[aram356]

Summary

Implements the portable outbound HTTP and request-lifecycle contracts across core and the Axum, Cloudflare, Fastly, and Spin adapters.

• Adds buffered and streamed outbound requests/responses plus a hard-cut, completion-driven batch API: start_batch_until, indexed next, explicit cancel, ordered collect, and the send_all_until convenience path.
• Clarifies that start_batch_until takes an observation cutoff: reaching it stops observation even when individual slots retain budget, while earlier cutoffs remain a supported partial-result operation.
• Replaces the memory-only adapter seam with typed PlatformMetadata facts for memory ceilings, live inbound request population, and host-ingress accounting, preserving source and explicit unknown reasons.
• Adds checked, scope-aware memory-envelope validation with Fits, Exceeds, and typed Indeterminate outcomes; publishes canonical Axum, Cloudflare, Fastly, generic Spin, and Akamai Functions profiles.
• Hard-cuts retired platform-memory APIs, updates the demo and generator, and records exact signature migrations in the unreleased changelog.
• Makes batch termination explicit as Completed or Cutoff. Only Cutoff permits unresolved slots in a successful result. Explicit adapter failure, premature driver EOF, and duplicate or out-of-range indices return OutboundBatchFailure, preserving the precise error and every terminal slot collected before failure.
• Preserves per-slot elapsed time and failure provenance. A batch cutoff keeps completed slots and leaves unresolved slots explicit instead of converting them into request timeouts.
• Adds explicit cache-bypass and wire-authority policies. URI routing, SNI, and certificate identity remain independent where the provider supports that separation.
• Enforces independent encoded-transport, decoded-output, and final-buffer limits; header count/byte limits; Brotli window and decoder-state policy; opt-in response rechunking; and typed timeout, transport, protocol, and content-coding failures.
• Uses fixed category-only public error messages so provider diagnostics, URLs, and credentials cannot become wire-visible.
• Carries one application-owned monotonic clock through ingress, outbound dispatch and deferred streams, returned response drains, configuration extraction, and response egress. MonotonicClock::deadline_after anchors relative cutoffs to that clock. Equality expiry wins and backwards time fails closed.
• Adds route-aware ingress admission on every standard adapter, stable route metadata, request-start-relative deadlines, opaque request-owned grants, and bounded 404/405 fallback reads with application-selected overflow/timeout responses.
• Gives every response-producing admission decision one non-clone ResponseEgressCompletion, transferred directly through PreparedIngress, ResponseEgressEnvelope, and the sole ResponseEgressAttempt. Terminal state is stored before the response-scoped completion and global observer run, each exactly once and behind independent panic boundaries. No response-extension carrier or envelope extraction bypass remains.
• Adds deterministic ResponseEgressCompletion::join composition so independent response-owned resources share one exactly-once terminal report, and hard-cuts detached normalized errors to Send { completion, deadline } | Abort with request-start-relative bounded deadlines.
• Adds explicit non-response AdmissionDecision::Abort. Axum closes the owned HTTP/1 connection before body polling; Cloudflare, Fastly, and Spin return a fixed provider error at their strongest available pre-response boundary and remain conservatively classified BestEffort.
• Hard-cuts application assembly to fallible Hooks::configure plus core-owned App::build::<A>(platform). Successful hooks must preserve the complete adapter-selected metadata; core rejects changed facts instead of restoring them. Typed configuration failures propagate unchanged and stop serving before request handling. The generated scaffold keeps finite ingress policy with core-owned empty lifecycle tokens; the checked-in demo retains the full application-owned resource-composition example.
• Implements adapter-owned response delivery through each platform's strongest boundary: Hyper connection ownership on Axum, a Workers writer plus AbortController, Fastly's low-level stream_to_client, and Spin's WASI response/body/result writers.
• Adds a closed Fastly lifecycle runner that keeps request conversion, routed execution, response finalization, framing, streaming, and platform delivery under adapter ownership.
• Fastly dispatches eligible slots before harvesting and advances heads/bodies through one cooperative readiness multiplexer, preserving positional ownership, original deadlines, bounded raw reads, fair rotation and documented provider limitations.
• Preserves duplicate response fields, canonical host authority, bodyless response framing, strict content-length validation, hop-by-hop stripping, and source release on every terminal path.
• Hard-cuts superseded APIs and configuration error variants. The checked-in demo, generated applications, templates, guides, capability matrices, CI sentinels, and legacy guards use only the current contracts.

