| matches!(target.state, TargetState::Terminal))
    }

-    fn next_deadline(&mut self) -> Option<Instant> {
-        #[cfg(test)]
-        {
-            self.deadline_inspections += self.targets.len();
-        }
+    fn next_deadline(&self) -> Option<Instant> {
        let mut non_send_deadline = None;
        let mut send_deadline = None;
        for target in &self.targets {
@@ -1972,24 +1936,21 @@ impl ManagedClientTask {
                    if target.desired && target.retirement.is_none() && !target.send_waiting {
                        send_deadline = send_deadline
                            .into_iter()
-                            .chain(client.next_send_deadline())
+                            .chain(
+                                target
+                                    .schedule
+                                    .as_ref()
+                                    .and_then(ProbeSchedule::next_send_deadline),
+                            )
                            .min();
                    }
                }
                TargetState::Draining {
                    client, deadline, ..
                } => {
-                    #[cfg(test)]
-                    let defer_work = self.drain_test_hook.defer_work_until_deadline;
-                    #[cfg(not(test))]
-                    let defer_work = false;
                    non_send_deadline = non_send_deadline
                        .into_iter()
-                        .chain(
-                            (!defer_work)
-                                .then(|| client.next_probe_timeout_deadline())
-                                .flatten(),
-                        )
+                        .chain(client.next_probe_timeout_deadline())
                        .chain(Some(*deadline))
                        .min();
                }
@@ -2289,6 +2250,7 @@ fn build_task(
            }
        })?;
        runtimes.push(TargetRuntime {
+            schedule: None,
            instance: TargetInstance {
                id: target.id.clone(),
                generation,
@@ -2378,16 +2340,6 @@ fn build_task(
        final_outcome: None,
        next_generation,
        applied_command_sequence: 0,
-        #[cfg(test)]
-        event_observations: None,
-        #[cfg(test)]
-        stagger_observations: None,
-        #[cfg(test)]
-        drain_test_hook: DrainTestHook::default(),
-        #[cfg(test)]
-        timeout_inspections: 0,
-        #[cfg(test)]
-        deadline_inspections: 0,
    };
    let handle = ManagedClientHandle {
        stop,
@@ -2395,8 +2347,6 @@ fn build_task(
        max_live_target_generations,
        status: status_receiver,
        events: weak_events,
-        #[cfg(test)]
-        update_submission_hook: None,
    };
    Ok((task, handle))
 }
@@ -2437,7 +2387,3 @@ fn close_timeout_failure() -> ManagedTargetFailure {
        message: Arc::from("best-effort close did not become writable before its deadline"),
    }
 }
-
-#[cfg(test)]
-#[path = "tests.rs"]
-mod tests;
@@ -56,180 +56,3 @@ impl From<ReceiveMeta> for PacketMeta {
        }
    }
 }
-
-#[cfg(test)]
-mod tests {
-    use std::time::{Duration, SystemTime};
-
-    use super::{ReceiveMeta, MAX_KERNEL_RX_LAG};
-    use crate::event::PacketMeta;
-
-    fn userspace_wall() -> SystemTime {
-        SystemTime::UNIX_EPOCH + Duration::from_secs(1_700_000_000)
-    }
-
-    fn meta_with_kernel_rx(kernel_rx_timestamp: SystemTime) -> ReceiveMeta {
-        ReceiveMeta {
-            traffic_class: None,
-            kernel_rx_timestamp: Some(kernel_rx_timestamp),
-        }
-    }
-
-    #[test]
-    fn preferred_receive_wall_without_kernel_timestamp_uses_userspace_sample() {
-        let userspace = userspace_wall();
-
-        assert_eq!(
-            ReceiveMeta::default().preferred_receive_wall(userspace),
-            userspace
-        );
-    }
-
-    #[test]
-    fn preferred_receive_wall_uses_plausible_earlier_kernel_timestamp() {
-        let userspace = userspace_wall();
-        let kernel = userspace - Duration::from_micros(80);
-
-        assert_eq!(
-            meta_with_kernel_rx(kernel).preferred_receive_wall(userspace),
-            kernel
-        );
-    }
-
-    #[test]
-    fn preferred_receive_wall_accepts_kernel_timestamp_equal_to_userspace_sample() {
-        let userspace = userspace_wall();
-
-        assert_eq!(
-            meta_with_kernel_rx(userspace).preferred_receive_wall(userspace),
-            userspace
-        );
-    }
-
-    #[test]
-    fn preferred_receive_wall_rejects_kernel_timestamp_later_than_userspace_sample() {
-        let userspace = userspace_wall();
-        let kernel = userspace + Duration::from_nanos(1);
-
-        assert_eq!(
-            meta_with_kernel_rx(kernel).preferred_receive_wall(userspace),
-            userspace
-        );
-    }
-
-    #[test]
-    fn preferred_receive_wall_accepts_kernel_timestamp_exactly_at_the_lag_bound() {
-        // The bound is inclusive: a lag of exactly MAX_KERNEL_RX_LAG is
-        // still accepted, one nanosecond more is not.
-        let userspace = userspace_wall();
-        let at_bound = userspace - MAX_KERNEL_RX_LAG;
-        let past_bound = userspace - MAX_KERNEL_RX_LAG - Duration::from_nanos(1);
-
-        assert_eq!(
-            meta_with_kernel_rx(at_bound).preferred_receive_wall(userspace),
-            at_bound
-        );
-        assert_eq!(
-            meta_with_kernel_rx(past_bound).preferred_receive_wall(userspace),
-            userspace
-        );
-    }
-
-    #[test]
-    fn preferred_receive_wall_rejects_implausibly_old_kernel_timestamp() {
-        let userspace = userspace_wall();
-        let kernel = SystemTime::UNIX_EPOCH;
-
-        assert_eq!(
-            meta_with_kernel_rx(kernel).preferred_receive_wall(userspace),
-            userspace
-        );
-    }
-
-    #[test]
-    fn preferred_receive_wall_handles_extreme_timestamps_without_panicking() {
-        let userspace = userspace_wall();
-        let far_future = SystemTime::UNIX_EPOCH + Duration::from_secs(u64::from(u32::MAX)) * 4;
-        let before_epoch = SystemTime::UNIX_EPOCH - Duration::from_secs(u64::from(u32::MAX));
-
-        assert_eq!(
-            meta_with_kernel_rx(far_future).preferred_receive_wall(userspace),
-            userspace
-        );
-        assert_eq!(
-            meta_with_kernel_rx(before_epoch).preferred_receive_wall(userspace),
-            userspace
-        );
-        assert_eq!(
-            ReceiveMeta::default().preferred_receive_wall(before_epoch),
-            before_epoch
-        );
-    }
-
-    #[test]
-    fn metadata_preserves_kernel_timestamp_rejected_for_measurement() {
-        let userspace = userspace_wall();
-        let rejected = userspace + Duration::from_secs(30);
-        let meta = meta_with_kernel_rx(rejected);
-
-        assert_eq!(meta.preferred_receive_wall(userspace), userspace);
-        assert_eq!(
-            PacketMeta::from(meta).kernel_rx_timestamp,
-            Some(rejected),
-            "observed metadata must survive rejection as a measurement endpoint"
-        );
-    }
-
-    #[test]
-    fn metadata_observed_traffic_class_zero_preserves_observed_zero() {
-        let packet_meta = PacketMeta::from(ReceiveMeta {
-            traffic_class: Some(0),
-            kernel_rx_timestamp: None,
-        });
-
-        assert_eq!(packet_meta.traffic_class, Some(0));
-        assert_eq!(packet_meta.dscp, Some(0));
-        assert_eq!(packet_meta.ecn, Some(0));
-        assert_eq!(packet_meta.kernel_rx_timestamp, None);
-    }
-
-    #[test]
-    fn metadata_observed_traffic_class_derives_dscp_and_ecn() {
-        let packet_meta = PacketMeta::from(ReceiveMeta {
-            traffic_class: Some(184),
-            kernel_rx_timestamp: None,
-        });
-
-        assert_eq!(packet_meta.traffic_class, Some(184));
-        assert_eq!(packet_meta.dscp, Some(46));
-        assert_eq!(packet_meta.ecn, Some(0));
-        assert_eq!(packet_meta.kernel_rx_timestamp, None);
-
-        let packet_meta = PacketMeta::from(ReceiveMeta {
-            traffic_class: Some(186),
-            kernel_rx_timestamp: None,
-        });
-
-        assert_eq!(packet_meta.traffic_class, Some(186));
-        assert_eq!(packet_meta.dscp, Some(46));
-        assert_eq!(packet_meta.ecn, Some(2));
-        assert_eq!(packet_meta.kernel_rx_timestamp, None);
-    }
-
-    #[test]
-    fn metadata_mapping_preserves_none_vs_observed_zero() {
-        let unavailable = PacketMeta::from(ReceiveMeta::default());
-        let observed_zero = PacketMeta::from(ReceiveMeta {
-            traffic_class: Some(0),
-            kernel_rx_timestamp: None,
-        });
-
-        assert_eq!(unavailable.traffic_class, None);
-        assert_eq!(unavailable.dscp, None);
-        assert_eq!(unavailable.ecn, None);
-
-        assert_eq!(observed_zero.traffic_class, Some(0));
-        assert_eq!(observed_zero.dscp, Some(0));
-        assert_eq!(observed_zero.ecn, Some(0));
-    }
-}
@@ -1,5 +1,5 @@
 use std::{
-    collections::{HashMap, HashSet, TryReserveError, VecDeque},
+    collections::{HashMap, HashSet, VecDeque},
    time::{Instant, SystemTime},
 };

@@ -39,7 +39,8 @@ pub(crate) struct PendingProbe {
    /// eligible only for upstream one-way delay after local plausibility
    /// validation against `tx_not_before_wall` (see `compute_one_way`'s
    /// `preferred_send_wall`). `sent_at` remains the userspace fallback for
-    /// upstream one-way delay when this is absent or implausible.
+    /// upstream one-way delay when this is absent, implausible, or kernel-ID
+    /// correlation was invalidated by a failed probe submission.
    pub kernel_tx_timestamp: Option<SystemTime>,
 }

@@ -84,7 +85,12 @@ impl PendingMap {
            });
        }
        if self.map.len() == self.map.capacity() {
-            self.map.try_reserve(1).map_err(pending_allocation_failed)?;
+            self.map
+                .try_reserve(1)
+                .map_err(|source| ClientError::AllocationFailed {
+                    operation: "pending probe storage",
+                    source,
+                })?;
        }
        Ok(())
    }
@@ -185,8 +191,8 @@ impl PendingMap {
        ExpiredBatch { probes, more_due }
    }

-    pub fn len(&self) -> usize {
-        self.map.len()
+    pub fn is_empty(&self) -> bool {
+        self.map.is_empty()
    }

    /// Mutable access to a still-pending probe by wire sequence, without
@@ -197,14 +203,13 @@ impl PendingMap {
        self.map.get_mut(&wire_seq).map(|entry| &mut entry.probe)
    }

-    #[cfg(any(feature = "tokio", test))]
    pub fn next_timeout_deadline(&self) -> Option<Instant> {
        self.first
            .and_then(|wire_seq| self.map.get(&wire_seq))
            .map(|entry| entry.probe.timeout_at)
    }

-    #[cfg(any(feature = "tokio", test))]
+    #[cfg(feature = "tokio")]
    pub fn latest_timeout_deadline(&self) -> Option<Instant> {
        self.last
            .and_then(|wire_seq| self.map.get(&wire_seq))
@@ -233,35 +238,6 @@ impl PendingMap {
            );
        }
    }
-
-    #[cfg(test)]
-    pub fn contains(&self, wire_seq: u32) -> bool {
-        self.map.contains_key(&wire_seq)
-    }
-
-    #[cfg(test)]
-    pub fn capacity(&self) -> usize {
-        self.map.capacity()
-    }
-
-    #[cfg(test)]
-    pub fn linkage(&self) -> (Option<u32>, Option<u32>) {
-        (self.first, self.last)
-    }
-
-    #[cfg(test)]
-    pub fn entry_links(&self, wire_seq: u32) -> Option<(Option<u32>, Option<u32>)> {
-        self.map
-            .get(&wire_seq)
-            .map(|entry| (entry.previous, entry.next))
-    }
-}
-
-fn pending_allocation_failed(source: TryReserveError) -> ClientError {
-    ClientError::AllocationFailed {
-        operation: "pending probe storage",
-        source,
-    }
 }

 #[derive(Debug)]
@@ -312,31 +288,11 @@ impl TimedOutMap {
        self.map.get_mut(&wire_seq)
    }

-    pub fn clear(&mut self) {
-        self.map.clear();
-        self.insertion_order.clear();
-    }
-
-    #[cfg(test)]
-    pub fn len(&self) -> usize {
-        self.map.len()
-    }
-
    #[cfg(feature = "tokio")]
    pub fn latest_timeout_deadline(&self) -> Option<Instant> {
        self.map.values().map(|probe| probe.timeout_at).max()
    }

-    #[cfg(test)]
-    pub fn contains(&self, wire_seq: u32) -> bool {
-        self.map.contains_key(&wire_seq)
-    }
-
-    #[cfg(test)]
-    fn insertion_order_len(&self) -> usize {
-        self.insertion_order.len()
-    }
-
    fn evict_oldest(&mut self) {
        while let Some(oldest_key) = self.insertion_order.pop_front() {
            if self.map.remove(&oldest_key).is_some() {
@@ -419,263 +375,17 @@ mod tests {
        }
    }

-    fn insert(map: &mut PendingMap, probe: PendingProbe) {
-        map.preflight_insert(probe.wire_seq).unwrap();
-        map.commit_insert(probe);
-    }
-
+    // Public loss/reply events cannot reveal leaked retention bookkeeping.
    #[test]
-    fn pending_map_rejects_over_capacity() {
-        let mut map = PendingMap::new(2);
-        let now = Instant::now();
-        map.preflight_insert(0).unwrap();
-        map.commit_insert(pending(0, now + Duration::from_secs(4)));
-        map.preflight_insert(1).unwrap();
-        map.commit_insert(pending(1, now + Duration::from_secs(4)));
-        assert!(matches!(
-            map.preflight_insert(2),
-            Err(ClientError::PendingLimitExceeded { limit: 2 })
-        ));
-    }
-
-    #[test]
-    fn pending_map_preflight_reserves_without_changing_contents() {
-        let mut map = PendingMap::new(2);
-        let initial_capacity = map.capacity();
-
-        map.preflight_insert(7).unwrap();
-        let reserved_capacity = map.capacity();
-        assert!(reserved_capacity >= initial_capacity);
-        assert_eq!(map.len(), 0);
-        assert!(!map.contains(7));
-
-        map.preflight_insert(7).unwrap();
-        assert_eq!(map.capacity(), reserved_capacity);
-        assert_eq!(map.len(), 0);
-        assert!(!map.contains(7));
-    }
-
-    #[test]
-    fn pending_map_preflight_rejects_sequence_collision() {
-        let mut map = PendingMap::new(2);
-        let now = Instant::now();
-        map.preflight_insert(9).unwrap();
-        map.commit_insert(pending(9, now));
-
-        assert!(matches!(
-            map.preflight_insert(9),
-            Err(ClientError::PendingSequenceCollision { seq: 9 })
-        ));
-        assert_eq!(map.len(), 1);
-    }
-
-    #[test]
-    fn pending_map_allocation_failure_maps_to_dedicated_error() {
-        let mut map = HashMap::<u32, PendingProbe>::new();
-        let source = map.try_reserve(usize::MAX).unwrap_err();
-
-        assert!(matches!(
-            pending_allocation_failed(source),
-            ClientError::AllocationFailed {
-                operation: "pending probe storage",
-                ..
-            }
-        ));
-    }
-
-    #[test]
-    fn pending_map_unlinks_head_middle_and_tail_and_updates_extrema() {
-        let mut map = PendingMap::new(4);
-        let now = Instant::now();
-        insert(&mut map, pending(1, now + Duration::from_secs(1)));
-        insert(&mut map, pending(2, now + Duration::from_secs(2)));
-        insert(&mut map, pending(3, now + Duration::from_secs(3)));
-
-        assert_eq!(
-            map.next_timeout_deadline(),
-            Some(now + Duration::from_secs(1))
-        );
-        assert_eq!(
-            map.latest_timeout_deadline(),
-            Some(now + Duration::from_secs(3))
-        );
-        assert_eq!(map.linkage(), (Some(1), Some(3)));
-        assert_eq!(map.entry_links(1), Some((None, Some(2))));
-        assert_eq!(map.entry_links(2), Some((Some(1), Some(3))));
-        assert_eq!(map.entry_links(3), Some((Some(2), None)));
-
-        assert!(map.remove(2).is_some());
-        assert_eq!(
-            map.next_timeout_deadline(),
-            Some(now + Duration::from_secs(1))
-        );
-        assert_eq!(
-            map.latest_timeout_deadline(),
-            Some(now + Duration::from_secs(3))
-        );
-        assert_eq!(map.linkage(), (Some(1), Some(3)));
-        assert_eq!(map.entry_links(1), Some((None, Some(3))));
-        assert_eq!(map.entry_links(3), Some((Some(1), None)));
-
-        assert!(map.remove(1).is_some());
-        assert_eq!(
-            map.next_timeout_deadline(),
-            Some(now + Duration::from_secs(3))
-        );
-        assert_eq!(
-            map.latest_timeout_deadline(),
-            Some(now + Duration::from_secs(3))
-        );
-        assert_eq!(map.linkage(), (Some(3), Some(3)));
-        assert_eq!(map.entry_links(3), Some((None, None)));
-
-        assert!(map.remove(3).is_some());
-        assert_eq!(map.next_timeout_deadline(), None);
-        assert_eq!(map.latest_timeout_deadline(), None);
-        assert_eq!(map.linkage(), (None, None));
-    }
-
-    #[test]
-    fn pending_map_bounded_expiration_matches_exhaustive_order() {
-        let now = Instant::now();
-        let probes = [
-            pending(1, now + Duration::from_secs(1)),
-            pending(2, now + Duration::from_secs(2)),
-            pending(3, now + Duration::from_secs(3)),
-            pending(4, now + Duration::from_secs(4)),
-        ];
-        let mut bounded = PendingMap::new(probes.len());
-        let mut exhaustive = PendingMap::new(probes.len());
-        for probe in probes.iter().cloned() {
-            insert(&mut bounded, probe.clone());
-            insert(&mut exhaustive, probe);
-        }
-
-        let empty = bounded.drain_expired_bounded(now + Duration::from_secs(4), 0);
-        assert!(empty.probes.is_empty());
-        assert!(empty.more_due);
-        assert_eq!(bounded.linkage(), (Some(1), Some(4)));
-
-        let mut actual = Vec::new();
-        loop {
-            let batch = bounded.drain_expired_bounded(now + Duration::from_secs(4), 2);
-            actual.extend(batch.probes.into_iter().map(|probe| probe.wire_seq));
-            if !batch.more_due {
-                break;
-            }
-        }
-        let expected = exhaustive
-            .drain_expired_bounded(now + Duration::from_secs(4), usize::MAX)
-            .probes
-            .into_iter()
-            .map(|probe| probe.wire_seq)
-            .collect::<Vec<_>>();
-
-        assert_eq!(actual, expected);
-        assert_eq!(actual, vec![1, 2, 3, 4]);
-        assert_eq!(bounded.linkage(), (None, None));
-    }
-
-    #[test]
-    fn pending_map_sequence_reuse_leaves_no_stale_link() {
-        let mut map = PendingMap::new(1);
-        let now = Instant::now();
-        insert(&mut map, pending(7, now));
-        assert!(map.remove(7).is_some());
-        insert(&mut map, pending(7, now + Duration::from_secs(1)));
-
-        assert!(map.drain_expired_bounded(now, usize::MAX).probes.is_empty());
-        assert_eq!(map.linkage(), (Some(7), Some(7)));
-        assert_eq!(map.entry_links(7), Some((None, None)));
-        assert_eq!(
-            map.drain_expired_bounded(now + Duration::from_secs(1), usize::MAX)
-                .probes
-                .into_iter()
-                .map(|probe| probe.wire_seq)
-                .collect::<Vec<_>>(),
-            vec![7]
-        );
-        assert_eq!(map.linkage(), (None, None));
-    }
-
-    #[test]
-    fn pending_map_commit_uses_only_preflighted_map_capacity() {
-        let mut map = PendingMap::new(2);
-        let now = Instant::now();
-        map.preflight_insert(7).unwrap();
-        let capacity = map.capacity();
-
-        map.commit_insert(pending(7, now));
-
-        assert_eq!(map.capacity(), capacity);
-        assert_eq!(map.len(), 1);
-        assert_eq!(map.linkage(), (Some(7), Some(7)));
-    }
-
-    #[test]
-    fn pending_map_mixed_removals_preserve_links() {
-        let mut map = PendingMap::new(4);
-        let now = Instant::now();
-        for seq in 1..=4 {
-            insert(
-                &mut map,
-                pending(seq, now + Duration::from_secs(u64::from(seq))),
-            );
-        }
-
-        assert!(map.remove(2).is_some());
-        assert_eq!(map.entry_links(1), Some((None, Some(3))));
-        assert_eq!(map.entry_links(3), Some((Some(1), Some(4))));
-        let expired = map.drain_expired_bounded(now + Duration::from_secs(3), usize::MAX);
-        assert_eq!(
-            expired
-                .probes
-                .into_iter()
-                .map(|probe| probe.wire_seq)
-                .collect::<Vec<_>>(),
-            vec![1, 3]
-        );
-        assert_eq!(map.linkage(), (Some(4), Some(4)));
-        assert!(map.remove(4).is_some());
-        assert_eq!(map.linkage(), (None, None));
-    }
-
-    #[test]
-    fn bounded_probe_tracking_evicts_oldest_entries() {
-        let mut set = CompletedSet::new(3);
-        set.insert(0);
-        set.insert(1);
-        set.insert(2);
-        assert!(set.contains(0));
-        assert!(set.contains(1));
-        assert!(set.contains(2));
-        set.insert(3);
-        assert_eq!(set.set.len(), 3);
-        assert!(!set.contains(0));
-        assert!(set.contains(3));
-
-        let mut map = TimedOutMap::new(2);
-        let now = Instant::now();
-        map.insert(pending(0, now));
-        map.insert(pending(1, now));
-        map.insert(pending(2, now));
-
-        assert_eq!(map.len(), 2);
-        assert!(map.remove(0).is_none());
-        assert!(map.remove(1).is_some());
-        assert!(map.remove(2).is_some());
-    }
-
-    #[test]
-    fn timed_out_map_remove_prunes_insertion_order() {
+    fn timed_out_retention_stays_bounded_after_repeated_removals() {
        let mut map = TimedOutMap::new(4);
        let now = Instant::now();

        for i in 0..20 {
            map.insert(pending(i, now));
            assert!(map.remove(i).is_some());
-            assert_eq!(map.len(), 0);
-            assert_eq!(map.insertion_order_len(), 0);
+            assert!(map.map.len() <= 4);
+            assert!(map.insertion_order.len() <= 4);
        }
    }
 }
@@ -111,80 +111,3 @@ pub(crate) fn drain_tx_timestamps<S: std::os::fd::AsRawFd>(
 ) -> io::Result<()> {
    linux::drain_tx_timestamps(socket, on_timestamp)
 }
-
-#[cfg(test)]
-mod tests {
-    use std::net::UdpSocket;
-
-    use crate::{metadata::ReceiveMeta, receive::recv_datagram, timing::ClientTimestamp};
-
-    fn connected_loopback_pair() -> (UdpSocket, UdpSocket) {
-        let a = UdpSocket::bind("127.0.0.1:0").unwrap();
-        let b = UdpSocket::bind("127.0.0.1:0").unwrap();
-        a.connect(b.local_addr().unwrap()).unwrap();
-        b.connect(a.local_addr().unwrap()).unwrap();
-        (a, b)
-    }
-
-    #[test]
-    fn fallback_receive_returns_length() {
-        let (sender, receiver) = connected_loopback_pair();
-        sender.send(b"hello").unwrap();
-
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-
-        assert_eq!(datagram.len, 5);
-        assert_eq!(&buf[..datagram.len], b"hello");
-    }
-
-    #[test]
-    fn fallback_receive_returns_default_metadata() {
-        let (sender, receiver) = connected_loopback_pair();
-        sender.send(b"meta").unwrap();
-
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-
-        assert_eq!(datagram.meta, ReceiveMeta::default());
-    }
-
-    #[test]
-    fn fallback_receive_captures_timestamp_after_successful_receive() {
-        let (sender, receiver) = connected_loopback_pair();
-        sender.send(b"time").unwrap();
-
-        let before = ClientTimestamp::now();
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-        let after = ClientTimestamp::now();
-
-        assert!(datagram.received_at.mono >= before.mono);
-        assert!(datagram.received_at.mono <= after.mono);
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_try_receive_preserves_fallback_metadata_and_would_block() {
-        let runtime = tokio::runtime::Builder::new_current_thread()
-            .enable_io()
-            .build()
-            .unwrap();
-
-        runtime.block_on(async {
-            let (sender, receiver) = connected_loopback_pair();
-            receiver.set_nonblocking(true).unwrap();
-            let receiver = tokio::net::UdpSocket::from_std(receiver).unwrap();
-            sender.send(b"tokio").unwrap();
-            receiver.readable().await.unwrap();
-
-            let mut buf = [0_u8; 16];
-            let datagram = super::try_recv_tokio_datagram(&receiver, &mut buf).unwrap();
-            assert_eq!(&buf[..datagram.len], b"tokio");
-            assert_eq!(datagram.meta, ReceiveMeta::default());
-
-            let error = super::try_recv_tokio_datagram(&receiver, &mut buf).unwrap_err();
-            assert_eq!(error.kind(), std::io::ErrorKind::WouldBlock);
-        });
-    }
-}
@@ -12,14 +12,17 @@
 //! After a successful Open, the client adapter best-effort upgrades the
 //! socket from [`RX_TIMESTAMPING_FLAGS`] to [`error_queue::TX_TIMESTAMPING_FLAGS`]
 //! via [`try_enable_tx_timestamping`]. When that succeeds, the automatic
-//! `SOF_TIMESTAMPING_OPT_ID` counter the kernel assigns to each successfully
-//! submitted datagram is used directly as the probe's wire sequence number
-//! (see the client crate's `AGENTS.md` for the correlation invariant this
-//! relies on). [`drain_tx_timestamps`] performs a small bounded, nonblocking
-//! read of `MSG_ERRQUEUE` so the adapter can opportunistically collect those
-//! timestamps without ever waiting for one. The observed kernel TX wall time
-//! is retained as metadata only; it is not consumed by any measurement in
-//! this change.
+//! `SOF_TIMESTAMPING_OPT_ID` counter normally tracks the probe wire sequence
+//! after successful sends, so it is used as a best-effort correlation ID.
+//! A kernel ID can theoretically be consumed by a send that later fails,
+//! desynchronizing that correlation. [`drain_tx_timestamps`] discards
+//! unmatched or implausible records; the userspace `sent_at` timestamp remains
+//! the fallback. After a probe send failure, correlation is disabled for that
+//! session so later IDs cannot be misattributed. It performs a small bounded,
+//! nonblocking read of
+//! `MSG_ERRQUEUE` so the adapter can opportunistically collect timestamps
+//! without ever waiting for one. A plausible kernel TX wall time is used only
+//! for upstream one-way delay; RTT retains the userspace send instant.

 use std::{
    io::{self, IoSliceMut},
@@ -158,12 +161,12 @@ fn recv_datagram_fd(
    buf: &mut [u8],
    flags: MsgFlags,
 ) -> Result<ReceivedDatagram, io::Error> {
-    let mut control = ControlBuffer::new();
+    let mut control = ControlBuffer([0; CONTROL_LEN]);
    let mut iov = [IoSliceMut::new(buf)];

    // The socket is connected, so the source address is not needed; `()` skips
    // copying it out.
-    let msg = recvmsg::<()>(socket_fd, &mut iov, Some(control.as_mut_slice()), flags)?;
+    let msg = recvmsg::<()>(socket_fd, &mut iov, Some(&mut control.0), flags)?;
    let received_at = ClientTimestamp::now();

    Ok(ReceivedDatagram {
@@ -212,343 +215,3 @@ fn system_time_from_timespec(timespec: TimeSpec) -> Option<SystemTime> {
 /// `cmsghdr` alignment, which 8-byte alignment covers on supported targets.
 #[repr(align(8))]
 struct ControlBuffer([u8; CONTROL_LEN]);
-
-impl ControlBuffer {
-    fn new() -> Self {
-        Self([0; CONTROL_LEN])
-    }
-
-    fn as_mut_slice(&mut self) -> &mut [u8] {
-        &mut self.0
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::{
-        io,
-        net::{SocketAddr, UdpSocket},
-        time::{Duration, UNIX_EPOCH},
-    };
-
-    use nix::sys::time::TimeSpec;
-
-    use crate::{
-        event::PacketMeta,
-        receive::{configure_receive_metadata, recv_datagram},
-        socket_options::apply_traffic_class_to_socket,
-        timing::ClientTimestamp,
-    };
-
-    fn connected_ipv4_loopback_pair() -> (UdpSocket, UdpSocket) {
-        let a = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        let b = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        a.connect(b.local_addr().unwrap()).unwrap();
-        b.connect(a.local_addr().unwrap()).unwrap();
-        a.set_read_timeout(Some(Duration::from_millis(200)))
-            .unwrap();
-        b.set_read_timeout(Some(Duration::from_millis(200)))
-            .unwrap();
-        (a, b)
-    }
-
-    fn connected_ipv6_loopback_pair() -> Option<(UdpSocket, UdpSocket)> {
-        let bind_addr = SocketAddr::from(([0, 0, 0, 0, 0, 0, 0, 1], 0));
-        let a = match UdpSocket::bind(bind_addr) {
-            Ok(socket) => socket,
-            Err(error) if is_unavailable_ipv6_loopback(&error) => {
-                eprintln!(
-                    "skipping IPv6 ancillary receive test: IPv6 loopback unavailable: {error}"
-                );
-                return None;
-            }
-            Err(error) => panic!("{error}"),
-        };
-        let b = match UdpSocket::bind(bind_addr) {
-            Ok(socket) => socket,
-            Err(error) if is_unavailable_ipv6_loopback(&error) => {
-                eprintln!(
-                    "skipping IPv6 ancillary receive test: IPv6 loopback unavailable: {error}"
-                );
-                return None;
-            }
-            Err(error) => panic!("{error}"),
-        };
-        match a.connect(b.local_addr().unwrap()) {
-            Ok(()) => {}
-            Err(error) if is_unavailable_ipv6_loopback(&error) => {
-                eprintln!(
-                    "skipping IPv6 ancillary receive test: IPv6 loopback unavailable: {error}"
-                );
-                return None;
-            }
-            Err(error) => panic!("{error}"),
-        }
-        match b.connect(a.local_addr().unwrap()) {
-            Ok(()) => {}
-            Err(error) if is_unavailable_ipv6_loopback(&error) => {
-                eprintln!(
-                    "skipping IPv6 ancillary receive test: IPv6 loopback unavailable: {error}"
-                );
-                return None;
-            }
-            Err(error) => panic!("{error}"),
-        }
-        a.set_read_timeout(Some(Duration::from_millis(200)))
-            .unwrap();
-        b.set_read_timeout(Some(Duration::from_millis(200)))
-            .unwrap();
-        Some((a, b))
-    }
-
-    #[test]
-    fn recvmsg_receive_returns_length_payload_and_timestamp() {
-        let (sender, receiver) = connected_ipv4_loopback_pair();
-        configure_receive_metadata(&receiver, sender.local_addr().unwrap()).unwrap();
-        sender.send(b"hello").unwrap();
-
-        let before = ClientTimestamp::now();
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-        let after = ClientTimestamp::now();
-
-        assert_eq!(datagram.len, 5);
-        assert_eq!(&buf[..datagram.len], b"hello");
-        assert!(datagram.received_at.mono >= before.mono);
-        assert!(datagram.received_at.mono <= after.mono);
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_recvmsg_would_block_clears_readiness() {
-        let runtime = tokio::runtime::Builder::new_current_thread()
-            .enable_io()
-            .enable_time()
-            .build()
-            .unwrap();
-
-        runtime.block_on(async {
-            let (sender, receiver) = connected_ipv4_loopback_pair();
-            configure_receive_metadata(&receiver, sender.local_addr().unwrap()).unwrap();
-            receiver.set_nonblocking(true).unwrap();
-            let receiver = tokio::net::UdpSocket::from_std(receiver).unwrap();
-            let mut buf = [0_u8; 16];
-
-            sender.send(b"first").unwrap();
-            tokio::time::timeout(Duration::from_secs(1), receiver.readable())
-                .await
-                .expect("initial readability timed out")
-                .unwrap();
-
-            let first = super::try_recv_tokio_datagram(&receiver, &mut buf).unwrap();
-            assert_eq!(&buf[..first.len], b"first");
-
-            let error = super::try_recv_tokio_datagram(&receiver, &mut buf).unwrap_err();
-            assert_eq!(error.kind(), io::ErrorKind::WouldBlock);
-
-            assert!(
-                tokio::time::timeout(Duration::from_millis(20), receiver.readable())
-                    .await
-                    .is_err(),
-                "readable completed from stale readiness after recvmsg WouldBlock"
-            );
-
-            sender.send(b"second").unwrap();
-            tokio::time::timeout(Duration::from_secs(1), receiver.readable())
-                .await
-                .expect("second readability timed out")
-                .unwrap();
-
-            let second = super::try_recv_tokio_datagram(&receiver, &mut buf).unwrap();
-            assert_eq!(&buf[..second.len], b"second");
-        });
-    }
-
-    #[test]
-    fn kernel_rx_timestamp_metadata_is_observed_when_kernel_provides_it() {
-        let (sender, receiver) = connected_ipv4_loopback_pair();
-        configure_receive_metadata(&receiver, sender.local_addr().unwrap()).unwrap();
-        sender.send(b"stamp").unwrap();
-
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-        assert_eq!(datagram.len, 5);
-        assert_eq!(&buf[..datagram.len], b"stamp");
-        let Some(timestamp) = datagram.meta.kernel_rx_timestamp else {
-            eprintln!(
-                "skipping kernel timestamp assertion: kernel did not provide SCM_TIMESTAMPING"
-            );
-            return;
-        };
-
-        let duration = timestamp.duration_since(UNIX_EPOCH).unwrap();
-        assert!(duration.as_nanos() > 0);
-    }
-
-    #[test]
-    fn kernel_rx_timestamp_and_traffic_class_coexist() {
-        let (sender, receiver) = connected_ipv4_loopback_pair();
-        configure_receive_metadata(&receiver, sender.local_addr().unwrap()).unwrap();
-        apply_traffic_class_to_socket(&sender, receiver.local_addr().unwrap(), 184).unwrap();
-        sender.send(b"both").unwrap();
-
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-        assert_eq!(&buf[..datagram.len], b"both");
-
-        // Both cmsgs are requested on this socket; the parser must not
-        // depend on the order the kernel emits them in to observe either.
-        if datagram.meta.kernel_rx_timestamp.is_none() {
-            eprintln!("skipping combined assertion: kernel did not provide SCM_TIMESTAMPING");
-            return;
-        }
-        if datagram.meta.traffic_class.is_none() {
-            eprintln!("skipping combined assertion: kernel did not provide IP_TOS");
-            return;
-        }
-        assert!(datagram.meta.kernel_rx_timestamp.is_some());
-        assert_eq!(datagram.meta.traffic_class.unwrap() & 0xfc, 184);
-    }
-
-    #[test]
-    fn ipv4_traffic_class_metadata_is_observed_when_kernel_provides_it() {
-        let (sender, receiver) = connected_ipv4_loopback_pair();
-        configure_receive_metadata(&receiver, sender.local_addr().unwrap()).unwrap();
-        apply_traffic_class_to_socket(&sender, receiver.local_addr().unwrap(), 184).unwrap();
-        sender.send(b"dscp").unwrap();
-
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-        let Some(traffic_class) = datagram.meta.traffic_class else {
-            eprintln!("skipping IPv4 ancillary metadata assertion: kernel did not provide IP_TOS");
-            return;
-        };
-
-        let packet_meta = PacketMeta::from(datagram.meta);
-        assert_eq!(traffic_class & 0xfc, 184);
-        assert_eq!(packet_meta.dscp, Some(46));
-        assert_eq!(packet_meta.ecn, Some(0));
-    }
-
-    #[test]
-    fn ipv6_traffic_class_metadata_is_observed_when_kernel_provides_it() {
-        let Some((sender, receiver)) = connected_ipv6_loopback_pair() else {
-            return;
-        };
-        configure_receive_metadata(&receiver, sender.local_addr().unwrap()).unwrap();
-        apply_traffic_class_to_socket(&sender, receiver.local_addr().unwrap(), 184).unwrap();
-        sender.send(b"dscp").unwrap();
-
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-        let Some(traffic_class) = datagram.meta.traffic_class else {
-            eprintln!(
-                "skipping IPv6 ancillary metadata assertion: kernel did not provide IPV6_TCLASS"
-            );
-            return;
-        };
-
-        let packet_meta = PacketMeta::from(datagram.meta);
-        assert_eq!(traffic_class & 0xfc, 184);
-        assert_eq!(packet_meta.dscp, Some(46));
-        assert_eq!(packet_meta.ecn, Some(0));
-    }
-
-    #[test]
-    fn observed_zero_traffic_class_preserves_some_zero() {
-        let (sender, receiver) = connected_ipv4_loopback_pair();
-        configure_receive_metadata(&receiver, sender.local_addr().unwrap()).unwrap();
-        sender.send(b"zero").unwrap();
-
-        let mut buf = [0_u8; 16];
-        let datagram = recv_datagram(&receiver, &mut buf).unwrap();
-        let Some(traffic_class) = datagram.meta.traffic_class else {
-            eprintln!("skipping observed-zero assertion: kernel did not provide IP_TOS");
-            return;
-        };
-
-        let packet_meta = PacketMeta::from(datagram.meta);
-        assert_eq!(traffic_class, 0);
-        assert_eq!(packet_meta.traffic_class, Some(0));
-        assert_eq!(packet_meta.dscp, Some(0));
-        assert_eq!(packet_meta.ecn, Some(0));
-    }
-
-    #[test]
-    fn timespec_conversion_accepts_valid_unix_timestamp() {
-        let timestamp = super::system_time_from_timespec(TimeSpec::new(1, 2)).unwrap();
-
-        assert_eq!(
-            timestamp.duration_since(UNIX_EPOCH).unwrap(),
-            Duration::new(1, 2)
-        );
-    }
-
-    #[test]
-    fn timespec_conversion_rejects_negative_or_invalid_values() {
-        assert_eq!(super::system_time_from_timespec(TimeSpec::new(-1, 0)), None);
-        assert_eq!(super::system_time_from_timespec(TimeSpec::new(0, -1)), None);
-        assert_eq!(
-            super::system_time_from_timespec(TimeSpec::new(0, 1_000_000_000)),
-            None
-        );
-    }
-
-    fn is_unavailable_ipv6_loopback(error: &io::Error) -> bool {
-        matches!(
-            error.kind(),
-            io::ErrorKind::AddrNotAvailable | io::ErrorKind::Unsupported
-        )
-    }
-
-    #[test]
-    fn try_enable_tx_timestamping_then_drain_reports_ids_through_the_adapter_api() {
-        let (socket, _peer) = connected_ipv4_loopback_pair();
-        // Mirrors production: RX-only first, then a best-effort upgrade.
-        configure_receive_metadata(&socket, socket.peer_addr().unwrap()).unwrap();
-
-        if !super::try_enable_tx_timestamping(&socket) {
-            eprintln!(
-                "skipping adapter-level TX timestamping smoke test: kernel/container denied \
-                 SO_TIMESTAMPING TX flags"
-            );
-            return;
-        }
-
-        if let Err(error) = socket.send(b"one") {
-            eprintln!("skipping adapter-level TX timestamping smoke test: send failed: {error}");
-            return;
-        }
-
-        let deadline = std::time::Instant::now() + Duration::from_secs(2);
-        let mut observed = None;
-        while observed.is_none() && std::time::Instant::now() < deadline {
-            super::drain_tx_timestamps(&socket, |id, timestamp| {
-                observed = Some((id, timestamp));
-            })
-            .unwrap();
-            std::thread::yield_now();
-        }
-
-        let Some((id, timestamp)) = observed else {
-            eprintln!(
-                "skipping adapter-level TX timestamping smoke test: no TX timestamp record \
-                 arrived within the poll deadline"
-            );
-            return;
-        };
-        assert_eq!(id, 0);
-        assert!(timestamp.duration_since(UNIX_EPOCH).unwrap() > Duration::ZERO);
-    }
-
-    #[test]
-    fn drain_tx_timestamps_is_a_bounded_nonblocking_no_op_on_an_untouched_socket() {
-        let (socket, _peer) = connected_ipv4_loopback_pair();
-        configure_receive_metadata(&socket, socket.peer_addr().unwrap()).unwrap();
-
-        let mut calls = 0_usize;
-        super::drain_tx_timestamps(&socket, |_, _| calls += 1).unwrap();
-
-        assert_eq!(calls, 0);
-    }
-}
@@ -103,10 +103,7 @@ pub(crate) fn classify(cmsgs: impl Iterator<Item = ControlMessageOwned>) -> Erro

    for cmsg in cmsgs {
        match cmsg {
-            ControlMessageOwned::Ipv4RecvErr(err, _) => {
-                extended_error = Some((err.ee_errno, err.ee_origin, err.ee_info, err.ee_data));
-            }
-            ControlMessageOwned::Ipv6RecvErr(err, _) => {
+            ControlMessageOwned::Ipv4RecvErr(err, _) | ControlMessageOwned::Ipv6RecvErr(err, _) => {
                extended_error = Some((err.ee_errno, err.ee_origin, err.ee_info, err.ee_data));
            }
            ControlMessageOwned::ScmTimestampsns(observed) => {
@@ -145,12 +142,6 @@ pub(crate) fn classify(cmsgs: impl Iterator<Item = ControlMessageOwned>) -> Erro
 #[repr(align(8))]
 struct ErrorQueueControlBuffer([u8; ERROR_QUEUE_CONTROL_LEN]);

-impl ErrorQueueControlBuffer {
-    fn new() -> Self {
-        Self([0; ERROR_QUEUE_CONTROL_LEN])
-    }
-}
-
 /// Nonblocking drain of a single record from `fd`'s `MSG_ERRQUEUE`.
 ///
 /// Returns `Ok(None)` when the queue is empty (`EAGAIN`/`EWOULDBLOCK`) — the
@@ -171,7 +162,7 @@ impl ErrorQueueControlBuffer {
 pub(crate) fn try_recv_error_queue_record(fd: RawFd) -> io::Result<Option<ErrorQueueRecord>> {
    let mut payload: [u8; 0] = [];
    let mut iov = [IoSliceMut::new(&mut payload)];
-    let mut control = ErrorQueueControlBuffer::new();
+    let mut control = ErrorQueueControlBuffer([0; ERROR_QUEUE_CONTROL_LEN]);

    match recvmsg::<()>(
        fd,
@@ -190,456 +181,3 @@ pub(crate) fn try_recv_error_queue_record(fd: RawFd) -> io::Result<Option<ErrorQ
        Err(errno) => Err(io::Error::from(errno)),
    }
 }
-
-#[cfg(test)]
-mod tests {
-    use std::{
-        net::{SocketAddr, UdpSocket},
-        os::fd::AsRawFd,
-        time::{Duration, Instant, UNIX_EPOCH},
-    };
-
-    use nix::sys::{
-        socket::{setsockopt, sockopt},
-        time::TimeSpec,
-    };
-
-    use super::*;
-
-    fn extended_error(
-        errno: u32,
-        origin: u8,
-        info: u32,
-        data: u32,
-    ) -> nix::libc::sock_extended_err {
-        nix::libc::sock_extended_err {
-            ee_errno: errno,
-            ee_origin: origin,
-            ee_type: 0,
-            ee_code: 0,
-            ee_pad: 0,
-            ee_info: info,
-            ee_data: data,
-        }
-    }
-
-    fn timestamps_with_system(system: TimeSpec) -> Timestamps {
-        Timestamps {
-            system,
-            hw_trans: TimeSpec::new(0, 0),
-            hw_raw: TimeSpec::new(0, 0),
-        }
-    }
-
-    fn send_timestamp_error(id: u32) -> ControlMessageOwned {
-        ControlMessageOwned::Ipv4RecvErr(
-            extended_error(
-                nix::libc::ENOMSG as u32,
-                nix::libc::SO_EE_ORIGIN_TIMESTAMPING,
-                SCM_TSTAMP_SND,
-                id,
-            ),
-            None,
-        )
-    }
-
-    #[test]
-    fn classifies_valid_send_timestamp_completion() {
-        let cmsgs = vec![
-            send_timestamp_error(7),
-            ControlMessageOwned::ScmTimestampsns(timestamps_with_system(TimeSpec::new(1, 2))),
-        ];
-
-        let record = classify(cmsgs.into_iter());
-
-        assert_eq!(
-            record,
-            ErrorQueueRecord::TxTimestamp {
-                id: 7,
-                timestamp: UNIX_EPOCH + Duration::new(1, 2),
-            }
-        );
-    }
-
-    #[test]
-    fn classifies_timestamp_origin_without_timestamp_as_malformed() {
-        let cmsgs = vec![send_timestamp_error(3)];
-
-        assert_eq!(
-            classify(cmsgs.into_iter()),
-            ErrorQueueRecord::MalformedOrUnsupportedTimestamp
-        );
-    }
-
-    #[test]
-    fn classifies_timestamp_origin_with_invalid_timespec_as_malformed() {
-        let cmsgs = vec![
-            send_timestamp_error(3),
-            ControlMessageOwned::ScmTimestampsns(timestamps_with_system(TimeSpec::new(-1, 0))),
-        ];
-
-        assert_eq!(
-            classify(cmsgs.into_iter()),
-            ErrorQueueRecord::MalformedOrUnsupportedTimestamp
-        );
-    }
-
-    #[test]
-    fn classifies_non_timestamp_extended_error_as_socket_error() {
-        let cmsgs = vec![ControlMessageOwned::Ipv4RecvErr(
-            extended_error(
-                nix::libc::ECONNREFUSED as u32,
-                nix::libc::SO_EE_ORIGIN_ICMP,
-                0,
-                0,
-            ),
-            None,
-        )];
-
-        assert_eq!(
-            classify(cmsgs.into_iter()),
-            ErrorQueueRecord::SocketError {
-                errno: nix::libc::ECONNREFUSED,
-                origin: nix::libc::SO_EE_ORIGIN_ICMP,
-            }
-        );
-    }
-
-    #[test]
-    fn classifies_timestamping_origin_with_wrong_completion_kind_as_malformed() {
-        // Same origin byte as a send-timestamp completion, but a different
-        // `ee_info` (e.g. SCM_TSTAMP_SCHED/ACK, which this client never
-        // requests). A timestamping-origin record must never become a
-        // fatal SocketError merely because it reports a completion kind we
-        // did not ask for; it stays timing metadata.
-        let cmsgs = vec![ControlMessageOwned::Ipv4RecvErr(
-            extended_error(
-                nix::libc::ENOMSG as u32,
-                nix::libc::SO_EE_ORIGIN_TIMESTAMPING,
-                1,
-                0,
-            ),
-            None,
-        )];
-
-        assert_eq!(
-            classify(cmsgs.into_iter()),
-            ErrorQueueRecord::MalformedOrUnsupportedTimestamp
-        );
-    }
-
-    #[test]
-    fn classifies_timestamping_origin_with_unexpected_errno_as_malformed() {
-        // Origin is the sole discriminator: even an origin==TIMESTAMPING
-        // record with a surprising errno (the kernel always reports ENOMSG
-        // for this origin, but classification must not assume that) is
-        // still timing metadata, never a real socket error.
-        let cmsgs = vec![ControlMessageOwned::Ipv4RecvErr(
-            extended_error(
-                nix::libc::ECONNREFUSED as u32,
-                nix::libc::SO_EE_ORIGIN_TIMESTAMPING,
-                SCM_TSTAMP_SND,
-                0,
-            ),
-            None,
-        )];
-
-        assert_eq!(
-            classify(cmsgs.into_iter()),
-            ErrorQueueRecord::MalformedOrUnsupportedTimestamp
-        );
-    }
-
-    #[test]
-    fn ignores_records_without_any_extended_error() {
-        let cmsgs = vec![ControlMessageOwned::Ipv4Tos(0)];
-
-        assert_eq!(classify(cmsgs.into_iter()), ErrorQueueRecord::Ignored);
-    }
-
-    #[test]
-    fn unknown_cmsgs_do_not_affect_classification() {
-        let cmsgs = vec![
-            ControlMessageOwned::Ipv4Tos(0),
-            send_timestamp_error(4),
-            ControlMessageOwned::ScmTimestampsns(timestamps_with_system(TimeSpec::new(9, 0))),
-        ];
-
-        assert_eq!(
-            classify(cmsgs.into_iter()),
-            ErrorQueueRecord::TxTimestamp {
-                id: 4,
-                timestamp: UNIX_EPOCH + Duration::new(9, 0),
-            }
-        );
-    }
-
-    #[test]
-    fn cmsg_order_does_not_affect_classification() {
-        let forward = classify(
-            vec![
-                send_timestamp_error(9),
-                ControlMessageOwned::ScmTimestampsns(timestamps_with_system(TimeSpec::new(5, 0))),
-            ]
-            .into_iter(),
-        );
-        let reversed = classify(
-            vec![
-                ControlMessageOwned::ScmTimestampsns(timestamps_with_system(TimeSpec::new(5, 0))),
-                send_timestamp_error(9),
-            ]
-            .into_iter(),
-        );
-
-        assert_eq!(forward, reversed);
-    }
-
-    /// Bounded poll for one error-queue record, since software TX timestamp
-    /// delivery is asynchronous even on loopback. Never sleeps hoping
-    /// delivery "probably" happened; it keeps polling until either a
-    /// record appears or the overall deadline passes.
-    fn poll_for_record(fd: RawFd, overall_timeout: Duration) -> Option<ErrorQueueRecord> {
-        let deadline = Instant::now() + overall_timeout;
-        loop {
-            if let Some(record) = try_recv_error_queue_record(fd).unwrap() {
-                return Some(record);
-            }
-            if Instant::now() >= deadline {
-                return None;
-            }
-            std::thread::yield_now();
-        }
-    }
-
-    fn tx_timestamped_loopback_socket() -> Option<(UdpSocket, UdpSocket)> {
-        let socket = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        // Held for the caller's lifetime: if this peer socket were dropped,
-        // its port would close and subsequent sends would fail with
-        // ECONNREFUSED once the kernel reports ICMP port-unreachable.
-        let peer = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        socket.connect(peer.local_addr().unwrap()).unwrap();
-
-        match setsockopt(&socket, sockopt::Timestamping, &TX_TIMESTAMPING_FLAGS) {
-            Ok(()) => Some((socket, peer)),
-            Err(error) => {
-                eprintln!(
-                    "skipping TX timestamping smoke test: kernel/container denied \
-                     SO_TIMESTAMPING TX flags: {error}"
-                );
-                None
-            }
-        }
-    }
-
-    #[test]
-    fn automatic_opt_id_increments_sequentially_across_separate_sends() {
-        let Some((socket, _peer)) = tx_timestamped_loopback_socket() else {
-            return;
-        };
-        let fd = socket.as_raw_fd();
-
-        // Under heavy parallel test load, loopback UDP sends can
-        // occasionally surface a stale ICMP-derived socket error unrelated
-        // to this test's own sockets. That is an environmental condition,
-        // not a claim this test makes about kernel TX timestamp behavior,
-        // so it is a skip rather than a failure.
-        if let Err(error) = socket.send(b"first") {
-            eprintln!("skipping automatic OPT_ID assertion: first send failed: {error}");
-            return;
-        }
-        let Some(first) = poll_for_record(fd, Duration::from_secs(2)) else {
-            eprintln!(
-                "skipping automatic OPT_ID assertion: no TX timestamp record was \
-                 delivered within the poll deadline"
-            );
-            return;
-        };
-        assert!(
-            matches!(first, ErrorQueueRecord::TxTimestamp { id: 0, .. }),
-            "expected first send to report id 0, got {first:?}"
-        );
-
-        if let Err(error) = socket.send(b"second") {
-            eprintln!("skipping automatic OPT_ID assertion: second send failed: {error}");
-            return;
-        }
-        let Some(second) = poll_for_record(fd, Duration::from_secs(2)) else {
-            eprintln!(
-                "skipping automatic OPT_ID assertion: no TX timestamp record was \
-                 delivered for the second send within the poll deadline"
-            );
-            return;
-        };
-        assert!(
-            matches!(second, ErrorQueueRecord::TxTimestamp { id: 1, .. }),
-            "expected second send to report id 1, got {second:?}"
-        );
-    }
-
-    #[test]
-    fn rx_only_sends_before_tx_enable_do_not_consume_the_later_tx_id_namespace() {
-        let socket = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        let peer = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        socket.connect(peer.local_addr().unwrap()).unwrap();
-        setsockopt(
-            &socket,
-            sockopt::Timestamping,
-            &super::super::RX_TIMESTAMPING_FLAGS,
-        )
-        .unwrap();
-
-        // Ordinary pre-enable sends: TX_SOFTWARE is not yet requested, so
-        // none of these may leave anything on the error queue for the
-        // later-enabled OPT_ID counter to have skipped past.
-        for _ in 0..3 {
-            if let Err(error) = socket.send(b"pre-enable") {
-                eprintln!("skipping pre-enable send/RX-only smoke test: {error}");
-                return;
-            }
-        }
-        assert_eq!(
-            try_recv_error_queue_record(socket.as_raw_fd()).unwrap(),
-            None,
-            "RX-only sends must never populate MSG_ERRQUEUE"
-        );
-
-        // This mirrors production: RX-only is configured first (e.g. at
-        // connect time), and only later, after a successful Open, is the
-        // socket upgraded to TX_TIMESTAMPING_FLAGS.
-        if setsockopt(&socket, sockopt::Timestamping, &TX_TIMESTAMPING_FLAGS).is_err() {
-            eprintln!(
-                "skipping pre-enable send/RX-only smoke test: kernel/container denied \
-                 SO_TIMESTAMPING TX flags"
-            );
-            return;
-        }
-
-        if let Err(error) = socket.send(b"first-timestamped") {
-            eprintln!(
-                "skipping pre-enable send/RX-only smoke test: post-upgrade send failed: {error}"
-            );
-            return;
-        }
-        let Some(record) = poll_for_record(socket.as_raw_fd(), Duration::from_secs(2)) else {
-            eprintln!(
-                "skipping pre-enable send/RX-only smoke test: no TX timestamp record was \
-                 delivered within the poll deadline"
-            );
-            return;
-        };
-        assert!(
-            matches!(record, ErrorQueueRecord::TxTimestamp { id: 0, .. }),
-            "expected the first send after upgrade to report id 0 (pre-enable sends must not \
-             have consumed part of the namespace), got {record:?}"
-        );
-    }
-
-    #[test]
-    fn normal_rx_scm_timestamping_still_works_after_tx_flags_are_enabled() {
-        let Some((socket, peer)) = tx_timestamped_loopback_socket() else {
-            return;
-        };
-        peer.send_to(b"reply", socket.local_addr().unwrap())
-            .unwrap();
-
-        let mut buf = [0_u8; 16];
-        let Ok(datagram) = super::super::recv_datagram(&socket, &mut buf) else {
-            eprintln!("skipping post-TX-enable RX smoke test: receive failed");
-            return;
-        };
-        assert_eq!(&buf[..datagram.len], b"reply");
-        let Some(timestamp) = datagram.meta.kernel_rx_timestamp else {
-            eprintln!(
-                "skipping post-TX-enable RX smoke test: kernel did not provide SCM_TIMESTAMPING"
-            );
-            return;
-        };
-        assert!(timestamp.duration_since(std::time::UNIX_EPOCH).unwrap() > Duration::ZERO);
-    }
-
-    #[test]
-    fn tx_timestamp_and_normal_reply_streams_do_not_interfere() {
-        let Some((socket, peer)) = tx_timestamped_loopback_socket() else {
-            return;
-        };
-        let fd = socket.as_raw_fd();
-
-        if let Err(error) = socket.send(b"ping") {
-            eprintln!("skipping TX/RX separation smoke test: ping send failed: {error}");
-            return;
-        }
-        let mut incoming = [0_u8; 16];
-        let Ok((len, from)) = peer.recv_from(&mut incoming) else {
-            eprintln!("skipping TX/RX separation smoke test: peer never observed ping");
-            return;
-        };
-        assert_eq!(&incoming[..len], b"ping");
-        peer.send_to(b"pong", from).unwrap();
-
-        // Reading the normal payload must not require, wait for, or be
-        // disturbed by draining MSG_ERRQUEUE first.
-        let mut reply_buf = [0_u8; 16];
-        let Ok(datagram) = super::super::recv_datagram(&socket, &mut reply_buf) else {
-            eprintln!("skipping TX/RX separation smoke test: normal receive failed");
-            return;
-        };
-        assert_eq!(&reply_buf[..datagram.len], b"pong");
-
-        // The TX timestamp for "ping" is still independently available on
-        // the error queue, unconsumed by the normal receive above.
-        let Some(record) = poll_for_record(fd, Duration::from_secs(2)) else {
-            eprintln!("skipping TX/RX separation smoke test: no TX timestamp record arrived");
-            return;
-        };
-        assert!(matches!(
-            record,
-            ErrorQueueRecord::TxTimestamp { id: 0, .. }
-        ));
-    }
-
-    #[test]
-    fn tx_timestamp_correlation_does_not_depend_on_original_payload() {
-        let Some((socket, _peer)) = tx_timestamped_loopback_socket() else {
-            return;
-        };
-
-        // OPT_TSONLY notifications never carry the original payload; a
-        // larger payload must classify identically to the zero-length one
-        // used elsewhere, since correlation is by `id` alone.
-        let payload = vec![0x5A_u8; 512];
-        if let Err(error) = socket.send(&payload) {
-            eprintln!("skipping OPT_TSONLY payload-independence smoke test: send failed: {error}");
-            return;
-        }
-        let Some(record) = poll_for_record(socket.as_raw_fd(), Duration::from_secs(2)) else {
-            eprintln!(
-                "skipping OPT_TSONLY payload-independence smoke test: no TX timestamp record \
-                 arrived"
-            );
-            return;
-        };
-        assert!(matches!(
-            record,
-            ErrorQueueRecord::TxTimestamp { id: 0, .. }
-        ));
-    }
-
-    // NOTE: a live test proving that a failed nonblocking `sendmsg` does not
-    // consume an automatic OPT_ID is not included here. Forcing a reliable,
-    // non-flaky `WouldBlock` on a connected loopback UDP socket (e.g. via
-    // socket-buffer saturation) has no deterministic OS-level mechanism
-    // available in this environment, and the repository's testing policy
-    // explicitly forbids faking coverage with sleep/saturation-based
-    // flakiness. That safety is instead established from Linux kernel
-    // source: `_sock_tx_timestamp` (include/net/sock.h) and
-    // `__ip_append_data`/`__ip6_append_data` (net/ipv4/ip_output.c,
-    // net/ipv6/ip6_output.c) increment `sk->sk_tskey` speculatively before
-    // a datagram is fully built and explicitly `atomic_dec` it back out on
-    // every error path (tracked via a local `hold_tskey` flag), so a failed
-    // send can never leave a gap in — or otherwise advance — the ID space
-    // the kernel hands out to successfully submitted datagrams. See the
-    // client crate's `AGENTS.md` for the full citation. The client-side
-    // half of this invariant (a `WouldBlock` `try_send` never advances the
-    // local wire-sequence counter used as the correlation ID) is covered by
-    // a deterministic test in the adapter module that injects `WouldBlock`.
-}
@@ -346,180 +346,3 @@ fn record_restriction(
    restrictions.push(restriction);
    Ok(())
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use irtt_proto::{Clock, ReceivedStats, ServerFill, StampAt};
-
-    fn default_params() -> Params {
-        Params {
-            protocol_version: PROTOCOL_VERSION,
-            duration_ns: 3_000_000_000,
-            interval_ns: 1_000_000_000,
-            length: 256,
-            received_stats: ReceivedStats::Both,
-            stamp_at: StampAt::Both,
-            clock: Clock::Both,
-            // Raw wire TOS/Traffic Class byte for DSCP codepoint 46 (EF).
-            dscp: 184,
-            server_fill: Some(ServerFill {
-                value: "rand".to_owned(),
-            }),
-        }
-    }
-
-    fn assert_rejected(requested: &Params, returned: &Params, policy: NegotiationPolicy) {
-        assert!(matches!(
-            negotiate_params(requested, returned.clone(), policy),
-            Err(ClientError::NegotiationRejected { .. })
-        ));
-    }
-
-    fn assert_negotiates(
-        requested: &Params,
-        returned: &Params,
-        policy: NegotiationPolicy,
-    ) -> NegotiatedParams {
-        negotiate_params(requested, returned.clone(), policy)
-            .unwrap_or_else(|err| panic!("expected negotiation success, got {err:?}"))
-    }
-
-    fn rejection_reason(
-        requested: &Params,
-        returned: &Params,
-        policy: NegotiationPolicy,
-    ) -> String {
-        match negotiate_params(requested, returned.clone(), policy) {
-            Err(ClientError::NegotiationRejected { reason }) => reason,
-            other => panic!("expected negotiation rejection, got {other:?}"),
-        }
-    }
-
-    #[test]
-    fn strict_rejects_changed_negotiated_fields() {
-        let requested = default_params();
-
-        let mut returned = requested.clone();
-        returned.length = 128;
-        assert_eq!(
-            rejection_reason(&requested, &returned, NegotiationPolicy::Strict),
-            NegotiationRestriction::LengthReduced {
-                requested: requested.length,
-                negotiated: returned.length,
-            }
-            .message()
-        );
-
-        let mut returned = requested.clone();
-        returned.dscp = 0;
-        assert_eq!(
-            rejection_reason(&requested, &returned, NegotiationPolicy::Strict),
-            NegotiationRestriction::DscpChanged {
-                requested: requested.dscp >> 2,
-                negotiated: returned.dscp >> 2,
-            }
-            .message()
-        );
-
-        let mut returned = requested.clone();
-        returned.received_stats = ReceivedStats::Count;
-        assert_eq!(
-            rejection_reason(&requested, &returned, NegotiationPolicy::Strict),
-            NegotiationRestriction::ReceivedStatsChanged {
-                requested: requested.received_stats,
-                negotiated: returned.received_stats,
-            }
-            .message()
-        );
-
-        let mut returned = requested.clone();
-        returned.stamp_at = StampAt::Midpoint;
-        assert_eq!(
-            rejection_reason(&requested, &returned, NegotiationPolicy::Strict),
-            NegotiationRestriction::StampAtChanged {
-                requested: requested.stamp_at,
-                negotiated: returned.stamp_at,
-            }
-            .message()
-        );
-
-        let mut returned = requested.clone();
-        returned.clock = Clock::Wall;
-        assert_eq!(
-            rejection_reason(&requested, &returned, NegotiationPolicy::Strict),
-            NegotiationRestriction::ClockChanged {
-                requested: requested.clock,
-                negotiated: returned.clock,
-            }
-            .message()
-        );
-
-        let mut returned = requested.clone();
-        returned.server_fill = None;
-        assert_eq!(
-            rejection_reason(&requested, &returned, NegotiationPolicy::Strict),
-            NegotiationRestriction::ServerFillChanged.message()
-        );
-    }
-
-    #[test]
-    fn loose_duration_negotiation_uses_run_duration_semantics() {
-        let requested = default_params();
-
-        let mut returned = requested.clone();
-        returned.duration_ns = requested.duration_ns / 2;
-        let negotiated = assert_negotiates(&requested, &returned, NegotiationPolicy::Loose);
-        assert_eq!(
-            negotiated.restrictions,
-            vec![NegotiationRestriction::DurationReduced {
-                requested_ns: requested.duration_ns,
-                negotiated_ns: returned.duration_ns,
-            }]
-        );
-
-        let mut returned = requested.clone();
-        returned.duration_ns = requested.duration_ns + 1;
-        assert_eq!(
-            rejection_reason(&requested, &returned, NegotiationPolicy::Loose),
-            "duration increased"
-        );
-
-        let mut returned = requested.clone();
-        returned.duration_ns = 0;
-        assert_eq!(
-            rejection_reason(&requested, &returned, NegotiationPolicy::Loose),
-            "server returned continuous duration for finite request"
-        );
-
-        let mut continuous_requested = requested.clone();
-        continuous_requested.duration_ns = 0;
-        let mut finite_returned = continuous_requested.clone();
-        finite_returned.duration_ns = 1_000_000_000;
-        let negotiated = assert_negotiates(
-            &continuous_requested,
-            &finite_returned,
-            NegotiationPolicy::Loose,
-        );
-        assert_eq!(
-            negotiated.restrictions,
-            vec![NegotiationRestriction::DurationReduced {
-                requested_ns: 0,
-                negotiated_ns: finite_returned.duration_ns,
-            }]
-        );
-
-        assert_rejected(
-            &continuous_requested,
-            &finite_returned,
-            NegotiationPolicy::Strict,
-        );
-
-        assert!(negotiate_params(
-            &continuous_requested,
-            continuous_requested.clone(),
-            NegotiationPolicy::Strict
-        )
-        .is_ok());
-    }
-}
@@ -12,6 +12,14 @@ use crate::{
    socket_options::apply_ttl_to_socket,
 };

+#[cfg(any(
+    target_os = "android",
+    target_os = "freebsd",
+    target_os = "fuchsia",
+    target_os = "linux"
+))]
+use crate::socket_options::apply_routing_options;
+
 pub(crate) fn validate_open_timeouts(timeouts: &[Duration]) -> Result<(), ClientError> {
    if timeouts.is_empty() {
        return Err(ClientError::NoOpenTimeouts);
@@ -28,9 +36,6 @@ pub(crate) fn validate_open_timeouts(timeouts: &[Duration]) -> Result<(), Client
 }

 pub(crate) fn resolve_remote(config: &ClientConfig) -> Result<SocketAddr, ClientError> {
-    #[cfg(all(test, feature = "tokio"))]
-    SYNC_RESOLVER_CALLS.with(|calls| calls.set(calls.get() + 1));
-
    let addr = normalize_server_addr(&config.server_addr);
    let mut addrs = addr
        .to_socket_addrs()
@@ -49,9 +54,6 @@ pub(crate) async fn resolve_remote_tokio(config: &ClientConfig) -> Result<Socket
            .ok_or(ClientError::Resolve { addr });
    }

-    #[cfg(all(test, feature = "tokio"))]
-    TOKIO_DNS_LOOKUPS.with(|calls| calls.set(calls.get() + 1));
-
    let mut addrs = tokio::net::lookup_host(&addr)
        .await
        .map_err(|_| ClientError::Resolve { addr: addr.clone() })?;
@@ -65,20 +67,6 @@ fn address_family_allowed(config: &ClientConfig, remote: SocketAddr) -> bool {
        && (!config.socket_config.ipv6_only || remote.is_ipv6())
 }

-#[cfg(all(test, feature = "tokio"))]
-std::thread_local! {
-    static SYNC_RESOLVER_CALLS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
-    static TOKIO_DNS_LOOKUPS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
-}
-
-#[cfg(all(test, feature = "tokio"))]
-pub(crate) fn resolution_call_counts() -> (usize, usize) {
-    (
-        SYNC_RESOLVER_CALLS.with(std::cell::Cell::get),
-        TOKIO_DNS_LOOKUPS.with(std::cell::Cell::get),
-    )
-}
-
 pub(crate) fn normalize_server_addr(addr: &str) -> String {
    if addr.parse::<SocketAddr>().is_ok() {
        return addr.to_owned();
@@ -115,6 +103,13 @@ fn create_connected_udp_socket(
    remote: SocketAddr,
 ) -> Result<UdpSocket, ClientError> {
    let socket = create_prebind_udp_socket(config, remote)?;
+    #[cfg(any(
+        target_os = "android",
+        target_os = "freebsd",
+        target_os = "fuchsia",
+        target_os = "linux"
+    ))]
+    apply_routing_options(&socket, config, remote)?;
    let bind_addr = config.bind_addr.unwrap_or_else(|| {
        if remote.is_ipv4() {
            SocketAddr::from(([0, 0, 0, 0], 0))
@@ -163,207 +158,3 @@ pub(crate) fn connect_tokio_udp_socket(
    socket.set_nonblocking(true)?;
    Ok(tokio::net::UdpSocket::from_std(socket)?)
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn normalize_server_addr_adds_default_ports() {
-        assert_eq!(normalize_server_addr("127.0.0.1"), "127.0.0.1:2112");
-        assert_eq!(normalize_server_addr("127.0.0.1:1234"), "127.0.0.1:1234");
-        assert_eq!(normalize_server_addr("localhost"), "localhost:2112");
-        assert_eq!(normalize_server_addr("localhost:1234"), "localhost:1234");
-        assert_eq!(normalize_server_addr("::1"), "[::1]:2112");
-        assert_eq!(normalize_server_addr("[::1]"), "[::1]:2112");
-        assert_eq!(normalize_server_addr("[::1]:1234"), "[::1]:1234");
-    }
-
-    #[test]
-    fn address_family_filtering_remains_unchanged() {
-        let ipv4 = SocketAddr::from(([127, 0, 0, 1], DEFAULT_PORT));
-        let ipv6 = SocketAddr::from(([0, 0, 0, 0, 0, 0, 0, 1], DEFAULT_PORT));
-        let mut config = ClientConfig::default();
-
-        assert!(address_family_allowed(&config, ipv4));
-        assert!(address_family_allowed(&config, ipv6));
-
-        config.socket_config.ipv4_only = true;
-        assert!(address_family_allowed(&config, ipv4));
-        assert!(!address_family_allowed(&config, ipv6));
-
-        config.socket_config.ipv4_only = false;
-        config.socket_config.ipv6_only = true;
-        assert!(!address_family_allowed(&config, ipv4));
-        assert!(address_family_allowed(&config, ipv6));
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_ipv6_only_is_applied_before_bind() {
-        let config = SocketConfig {
-            ipv6_only: true,
-            ..SocketConfig::default()
-        };
-        let remote = SocketAddr::from(([0, 0, 0, 0, 0, 0, 0, 1], DEFAULT_PORT));
-
-        let socket = create_prebind_udp_socket(&config, remote).unwrap();
-
-        assert!(socket.only_v6().unwrap());
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_ipv6_socket_preserves_v6only_and_explicit_bind() {
-        let bind_addr = SocketAddr::from(([0, 0, 0, 0, 0, 0, 0, 1], 0));
-        let peer = match UdpSocket::bind(bind_addr) {
-            Ok(peer) => peer,
-            Err(error) if ipv6_loopback_unavailable(&error) => {
-                eprintln!("skipping IPv6 Tokio socket test: IPv6 loopback unavailable: {error}");
-                return;
-            }
-            Err(error) => panic!("{error}"),
-        };
-        let remote = peer.local_addr().unwrap();
-        let config = SocketConfig {
-            bind_addr: Some(bind_addr),
-            ipv6_only: true,
-            ..SocketConfig::default()
-        };
-
-        tokio_runtime().block_on(async {
-            let socket = connect_tokio_udp_socket(&config, remote).unwrap();
-
-            assert!(socket2::SockRef::from(&socket).only_v6().unwrap());
-            assert!(socket.local_addr().unwrap().is_ipv6());
-            assert_eq!(socket.local_addr().unwrap().ip(), bind_addr.ip());
-            assert_eq!(socket.peer_addr().unwrap(), remote);
-        });
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_ipv4_socket_preserves_family_bind_peer_and_ttl() {
-        let peer = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        let remote = peer.local_addr().unwrap();
-        let bind_addr = SocketAddr::from(([127, 0, 0, 1], 0));
-        let config = SocketConfig {
-            bind_addr: Some(bind_addr),
-            ttl: Some(64),
-            ..SocketConfig::default()
-        };
-
-        tokio_runtime().block_on(async {
-            let socket = connect_tokio_udp_socket(&config, remote).unwrap();
-
-            assert!(socket.local_addr().unwrap().is_ipv4());
-            assert_eq!(socket.local_addr().unwrap().ip(), bind_addr.ip());
-            assert_eq!(socket.peer_addr().unwrap(), remote);
-            assert_eq!(socket2::SockRef::from(&socket).ttl_v4().unwrap(), 64);
-        });
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_resolver_filters_families_without_using_blocking_resolution() {
-        let mut config = ClientConfig {
-            server_addr: "localhost:2112".to_owned(),
-            ..ClientConfig::default()
-        };
-        config.socket_config.ipv4_only = true;
-
-        tokio_runtime().block_on(async {
-            let before = resolution_call_counts();
-            let remote = resolve_remote_tokio(&config).await.unwrap();
-            let after = resolution_call_counts();
-
-            assert!(remote.is_ipv4());
-            assert_eq!(after.0, before.0);
-            assert_eq!(after.1, before.1 + 1);
-        });
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_resolver_selects_ipv6_for_ipv6_only_hostname() {
-        let mut config = ClientConfig {
-            server_addr: "localhost:2112".to_owned(),
-            ..ClientConfig::default()
-        };
-        config.socket_config.ipv6_only = true;
-
-        tokio_runtime().block_on(async {
-            let remote = resolve_remote_tokio(&config).await.unwrap();
-            assert!(remote.is_ipv6());
-        });
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_resolver_literal_path_bypasses_all_name_resolution() {
-        let config = ClientConfig {
-            server_addr: "127.0.0.1:2112".to_owned(),
-            ..ClientConfig::default()
-        };
-
-        tokio_runtime().block_on(async {
-            let before = resolution_call_counts();
-            let remote = resolve_remote_tokio(&config).await.unwrap();
-            let after = resolution_call_counts();
-
-            assert_eq!(remote, SocketAddr::from(([127, 0, 0, 1], 2112)));
-            assert_eq!(after, before);
-        });
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_resolver_rejects_disallowed_literal_family() {
-        let mut config = ClientConfig {
-            server_addr: "127.0.0.1:2112".to_owned(),
-            ..ClientConfig::default()
-        };
-        config.socket_config.ipv6_only = true;
-
-        tokio_runtime().block_on(async {
-            assert!(matches!(
-                resolve_remote_tokio(&config).await,
-                Err(ClientError::Resolve { .. })
-            ));
-        });
-    }
-
-    #[cfg(feature = "tokio")]
-    #[test]
-    fn tokio_resolver_rejects_mixed_family_restrictions() {
-        let mut config = ClientConfig {
-            server_addr: "127.0.0.1:2112".to_owned(),
-            ..ClientConfig::default()
-        };
-        config.socket_config.ipv4_only = true;
-        config.socket_config.ipv6_only = true;
-
-        tokio_runtime().block_on(async {
-            assert!(matches!(
-                resolve_remote_tokio(&config).await,
-                Err(ClientError::Resolve { .. })
-            ));
-        });
-    }
-
-    #[cfg(feature = "tokio")]
-    fn tokio_runtime() -> tokio::runtime::Runtime {
-        tokio::runtime::Builder::new_current_thread()
-            .enable_io()
-            .build()
-            .unwrap()
-    }
-
-    #[cfg(feature = "tokio")]
-    fn ipv6_loopback_unavailable(error: &std::io::Error) -> bool {
-        matches!(
-            error.kind(),
-            std::io::ErrorKind::AddrNotAvailable | std::io::ErrorKind::Unsupported
-        )
-    }
-}
@@ -5,11 +5,64 @@ use std::{

 use socket2::SockRef;

+#[cfg(any(
+    target_os = "android",
+    target_os = "freebsd",
+    target_os = "fuchsia",
+    target_os = "linux"
+))]
+use socket2::Socket;
+
 use crate::{
    config::{MAX_DSCP_CODEPOINT, MAX_TTL},
    error::ClientError,
 };

+#[cfg(any(
+    target_os = "android",
+    target_os = "freebsd",
+    target_os = "fuchsia",
+    target_os = "linux"
+))]
+pub(crate) fn apply_routing_options(
+    socket: &Socket,
+    config: &crate::SocketConfig,
+    remote: SocketAddr,
+) -> Result<(), ClientError> {
+    #[cfg(any(target_os = "android", target_os = "fuchsia", target_os = "linux"))]
+    {
+        if let Some(device) = &config.bind_to_device {
+            socket
+                .bind_device(Some(device.as_bytes()))
+                .map_err(|source| ClientError::SocketOption {
+                    operation: "bind socket to device",
+                    remote,
+                    source,
+                })?;
+        }
+        if let Some(mark) = config.mark {
+            socket
+                .set_mark(mark)
+                .map_err(|source| ClientError::SocketOption {
+                    operation: "set firewall mark",
+                    remote,
+                    source,
+                })?;
+        }
+    }
+    #[cfg(target_os = "freebsd")]
+    if let Some(fib) = config.fib {
+        socket
+            .set_fib(fib)
+            .map_err(|source| ClientError::SocketOption {
+                operation: "set FIB",
+                remote,
+                source,
+            })?;
+    }
+    Ok(())
+}
+
 /// Converts a public DSCP codepoint (`0..=`[`MAX_DSCP_CODEPOINT`]) into the
 /// raw IP TOS / Traffic Class byte it occupies the upper six bits of.
 ///
@@ -87,52 +140,15 @@ pub(crate) fn apply_ttl_to_socket(
    ttl: u32,
 ) -> Result<(), ClientError> {
    validate_ttl(ttl)?;
-    set_socket_ttl(socket, remote, ttl).map_err(|source| ClientError::SocketOption {
-        operation: "set TTL/hop limit",
-        remote,
-        source,
-    })
-}
-
-#[cfg(test)]
-pub(crate) fn socket_traffic_class(
-    socket: &UdpSocket,
-    remote: SocketAddr,
-) -> Result<u32, ClientError> {
-    get_socket_traffic_class(socket, remote).map_err(|source| ClientError::SocketOption {
-        operation: "read DSCP socket option",
-        remote,
-        source,
-    })
-}
-
-#[cfg(all(test, feature = "tokio"))]
-pub(crate) fn tokio_socket_traffic_class(
-    socket: &tokio::net::UdpSocket,
-    remote: SocketAddr,
-) -> Result<u32, ClientError> {
-    get_socket_traffic_class_ref(SockRef::from(socket), remote).map_err(|source| {
+    set_socket_ttl_ref(SockRef::from(socket), remote, ttl).map_err(|source| {
        ClientError::SocketOption {
-            operation: "read DSCP socket option",
+            operation: "set TTL/hop limit",
            remote,
            source,
        }
    })
 }

-#[cfg(test)]
-pub(crate) fn socket_ttl(socket: &UdpSocket, remote: SocketAddr) -> Result<u32, ClientError> {
-    get_socket_ttl(socket, remote).map_err(|source| ClientError::SocketOption {
-        operation: "read TTL/hop limit socket option",
-        remote,
-        source,
-    })
-}
-
-fn set_socket_ttl(socket: &UdpSocket, remote: SocketAddr, ttl: u32) -> io::Result<()> {
-    set_socket_ttl_ref(SockRef::from(socket), remote, ttl)
-}
-
 fn set_socket_ttl_ref(socket: SockRef<'_>, remote: SocketAddr, ttl: u32) -> io::Result<()> {
    if remote.is_ipv4() {
        socket.set_ttl_v4(ttl)
@@ -141,23 +157,13 @@ fn set_socket_ttl_ref(socket: SockRef<'_>, remote: SocketAddr, ttl: u32) -> io::
    }
 }

-#[cfg(test)]
-fn get_socket_ttl(socket: &UdpSocket, remote: SocketAddr) -> io::Result<u32> {
-    let socket = SockRef::from(socket);
-    if remote.is_ipv4() {
-        socket.ttl_v4()
-    } else {
-        socket.unicast_hops_v6()
-    }
-}
-
 fn set_socket_traffic_class(
    socket: &UdpSocket,
    remote: SocketAddr,
    traffic_class: u32,
    operation: &'static str,
 ) -> Result<(), ClientError> {
-    set_socket_traffic_class_io(socket, remote, traffic_class).map_err(|source| {
+    set_socket_traffic_class_ref(SockRef::from(socket), remote, traffic_class).map_err(|source| {
        ClientError::SocketOption {
            operation,
            remote,
@@ -166,14 +172,6 @@ fn set_socket_traffic_class(
    })
 }

-fn set_socket_traffic_class_io(
-    socket: &UdpSocket,
-    remote: SocketAddr,
-    traffic_class: u32,
-) -> io::Result<()> {
-    set_socket_traffic_class_ref(SockRef::from(socket), remote, traffic_class)
-}
-
 #[cfg(feature = "tokio")]
 fn set_tokio_socket_traffic_class(
    socket: &tokio::net::UdpSocket,
@@ -282,302 +280,3 @@ fn unsupported_traffic_class(traffic_class: u32, feature: &'static str) -> io::R
        ))
    }
 }
-
-#[cfg(all(
-    test,
-    not(any(
-        target_os = "fuchsia",
-        target_os = "redox",
-        target_os = "solaris",
-        target_os = "illumos",
-        target_os = "haiku",
-    ))
-))]
-fn get_ipv4_traffic_class(socket: SockRef<'_>) -> io::Result<u32> {
-    socket.tos_v4()
-}
-
-#[cfg(all(
-    test,
-    any(
-        target_os = "fuchsia",
-        target_os = "redox",
-        target_os = "solaris",
-        target_os = "illumos",
-        target_os = "haiku",
-    )
-))]
-fn get_ipv4_traffic_class(_socket: SockRef<'_>) -> io::Result<u32> {
-    unsupported_readback("IPv4 DSCP socket option readback")
-}
-
-#[cfg(all(
-    test,
-    any(
-        target_os = "android",
-        target_os = "dragonfly",
-        target_os = "freebsd",
-        target_os = "fuchsia",
-        target_os = "linux",
-        target_os = "macos",
-        target_os = "netbsd",
-        target_os = "openbsd",
-        target_os = "cygwin",
-    )
-))]
-fn get_ipv6_traffic_class(socket: SockRef<'_>) -> io::Result<u32> {
-    socket.tclass_v6()
-}
-
-#[cfg(all(
-    test,
-    not(any(
-        target_os = "android",
-        target_os = "dragonfly",
-        target_os = "freebsd",
-        target_os = "fuchsia",
-        target_os = "linux",
-        target_os = "macos",
-        target_os = "netbsd",
-        target_os = "openbsd",
-        target_os = "cygwin",
-    ))
-))]
-fn get_ipv6_traffic_class(_socket: SockRef<'_>) -> io::Result<u32> {
-    unsupported_readback("IPv6 DSCP socket option readback")
-}
-
-#[cfg(test)]
-fn get_socket_traffic_class(socket: &UdpSocket, remote: SocketAddr) -> io::Result<u32> {
-    get_socket_traffic_class_ref(SockRef::from(socket), remote)
-}
-
-#[cfg(test)]
-fn get_socket_traffic_class_ref(socket: SockRef<'_>, remote: SocketAddr) -> io::Result<u32> {
-    if remote.is_ipv4() {
-        get_ipv4_traffic_class(socket)
-    } else {
-        get_ipv6_traffic_class(socket)
-    }
-}
-
-#[cfg(all(
-    test,
-    any(
-        target_os = "fuchsia",
-        target_os = "redox",
-        target_os = "solaris",
-        target_os = "illumos",
-        target_os = "haiku",
-        not(any(
-            target_os = "android",
-            target_os = "dragonfly",
-            target_os = "freebsd",
-            target_os = "fuchsia",
-            target_os = "linux",
-            target_os = "macos",
-            target_os = "netbsd",
-            target_os = "openbsd",
-            target_os = "cygwin",
-        )),
-    )
-))]
-fn unsupported_readback(feature: &'static str) -> io::Result<u32> {
-    Err(io::Error::new(
-        io::ErrorKind::Unsupported,
-        format!("{feature} is unsupported on this target"),
-    ))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn converts_dscp_codepoint_to_traffic_class_byte() {
-        for (dscp, traffic_class) in [(0, 0), (1, 4), (46, 184), (63, 252)] {
-            let value = dscp_codepoint_to_traffic_class(dscp).unwrap();
-            assert_eq!(value, traffic_class);
-            assert_eq!(value & 0b11, 0);
-        }
-    }
-
-    #[test]
-    fn rejects_out_of_range_dscp_codepoint() {
-        assert!(matches!(
-            dscp_codepoint_to_traffic_class(64),
-            Err(ClientError::InvalidConfig { .. })
-        ));
-    }
-
-    #[test]
-    fn validates_ttl_range() {
-        assert!(validate_ttl(1).is_ok());
-        assert!(validate_ttl(64).is_ok());
-        assert!(validate_ttl(255).is_ok());
-        assert!(matches!(
-            validate_ttl(0),
-            Err(ClientError::InvalidConfig { .. })
-        ));
-        assert!(matches!(
-            validate_ttl(256),
-            Err(ClientError::InvalidConfig { .. })
-        ));
-    }
-
-    #[test]
-    fn ipv4_socket_option_sets_ttl() {
-        let remote = SocketAddr::from(([127, 0, 0, 1], 9));
-        let socket = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        socket.connect(remote).unwrap();
-
-        apply_ttl_to_socket(&socket, remote, 64).unwrap();
-        assert_eq!(socket_ttl(&socket, remote).unwrap(), 64);
-
-        apply_ttl_to_socket(&socket, remote, 1).unwrap();
-        assert_eq!(socket_ttl(&socket, remote).unwrap(), 1);
-    }
-
-    #[test]
-    fn ipv6_socket_option_sets_unicast_hop_limit() {
-        let remote = SocketAddr::from(([0, 0, 0, 0, 0, 0, 0, 1], 9));
-        let Some(socket) = bind_connected_ipv6_loopback(remote) else {
-            return;
-        };
-
-        apply_ttl_to_socket(&socket, remote, 64).unwrap();
-        let ttl = match socket_ttl(&socket, remote) {
-            Ok(ttl) => ttl,
-            Err(error) if is_unsupported_socket_readback(&error) => {
-                eprintln!("skipping IPv6 hop-limit readback test: {error}");
-                return;
-            }
-            Err(error) => panic!("{error}"),
-        };
-        assert_eq!(ttl, 64);
-
-        apply_ttl_to_socket(&socket, remote, 1).unwrap();
-        assert_eq!(socket_ttl(&socket, remote).unwrap(), 1);
-    }
-
-    #[test]
-    #[cfg(not(any(
-        target_os = "fuchsia",
-        target_os = "redox",
-        target_os = "solaris",
-        target_os = "illumos",
-        target_os = "haiku",
-    )))]
-    fn ipv4_socket_option_sets_and_clears_traffic_class() {
-        let remote = SocketAddr::from(([127, 0, 0, 1], 9));
-        let socket = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-        socket.connect(remote).unwrap();
-
-        // 184 is the raw wire TOS/Traffic Class byte for DSCP codepoint 46
-        // (EF); applying it directly must not shift it again.
-        apply_traffic_class_to_socket(&socket, remote, 184).unwrap();
-        assert_eq!(socket_traffic_class(&socket, remote).unwrap(), 184);
-
-        clear_dscp_on_socket(&socket, remote).unwrap();
-        assert_eq!(socket_traffic_class(&socket, remote).unwrap(), 0);
-    }
-
-    #[cfg(all(
-        feature = "tokio",
-        not(any(
-            target_os = "fuchsia",
-            target_os = "redox",
-            target_os = "solaris",
-            target_os = "illumos",
-            target_os = "haiku",
-        ))
-    ))]
-    #[test]
-    fn tokio_ipv4_socket_option_sets_and_clears_traffic_class() {
-        let runtime = tokio::runtime::Builder::new_current_thread()
-            .enable_io()
-            .build()
-            .unwrap();
-
-        runtime.block_on(async {
-            let remote = SocketAddr::from(([127, 0, 0, 1], 9));
-            let socket = UdpSocket::bind(SocketAddr::from(([127, 0, 0, 1], 0))).unwrap();
-            socket.connect(remote).unwrap();
-            socket.set_nonblocking(true).unwrap();
-            let socket = tokio::net::UdpSocket::from_std(socket).unwrap();
-
-            apply_traffic_class_to_tokio_socket(&socket, remote, 184).unwrap();
-            assert_eq!(tokio_socket_traffic_class(&socket, remote).unwrap(), 184);
-
-            clear_dscp_on_tokio_socket(&socket, remote).unwrap();
-            assert_eq!(tokio_socket_traffic_class(&socket, remote).unwrap(), 0);
-        });
-    }
-
-    #[test]
-    #[cfg(any(
-        target_os = "android",
-        target_os = "dragonfly",
-        target_os = "freebsd",
-        target_os = "fuchsia",
-        target_os = "linux",
-        target_os = "macos",
-        target_os = "netbsd",
-        target_os = "openbsd",
-        target_os = "cygwin",
-    ))]
-    fn ipv6_socket_option_sets_and_clears_traffic_class() {
-        let remote = SocketAddr::from(([0, 0, 0, 0, 0, 0, 0, 1], 9));
-        let Some(socket) = bind_connected_ipv6_loopback(remote) else {
-            return;
-        };
-
-        apply_traffic_class_to_socket(&socket, remote, 184).unwrap();
-        let traffic_class = match socket_traffic_class(&socket, remote) {
-            Ok(traffic_class) => traffic_class,
-            Err(error) if is_unsupported_socket_readback(&error) => {
-                eprintln!("skipping IPv6 traffic-class readback test: {error}");
-                return;
-            }
-            Err(error) => panic!("{error}"),
-        };
-        assert_eq!(traffic_class, 184);
-
-        clear_dscp_on_socket(&socket, remote).unwrap();
-        assert_eq!(socket_traffic_class(&socket, remote).unwrap(), 0);
-    }
-
-    fn bind_connected_ipv6_loopback(remote: SocketAddr) -> Option<UdpSocket> {
-        let socket = match UdpSocket::bind(SocketAddr::from(([0, 0, 0, 0, 0, 0, 0, 1], 0))) {
-            Ok(socket) => socket,
-            Err(error) if is_unavailable_ipv6_loopback(&error) => {
-                eprintln!("skipping IPv6 socket option test: IPv6 loopback unavailable: {error}");
-                return None;
-            }
-            Err(error) => panic!("{error}"),
-        };
-        match socket.connect(remote) {
-            Ok(()) => Some(socket),
-            Err(error) if is_unavailable_ipv6_loopback(&error) => {
-                eprintln!("skipping IPv6 socket option test: IPv6 loopback unavailable: {error}");
-                None
-            }
-            Err(error) => panic!("{error}"),
-        }
-    }
-
-    fn is_unavailable_ipv6_loopback(error: &io::Error) -> bool {
-        matches!(
-            error.kind(),
-            io::ErrorKind::AddrNotAvailable | io::ErrorKind::Unsupported
-        )
-    }
-
-    fn is_unsupported_socket_readback(error: &ClientError) -> bool {
-        matches!(
-            error,
-            ClientError::SocketOption { source, .. }
-                if matches!(source.kind(), io::ErrorKind::Unsupported)
-        )
-    }
-}
@@ -0,0 +1,8 @@
+use irtt_client::*;
+use std::{
+    net::SocketAddr,
+    time::{Duration, Instant},
+};
+
+#[path = "client/mod.rs"]
+mod client;
@@ -2,8 +2,7 @@ use super::*;

 #[test]
 fn open_fails_after_close() {
-    let config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    let params = params_from_config(&config).unwrap();
+    let params = default_params();
    let server = start_fake_server(move |socket, tx| {
        let (_, peer) = recv_request(&socket, &tx);
        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
@@ -17,191 +16,6 @@ fn open_fails_after_close() {
    server.join();
 }

-#[test]
-fn close_sends_one_close_packet_with_negotiated_token() {
-    let config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    let params = params_from_config(&config).unwrap();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
-        socket.send_to(&reply, peer).unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    assert_open_started(client.open().unwrap());
-    let sent_at = ClientTimestamp {
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(1_234),
-        mono: Instant::now() + Duration::from_secs(5),
-    };
-    client.test_hooks.close_sent_at.set(Some(sent_at));
-    let events = client.close().unwrap();
-    assert!(matches!(
-        events.as_slice(),
-        [ClientEvent::SessionClosed {
-            token: TOKEN,
-            at,
-            ..
-        }] if *at == sent_at
-    ));
-    assert!(!client.runtime.is_open());
-    assert!(client.schedule.is_none());
-    assert_eq!(client.applied_traffic_class, None);
-    let packets: Vec<_> = server.rx.iter().take(2).collect();
-    let close = &packets[1];
-    assert_eq!(close[3], flags::FLAG_CLOSE);
-    assert_eq!(u64::from_le_bytes(close[4..12].try_into().unwrap()), TOKEN);
-    server.join();
-}
-
-#[test]
-fn close_event_reservation_failure_precedes_dscp_clear_and_send() {
-    let params = default_params();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
-                peer,
-            )
-            .unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.test_hooks.fail_close_event_reserve.set(true);
-    client.test_hooks.fail_close_dscp_clear.set(true);
-
-    assert!(matches!(
-        client.close(),
-        Err(ClientError::AllocationFailed {
-            operation: "close event result",
-            ..
-        })
-    ));
-    assert_eq!(client.test_hooks.close_send_attempts.get(), 0);
-    assert!(client.test_hooks.fail_close_dscp_clear.get());
-    assert!(client.runtime.is_open());
-    assert!(client.schedule.is_some());
-    assert_eq!(client.applied_traffic_class, Some(0));
-
-    client.test_hooks.fail_close_dscp_clear.set(false);
-    client.close().unwrap();
-    assert_eq!(client.test_hooks.close_send_attempts.get(), 1);
-    server.join();
-}
-
-#[test]
-fn close_dscp_clear_failure_precedes_send_and_preserves_open_state() {
-    let params = default_params();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
-                peer,
-            )
-            .unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.test_hooks.fail_close_dscp_clear.set(true);
-
-    assert!(matches!(
-        client.close(),
-        Err(ClientError::SocketOption { .. })
-    ));
-    assert_eq!(client.test_hooks.close_send_attempts.get(), 0);
-    assert!(client.runtime.is_open());
-    assert!(client.schedule.is_some());
-    assert_eq!(client.applied_traffic_class, Some(0));
-
-    client.close().unwrap();
-    assert_eq!(client.test_hooks.close_send_attempts.get(), 1);
-    server.join();
-}
-
-#[test]
-fn close_send_failure_leaves_machine_and_schedule_open_for_retry() {
-    let params = default_params();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
-                peer,
-            )
-            .unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    assert_open_started(client.open().unwrap());
-    let sent_at = ClientTimestamp {
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(2_345),
-        mono: Instant::now() + Duration::from_secs(6),
-    };
-    client.test_hooks.close_sent_at.set(Some(sent_at));
-    client.test_hooks.fail_close_send.set(true);
-
-    assert!(matches!(client.close(), Err(ClientError::Socket(_))));
-    assert_eq!(client.test_hooks.close_sent_at.get(), Some(sent_at));
-    assert!(client.runtime.is_open());
-    assert!(client.schedule.is_some());
-    assert_eq!(client.applied_traffic_class, Some(0));
-    assert_eq!(client.test_hooks.close_send_attempts.get(), 1);
-
-    assert!(matches!(
-        client.close().unwrap().as_slice(),
-        [ClientEvent::SessionClosed {
-            token: TOKEN,
-            at,
-            ..
-        }] if *at == sent_at
-    ));
-    assert_eq!(client.test_hooks.close_sent_at.get(), None);
-    assert_eq!(client.test_hooks.close_send_attempts.get(), 2);
-    assert!(matches!(client.close(), Err(ClientError::AlreadyClosed)));
-    server.join();
-}
-
-#[test]
-fn short_successful_close_commits_before_length_mismatch() {
-    let params = default_params();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
-                peer,
-            )
-            .unwrap();
-        let _ = recv_request(&socket, &tx);
-    });
-    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
-    assert_open_started(client.open().unwrap());
-    let expected = client.runtime.prepare_close().unwrap().bytes.len();
-    let sent_at = ClientTimestamp {
-        wall: SystemTime::UNIX_EPOCH + Duration::from_secs(3_456),
-        mono: Instant::now() + Duration::from_secs(7),
-    };
-    client.test_hooks.close_sent_at.set(Some(sent_at));
-    client.test_hooks.close_reported_len.set(Some(expected - 1));
-
-    assert!(matches!(
-        client.close(),
-        Err(ClientError::DatagramLengthMismatch {
-            expected: error_expected,
-            actual,
-        }) if error_expected == expected && actual + 1 == expected
-    ));
-    assert!(!client.runtime.is_open());
-    assert!(client.schedule.is_none());
-    assert_eq!(client.applied_traffic_class, None);
-    assert_eq!(client.test_hooks.close_sent_at.get(), None);
-    assert!(matches!(client.close(), Err(ClientError::AlreadyClosed)));
-    server.join();
-}
-
 #[test]
 fn send_probe_fails_after_close() {
    let params = default_params();
@@ -232,135 +46,6 @@ fn send_probe_fails_after_close() {
    server.join();
 }

-#[test]
-fn close_flagged_echo_reply_emits_reply_then_closes_without_sending_close() {
-    let params = default_params();
-    let server = start_fake_server({
-        let params = params.clone();
-        move |socket, tx| {
-            let (_, peer) = recv_request(&socket, &tx);
-            let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
-            socket.send_to(&reply, peer).unwrap();
-
-            let (request, _) = recv_request(&socket, &tx);
-            let seq = u32::from_le_bytes(request[12..16].try_into().unwrap());
-            let reply = echo_reply_packet_with_flags(
-                TOKEN,
-                seq,
-                &params,
-                &TimestampFields::default(),
-                None,
-                FLAG_REPLY | flags::FLAG_CLOSE,
-            );
-            socket.send_to(&reply, peer).unwrap();
-
-            socket
-                .set_read_timeout(Some(Duration::from_millis(250)))
-                .unwrap();
-            while recv_request_timeout(&socket, &tx).is_some() {}
-        }
-    });
-    let config = ClientConfig {
-        socket_config: crate::SocketConfig {
-            recv_timeout: Some(Duration::from_millis(200)),
-            ..Default::default()
-        },
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.send_probe().unwrap();
-
-    let events = client.recv_once().unwrap();
-    assert!(matches!(
-        events.first(),
-        Some(ClientEvent::EchoReply { .. })
-    ));
-    assert!(matches!(
-        events.get(1),
-        Some(ClientEvent::SessionClosed { token: TOKEN, .. })
-    ));
-    assert_eq!(events.len(), 2);
-    assert!(client.next_send_deadline().is_none());
-    assert!(client.schedule.is_none());
-    assert!(matches!(
-        client.send_probe(),
-        Err(ClientError::AlreadyClosed)
-    ));
-
-    let first = server.rx.recv_timeout(Duration::from_millis(100)).unwrap();
-    let second = server.rx.recv_timeout(Duration::from_millis(100)).unwrap();
-    assert_eq!(first[3] & FLAG_OPEN, FLAG_OPEN);
-    assert_eq!(second[3] & flags::FLAG_CLOSE, 0);
-    assert!(server.rx.recv_timeout(Duration::from_millis(400)).is_err());
-    server.join();
-}
-
-#[test]
-fn peer_close_dscp_cleanup_failure_preserves_events_and_closed_state() {
-    let params = default_params();
-    let server = start_fake_server({
-        let params = params.clone();
-        move |socket, tx| {
-            let (_, peer) = recv_request(&socket, &tx);
-            socket
-                .send_to(
-                    &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
-                    peer,
-                )
-                .unwrap();
-            let (request, _) = recv_request(&socket, &tx);
-            let seq = u32::from_le_bytes(request[12..16].try_into().unwrap());
-            socket
-                .send_to(
-                    &echo_reply_packet_with_flags(
-                        TOKEN,
-                        seq,
-                        &params,
-                        &TimestampFields::default(),
-                        None,
-                        FLAG_REPLY | flags::FLAG_CLOSE,
-                    ),
-                    peer,
-                )
-                .unwrap();
-            socket
-                .set_read_timeout(Some(Duration::from_millis(250)))
-                .unwrap();
-            while recv_request_timeout(&socket, &tx).is_some() {}
-        }
-    });
-    let mut client = Client::connect(ClientConfig {
-        socket_config: crate::SocketConfig {
-            recv_timeout: Some(Duration::from_millis(200)),
-            ..Default::default()
-        },
-        ..default_test_config(server.addr)
-    })
-    .unwrap();
-    assert_open_started(client.open().unwrap());
-    client.send_probe().unwrap();
-    client.test_hooks.fail_close_dscp_clear.set(true);
-
-    assert!(matches!(
-        client.recv_once().unwrap().as_slice(),
-        [
-            ClientEvent::EchoReply { .. },
-            ClientEvent::SessionClosed { token: TOKEN, .. }
-        ]
-    ));
-    assert!(client.is_peer_closed());
-    assert!(client.schedule.is_none());
-    assert_eq!(client.applied_traffic_class, Some(0));
-    assert_eq!(client.test_hooks.close_send_attempts.get(), 0);
-    let open = server.rx.recv_timeout(Duration::from_millis(100)).unwrap();
-    let echo = server.rx.recv_timeout(Duration::from_millis(100)).unwrap();
-    assert_ne!(open[3] & FLAG_OPEN, 0);
-    assert_eq!(echo[3] & flags::FLAG_CLOSE, 0);
-    assert!(server.rx.recv_timeout(Duration::from_millis(400)).is_err());
-    server.join();
-}
-
 #[test]
 fn recv_available_stops_after_peer_close() {
    let params = default_params();
@@ -407,21 +92,6 @@ fn recv_available_stops_after_peer_close() {
    server.join();
 }

-#[test]
-fn normal_echo_reply_does_not_close_session() {
-    let params = default_params();
-    let (mut client, server) = open_client_with_echo_server(&params);
-    client.send_probe().unwrap();
-
-    let events = client.recv_once().unwrap();
-    assert!(matches!(events.as_slice(), [ClientEvent::EchoReply { .. }]));
-    assert!(client.next_send_deadline().is_some());
-    assert!(client.send_probe().is_ok());
-
-    client.close().unwrap();
-    server.join();
-}
-
 #[test]
 fn close_flagged_duplicate_emits_duplicate_then_closes() {
    let params = default_params();
@@ -452,7 +122,7 @@ fn close_flagged_duplicate_emits_duplicate_then_closes() {
        }
    });
    let mut client = Client::connect(ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(200)),
            ..Default::default()
        },
@@ -510,7 +180,7 @@ fn close_flagged_retained_timeout_emits_late_then_closes() {
    });
    let mut client = Client::connect(ClientConfig {
        probe_timeout: Duration::from_millis(50),
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(200)),
            ..Default::default()
        },
@@ -605,7 +275,7 @@ fn close_flagged_evicted_sequence_emits_late_then_closes() {
    });
    let mut client = Client::connect(ClientConfig {
        max_pending_probes: 1,
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(200)),
            ..Default::default()
        },
@@ -669,7 +339,7 @@ fn close_flagged_untracked_sequence_emits_warning_then_closes() {
        }
    });
    let mut client = Client::connect(ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(200)),
            ..Default::default()
        },
@@ -727,7 +397,7 @@ fn wrong_token_close_flag_does_not_close_session() {
        }
    });
    let mut client = Client::connect(ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(200)),
            ..Default::default()
        },
@@ -752,3 +422,66 @@ fn wrong_token_close_flag_does_not_close_session() {
    client.close().unwrap();
    server.join();
 }
+
+#[test]
+fn close_flagged_echo_reply_emits_reply_then_closes_without_sending_close() {
+    let params = default_params();
+    let server = start_fake_server({
+        let params = params.clone();
+        move |socket, tx| {
+            let (_, peer) = recv_request(&socket, &tx);
+            let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+            socket.send_to(&reply, peer).unwrap();
+
+            let (request, _) = recv_request(&socket, &tx);
+            let seq = u32::from_le_bytes(request[12..16].try_into().unwrap());
+            let reply = echo_reply_packet_with_flags(
+                TOKEN,
+                seq,
+                &params,
+                &TimestampFields::default(),
+                None,
+                FLAG_REPLY | flags::FLAG_CLOSE,
+            );
+            socket.send_to(&reply, peer).unwrap();
+
+            socket
+                .set_read_timeout(Some(Duration::from_millis(250)))
+                .unwrap();
+            while recv_request_timeout(&socket, &tx).is_some() {}
+        }
+    });
+    let config = ClientConfig {
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    client.send_probe().unwrap();
+
+    let events = client.recv_once().unwrap();
+    assert!(matches!(
+        events.first(),
+        Some(ClientEvent::EchoReply { .. })
+    ));
+    assert!(matches!(
+        events.get(1),
+        Some(ClientEvent::SessionClosed { token: TOKEN, .. })
+    ));
+    assert_eq!(events.len(), 2);
+
+    assert!(matches!(
+        client.send_probe(),
+        Err(ClientError::AlreadyClosed)
+    ));
+
+    let first = server.rx.recv_timeout(Duration::from_millis(100)).unwrap();
+    let second = server.rx.recv_timeout(Duration::from_millis(100)).unwrap();
+    assert_eq!(first[3] & FLAG_OPEN, FLAG_OPEN);
+    assert_eq!(second[3] & flags::FLAG_CLOSE, 0);
+    assert!(server.rx.recv_timeout(Duration::from_millis(400)).is_err());
+    server.join();
+}
@@ -1,93 +1,7 @@
 use super::*;

 #[test]
-fn client_config_default() {
-    let config = ClientConfig::default();
-    assert_eq!(config.duration, Some(Duration::from_secs(3)));
-    assert_eq!(config.interval, Duration::from_secs(1));
-    assert_eq!(config.length, 0);
-    assert_eq!(config.received_stats, ReceivedStats::Both);
-    assert_eq!(config.stamp_at, StampAt::Both);
-    assert_eq!(config.clock, Clock::Both);
-    assert_eq!(config.dscp, 0);
-    assert_eq!(config.hmac_key, None);
-    assert_eq!(config.server_fill, None);
-    assert_eq!(config.open_timeouts, DEFAULT_OPEN_TIMEOUTS);
-    assert_eq!(config.run_mode, RunMode::Normal);
-    assert_eq!(config.negotiation_policy, NegotiationPolicy::Strict);
-    assert_eq!(config.probe_timeout, Duration::from_secs(4));
-    assert_eq!(config.max_pending_probes, 4096);
-}
-
-#[test]
-fn params_from_config_maps_compatibility_fields() {
-    let config = ClientConfig {
-        duration: Some(Duration::from_secs(5)),
-        interval: Duration::from_millis(250),
-        length: 1472,
-        received_stats: ReceivedStats::Window,
-        stamp_at: StampAt::Midpoint,
-        clock: Clock::Wall,
-        dscp: 46,
-        hmac_key: Some(b"secret".to_vec()),
-        server_fill: Some("rand".to_owned()),
-        ..ClientConfig::default()
-    };
-
-    let params = params_from_config(&config).unwrap();
-    assert_eq!(params.protocol_version, PROTOCOL_VERSION);
-    assert_eq!(params.duration_ns, 5_000_000_000);
-    assert_eq!(params.interval_ns, 250_000_000);
-    assert_eq!(params.length, 1472);
-    assert_eq!(params.received_stats, ReceivedStats::Window);
-    assert_eq!(params.stamp_at, StampAt::Midpoint);
-    assert_eq!(params.clock, Clock::Wall);
-    assert_eq!(
-        params.dscp, 184,
-        "config DSCP codepoint 46 must be shifted into raw wire byte 184"
-    );
-    assert_eq!(
-        params.server_fill.as_ref().map(|fill| fill.value.as_str()),
-        Some("rand")
-    );
-    assert_eq!(config.hmac_key.as_deref(), Some(b"secret".as_slice()));
-}
-
-#[test]
-fn params_from_config_accepts_boundary_values() {
-    for length in [0, 1, 1472, 4096, MAX_UDP_PAYLOAD_LENGTH] {
-        let config = ClientConfig {
-            length,
-            ..ClientConfig::default()
-        };
-        assert_eq!(
-            params_from_config(&config).unwrap().length,
-            i64::from(length)
-        );
-    }
-
-    let config = ClientConfig {
-        dscp: 63,
-        ..ClientConfig::default()
-    };
-    assert_eq!(
-        params_from_config(&config).unwrap().dscp,
-        252,
-        "boundary codepoint 63 must be shifted into raw wire byte 252"
-    );
-}
-
-#[test]
-fn params_from_config_encodes_continuous_duration_as_zero() {
-    let config = ClientConfig {
-        duration: None,
-        ..ClientConfig::default()
-    };
-    assert_eq!(params_from_config(&config).unwrap().duration_ns, 0);
-}
-
-#[test]
-fn params_from_config_rejects_invalid_values() {
+fn connect_rejects_invalid_configuration() {
    let i64_max_ns = u64::try_from(i64::MAX).unwrap();
    let too_large = Duration::from_nanos(i64_max_ns) + Duration::from_nanos(1);
    let cases = [
@@ -170,10 +84,10 @@ fn params_from_config_rejects_invalid_values() {
    for (name, config, expected_reason) in cases {
        assert!(
            matches!(
-                params_from_config(&config),
-                Err(ClientError::InvalidConfig { reason }) if reason.contains(expected_reason)
+                Client::connect(config),
+                Err(ClientError::InvalidConfig { .. })
            ),
-            "{name} should fail with InvalidConfig containing {expected_reason:?}"
+            "{name} should fail with InvalidConfig ({expected_reason})"
        );
    }
 }
@@ -0,0 +1,76 @@
+use super::*;
+
+#[test]
+fn hmac_open_ignores_missing_hmac_before_valid_reply() {
+    let key = b"secret".to_vec();
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.hmac_key = Some(key.clone());
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let missing = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        let valid = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&key));
+        socket.send_to(&missing, peer).unwrap();
+        socket.send_to(&valid, peer).unwrap();
+    });
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    assert_eq!(server.rx.iter().take(1).count(), 1);
+    assert!(server.rx.try_recv().is_err());
+    server.join();
+}
+
+#[test]
+fn hmac_open_ignores_bad_hmac_before_valid_reply() {
+    let key = b"secret".to_vec();
+    let wrong_key = b"wrong".to_vec();
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.hmac_key = Some(key.clone());
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let bad = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&wrong_key));
+        let valid = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&key));
+        socket.send_to(&bad, peer).unwrap();
+        socket.send_to(&valid, peer).unwrap();
+    });
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    assert_eq!(server.rx.iter().take(1).count(), 1);
+    assert!(server.rx.try_recv().is_err());
+    server.join();
+}
+
+#[test]
+fn post_token_hmac_negotiation_failure_sends_authenticated_cleanup_close() {
+    let key = b"secret".to_vec();
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.hmac_key = Some(key.clone());
+    let mut returned = default_params();
+    returned.interval_ns += 1;
+    let server_key = key.clone();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &returned, Some(&server_key));
+        socket.send_to(&reply, peer).unwrap();
+        let _ = recv_request(&socket, &tx);
+    });
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+
+    assert!(matches!(
+        client.open(),
+        Err(ClientError::NegotiationRejected { .. })
+    ));
+    let packets: Vec<_> = server.rx.iter().take(2).collect();
+    let cleanup = &packets[1];
+    assert_eq!(cleanup[3], flags::FLAG_CLOSE | FLAG_HMAC);
+    verify_packet_hmac(&key, cleanup).unwrap();
+    assert_eq!(
+        u64::from_le_bytes(cleanup[4 + HMAC_SIZE..12 + HMAC_SIZE].try_into().unwrap()),
+        TOKEN
+    );
+    server.join();
+}
@@ -0,0 +1,22 @@
+use super::*;
+use irtt_client::NegotiationPolicy;
+use irtt_client::{NegotiatedParams, RunMode, WarningKind, MAX_UDP_PAYLOAD_LENGTH};
+use irtt_proto::{flags, Params, TimestampFields};
+use irtt_proto::{
+    flags::FLAG_HMAC, flags::FLAG_OPEN, flags::FLAG_REPLY, verify_packet_hmac, Clock, HMAC_SIZE,
+    MAGIC,
+};
+use std::thread;
+#[cfg(all(target_os = "linux", feature = "ancillary"))]
+use std::time::SystemTime;
+
+mod support;
+use support::*;
+
+mod close;
+mod config;
+mod hmac;
+mod no_test;
+mod open;
+mod probes_replies;
+mod ttl;
@@ -1,27 +1,10 @@
 use super::*;

-#[test]
-fn no_test_success_validates_params() {
-    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    config.run_mode = RunMode::NoTest;
-    let params = params_from_config(&config).unwrap();
-    let server = no_test_server(params.clone(), 0);
-    config.server_addr = server.addr.to_string();
-    let mut client = Client::connect(config).unwrap();
-    assert!(client.next_send_deadline().is_none());
-    let negotiated = assert_no_test_completed(client.open().unwrap());
-    assert_eq!(negotiated.params, params);
-    assert!(client.next_send_deadline().is_none());
-    assert!(client.schedule.is_none());
-    assert_eq!(client.applied_traffic_class, None);
-    server.join();
-}
-
 #[test]
 fn no_test_rejects_non_close_open_reply() {
    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
    config.run_mode = RunMode::NoTest;
-    let params = params_from_config(&config).unwrap();
+    let params = default_params();
    let server = start_fake_server(move |socket, tx| {
        let (_, peer) = recv_request(&socket, &tx);
        socket
@@ -44,33 +27,6 @@ fn no_test_rejects_non_close_open_reply() {
        u64::from_le_bytes(packets[1][4..12].try_into().unwrap()),
        TOKEN
    );
-    assert!(client.runtime.prepare_open_request().is_ok());
-    server.join();
-}
-
-#[test]
-fn no_test_cleanup_send_failure_preserves_unexpected_reply() {
-    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
-    config.run_mode = RunMode::NoTest;
-    let params = params_from_config(&config).unwrap();
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        socket
-            .send_to(
-                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
-                peer,
-            )
-            .unwrap();
-    });
-    config.server_addr = server.addr.to_string();
-    let mut client = Client::connect(config).unwrap();
-    client.test_hooks.fail_cleanup_send.set(true);
-
-    assert!(matches!(
-        client.open(),
-        Err(ClientError::UnexpectedNoTestReply)
-    ));
-    assert!(client.runtime.prepare_open_request().is_ok());
    server.join();
 }

@@ -78,7 +34,7 @@ fn no_test_cleanup_send_failure_preserves_unexpected_reply() {
 fn no_test_rejects_non_zero_token_with_close_reply() {
    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
    config.run_mode = RunMode::NoTest;
-    let params = params_from_config(&config).unwrap();
+    let params = default_params();
    let server = no_test_server(params, TOKEN);
    config.server_addr = server.addr.to_string();
    let mut client = Client::connect(config).unwrap();
@@ -93,7 +49,7 @@ fn no_test_rejects_non_zero_token_with_close_reply() {
 fn no_test_strict_negotiation_rejects_changed_params() {
    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
    config.run_mode = RunMode::NoTest;
-    let mut params = params_from_config(&config).unwrap();
+    let mut params = default_params();
    params.dscp = 1;
    let server = no_test_server(params, 0);
    config.server_addr = server.addr.to_string();
@@ -110,7 +66,7 @@ fn no_test_loose_negotiation_accepts_restricted_params() {
    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
    config.run_mode = RunMode::NoTest;
    config.negotiation_policy = NegotiationPolicy::Loose;
-    let requested = params_from_config(&config).unwrap();
+    let requested = default_params();
    let mut params = requested.clone();
    params.duration_ns /= 2;
    let server = no_test_server(params.clone(), 0);
@@ -120,7 +76,7 @@ fn no_test_loose_negotiation_accepts_restricted_params() {
    assert_eq!(negotiated.params, params);
    assert_eq!(
        negotiated.restrictions,
-        vec![crate::NegotiationRestriction::DurationReduced {
+        vec![irtt_client::NegotiationRestriction::DurationReduced {
            requested_ns: requested.duration_ns,
            negotiated_ns: params.duration_ns,
        }]
@@ -132,7 +88,7 @@ fn no_test_loose_negotiation_accepts_restricted_params() {
 fn send_probe_fails_after_no_test_completed() {
    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
    config.run_mode = RunMode::NoTest;
-    let params = params_from_config(&config).unwrap();
+    let params = default_params();
    let server = no_test_server(params, 0);
    config.server_addr = server.addr.to_string();
    let mut client = Client::connect(config).unwrap();
@@ -148,7 +104,7 @@ fn send_probe_fails_after_no_test_completed() {
 fn open_fails_after_no_test_completed() {
    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
    config.run_mode = RunMode::NoTest;
-    let params = params_from_config(&config).unwrap();
+    let params = default_params();
    let server = no_test_server(params, 0);
    config.server_addr = server.addr.to_string();
    let mut client = Client::connect(config).unwrap();
@@ -0,0 +1,233 @@
+use super::*;
+
+#[test]
+fn open_fails_when_already_open() {
+    let params = default_params();
+    let server = open_success_server(params);
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+    assert_open_started(client.open().unwrap());
+    assert!(matches!(client.open(), Err(ClientError::AlreadyOpen)));
+    server.join();
+}
+
+#[test]
+fn open_retries_after_first_timeout() {
+    let server = start_fake_server(|socket, tx| {
+        let (first, _) = recv_request(&socket, &tx);
+        let (_, peer) = recv_request(&socket, &tx);
+        let params = Params::decode(&first[4..]).unwrap();
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        assert_eq!(first[3] & FLAG_OPEN, FLAG_OPEN);
+        socket.send_to(&reply, peer).unwrap();
+    });
+    let config = ClientConfig {
+        open_timeouts: vec![Duration::from_millis(200), Duration::from_millis(500)],
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    let outcome = client.open().unwrap();
+    assert_open_started(outcome);
+    assert_eq!(server.rx.iter().take(2).count(), 2);
+    server.join();
+}
+
+#[test]
+fn protocol_version_mismatch_fails() {
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.negotiation_policy = NegotiationPolicy::Loose;
+    let mut params = default_params();
+    params.protocol_version = 2;
+    let server = open_success_server(params);
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+    assert!(matches!(
+        client.open(),
+        Err(ClientError::ProtocolVersionMismatch { received: 2, .. })
+    ));
+    assert_eq!(server.rx.iter().take(1).count(), 1);
+    server.join();
+}
+
+#[test]
+fn server_rejection_fails_in_normal_mode() {
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY | flags::FLAG_CLOSE, 0, &params, None);
+        socket.send_to(&reply, peer).unwrap();
+    });
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+    assert!(matches!(client.open(), Err(ClientError::ServerRejected)));
+    assert_eq!(server.rx.iter().take(1).count(), 1);
+    server.join();
+}
+
+#[test]
+fn ignored_datagrams_do_not_restart_the_attempt_deadline() {
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        thread::sleep(Duration::from_millis(150));
+        socket.send_to(&[0_u8], peer).unwrap();
+        thread::sleep(Duration::from_millis(150));
+        socket.send_to(&[0_u8], peer).unwrap();
+        let _ = recv_request(&socket, &tx);
+    });
+    let config = ClientConfig {
+        open_timeouts: vec![Duration::from_millis(250), Duration::from_millis(250)],
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    let started = Instant::now();
+
+    assert!(matches!(client.open(), Err(ClientError::OpenTimeout)));
+    let requests: Vec<_> = server.rx.iter().take(2).collect();
+    assert_eq!(requests.len(), 2);
+    assert!(
+        started.elapsed() < Duration::from_millis(700),
+        "ignored datagrams restarted an attempt deadline"
+    );
+    server.join();
+}
+
+#[test]
+fn opening_deadline_overflow_occurs_before_send() {
+    let server = timeout_server(Duration::from_millis(250));
+    let config = ClientConfig {
+        open_timeouts: vec![Duration::MAX],
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+
+    assert!(matches!(client.open(), Err(ClientError::DurationOverflow)));
+    assert!(server.rx.try_recv().is_err());
+    server.join();
+}
+
+#[test]
+fn post_token_negotiation_failure_sends_cleanup_close() {
+    let mut returned = default_params();
+    returned.interval_ns += 1;
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        socket
+            .send_to(
+                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &returned, None),
+                peer,
+            )
+            .unwrap();
+        let _ = recv_request(&socket, &tx);
+    });
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+
+    assert!(matches!(
+        client.open(),
+        Err(ClientError::NegotiationRejected { .. })
+    ));
+    let packets: Vec<_> = server.rx.iter().take(2).collect();
+    assert_eq!(packets[1][3], flags::FLAG_CLOSE);
+    assert_eq!(
+        u64::from_le_bytes(packets[1][4..12].try_into().unwrap()),
+        TOKEN
+    );
+    server.join();
+}
+
+#[test]
+fn open_timeout_after_all_timeouts() {
+    let server = timeout_server(Duration::from_millis(700));
+    let config = ClientConfig {
+        open_timeouts: vec![Duration::from_millis(200), Duration::from_millis(200)],
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(50)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert!(matches!(client.open(), Err(ClientError::OpenTimeout)));
+    assert_eq!(server.rx.iter().take(2).count(), 2);
+    server.join();
+}
+
+#[test]
+fn multiple_untrusted_datagrams_before_valid_reply_use_one_attempt() {
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let valid = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        let mut wrong_type = valid.clone();
+        wrong_type[3] = FLAG_REPLY;
+        let mut reserved_flags = valid.clone();
+        reserved_flags[3] |= 0x10;
+        let mut bad_magic = valid.clone();
+        bad_magic[0] ^= 0xff;
+        let unexpected_hmac =
+            open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(b"unexpected"));
+
+        for packet in [
+            vec![0_u8],
+            bad_magic,
+            wrong_type,
+            reserved_flags,
+            unexpected_hmac,
+            valid,
+        ] {
+            socket.send_to(&packet, peer).unwrap();
+        }
+    });
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+
+    assert_open_started(client.open().unwrap());
+    assert_eq!(server.rx.iter().take(1).count(), 1);
+    assert!(server.rx.try_recv().is_err());
+
+    server.join();
+}
+
+#[test]
+fn only_ignored_open_datagrams_eventually_time_out() {
+    let server = start_fake_server(move |socket, tx| {
+        for _ in 0..2 {
+            let (_, peer) = recv_request(&socket, &tx);
+            socket.send_to(&[0_u8], peer).unwrap();
+            socket.send_to(&MAGIC, peer).unwrap();
+        }
+        thread::sleep(Duration::from_millis(300));
+    });
+    let config = ClientConfig {
+        open_timeouts: vec![Duration::from_millis(200), Duration::from_millis(200)],
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(50)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+
+    assert!(matches!(client.open(), Err(ClientError::OpenTimeout)));
+    assert_eq!(server.rx.iter().take(2).count(), 2);
+    assert!(server.rx.try_recv().is_err());
+    server.join();
+}
+
+#[test]
+fn trusted_zero_token_normal_reply_is_terminal() {
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        // encode_open_reply rejects a zero token without FLAG_CLOSE, so this
+        // deliberately non-compliant reply is built by encoding a normal
+        // reply with a placeholder token and then zeroing the token field.
+        let mut reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        reply[HMAC_OFFSET..HMAC_OFFSET + 8].copy_from_slice(&0_u64.to_le_bytes());
+        socket.send_to(&reply, peer).unwrap();
+    });
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+
+    assert!(matches!(
+        client.open(),
+        Err(ClientError::Protocol(irtt_proto::ProtoError::ZeroToken))
+    ));
+    assert_eq!(server.rx.iter().take(1).count(), 1);
+
+    server.join();
+}
@@ -2,7 +2,7 @@ use super::*;
 use support::echo_packet_len;

 #[cfg(not(all(target_os = "linux", feature = "ancillary")))]
-fn assert_packet_meta_unavailable(packet_meta: &crate::event::PacketMeta) {
+fn assert_packet_meta_unavailable(packet_meta: &irtt_client::PacketMeta) {
    assert_eq!(packet_meta.traffic_class, None);
    assert_eq!(packet_meta.dscp, None);
    assert_eq!(packet_meta.ecn, None);
@@ -20,11 +20,8 @@ fn kernel_rx_timestamp_unavailable_skip(test_name: &str) {
 }

 mod burst_recv;
-mod interrupted_receive;
 mod packet_length;
-mod probe_schedule;
 mod reply_classification;
 mod reply_decode;
 mod reply_metadata;
 mod timeouts;
-mod timing_math;
@@ -1,62 +1,5 @@
 use super::*;

-#[test]
-fn minimal_negotiated_layout_works() {
-    let params = Params {
-        protocol_version: 1,
-        duration_ns: 3_000_000_000,
-        interval_ns: 1_000_000_000,
-        received_stats: ReceivedStats::None,
-        stamp_at: StampAt::None,
-        clock: Clock::Both,
-        ..Params::default()
-    };
-    let server = start_fake_server(move |socket, tx| {
-        let (_, peer) = recv_request(&socket, &tx);
-        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
-        socket.send_to(&reply, peer).unwrap();
-
-        socket
-            .set_read_timeout(Some(Duration::from_secs(2)))
-            .unwrap();
-        let mut buf = [0_u8; 2048];
-        if let Ok((size, _)) = socket.recv_from(&mut buf) {
-            tx.send(buf[..size].to_vec()).unwrap();
-            let seq = u32::from_le_bytes(buf[12..16].try_into().unwrap());
-            let ts = TimestampFields::default();
-            let reply_packet = echo_reply_packet(TOKEN, seq, &params, &ts, None);
-            socket.send_to(&reply_packet, peer).unwrap();
-        }
-    });
-    let config = ClientConfig {
-        received_stats: ReceivedStats::None,
-        stamp_at: StampAt::None,
-        socket_config: crate::SocketConfig {
-            recv_timeout: Some(Duration::from_millis(200)),
-            ..Default::default()
-        },
-        ..default_test_config(server.addr)
-    };
-    let mut client = Client::connect(config).unwrap();
-    assert_open_started(client.open().unwrap());
-    client.send_probe().unwrap();
-    thread::sleep(Duration::from_millis(30));
-    let events = client.recv_once().unwrap();
-    assert_eq!(events.len(), 1);
-    if let ClientEvent::EchoReply {
-        received_stats,
-        server_timing,
-        ..
-    } = &events[0]
-    {
-        assert!(received_stats.is_none());
-        assert!(server_timing.is_none());
-    } else {
-        panic!("expected EchoReply");
-    }
-    server.join();
-}
-
 // ---------- Regression tests ----------

 #[test]
@@ -81,7 +24,7 @@ fn short_echo_reply_does_not_emit_echo_reply() {
    });
    let config = ClientConfig {
        length: 64,
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(200)),
            ..Default::default()
        },
@@ -127,7 +70,7 @@ fn overlong_datagram_detection_uses_extra_receive_byte() {
    });
    let config = ClientConfig {
        length: 4096,
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(200)),
            ..Default::default()
        },
@@ -170,7 +113,7 @@ fn exact_length_echo_reply_still_emits_echo_reply() {
    });
    let config = ClientConfig {
        length: 4096,
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(200)),
            ..Default::default()
        },
@@ -23,7 +23,7 @@ fn duplicate_reply_emits_duplicate_event() {
        }
    });
    let config = ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(200)),
            ..Default::default()
        },
@@ -77,7 +77,7 @@ fn out_of_order_reply_emits_late_event() {
        socket.send_to(&reply0, peer).unwrap();
    });
    let config = ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(200)),
            ..Default::default()
        },
@@ -5,7 +5,7 @@ fn recv_once_returns_empty_on_timeout() {
    let params = default_params();
    let server = open_success_server(params);
    let config = ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(50)),
            ..Default::default()
        },
@@ -18,66 +18,6 @@ fn recv_once_returns_empty_on_timeout() {
    server.join();
 }

-#[test]
-fn recv_once_decodes_echo_reply_and_emits_event() {
-    let params = default_params();
-    let (mut client, server) = open_client_with_echo_server(&params);
-
-    client.send_probe().unwrap();
-    thread::sleep(Duration::from_millis(50));
-
-    let events = client.recv_once().unwrap();
-    assert_eq!(events.len(), 1);
-    match &events[0] {
-        ClientEvent::EchoReply {
-            seq,
-            rtt,
-            received_stats,
-            server_timing,
-            bytes,
-            packet_meta,
-            ..
-        } => {
-            assert_eq!(*seq, 0);
-            assert_eq!(*bytes, echo_packet_len(false, &params));
-            assert!(rtt.raw > Duration::ZERO);
-            assert_eq!(
-                rtt.effective,
-                rtt.adjusted
-                    .unwrap_or_else(|| SignedDuration::from_duration(rtt.raw))
-            );
-            assert!(received_stats.is_some());
-            let stats = received_stats.as_ref().unwrap();
-            assert_eq!(stats.count, Some(42));
-            assert_eq!(stats.window, Some(0x07));
-            assert!(server_timing.is_some());
-            let st = server_timing.as_ref().unwrap();
-            assert!(st.processing.is_some());
-            #[cfg(not(all(target_os = "linux", feature = "ancillary")))]
-            {
-                assert_eq!(packet_meta.traffic_class, None);
-                assert_eq!(packet_meta.dscp, None);
-                assert_eq!(packet_meta.ecn, None);
-                assert_eq!(packet_meta.kernel_rx_timestamp, None);
-            }
-            #[cfg(all(target_os = "linux", feature = "ancillary"))]
-            {
-                assert_eq!(
-                    packet_meta.dscp,
-                    packet_meta.traffic_class.map(|tc| tc >> 2)
-                );
-                assert_eq!(
-                    packet_meta.ecn,
-                    packet_meta.traffic_class.map(|tc| tc & 0b11)
-                );
-            }
-        }
-        other => panic!("expected EchoReply, got {other:?}"),
-    }
-    client.close().unwrap();
-    server.join();
-}
-
 #[test]
 fn recv_once_decodes_only_received_bytes_after_longer_datagram() {
    let params = default_params();
@@ -113,7 +53,7 @@ fn recv_once_decodes_only_received_bytes_after_longer_datagram() {
        socket.send_to(&shorter, peer).unwrap();
    });
    let config = ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(200)),
            ..Default::default()
        },
@@ -14,13 +14,13 @@ fn echo_reply_metadata_propagates_observed_dscp_with_ancillary() {
        let (size, _) = socket.recv_from(&mut buf).unwrap();
        tx.send(buf[..size].to_vec()).unwrap();
        let seq = u32::from_le_bytes(buf[12..16].try_into().unwrap());
-        crate::socket_options::apply_traffic_class_to_socket(&socket, peer, 184).unwrap();
+        socket2::SockRef::from(&socket).set_tos_v4(184).unwrap();
        let reply_packet =
            echo_reply_packet(TOKEN, seq, &params, &TimestampFields::default(), None);
        socket.send_to(&reply_packet, peer).unwrap();
    });
    let config = ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(200)),
            ..Default::default()
        },
@@ -6,7 +6,7 @@ fn poll_timeouts_emits_echo_loss() {
    let server = silent_open_server(params);
    let config = ClientConfig {
        probe_timeout: Duration::from_millis(100),
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(50)),
            ..Default::default()
        },
@@ -57,7 +57,7 @@ fn late_reply_after_timeout_preserves_measurement_metadata() {
    });
    let config = ClientConfig {
        probe_timeout: Duration::from_millis(40),
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(200)),
            ..Default::default()
        },
@@ -119,7 +119,7 @@ fn pending_full_does_not_send_packet() {
    let config = ClientConfig {
        duration: Some(Duration::from_secs(60)),
        max_pending_probes: 2,
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(50)),
            ..Default::default()
        },
@@ -253,7 +253,7 @@ pub(super) fn assert_no_test_completed(outcome: OpenOutcome) -> NegotiatedParams
 pub(super) fn open_client_with_echo_server(params: &Params) -> (Client, FakeServer) {
    let server = echo_server(params.clone());
    let config = ClientConfig {
-        socket_config: crate::SocketConfig {
+        socket_config: irtt_client::SocketConfig {
            recv_timeout: Some(Duration::from_millis(200)),
            ..Default::default()
        },
@@ -0,0 +1,22 @@
+use super::*;
+
+#[test]
+fn connect_accepts_valid_ttl_config_values() {
+    for ttl in [None, Some(1), Some(255)] {
+        let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 9)));
+        config.socket_config.ttl = ttl;
+        Client::connect(config).unwrap();
+    }
+}
+
+#[test]
+fn connect_rejects_invalid_ttl_values() {
+    for ttl in [0, 256] {
+        let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 9)));
+        config.socket_config.ttl = Some(ttl);
+        assert!(matches!(
+            Client::connect(config),
+            Err(ClientError::InvalidConfig { .. })
+        ));
+    }
+}
@@ -75,16 +75,48 @@ async fn exercise_client_server() {
            ..
        }] if *remote == server_addr
    ));
-    assert!(matches!(
-        client.recv().await.unwrap().as_slice(),
-        [ClientEvent::EchoReply {
-            seq: 0,
-            remote,
-            server_timing: Some(_),
-            received_stats: Some(_),
-            ..
-        }] if *remote == server_addr
-    ));
+    let events = client.recv().await.unwrap();
+    let [ClientEvent::EchoReply {
+        seq: 0,
+        remote,
+        sent_at,
+        received_at,
+        rtt,
+        server_timing: Some(timing),
+        one_way: Some(one_way),
+        received_stats: Some(_),
+        packet_meta,
+        ..
+    }] = events.as_slice()
+    else {
+        panic!("expected a measured reply, got {events:?}");
+    };
+    assert_eq!(*remote, server_addr);
+    assert_eq!(rtt.raw, received_at.mono.duration_since(sent_at.mono));
+    // Verify the measurement endpoint through public reply metadata and real
+    // OS timestamps. This also covers the userspace fallback on other targets.
+    let receive_wall = packet_meta
+        .kernel_rx_timestamp
+        .filter(|kernel| {
+            received_at
+                .wall
+                .duration_since(*kernel)
+                .is_ok_and(|lag| lag <= Duration::from_secs(1))
+        })
+        .unwrap_or(received_at.wall);
+    let receive_ns = i128::try_from(
+        receive_wall
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_nanos(),
+    )
+    .unwrap();
+    assert_eq!(
+        one_way.server_to_client,
+        Some(irtt_client::SignedDuration::from_nanos(
+            receive_ns - i128::from(timing.send_wall_ns.unwrap())
+        ))
+    );
    assert!(matches!(
        client.close().await.unwrap().as_slice(),
        [ClientEvent::SessionClosed { remote, .. }] if *remote == server_addr
@@ -0,0 +1,678 @@
+use std::{
+    future::Future,
+    net::UdpSocket,
+    pin::Pin,
+    sync::mpsc,
+    task::{Context, Poll, Waker},
+    thread::{self, JoinHandle},
+};
+
+use irtt_proto::{
+    decode_request, encode_echo_reply, encode_open_reply, flags, verify_packet_hmac,
+    DecodedRequestKind, EchoReply, OpenReply, Params, ReceivedStats, StampAt, TimestampFields,
+};
+use tokio::runtime::{Builder, Runtime};
+
+mod support;
+
+use irtt_client::{AsyncClient, ClientConfig, ClientError, ClientEvent, OpenOutcome};
+use irtt_client::{Client, RunMode, SocketConfig};
+use irtt_server::ServerConfig;
+use std::{
+    io,
+    net::SocketAddr,
+    time::{Duration, Instant},
+};
+use support::InTreeServer;
+
+const TOKEN: u64 = 0x1234_5678_90ab_cdef;
+
+struct TestServer {
+    addr: SocketAddr,
+    packets: mpsc::Receiver<Vec<u8>>,
+    done: JoinHandle<()>,
+}
+
+impl TestServer {
+    fn finish(self) -> Vec<Vec<u8>> {
+        self.done.join().unwrap();
+        self.packets.try_iter().collect()
+    }
+}
+
+fn runtime() -> Runtime {
+    Builder::new_current_thread()
+        .enable_io()
+        .enable_time()
+        .build()
+        .unwrap()
+}
+
+fn config(addr: SocketAddr, key: Option<Vec<u8>>, dscp: u8) -> ClientConfig {
+    ClientConfig {
+        server_addr: addr.to_string(),
+        received_stats: ReceivedStats::None,
+        stamp_at: StampAt::None,
+        dscp,
+        hmac_key: key,
+        open_timeouts: vec![Duration::from_millis(200)],
+        socket_config: SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..SocketConfig::default()
+        },
+        ..ClientConfig::default()
+    }
+}
+
+async fn opened_client(addr: SocketAddr, dscp: u8) -> AsyncClient {
+    let mut client = AsyncClient::connect(config(addr, None, dscp))
+        .await
+        .unwrap();
+    client.open().await.unwrap();
+    client
+}
+
+fn start_server<F>(handler: F) -> TestServer
+where
+    F: FnOnce(UdpSocket, mpsc::Sender<Vec<u8>>) + Send + 'static,
+{
+    let socket = UdpSocket::bind("127.0.0.1:0").unwrap();
+    socket
+        .set_read_timeout(Some(Duration::from_secs(2)))
+        .unwrap();
+    let addr = socket.local_addr().unwrap();
+    let (tx, packets) = mpsc::channel();
+    let done = thread::spawn(move || handler(socket, tx));
+    TestServer {
+        addr,
+        packets,
+        done,
+    }
+}
+
+fn recv_packet(socket: &UdpSocket, tx: &mpsc::Sender<Vec<u8>>) -> (Vec<u8>, SocketAddr) {
+    let mut buffer = [0_u8; 8192];
+    let (len, peer) = socket.recv_from(&mut buffer).unwrap();
+    let packet = buffer[..len].to_vec();
+    tx.send(packet.clone()).unwrap();
+    (packet, peer)
+}
+
+/// Admits a request the way a compliant server does: structural decode first,
+/// then HMAC presence policy, then authentication. Returns `None` for anything
+/// a server would silently discard.
+fn decode_server_request<'a>(
+    packet: &'a [u8],
+    key: Option<&[u8]>,
+) -> Option<DecodedRequestKind<'a>> {
+    let request = decode_request(packet).ok()?;
+    if request.hmac_present != key.is_some() {
+        return None;
+    }
+    if let Some(key) = key {
+        verify_packet_hmac(key, packet).ok()?;
+    }
+    Some(request.kind)
+}
+
+/// Returns the requested parameters and whether this was a no-test open.
+fn open_request(packet: &[u8], key: Option<&[u8]>) -> (Params, bool) {
+    match decode_server_request(packet, key) {
+        Some(DecodedRequestKind::Open { params, no_test }) => {
+            (Params::decode(params).unwrap(), no_test)
+        }
+        other => panic!("expected an authenticated open request, got {other:?}"),
+    }
+}
+
+fn echo_request_sequence(packet: &[u8], key: Option<&[u8]>) -> u32 {
+    match decode_server_request(packet, key) {
+        Some(DecodedRequestKind::Echo { sequence, .. }) => sequence,
+        other => panic!("expected an authenticated echo request, got {other:?}"),
+    }
+}
+
+fn close_request_token(packet: &[u8], key: Option<&[u8]>) -> u64 {
+    match decode_server_request(packet, key) {
+        Some(DecodedRequestKind::Close { token }) => token,
+        other => panic!("expected an authenticated close request, got {other:?}"),
+    }
+}
+
+fn send_open_reply(
+    socket: &UdpSocket,
+    peer: SocketAddr,
+    params: Params,
+    key: Option<&[u8]>,
+    reply_flags: u8,
+    token: u64,
+) {
+    let reply = encode_open_reply(
+        &OpenReply {
+            flags: reply_flags,
+            token,
+            params,
+        },
+        key,
+    )
+    .unwrap();
+    socket.send_to(&reply, peer).unwrap();
+}
+
+fn open_session(
+    socket: &UdpSocket,
+    tx: &mpsc::Sender<Vec<u8>>,
+    key: Option<&[u8]>,
+) -> (Params, SocketAddr) {
+    let (packet, peer) = recv_packet(socket, tx);
+    let (params, _) = open_request(&packet, key);
+    send_open_reply(
+        socket,
+        peer,
+        params.clone(),
+        key,
+        flags::FLAG_OPEN | flags::FLAG_REPLY,
+        TOKEN,
+    );
+    (params, peer)
+}
+
+fn echo_reply(
+    params: &Params,
+    sequence: u32,
+    token: u64,
+    reply_flags: u8,
+    key: Option<&[u8]>,
+) -> Vec<u8> {
+    encode_echo_reply(
+        &EchoReply {
+            flags: reply_flags,
+            token,
+            sequence,
+            recv_count: None,
+            recv_window: None,
+            timestamps: TimestampFields::default(),
+            payload: Vec::new(),
+        },
+        params,
+        key,
+    )
+    .unwrap()
+}
+
+fn start_no_test_server() -> TestServer {
+    start_server(move |socket, tx| {
+        let (open_packet, peer) = recv_packet(&socket, &tx);
+        let (params, no_test) = open_request(&open_packet, None);
+        assert!(no_test);
+        send_open_reply(
+            &socket,
+            peer,
+            params,
+            None,
+            flags::FLAG_OPEN | flags::FLAG_REPLY | flags::FLAG_CLOSE,
+            0,
+        );
+    })
+}
+
+fn start_peer_close_server() -> TestServer {
+    start_server(move |socket, tx| {
+        let (params, peer) = open_session(&socket, &tx, None);
+        let (probe_packet, _) = recv_packet(&socket, &tx);
+        let sequence = echo_request_sequence(&probe_packet, None);
+        socket
+            .send_to(
+                &echo_reply(
+                    &params,
+                    sequence,
+                    TOKEN,
+                    flags::FLAG_REPLY | flags::FLAG_CLOSE,
+                    None,
+                ),
+                peer,
+            )
+            .unwrap();
+    })
+}
+
+fn poll_once<F: Future>(future: Pin<&mut F>) -> Poll<F::Output> {
+    let mut context = Context::from_waker(Waker::noop());
+    Future::poll(future, &mut context)
+}
+
+fn poll_recv_once(client: &mut AsyncClient) -> Poll<Result<Vec<ClientEvent>, ClientError>> {
+    let mut future = Box::pin(client.recv());
+    poll_once(Pin::as_mut(&mut future))
+}
+
+#[test]
+fn connect_requires_current_runtime_when_polled() {
+    let mut future = Box::pin(AsyncClient::connect(ClientConfig::default()));
+    assert!(matches!(
+        poll_once(Pin::as_mut(&mut future)),
+        Poll::Ready(Err(ClientError::NoTokioRuntime))
+    ));
+}
+
+#[test]
+fn recv_before_open_fails_on_first_poll_without_socket_readiness() {
+    runtime().block_on(async {
+        let remote = SocketAddr::from(([127, 0, 0, 1], 2112));
+        let mut client = AsyncClient::connect(config(remote, None, 0)).await.unwrap();
+
+        assert!(matches!(
+            poll_recv_once(&mut client),
+            Poll::Ready(Err(ClientError::NotOpen))
+        ));
+    });
+}
+
+#[test]
+fn ignored_open_traffic_cannot_extend_the_absolute_attempt_deadline() {
+    let server = start_server(move |socket, tx| {
+        let (first_packet, peer) = recv_packet(&socket, &tx);
+        let (params, _) = open_request(&first_packet, None);
+        socket
+            .set_read_timeout(Some(Duration::from_millis(10)))
+            .unwrap();
+        let started = Instant::now();
+        let mut next_noise = started;
+        let mut buffer = [0_u8; 512];
+
+        while started.elapsed() < Duration::from_millis(350) {
+            let now = Instant::now();
+            if now >= next_noise {
+                socket.send_to(&[0_u8], peer).unwrap();
+                next_noise = now + Duration::from_millis(25);
+            }
+            match socket.recv_from(&mut buffer) {
+                Ok((len, second_peer)) => {
+                    tx.send(buffer[..len].to_vec()).unwrap();
+                    send_open_reply(
+                        &socket,
+                        second_peer,
+                        params,
+                        None,
+                        flags::FLAG_OPEN | flags::FLAG_REPLY,
+                        TOKEN,
+                    );
+                    return;
+                }
+                Err(error)
+                    if matches!(
+                        error.kind(),
+                        io::ErrorKind::WouldBlock | io::ErrorKind::TimedOut
+                    ) => {}
+                Err(error) => panic!("{error}"),
+            }
+        }
+        panic!("second open request did not arrive after the first absolute deadline");
+    });
+    let mut client_config = config(server.addr, None, 0);
+    client_config.open_timeouts = vec![Duration::from_millis(200), Duration::from_millis(200)];
+
+    runtime().block_on(async {
+        let mut client = AsyncClient::connect(client_config).await.unwrap();
+        assert!(matches!(
+            client.open().await.unwrap(),
+            OpenOutcome::Started { .. }
+        ));
+    });
+    assert_eq!(server.finish().len(), 2);
+}
+
+#[test]
+fn authenticated_rejection_is_terminal_without_retry() {
+    let server = start_server(move |socket, tx| {
+        let (open_packet, peer) = recv_packet(&socket, &tx);
+        let (params, _) = open_request(&open_packet, None);
+        send_open_reply(
+            &socket,
+            peer,
+            params,
+            None,
+            flags::FLAG_OPEN | flags::FLAG_REPLY | flags::FLAG_CLOSE,
+            0,
+        );
+    });
+    let mut client_config = config(server.addr, None, 0);
+    client_config.open_timeouts = vec![Duration::from_millis(200), Duration::from_millis(200)];
+
+    runtime().block_on(async {
+        let mut client = AsyncClient::connect(client_config).await.unwrap();
+        assert!(matches!(
+            client.open().await,
+            Err(ClientError::ServerRejected)
+        ));
+    });
+    assert_eq!(server.finish().len(), 1);
+}
+
+#[test]
+fn recv_after_local_close_and_no_test_fails_on_first_poll() {
+    let close_server = start_server(move |socket, tx| {
+        open_session(&socket, &tx, None);
+        let (close_packet, _) = recv_packet(&socket, &tx);
+        assert_eq!(close_request_token(&close_packet, None), TOKEN);
+    });
+    runtime().block_on(async {
+        let mut client = opened_client(close_server.addr, 0).await;
+        client.close().await.unwrap();
+        assert!(matches!(
+            poll_recv_once(&mut client),
+            Poll::Ready(Err(ClientError::AlreadyClosed))
+        ));
+    });
+    assert_eq!(close_server.finish().len(), 2);
+
+    let no_test_server = start_no_test_server();
+    runtime().block_on(async {
+        let mut client_config = config(no_test_server.addr, None, 0);
+        client_config.run_mode = RunMode::NoTest;
+        let mut client = AsyncClient::connect(client_config).await.unwrap();
+        client.open().await.unwrap();
+        assert!(matches!(
+            poll_recv_once(&mut client),
+            Poll::Ready(Err(ClientError::AlreadyCompleted))
+        ));
+    });
+    assert_eq!(no_test_server.finish().len(), 1);
+}
+
+#[test]
+fn authenticated_async_lifecycle_applies_negotiated_dscp() {
+    let key = b"async-lifecycle-key".to_vec();
+    let server = InTreeServer::start(ServerConfig::default().with_hmac_key(key.clone()));
+    runtime().block_on(async {
+        let mut client = AsyncClient::connect(config(server.addr, Some(key), 46))
+            .await
+            .unwrap();
+        let opened = client.open().await.unwrap();
+        assert_eq!(open_negotiated(&opened).params.dscp, 184);
+        client.send_probe().await.unwrap();
+        assert!(matches!(client.recv().await.unwrap().as_slice(), [ClientEvent::EchoReply { seq: 0, .. }]));
+        assert!(matches!(client.close().await.unwrap().as_slice(), [ClientEvent::SessionClosed { token, .. }] if *token == open_token(&opened)));
+    });
+}
+
+#[test]
+fn blocking_and_async_peer_close_are_semantically_equivalent() {
+    let blocking_peer_close_server = start_peer_close_server();
+    let mut blocking_peer_close =
+        Client::connect(config(blocking_peer_close_server.addr, None, 0)).unwrap();
+    blocking_peer_close.open().unwrap();
+    blocking_peer_close.send_probe().unwrap();
+    let blocking_peer_close_events = blocking_peer_close.recv_once().unwrap();
+    assert!(blocking_peer_close.is_peer_closed());
+    assert_eq!(blocking_peer_close_server.finish().len(), 2);
+
+    let async_peer_close_server = start_peer_close_server();
+    let async_peer_close_events = runtime().block_on(async {
+        let mut client = AsyncClient::connect(config(async_peer_close_server.addr, None, 0))
+            .await
+            .unwrap();
+        client.open().await.unwrap();
+        client.send_probe().await.unwrap();
+        let events = client.recv().await.unwrap();
+        assert!(client.is_peer_closed());
+        events
+    });
+    assert_eq!(async_peer_close_server.finish().len(), 2);
+    assert_eq!(
+        blocking_peer_close_events.len(),
+        async_peer_close_events.len()
+    );
+    for (blocking, asynchronous) in blocking_peer_close_events
+        .iter()
+        .zip(&async_peer_close_events)
+    {
+        assert_matching_event_shape(blocking, asynchronous);
+    }
+}
+
+fn open_negotiated(outcome: &OpenOutcome) -> &irtt_client::NegotiatedParams {
+    match outcome {
+        OpenOutcome::Started { negotiated, .. }
+        | OpenOutcome::NoTestCompleted { negotiated, .. } => negotiated,
+    }
+}
+
+fn open_token(outcome: &OpenOutcome) -> u64 {
+    match outcome {
+        OpenOutcome::Started { token, .. } => *token,
+        OpenOutcome::NoTestCompleted { .. } => panic!("no-test open has no session token"),
+    }
+}
+
+fn assert_matching_event_shape(blocking: &ClientEvent, asynchronous: &ClientEvent) {
+    assert_eq!(event_shape(blocking), event_shape(asynchronous));
+}
+
+fn event_shape(event: &ClientEvent) -> (&'static str, u64, usize) {
+    match event {
+        ClientEvent::EchoSent { seq, bytes, .. } => ("sent", u64::from(*seq), *bytes),
+        ClientEvent::EchoReply { seq, bytes, .. } => ("reply", u64::from(*seq), *bytes),
+        ClientEvent::SessionClosed { .. } => ("closed", 0, 0),
+        other => panic!("unexpected equivalence event: {other:?}"),
+    }
+}
+
+/// A peer that ignores the first `ignored_requests` datagrams before serving a
+/// compliant open, one echo, and one close.
+///
+/// Silence is the point here, so this stays a narrow fake peer rather than a
+/// real `irtt-server`: a compliant server has no way to be deliberately mute
+/// for exactly one open attempt.
+fn start_silent_then_open_server(ignored_requests: usize) -> TestServer {
+    start_server(move |socket, tx| {
+        for _ in 0..ignored_requests {
+            let _ = recv_packet(&socket, &tx);
+        }
+        let (params, peer) = open_session(&socket, &tx, None);
+        let (probe_packet, _) = recv_packet(&socket, &tx);
+        let sequence = echo_request_sequence(&probe_packet, None);
+        socket
+            .send_to(
+                &echo_reply(&params, sequence, TOKEN, flags::FLAG_REPLY, None),
+                peer,
+            )
+            .unwrap();
+        let (close_packet, _) = recv_packet(&socket, &tx);
+        assert_eq!(close_request_token(&close_packet, None), TOKEN);
+    })
+}
+
+/// Stable name for a `ClientError` variant, for comparing what each driver
+/// promises rather than how it produced it.
+fn error_name(error: &ClientError) -> &'static str {
+    match error {
+        ClientError::OpenTimeout => "open timeout",
+        ClientError::NotOpen => "not open",
+        ClientError::AlreadyOpen => "already open",
+        ClientError::AlreadyClosed => "already closed",
+        ClientError::AlreadyCompleted => "already completed",
+        ClientError::ServerRejected => "server rejected",
+        other => panic!("unexpected conformance error: {other:?}"),
+    }
+}
+
+fn probe_sequences(events: &[ClientEvent]) -> Vec<u32> {
+    events
+        .iter()
+        .filter_map(|event| match event {
+            ClientEvent::EchoSent { seq, .. } => Some(*seq),
+            _ => None,
+        })
+        .collect()
+}
+
+fn reply_sequences(events: &[ClientEvent]) -> Vec<u32> {
+    events
+        .iter()
+        .filter_map(|event| match event {
+            ClientEvent::EchoReply { seq, .. } => Some(*seq),
+            _ => None,
+        })
+        .collect()
+}
+
+#[test]
+fn blocking_and_async_roll_back_a_failed_open_and_accept_a_retry() {
+    // One open attempt is ignored, so the first open times out and the second
+    // must be able to open the same connected client.
+    let blocking_server = start_silent_then_open_server(1);
+    let mut blocking = Client::connect(config(blocking_server.addr, None, 0)).unwrap();
+    assert!(!blocking.has_pending_probes());
+    let blocking_first = blocking.open().unwrap_err();
+    assert!(!blocking.has_pending_probes());
+    let blocking_second = blocking.open().unwrap();
+    assert!(!blocking.has_pending_probes());
+    let blocking_sent = blocking.send_probe().unwrap();
+    let blocking_reply = blocking.recv_once().unwrap();
+    let blocking_close = blocking.close().unwrap();
+    assert_eq!(blocking_server.finish().len(), 4);
+
+    let async_server = start_silent_then_open_server(1);
+    let (async_first, async_second, async_sent, async_reply, async_close) =
+        runtime().block_on(async {
+            let mut client = AsyncClient::connect(config(async_server.addr, None, 0))
+                .await
+                .unwrap();
+            assert!(!client.has_pending_probes());
+            let first = client.open().await.unwrap_err();
+            assert!(!client.has_pending_probes());
+            let second = client.open().await.unwrap();
+            assert!(!client.has_pending_probes());
+            let sent = client.send_probe().await.unwrap();
+            let reply = client.recv().await.unwrap();
+            let closed = client.close().await.unwrap();
+            (first, second, sent, reply, closed)
+        });
+    assert_eq!(async_server.finish().len(), 4);
+
+    // Both drivers promise the same failure, and neither leaves the client in a
+    // state that refuses the retry.
+    assert_eq!(error_name(&blocking_first), "open timeout");
+    assert_eq!(error_name(&blocking_first), error_name(&async_first));
+    assert!(matches!(blocking_second, OpenOutcome::Started { .. }));
+    assert!(matches!(async_second, OpenOutcome::Started { .. }));
+    assert_eq!(
+        open_negotiated(&blocking_second),
+        open_negotiated(&async_second)
+    );
+    assert_eq!(open_token(&blocking_second), open_token(&async_second));
+
+    // The retried session starts a fresh probe sequence in both drivers.
+    assert_eq!(probe_sequences(&blocking_sent), [0]);
+    assert_eq!(probe_sequences(&async_sent), [0]);
+    assert_eq!(reply_sequences(&blocking_reply), [0]);
+    assert_eq!(reply_sequences(&async_reply), [0]);
+    assert_eq!(blocking_sent.len(), async_sent.len());
+    assert_eq!(blocking_reply.len(), async_reply.len());
+    assert_eq!(blocking_close.len(), async_close.len());
+    assert_matching_event_shape(&blocking_close[0], &async_close[0]);
+}
+
+#[test]
+fn blocking_and_async_complete_every_caller_paced_probe() {
+    const PROBES: u32 = 3;
+    fn caller_config(addr: SocketAddr) -> ClientConfig {
+        ClientConfig {
+            duration: Some(Duration::from_millis(1)),
+            interval: Duration::from_secs(1),
+            ..config(addr, None, 0)
+        }
+    }
+
+    let blocking_server = InTreeServer::start(ServerConfig::default());
+    let mut blocking = Client::connect(caller_config(blocking_server.addr)).unwrap();
+    let outcome = blocking.open().unwrap();
+    assert_eq!(
+        blocking.negotiated_params(),
+        Some(open_negotiated(&outcome))
+    );
+    assert!(!blocking.has_pending_probes());
+    // Oversleeping cannot invalidate this: low-level sends remain caller-owned
+    // after the negotiated duration. The compliant server has no duration cap.
+    thread::sleep(Duration::from_millis(2));
+    let mut blocking_sent = Vec::new();
+    let mut blocking_replies = Vec::new();
+    for _ in 0..PROBES {
+        blocking_sent.extend(blocking.send_probe().unwrap());
+        assert!(blocking.has_pending_probes());
+        assert!(blocking.next_probe_timeout_deadline().is_some());
+        blocking_replies.extend(blocking.recv_once().unwrap());
+        assert!(!blocking.has_pending_probes());
+    }
+    blocking.close().unwrap();
+    drop(blocking_server);
+
+    let async_server = InTreeServer::start(ServerConfig::default());
+    let (async_sent, async_replies) = runtime().block_on(async {
+        let mut client = AsyncClient::connect(caller_config(async_server.addr))
+            .await
+            .unwrap();
+        let outcome = client.open().await.unwrap();
+        assert_eq!(client.negotiated_params(), Some(open_negotiated(&outcome)));
+        tokio::time::sleep(Duration::from_millis(2)).await;
+        let mut sent = Vec::new();
+        let mut replies = Vec::new();
+        for _ in 0..PROBES {
+            sent.extend(client.send_probe().await.unwrap());
+            assert!(client.has_pending_probes());
+            assert!(client.next_probe_timeout_deadline().is_some());
+            replies.extend(client.recv().await.unwrap());
+            assert!(!client.has_pending_probes());
+        }
+        client.close().await.unwrap();
+        (sent, replies)
+    });
+    drop(async_server);
+
+    let expected: Vec<u32> = (0..PROBES).collect();
+    assert_eq!(probe_sequences(&blocking_sent), expected);
+    assert_eq!(probe_sequences(&async_sent), expected);
+    assert_eq!(reply_sequences(&blocking_replies), expected);
+    assert_eq!(reply_sequences(&async_replies), expected);
+    // Compare the whole emitted streams, not just the probe and reply events
+    // the sequence helpers keep: an extra event on either side is a difference.
+    assert_eq!(blocking_sent.len(), async_sent.len());
+    assert_eq!(blocking_replies.len(), async_replies.len());
+    for event in blocking_sent.iter().chain(&async_sent) {
+        assert!(matches!(
+            event,
+            ClientEvent::EchoSent {
+                scheduled_at: None,
+                timer_error: None,
+                ..
+            }
+        ));
+    }
+    for (blocking, asynchronous) in blocking_sent.iter().zip(&async_sent) {
+        assert_matching_event_shape(blocking, asynchronous);
+    }
+    for (blocking, asynchronous) in blocking_replies.iter().zip(&async_replies) {
+        assert_matching_event_shape(blocking, asynchronous);
+    }
+}
+
+#[test]
+fn ignored_open_traffic_uses_one_request_and_deadline_per_attempt() {
+    let server = start_server(move |socket, tx| {
+        for _ in 0..2 {
+            let (_, peer) = recv_packet(&socket, &tx);
+            for _ in 0..3 {
+                socket.send_to(&[0_u8], peer).unwrap();
+            }
+        }
+    });
+    let mut client_config = config(server.addr, None, 0);
+    client_config.open_timeouts = vec![Duration::from_millis(200), Duration::from_millis(200)];
+
+    runtime().block_on(async {
+        let mut client = AsyncClient::connect(client_config).await.unwrap();
+        assert!(matches!(client.open().await, Err(ClientError::OpenTimeout)));
+    });
+    assert_eq!(server.finish().len(), 2);
+}
@@ -1,6 +1,6 @@
 use std::{
    net::{SocketAddr, UdpSocket},
-    sync::{mpsc::sync_channel, Arc, Condvar, Mutex},
+    sync::{Arc, Condvar, Mutex},
    thread::{self, JoinHandle},
    time::{Duration, Instant},
 };
@@ -11,13 +11,11 @@ use irtt_proto::{
 };
 use tokio::{runtime::Builder, time::timeout};

-use super::{
-    blocking::{join_worker, WorkerRuntime},
-    BlockingManagedClient, BlockingManagedJoinError, ManagedClientConfig, ManagedCompletionPolicy,
-    ManagedEndReason, ManagedEvent, ManagedLifecycle, ManagedPacing, ManagedTargetConfig,
-    ManagedTargetEndReason,
+use irtt_client::managed::{
+    BlockingManagedClient, ManagedClientConfig, ManagedCompletionPolicy, ManagedEndReason,
+    ManagedEvent, ManagedLifecycle, ManagedPacing, ManagedTargetConfig, ManagedTargetEndReason,
 };
-use crate::ClientConfig;
+use irtt_client::ClientConfig;

 const TOKEN: u64 = 0x1234_5678_90ab_cdef;

@@ -167,7 +165,7 @@ fn target(server: &EchoServer) -> ManagedTargetConfig {
    ManagedTargetConfig::new("target", server.addr.to_string())
 }

-fn assert_stopped(outcome: &super::ManagedOutcome) {
+fn assert_stopped(outcome: &irtt_client::managed::ManagedOutcome) {
    assert_eq!(outcome.end_reason, ManagedEndReason::StopRequested);
 }

@@ -309,53 +307,6 @@ fn dropping_owner_stops_and_joins_worker() {
    server.finish();
 }

-#[test]
-fn worker_panic_is_a_join_error() {
-    let worker = thread::spawn(|| -> super::ManagedOutcome { panic!("test worker panic") });
-    assert_eq!(
-        join_worker(worker),
-        Err(BlockingManagedJoinError::WorkerPanicked)
-    );
-}
-
-#[test]
-fn dropping_worker_runtime_inside_async_context_does_not_panic() {
-    test_runtime().block_on(async {
-        let runtime = Builder::new_current_thread()
-            .enable_io()
-            .enable_time()
-            .build()
-            .unwrap();
-        drop(WorkerRuntime::new(runtime));
-    });
-}
-
-#[test]
-fn worker_runtime_shutdown_is_bounded_with_blocking_work() {
-    let runtime = Builder::new_current_thread()
-        .enable_io()
-        .enable_time()
-        .build()
-        .unwrap();
-    let (started_send, started_receive) = sync_channel(0);
-    let (release_send, release_receive) = sync_channel(0);
-
-    runtime.block_on(async move {
-        tokio::task::spawn_blocking(move || {
-            started_send.send(()).unwrap();
-            release_receive.recv().unwrap();
-        });
-    });
-    started_receive
-        .recv_timeout(Duration::from_secs(2))
-        .unwrap();
-
-    let started = Instant::now();
-    WorkerRuntime::new(runtime).shutdown();
-    assert!(started.elapsed() < Duration::from_secs(2));
-    release_send.send(()).unwrap();
-}
-
 #[test]
 fn drop_after_natural_completion_preserves_outcome() {
    let server = EchoServer::start();
@@ -0,0 +1,169 @@
+mod support;
+
+use std::{collections::HashMap, time::Duration};
+
+use irtt_client::{managed::*, ClientConfig, ClientEvent};
+use irtt_server::ServerConfig;
+use support::InTreeServer;
+use tokio::time::timeout;
+
+// A real service and public events protect cadence/fairness without depending
+// on a scheduler, a send cursor, or a private event-publication hook.
+#[tokio::test(flavor = "current_thread")]
+async fn both_pacing_modes_serve_every_target_on_its_negotiated_grid() {
+    timeout(Duration::from_secs(5), async {
+        let server = InTreeServer::start(ServerConfig::default());
+        for pacing in [ManagedPacing::Burst, ManagedPacing::Staggered] {
+            let config = ManagedClientConfig {
+                client: ClientConfig {
+                    duration: Some(Duration::from_millis(200)),
+                    interval: Duration::from_millis(20),
+                    probe_timeout: Duration::from_millis(100),
+                    open_timeouts: vec![Duration::from_millis(200)],
+                    ..ClientConfig::default()
+                },
+                pacing,
+                ..ManagedClientConfig::default()
+            };
+            let targets =
+                ["first", "second"].map(|id| ManagedTargetConfig::new(id, server.addr.to_string()));
+            let (task, handle) = ManagedClient::task(config, targets.into()).unwrap();
+            let mut events = handle.subscribe().unwrap();
+            let run = tokio::spawn(task);
+            let mut sends: HashMap<TargetInstance, Vec<_>> = HashMap::new();
+            while let Ok(event) = events.recv().await {
+                if let ManagedEvent::Client {
+                    target,
+                    event:
+                        ClientEvent::EchoSent {
+                            scheduled_at,
+                            sent_at,
+                            ..
+                        },
+                } = event
+                {
+                    let scheduled = scheduled_at.expect("managed probes expose their cadence");
+                    assert!(sent_at.mono >= scheduled);
+                    let previous = sends.entry(target).or_default();
+                    if let Some(last) = previous.last() {
+                        let elapsed: Duration = scheduled.duration_since(*last);
+                        assert!(!elapsed.is_zero());
+                        assert_eq!(elapsed.as_nanos() % Duration::from_millis(20).as_nanos(), 0);
+                    }
+                    previous.push(scheduled);
+                }
+            }
+            let outcome = run.await.unwrap();
+            assert_eq!(outcome.end_reason, ManagedEndReason::TargetsComplete);
+            assert_eq!(outcome.successful_target_outcomes, 2);
+            assert_eq!(sends.len(), 2);
+            for target in outcome.recent_target_outcomes.iter() {
+                assert!(sends[&target.target].len() >= 2);
+                assert!(target.replies_received >= 2);
+            }
+        }
+    })
+    .await
+    .expect("managed pacing did not complete");
+}
+
+// Updates, receipts, generations and cleanup are observable through the control
+// handle and event subscription; no task internals or artificial races are needed.
+#[tokio::test(flavor = "current_thread")]
+async fn target_updates_preserve_identical_sessions_and_retire_removed_generations() {
+    timeout(Duration::from_secs(5), async {
+        let server = InTreeServer::start(ServerConfig::default());
+        let config = ManagedClientConfig {
+            client: ClientConfig {
+                duration: None,
+                interval: Duration::from_millis(20),
+                probe_timeout: Duration::from_millis(100),
+                open_timeouts: vec![Duration::from_millis(200)],
+                ..ClientConfig::default()
+            },
+            completion: ManagedCompletionPolicy::ExplicitStop,
+            ..ManagedClientConfig::default()
+        };
+        let configured = ManagedTargetConfig::new("one", server.addr.to_string());
+        let (task, handle) = ManagedClient::task(config, vec![]).unwrap();
+        let mut events = handle.subscribe().unwrap();
+        let run = tokio::spawn(task);
+        let added = handle
+            .update_targets(vec![configured.clone()])
+            .unwrap()
+            .await
+            .unwrap();
+        let first = added.status.targets[0].target.clone();
+        loop {
+            if matches!(events.recv().await.unwrap(), ManagedEvent::Client {
+                target, event: ClientEvent::EchoReply { .. }
+            } if target == first)
+            {
+                break;
+            }
+        }
+        let identical = handle
+            .update_targets(vec![configured.clone()])
+            .unwrap()
+            .await
+            .unwrap();
+        assert_eq!(identical.status.targets.len(), 1);
+        assert_eq!(identical.status.targets[0].target, first);
+        loop {
+            match events.recv().await.unwrap() {
+                ManagedEvent::Client {
+                    target,
+                    event: ClientEvent::SessionStarted { .. },
+                } if target == first => panic!("identical update reopened the session"),
+                ManagedEvent::Client {
+                    target,
+                    event: ClientEvent::EchoReply { .. },
+                } if target == first => break,
+                _ => {}
+            }
+        }
+        handle.update_targets(vec![]).unwrap().await.unwrap();
+        loop {
+            if let ManagedEvent::TargetFinished { outcome } = events.recv().await.unwrap() {
+                assert_eq!(outcome.target, first);
+                assert_eq!(outcome.end_reason, ManagedTargetEndReason::Removed);
+                assert_eq!(outcome.cleanup_failure, None);
+                break;
+            }
+        }
+        let readded = handle
+            .update_targets(vec![configured])
+            .unwrap()
+            .await
+            .unwrap();
+        let second = readded
+            .status
+            .targets
+            .iter()
+            .find(|target| target.desired)
+            .unwrap()
+            .target
+            .clone();
+        assert!(second.generation > first.generation);
+        loop {
+            if matches!(events.recv().await.unwrap(), ManagedEvent::Client {
+                target, event: ClientEvent::EchoReply { .. }
+            } if target == second)
+            {
+                break;
+            }
+        }
+        let stop = handle.stop();
+        let outcome = run.await.unwrap();
+        stop.await;
+        assert_eq!(outcome.end_reason, ManagedEndReason::StopRequested);
+        assert_eq!(outcome.total_target_outcomes, 2);
+        assert!(outcome.recent_target_outcomes.iter().any(|target| {
+            target.target == second
+                && target.end_reason == ManagedTargetEndReason::Stopped
+                && target.cleanup_failure.is_none()
+        }));
+    })
+    .await
+    .expect("managed target updates did not complete");
+}
@@ -0,0 +1,553 @@
+use std::{
+    future::Future,
+    net::{SocketAddr, UdpSocket},
+    pin::Pin,
+    sync::{Arc, Mutex},
+    task::{Context, Poll, Waker},
+    thread::{self, JoinHandle},
+    time::{Duration, Instant},
+};
+
+use irtt_proto::{
+    decode_request, encode_echo_reply, encode_open_reply, flags, verify_packet_hmac,
+    DecodedRequestKind, EchoReply, OpenReply, Params, ReceivedStats, StampAt, TimestampFields,
+};
+use tokio::runtime::{Builder, Runtime};
+
+use irtt_client::{managed::*, ClientConfig};
+use irtt_client::{ClientAuthConfig, RunMode};
+use tokio::sync::broadcast;
+
+const TOKEN: u64 = 0x1234_5678_90ab_cdef;
+
+#[derive(Clone, Copy)]
+enum ServerBehavior {
+    Echo,
+    NoTest,
+    PeerClose,
+    DelayedEcho(Duration),
+}
+
+#[derive(Clone, Debug)]
+enum PacketKind {
+    Open,
+    Probe,
+    Close,
+}
+
+#[derive(Clone, Debug)]
+struct PacketRecord {
+    kind: PacketKind,
+    at: Instant,
+}
+
+struct TestServer {
+    addr: SocketAddr,
+    records: Arc<Mutex<Vec<PacketRecord>>>,
+    thread: JoinHandle<()>,
+}
+
+impl TestServer {
+    fn finish(self) -> Vec<PacketRecord> {
+        self.thread.join().unwrap();
+        self.records.lock().unwrap().clone()
+    }
+}
+
+/// Admits a request the way a compliant server does: structural decode first,
+/// then HMAC presence policy, then authentication. Returns `None` for anything
+/// a server would silently discard.
+fn decode_server_request<'a>(
+    packet: &'a [u8],
+    key: Option<&[u8]>,
+) -> Option<DecodedRequestKind<'a>> {
+    let request = decode_request(packet).ok()?;
+    if request.hmac_present != key.is_some() {
+        return None;
+    }
+    if let Some(key) = key {
+        verify_packet_hmac(key, packet).ok()?;
+    }
+    Some(request.kind)
+}
+
+fn decode_open_params(packet: &[u8], key: Option<&[u8]>) -> Params {
+    match decode_server_request(packet, key) {
+        Some(DecodedRequestKind::Open { params, .. }) => Params::decode(params).unwrap(),
+        other => panic!("expected an authenticated open request, got {other:?}"),
+    }
+}
+
+fn start_server(behavior: ServerBehavior, key: Option<Vec<u8>>) -> TestServer {
+    let socket = UdpSocket::bind("127.0.0.1:0").unwrap();
+    socket
+        .set_read_timeout(Some(Duration::from_secs(3)))
+        .unwrap();
+    let addr = socket.local_addr().unwrap();
+    let records = Arc::new(Mutex::new(Vec::new()));
+    let thread_records = Arc::clone(&records);
+    let thread = thread::spawn(move || {
+        let mut buffer = [0_u8; 8192];
+        let (open_len, peer) = socket.recv_from(&mut buffer).unwrap();
+        thread_records.lock().unwrap().push(PacketRecord {
+            kind: PacketKind::Open,
+            at: Instant::now(),
+        });
+        let negotiated = decode_open_params(&buffer[..open_len], key.as_deref());
+        let no_test = matches!(behavior, ServerBehavior::NoTest);
+        let open_reply = encode_open_reply(
+            &OpenReply {
+                flags: flags::FLAG_OPEN
+                    | flags::FLAG_REPLY
+                    | if no_test { flags::FLAG_CLOSE } else { 0 },
+                token: if no_test { 0 } else { TOKEN },
+                params: negotiated.clone(),
+            },
+            key.as_deref(),
+        )
+        .unwrap();
+        socket.send_to(&open_reply, peer).unwrap();
+        if no_test {
+            return;
+        }
+
+        loop {
+            let Ok((len, packet_peer)) = socket.recv_from(&mut buffer) else {
+                return;
+            };
+            let packet = &buffer[..len];
+            match decode_server_request(packet, key.as_deref()) {
+                Some(DecodedRequestKind::Echo { sequence, .. }) => {
+                    thread_records.lock().unwrap().push(PacketRecord {
+                        kind: PacketKind::Probe,
+                        at: Instant::now(),
+                    });
+                    if let ServerBehavior::DelayedEcho(delay) = behavior {
+                        thread::sleep(delay);
+                    }
+                    let peer_close = matches!(behavior, ServerBehavior::PeerClose);
+                    let reply = encode_echo_reply(
+                        &EchoReply {
+                            flags: flags::FLAG_REPLY
+                                | if peer_close { flags::FLAG_CLOSE } else { 0 },
+                            token: TOKEN,
+                            sequence,
+                            recv_count: None,
+                            recv_window: None,
+                            timestamps: TimestampFields::default(),
+                            payload: Vec::new(),
+                        },
+                        &negotiated,
+                        key.as_deref(),
+                    )
+                    .unwrap();
+                    socket.send_to(&reply, packet_peer).unwrap();
+                    if peer_close {
+                        return;
+                    }
+                }
+                Some(DecodedRequestKind::Close { .. }) => {
+                    thread_records.lock().unwrap().push(PacketRecord {
+                        kind: PacketKind::Close,
+                        at: Instant::now(),
+                    });
+                    return;
+                }
+                Some(DecodedRequestKind::Open { .. }) | None => {}
+            }
+        }
+    });
+    TestServer {
+        addr,
+        records,
+        thread,
+    }
+}
+
+fn runtime() -> Runtime {
+    Builder::new_current_thread()
+        .enable_io()
+        .enable_time()
+        .build()
+        .unwrap()
+}
+
+fn config(pacing: ManagedPacing) -> ManagedClientConfig {
+    ManagedClientConfig {
+        client: ClientConfig {
+            duration: Some(Duration::from_millis(130)),
+            interval: Duration::from_millis(60),
+            probe_timeout: Duration::from_millis(35),
+            open_timeouts: vec![Duration::from_millis(200)],
+            received_stats: ReceivedStats::None,
+            stamp_at: StampAt::None,
+            ..ClientConfig::default()
+        },
+        pacing,
+        final_drain: Duration::from_millis(5),
+        ..ManagedClientConfig::default()
+    }
+}
+
+fn target(id: &str, addr: SocketAddr) -> ManagedTargetConfig {
+    ManagedTargetConfig::new(id, addr.to_string())
+}
+
+fn poll_once<F: Future>(future: Pin<&mut F>) -> Poll<F::Output> {
+    Future::poll(future, &mut Context::from_waker(Waker::noop()))
+}
+
+fn probes(records: &[PacketRecord]) -> Vec<Instant> {
+    records
+        .iter()
+        .filter_map(|record| matches!(record.kind, PacketKind::Probe).then_some(record.at))
+        .collect()
+}
+
+fn has_close(records: &[PacketRecord]) -> bool {
+    records
+        .iter()
+        .any(|record| matches!(record.kind, PacketKind::Close))
+}
+
+#[test]
+fn construction_is_runtime_and_io_free() {
+    let (task, handle) = ManagedClient::task(
+        config(ManagedPacing::Staggered),
+        vec![ManagedTargetConfig::new("dns", "no-such-host.invalid")],
+    )
+    .unwrap();
+    assert_eq!(handle.status().lifecycle, ManagedLifecycle::NotStarted);
+    drop(task);
+}
+
+#[test]
+fn quiescent_rejects_empty_initial_targets() {
+    assert!(matches!(
+        ManagedClient::task(config(ManagedPacing::Staggered), vec![]),
+        Err(ManagedConfigError::EmptyInitialTargets)
+    ));
+}
+
+#[test]
+fn explicit_empty_waits_for_stop() {
+    let mut config = config(ManagedPacing::Staggered);
+    config.completion = ManagedCompletionPolicy::ExplicitStop;
+    let (task, handle) = ManagedClient::task(config, vec![]).unwrap();
+    let outcome = runtime().block_on(async move {
+        let mut task = Box::pin(task);
+        assert!(
+            tokio::time::timeout(Duration::from_millis(20), task.as_mut())
+                .await
+                .is_err()
+        );
+        assert_eq!(handle.status().lifecycle, ManagedLifecycle::Running);
+        let receipt = handle.stop();
+        let outcome = task.await;
+        receipt.await;
+        outcome
+    });
+    assert_eq!(outcome.end_reason, ManagedEndReason::StopRequested);
+}
+
+#[test]
+fn accepted_update_before_stop_resolves_stopping() {
+    let mut managed = config(ManagedPacing::Staggered);
+    managed.completion = ManagedCompletionPolicy::ExplicitStop;
+    let (task, handle) = ManagedClient::task(managed, vec![]).unwrap();
+    let receipt = handle
+        .update_targets(vec![ManagedTargetConfig::new("queued", "127.0.0.1:9")])
+        .unwrap();
+    let stop = handle.stop();
+    let outcome = runtime().block_on(task);
+    runtime().block_on(stop);
+    assert_eq!(outcome.applied_command_sequence, 0);
+    assert!(matches!(
+        runtime().block_on(receipt),
+        Err(ManagedCommandApplyError::Stopping)
+    ));
+}
+
+#[test]
+fn accepted_update_before_driver_failure_resolves_driver_failed() {
+    let mut managed = config(ManagedPacing::Staggered);
+    managed.completion = ManagedCompletionPolicy::ExplicitStop;
+    let (task, handle) = ManagedClient::task(managed, vec![]).unwrap();
+    let receipt = handle
+        .update_targets(vec![ManagedTargetConfig::new("queued", "127.0.0.1:9")])
+        .unwrap();
+    let mut task = Box::pin(task);
+    let Poll::Ready(outcome) = poll_once(task.as_mut()) else {
+        panic!("first poll outside Tokio did not fail")
+    };
+    assert_eq!(
+        outcome.end_reason,
+        ManagedEndReason::DriverFailed(ManagedDriverFailure::NoTokioRuntime)
+    );
+    let mut receipt = Box::pin(receipt);
+    assert!(matches!(
+        poll_once(Pin::as_mut(&mut receipt)),
+        Poll::Ready(Err(ManagedCommandApplyError::DriverFailed(
+            ManagedDriverFailure::NoTokioRuntime
+        )))
+    ));
+    assert!(matches!(
+        handle.update_targets(vec![]),
+        Err(ManagedCommandError::DriverClosed)
+    ));
+}
+
+#[test]
+fn extreme_event_capacity_is_rejected_without_panic() {
+    let mut managed = config(ManagedPacing::Staggered);
+    managed.completion = ManagedCompletionPolicy::ExplicitStop;
+    managed.event_capacity = usize::MAX;
+    assert!(matches!(
+        ManagedClient::task(managed, vec![]),
+        Err(ManagedConfigError::EventCapacityTooLarge {
+            configured: usize::MAX,
+            ..
+        })
+    ));
+}
+
+#[test]
+fn extreme_command_capacity_is_rejected_without_panic() {
+    let mut managed = config(ManagedPacing::Staggered);
+    managed.completion = ManagedCompletionPolicy::ExplicitStop;
+    managed.command_capacity = usize::MAX;
+    assert!(matches!(
+        ManagedClient::task(managed, vec![]),
+        Err(ManagedConfigError::CommandCapacityTooLarge {
+            configured: usize::MAX,
+            ..
+        })
+    ));
+}
+
+#[test]
+fn first_poll_without_runtime_fails_durably() {
+    let (task, handle) = ManagedClient::task(
+        config(ManagedPacing::Staggered),
+        vec![target("one", "127.0.0.1:9".parse().unwrap())],
+    )
+    .unwrap();
+    let mut task = Box::pin(task);
+    let Poll::Ready(outcome) = poll_once(task.as_mut()) else {
+        panic!("task did not fail on its first poll")
+    };
+    assert_eq!(
+        outcome.end_reason,
+        ManagedEndReason::DriverFailed(ManagedDriverFailure::NoTokioRuntime)
+    );
+    assert_eq!(handle.status().lifecycle, ManagedLifecycle::Failed);
+}
+
+#[test]
+fn pre_poll_stop() {
+    let (task, handle) = ManagedClient::task(
+        config(ManagedPacing::Staggered),
+        vec![ManagedTargetConfig::new("one", "no-such-host.invalid")],
+    )
+    .unwrap();
+    let mut receipt = Box::pin(handle.stop());
+    let mut task = Box::pin(task);
+    let Poll::Ready(outcome) = poll_once(task.as_mut()) else {
+        panic!("pre-stopped task did not complete")
+    };
+    assert!(poll_once(receipt.as_mut()).is_ready());
+    assert_eq!(outcome.end_reason, ManagedEndReason::StopRequested);
+}
+
+#[test]
+fn finite_immediate_replies_use_retained_drain_deadline() {
+    let server = start_server(ServerBehavior::Echo, None);
+    let mut managed = config(ManagedPacing::Staggered);
+    managed.client.probe_timeout = Duration::from_secs(3);
+    managed.final_drain = Duration::from_millis(30);
+    let (task, _) = ManagedClient::task(managed, vec![target("one", server.addr)]).unwrap();
+    let started_at = Instant::now();
+    let outcome = runtime().block_on(async {
+        tokio::time::timeout(Duration::from_secs(1), task)
+            .await
+            .expect("replied probes must not hold the drain until their obsolete timeout")
+    });
+    assert!(started_at.elapsed() < Duration::from_secs(1));
+    let records = server.finish();
+    assert_eq!(outcome.end_reason, ManagedEndReason::TargetsComplete);
+    assert!(matches!(
+        outcome.recent_target_outcomes[0].end_reason,
+        ManagedTargetEndReason::TestComplete
+    ));
+    assert!(!probes(&records).is_empty() && has_close(&records));
+}
+
+#[test]
+fn no_test_target_completion() {
+    let server = start_server(ServerBehavior::NoTest, None);
+    let mut config = config(ManagedPacing::Staggered);
+    config.client.run_mode = RunMode::NoTest;
+    let (task, _) = ManagedClient::task(config, vec![target("no-test", server.addr)]).unwrap();
+    let outcome = runtime().block_on(task);
+    let records = server.finish();
+    assert!(matches!(
+        outcome.recent_target_outcomes[0].end_reason,
+        ManagedTargetEndReason::NoTestComplete
+    ));
+    assert!(probes(&records).is_empty() && !has_close(&records));
+}
+
+#[test]
+fn authenticated_peer_close_outcome() {
+    let key = b"managed-peer-close".to_vec();
+    let server = start_server(ServerBehavior::PeerClose, Some(key.clone()));
+    let mut configured = target("peer", server.addr);
+    configured.auth = Some(ClientAuthConfig {
+        hmac_key: Some(key),
+    });
+    let (task, _) =
+        ManagedClient::task(config(ManagedPacing::Staggered), vec![configured]).unwrap();
+    let outcome = runtime().block_on(task);
+    let records = server.finish();
+    assert_eq!(outcome.peer_closed_target_outcomes, 1);
+    assert!(matches!(
+        outcome.recent_target_outcomes[0].end_reason,
+        ManagedTargetEndReason::PeerClosed
+    ));
+    assert!(!has_close(&records));
+}
+
+#[test]
+fn static_multi_target_completion() {
+    let first = start_server(ServerBehavior::Echo, None);
+    let second = start_server(ServerBehavior::Echo, None);
+    let (task, _) = ManagedClient::task(
+        config(ManagedPacing::Burst),
+        vec![target("first", first.addr), target("second", second.addr)],
+    )
+    .unwrap();
+    let outcome = runtime().block_on(task);
+    assert_eq!(outcome.total_target_outcomes, 2);
+    assert_eq!(outcome.successful_target_outcomes, 2);
+    assert!(!probes(&first.finish()).is_empty());
+    assert!(!probes(&second.finish()).is_empty());
+}
+
+#[test]
+fn sibling_failure_isolation() {
+    let good = start_server(ServerBehavior::Echo, None);
+    let unused = UdpSocket::bind("127.0.0.1:0").unwrap();
+    let bad_addr = unused.local_addr().unwrap();
+    drop(unused);
+    let (task, _) = ManagedClient::task(
+        config(ManagedPacing::Staggered),
+        vec![target("good", good.addr), target("bad", bad_addr)],
+    )
+    .unwrap();
+    let outcome = runtime().block_on(task);
+    assert_eq!(outcome.total_target_outcomes, 2);
+    assert_eq!(outcome.successful_target_outcomes, 1);
+    assert_eq!(outcome.failed_target_outcomes, 1);
+    assert!(!probes(&good.finish()).is_empty());
+}
+
+#[test]
+fn pending_limit_failure_drains_reply_and_closes_session() {
+    let key = b"managed-send-failure-cleanup".to_vec();
+    let server = start_server(
+        ServerBehavior::DelayedEcho(Duration::from_millis(80)),
+        Some(key.clone()),
+    );
+    let mut managed = config(ManagedPacing::Staggered);
+    managed.client.duration = Some(Duration::from_millis(250));
+    managed.client.interval = Duration::from_millis(20);
+    managed.client.probe_timeout = Duration::from_secs(2);
+    managed.client.max_pending_probes = 1;
+    managed.final_drain = Duration::from_millis(50);
+    let mut configured = target("one", server.addr);
+    configured.auth = Some(ClientAuthConfig {
+        hmac_key: Some(key),
+    });
+    let (task, _) = ManagedClient::task(managed, vec![configured]).unwrap();
+    let outcome = runtime().block_on(async {
+        tokio::time::timeout(Duration::from_secs(1), task)
+            .await
+            .expect("send failure cleanup must shorten after draining the committed reply")
+    });
+    let records = server.finish();
+    let target = &outcome.recent_target_outcomes[0];
+    assert_eq!(outcome.failed_target_outcomes, 1);
+    assert!(matches!(
+        target.end_reason,
+        ManagedTargetEndReason::Failed(ManagedTargetFailure {
+            phase: ManagedTargetFailurePhase::Sending,
+            kind: ManagedTargetFailureKind::ResourceExhausted,
+            ..
+        })
+    ));
+    assert_eq!(target.cleanup_failure, None);
+    assert_eq!(target.packets_sent, 1);
+    assert_eq!(target.replies_received, 1);
+    assert_eq!(probes(&records).len(), 1);
+    assert!(has_close(&records));
+}
+
+#[test]
+fn event_loss_independence() {
+    let server = start_server(ServerBehavior::Echo, None);
+    let mut config = config(ManagedPacing::Staggered);
+    config.event_capacity = 1;
+    let (task, handle) = ManagedClient::task(config, vec![target("one", server.addr)]).unwrap();
+    let mut events = handle.subscribe().unwrap();
+    let outcome = runtime().block_on(task);
+    assert!(matches!(
+        events.try_recv(),
+        Err(broadcast::error::TryRecvError::Lagged(_))
+    ));
+    assert_eq!(outcome.successful_target_outcomes, 1);
+    assert_eq!(handle.status().lifecycle, ManagedLifecycle::Completed);
+    server.finish();
+}
+
+#[test]
+fn dropping_all_handles_does_not_stop() {
+    let server = start_server(ServerBehavior::Echo, None);
+    let (task, handle) = ManagedClient::task(
+        config(ManagedPacing::Staggered),
+        vec![target("one", server.addr)],
+    )
+    .unwrap();
+    drop(handle);
+    let outcome = runtime().block_on(task);
+    assert_eq!(outcome.end_reason, ManagedEndReason::TargetsComplete);
+    server.finish();
+}
+
+#[test]
+fn task_drop_abandonment() {
+    let (task, handle) = ManagedClient::task(
+        config(ManagedPacing::Staggered),
+        vec![target("one", "127.0.0.1:9".parse().unwrap())],
+    )
+    .unwrap();
+    let mut events = handle.subscribe().unwrap();
+    drop(task);
+    assert_eq!(handle.status().lifecycle, ManagedLifecycle::Abandoned);
+    assert_eq!(handle.status().total_target_outcomes, 0);
+    assert!(matches!(events.try_recv(), Ok(ManagedEvent::Abandoned)));
+}
+
+#[test]
+fn terminal_subscription_is_closed() {
+    let (task, handle) = ManagedClient::task(
+        config(ManagedPacing::Staggered),
+        vec![target("one", "127.0.0.1:9".parse().unwrap())],
+    )
+    .unwrap();
+    let mut task = Box::pin(task);
+    assert!(poll_once(task.as_mut()).is_ready());
+    assert!(matches!(
+        handle.subscribe(),
+        Err(ManagedSubscribeError::Closed)
+    ));
+}
@@ -1,6 +1,6 @@
 [package]
 name = "irtt-proto"
-version = "0.5.0"
+version = "0.5.1"
 description = "IRTT protocol encoding and decoding primitives"
 edition.workspace = true
 license.workspace = true
@@ -15,7 +15,7 @@ categories = ["network-programming"]
 hmac = "0.13"
 md-5 = "0.11"
 subtle = "2.6.1"
-thiserror = "2.0.20"
+thiserror = "2.0.21"

 [dev-dependencies]
 proptest = "1.11.0"
@@ -60,6 +60,50 @@ pub struct TimestampFields {
    pub send_mono: Option<i64>,
 }

+/// Encodes an ECHO reply.
+///
+/// `params` supplies the negotiated layout and length, exactly as on the
+/// request side, and every optional field the layout requires must be present
+/// in `reply`: a `Some` where the layout has no field, or a `None` where it has
+/// one, is an error. `hmac_key` is authoritative: `Some(key)` sets `FLAG_HMAC`
+/// and signs the finished datagram.
+///
+/// # Errors
+///
+/// Returns [`ProtoError::MissingFlag`] or [`ProtoError::UnexpectedFlag`] when
+/// the reply does not carry exactly the packet-type flags this encoder
+/// requires, [`ProtoError::MissingField`] or [`ProtoError::UnexpectedField`]
+/// when `reply`'s optional fields do not match the negotiated layout, and
+/// [`ProtoError::PayloadTooLarge`] when the payload does not fit the negotiated
+/// length.
+///
+/// # Example
+///
+/// ```
+/// use irtt_proto::{
+///     decode_echo_reply, encode_echo_reply, EchoReply, Params, ReceivedStats,
+///     TimestampFields, FLAG_REPLY,
+/// };
+///
+/// // `received_stats` negotiates a receive counter; four payload bytes.
+/// let params = Params {
+///     length: 24,
+///     received_stats: ReceivedStats::Count,
+///     ..Params::default()
+/// };
+/// let reply = EchoReply {
+///     flags: FLAG_REPLY,
+///     token: 0x1234_5678_9abc_def0,
+///     sequence: 7,
+///     recv_count: Some(3),
+///     recv_window: None,
+///     timestamps: TimestampFields::default(),
+///     payload: vec![1, 2, 3, 4],
+/// };
+///
+/// let packet = encode_echo_reply(&reply, &params, None).unwrap();
+/// assert_eq!(decode_echo_reply(&packet, &params, None).unwrap(), reply);
+/// ```
 pub fn encode_echo_reply(
    reply: &EchoReply,
    params: &Params,
@@ -68,6 +68,23 @@ pub fn verify_hmac(key: &[u8], packet: &[u8], hmac_offset: usize) -> Result<()>
 /// [`ProtoError::InvalidHmacOffset`] when the field is truncated, and
 /// [`ProtoError::BadHmac`] when the MAC does not match. The packet is never
 /// modified.
+///
+/// # Example
+///
+/// ```
+/// use irtt_proto::{encode_request, verify_packet_hmac, Params, RequestToEncode};
+///
+/// // Synthetic example key — use a real shared secret in production.
+/// let key = b"example key";
+/// let params = Params::with_protocol_defaults();
+/// let packet = encode_request(
+///     RequestToEncode::Open { params: &params, no_test: false },
+///     Some(key),
+/// ).unwrap();
+///
+/// verify_packet_hmac(key, &packet).unwrap();
+/// assert!(verify_packet_hmac(b"wrong key", &packet).is_err());
+/// ```
 pub fn verify_packet_hmac(key: &[u8], packet: &[u8]) -> Result<()> {
    let envelope = envelope::decode_structural(packet)?;
    if !envelope.hmac_present {
@@ -135,6 +135,20 @@ pub fn echo_header_len(hmac: bool, params: &Params) -> usize {
 /// A ceiling on what a negotiated length may legitimately *be* — an MTU, a
 /// resource bound, a maximum packet size — is deliberately not here. That is
 /// server and runtime policy, and it belongs where the negotiation happens.
+///
+/// # Example
+///
+/// ```
+/// use irtt_proto::{echo_packet_len, Params};
+///
+/// // The default layout's mandatory field block is 16 bytes (header, token,
+/// // sequence), so a smaller requested length is floored up to it.
+/// assert_eq!(echo_packet_len(false, &Params::default()).unwrap(), 16);
+/// assert_eq!(
+///     echo_packet_len(false, &Params { length: 40, ..Params::default() }).unwrap(),
+///     40,
+/// );
+/// ```
 pub fn echo_packet_len(hmac: bool, params: &Params) -> Result<usize> {
    let header_len = echo_header_len(hmac, params);
    let requested = if params.length <= 0 {
@@ -42,6 +42,39 @@
 //! which reply kind to expect, and the two need genuinely different semantic
 //! context.
 //!
+//! # Example
+//!
+//! The normal path is directional: a sender encodes with [`encode_request`], a
+//! receiver classifies with [`decode_request`], and authentication is a
+//! separate step once the applicable key is known.
+//!
+//! ```
+//! use irtt_proto::{
+//!     decode_request, encode_request, verify_packet_hmac, DecodedRequestKind, Params,
+//!     RequestToEncode,
+//! };
+//!
+//! // Sender side: encode an authenticated open request.
+//! let params = Params::with_protocol_defaults();
+//! let key = b"example key";
+//! let packet = encode_request(
+//!     RequestToEncode::Open { params: &params, no_test: false },
+//!     Some(key),
+//! ).unwrap();
+//!
+//! // Receiver side: classify structurally, before any key is known.
+//! let request = decode_request(&packet).unwrap();
+//! assert!(request.hmac_present);
+//! let DecodedRequestKind::Open { no_test, params: encoded } = request.kind else {
+//!     panic!("expected an open request");
+//! };
+//! assert!(!no_test);
+//! assert_eq!(Params::decode(encoded).unwrap(), params);
+//!
+//! // Authentication is a separate step, once the applicable key is known.
+//! verify_packet_hmac(key, &packet).unwrap();
+//! ```
+//!
 #![forbid(unsafe_code)]

 pub mod echo;
@@ -13,6 +13,34 @@ pub struct OpenReply {
    pub params: Params,
 }

+/// Encodes an open reply.
+///
+/// `hmac_key` is authoritative: `Some(key)` sets `FLAG_HMAC` and signs the
+/// finished datagram, while `None` produces an unauthenticated reply and clears
+/// any caller-supplied `FLAG_HMAC`. A zero token is rejected unless the reply
+/// also carries `FLAG_CLOSE` (a rejected open).
+///
+/// # Errors
+///
+/// Returns [`ProtoError::MissingFlag`] when the reply lacks `FLAG_OPEN` or
+/// `FLAG_REPLY`, and [`ProtoError::ZeroToken`] for a zero token without
+/// `FLAG_CLOSE`.
+///
+/// # Example
+///
+/// ```
+/// use irtt_proto::{
+///     decode_open_reply, encode_open_reply, OpenReply, Params, FLAG_OPEN, FLAG_REPLY,
+/// };
+///
+/// let reply = OpenReply {
+///     flags: FLAG_OPEN | FLAG_REPLY,
+///     token: 0x1234_5678_9abc_def0,
+///     params: Params::with_protocol_defaults(),
+/// };
+/// let packet = encode_open_reply(&reply, None).unwrap();
+/// assert_eq!(decode_open_reply(&packet, None).unwrap(), reply);
+/// ```
 pub fn encode_open_reply(reply: &OpenReply, hmac_key: Option<&[u8]>) -> Result<Vec<u8>> {
    let params = reply.params.encode();
    let mut out = envelope::begin_checked(
@@ -30,6 +58,18 @@ pub fn encode_open_reply(reply: &OpenReply, hmac_key: Option<&[u8]>) -> Result<V
    envelope::finish(out, hmac_key)
 }

+/// Decodes an open reply.
+///
+/// Requires `FLAG_OPEN` and `FLAG_REPLY`, and — when `hmac_key` is supplied —
+/// verifies the authentication field. The decoded [`Params`] are validated:
+/// malformed or incompatible parameter values are rejected here.
+///
+/// # Errors
+///
+/// Returns [`ProtoError::MissingFlag`], [`ProtoError::HmacPresenceMismatch`],
+/// [`ProtoError::BadHmac`], [`ProtoError::PacketTooShort`],
+/// [`ProtoError::ZeroToken`], or a parameter decode error. See
+/// [`encode_open_reply`] for a round-trip example.
 pub fn decode_open_reply(packet: &[u8], hmac_key: Option<&[u8]>) -> Result<OpenReply> {
    let envelope = envelope::decode(
        packet,
@@ -16,6 +16,29 @@ pub const MAX_SERVER_FILL_BYTES: usize = 32;
 /// [`clock`](Params::clock) is [`Clock::Unspecified`], which is what an open
 /// request with an empty parameter payload means. It is not a set of sensible
 /// client settings; a client builds its request from its own configuration.
+///
+/// # Example
+///
+/// Construct a `Params`, encode it, and decode it back:
+///
+/// ```
+/// use irtt_proto::{Clock, Params, ReceivedStats, ServerFill, StampAt};
+///
+/// let params = Params {
+///     protocol_version: 1,
+///     duration_ns: 3_000_000_000,
+///     interval_ns: 1_000_000_000,
+///     length: 1472,
+///     received_stats: ReceivedStats::Both,
+///     stamp_at: StampAt::Both,
+///     clock: Clock::Both,
+///     server_fill: Some(ServerFill { value: "rand".to_owned() }),
+///     ..Params::default()
+/// };
+///
+/// let encoded = params.encode();
+/// assert_eq!(Params::decode(&encoded).unwrap(), params);
+/// ```
 #[derive(Debug, Clone, PartialEq, Eq, Default)]
 pub struct Params {
    pub protocol_version: i64,
@@ -88,6 +111,20 @@ impl Params {
    /// Presence means the tag appeared at least once. Repeated known tags keep
    /// last-value-wins, and unknown tags remain ignored and untracked.
    ///
+    /// # Example
+    ///
+    /// ```
+    /// use irtt_proto::Params;
+    ///
+    /// // Wire bytes: tag 2 (duration) carrying an explicit zero. Interval
+    /// // (tag 3) is absent, so both fields decode to zero but only one is
+    /// // reported present.
+    /// let decoded = Params::decode_with_presence(&[0x02, 0x00]).unwrap();
+    /// assert_eq!(decoded.params.duration_ns, 0);
+    /// assert!(decoded.presence.duration_ns);
+    /// assert!(!decoded.presence.interval_ns);
+    /// ```
+    ///
    /// [`decode`]: Params::decode
    pub fn decode_with_presence(input: &[u8]) -> Result<DecodedParams> {
        let mut params = Self::default();
@@ -88,6 +88,26 @@ pub enum DecodedRequestKind<'a> {
 /// the negotiated length is positive and wider than `usize`. A *negative*
 /// negotiated length is not an error: see [`echo_packet_len`], which floors it
 /// at the mandatory field block.
+///
+/// # Example
+///
+/// ```
+/// use irtt_proto::{encode_request, Params, RequestToEncode};
+///
+/// // An unauthenticated ECHO probe. `params` supplies the negotiated length,
+/// // which reserves four payload bytes beyond the 16-byte echo header.
+/// let params = Params { length: 20, ..Params::default() };
+/// let packet = encode_request(
+///     RequestToEncode::Echo {
+///         token: 0x1234_5678_9abc_def0,
+///         sequence: 7,
+///         params: &params,
+///         payload: &[1, 2, 3, 4],
+///     },
+///     None,
+/// ).unwrap();
+/// assert_eq!(packet.len(), 20);
+/// ```
 pub fn encode_request(request: RequestToEncode<'_>, hmac_key: Option<&[u8]>) -> Result<Vec<u8>> {
    match request {
        RequestToEncode::Open { params, no_test } => encode_open(params, no_test, hmac_key),
@@ -138,6 +158,21 @@ pub fn encode_request(request: RequestToEncode<'_>, hmac_key: Option<&[u8]>) ->
 /// Returns [`ProtoError::PacketTooShort`], [`ProtoError::BadMagic`],
 /// [`ProtoError::ReservedFlags`], or [`ProtoError::UnexpectedFlag`] for
 /// `FLAG_REPLY`.
+///
+/// # Example
+///
+/// ```
+/// use irtt_proto::{decode_request, encode_request, DecodedRequestKind, RequestToEncode};
+///
+/// let packet = encode_request(
+///     RequestToEncode::Close { token: 0x1234_5678_9abc_def0 },
+///     None,
+/// ).unwrap();
+///
+/// let request = decode_request(&packet).unwrap();
+/// assert!(!request.hmac_present);
+/// assert_eq!(request.kind, DecodedRequestKind::Close { token: 0x1234_5678_9abc_def0 });
+/// ```
 pub fn decode_request(packet: &[u8]) -> Result<DecodedRequest<'_>> {
    let envelope = envelope::decode_structural(packet)?;
    if has(envelope.flags, FLAG_REPLY) {
@@ -1,3 +1,19 @@
+//! Variable-length integer encoding for IRTT wire values.
+//!
+//! Tags use an unsigned base-128 varint ([`encode_uvarint`]), and signed
+//! integers (such as parameter values) use the same encoding after a zigzag
+//! transform ([`encode_varint`]), which keeps small negative numbers compact.
+//!
+//! # Example
+//!
+//! ```
+//! use irtt_proto::varint::{decode_varint, encode_varint};
+//!
+//! let mut out = Vec::new();
+//! encode_varint(1_000_000_000, &mut out);
+//! assert_eq!(decode_varint(&out).unwrap(), (1_000_000_000, out.len()));
+//! ```
+
 use crate::{ProtoError, Result};

 pub fn encode_uvarint(mut value: u64, out: &mut Vec<u8>) {
@@ -500,13 +500,14 @@ session policy lives.
  unmarked reply into a *dropped* one, because an unappliable marking stops the
  send. Verify a platform before extending that list.
 - A genuinely dual-stack `[::]` listener still emits **unmarked** IPv4-mapped
-  replies, and this is known. It is not fixed by choosing the option per reply,
-  for the macOS reason above, and it predates wildcard source selection. Leave it
-  until it is worth its own slice, and do not "fix" it by weakening the rule that
-  an unappliable marking stops the send. The crate forbids unsafe code;
-  there is no raw `setsockopt` and no `sendmsg`/`cmsg` machinery. Keep the
-  target lists identical to the pinned `socket2` version's own gates — check
-  its source rather than copying another crate's older matrix.
+  replies on Linux. When reply DSCP/traffic-class marking for IPv4 peers
+  matters, configure the normal same-port `[::]:PORT` plus `0.0.0.0:PORT`
+  listener pair instead; `ServerSet` makes the IPv6 half IPv6-only for that
+  pair. Do not force `IPV6_V6ONLY` on every lone IPv6 listener, and do not
+  weaken the rule that an unappliable marking stops the send. The crate forbids
+  unsafe code; there is no raw `setsockopt` and no `sendmsg`/`cmsg` machinery.
+  Keep the target lists identical to the pinned `socket2` version's own gates
+  — check its source rather than copying another crate's older matrix.

 ## Rate, lifetime and server-initiated close

@@ -1,6 +1,6 @@
 [package]
 name = "irtt-server"
-version = "0.5.2"
+version = "0.5.3"
 description = "IRTT-compatible Rust server library"
 edition.workspace = true
 license.workspace = true
@@ -15,7 +15,7 @@ categories = ["network-programming"]
 irtt-proto.workspace = true
 getrandom = "0.4.3"
 socket2 = { version = "0.6.5", features = ["all"] }
-thiserror = "2.0.20"
+thiserror = "2.0.21"
 tokio = { version = "1.53.1", default-features = false, features = ["rt", "net", "time", "sync", "macros"] }

 # Wildcard listeners recover each request's local destination address and send