Current Checkpoint: Core Policy Conformance Binding

• Add literal one-second connect-setting proof through parts round-trip, public/prepared getters, Send and a two-dispatch Follow. Paired fake time advances between hops, while every prepared record keeps its full 15-second aggregate budget and original 20-second deadline. This proves carriage, not enforcement of a deadline that never governs the fixture.
• Extend the existing raw-coding matrix with the exact gzip bytes 10-19/100 range, ten undecoded bytes and unchanged headers under both modes/choices. Retain valid gzip/deflate/br fixtures and complete encoded/decoded/final-cap controls.
• Exercise actual facade upload rules through the existing private client: Begin rejects streamed POST without polling/sending, an unread inbound GET reaches Begin certified empty, and Send forwards the original streamed abc payload. The 64-byte recorder bound is fixture plumbing only. One off-configured marker handle covers inherited Send, Begin and exactly two batch slots; only the explicit-on Send carries the marker. Existing matrices remain intact.
• Bind seven complete unit/core legs: EZ-4/01, EZ-5/01/02/03/10, EZ-6/13 and EZ-7/02. The existing grouped command discovers all 68 sentinels and passes 299 tests, without another CI job or command list. Inventory is 44 ready / 467 planned, still unqualified. All provider legs, frozen identities, expected criteria, conditions and approvals are preserved.
• Fresh verification: all five root gates pass, including 2,572 workspace tests in 32 binaries (one existing ignored), strict all-targets/all-features Clippy, workspace features and the Spin target check. All 52 Node regressions, 66 demo tests, docs lint/format/build and legacy/docs/inventory guards pass. Independent spec, quality and evidence reviews are clear. No production API, adapter behavior, SDK/dependency pin, capability, generator or demo-code change.
• Earlier lifecycle and clock-proof artifacts remain intact. This checkpoint does not rerun or relabel provider timing probes, SDK qualification, full provider feature matrices or the ignored generated-workspace gate. Strict runtime failures, native SDK/poll witnesses, remaining acceptance bindings, candidate freeze and authorized hosted/consumer qualification stay open. No compatibility layer, deployment, applicability approval or qualification promotion.

Checkpoint: 350c4b04. Earlier lifecycle verification at 52719940 remains intact. See the core policy conformance binding checkpoint in the implementation tracker for exact scope and remaining gates.

Earlier Checkpoint: Response-Owned Outbound Handoff

• Add EZ-6 criterion 20 to the existing local lifetime runner for Axum, workerd and Spin. One exact response-body owner retains the original pending begun origin and three-slot batch across dispatch; the body collects those same handles, without replay or another transport.
• Hold all source heads, payload and EOF until the native client validates a canonical, bounded NDJSON prelude. Require closed callback/live body scopes and Cloudflare/Spin's fixture-only dispatch-return signal. Validate causal source write-start order, strict original arrival cutoffs and valid late collection. This names EdgeZero dispatch/native handoff, not literal exported callback return or hosted delivery.
• Harden the same HTTP reader against ambiguous framing, short/fragmented prefixes and notification after waiting for a gated tail. Keep exact two-record bounds, malformed-evidence controls, preexisting resource-owner counts and exactly-once terminal family release. Retain primary client failures, interrupted captures, cleanup errors and client/runtime logs.
• Verification: all five root Rust gates pass (2,568 tests / 32 binaries, one ignored); 263 harness tests (one ignored), 54 fixture tests, strict harness/core/all-four-entrypoint Clippy, 51 Node guard tests, docs checks and dependency audits pass. Independent ownership, evidence, code-quality and verification reviews are clear.
• Reviewed local handoff passes on Axum, Spin and workerd. Fastly records this criterion as inapplicable and still runs its original nine cases. Complete suites remain red: Axum 5/10, repaired Viceroy 5/9, Spin 6/10, workerd 5/10. Strict source/arrival/cadence misses and earlier failed observations are retained, not waived by the new case.
• Inventory remains 33 ready / 478 planned, unqualified. D6, native body-entry witnesses, cleanup/callback cases, candidate freeze and authorized hosted qualification remain open. No production API, SDK/runtime pin, capability or frozen requirement changes; no deployment.

Checkpoint: abbc2c11. Detailed local artifacts and failures are recorded in the D6 response-handoff tracker checkpoint.

Earlier Checkpoint: Core Mixed-Observation Acceptance Binding

• Activate only EZ-6/acceptance/22@unit/core, replacing its placeholder with five executable receipt/accumulator proofs. Run six exact three-slot cases: fresh and mixed check/next/collect under Completed, Cutoff and an original typed driver failure. Stage terminal production after both mixed receipts transfer.
• Preserve the earlier four-slot partial-failure/cutoff proofs and out-of-order test. Assert precise states before merge, cardinality and termination afterward, original error identity, no premature body consumption, exact payloads and one body-owner release. Invalid insert/merge recovery retains both inputs.
• Broaden one existing grouped CI execution to --lib outbound::; discover all 56 exact sentinels, including the original 51 redirect proofs. No new job or per-test CI list. The old redirect-only selection fails before execution because it omits the five batch proofs. Use the shared raw Cargo log path without relabelling older evidence.
• Final verification passes all five root Rust gates: 2,568 tests in 32 binaries (one existing ignored), strict workspace Clippy, formatting and feature/Spin checks. The grouped outbound command passes 296 tests; 37 evidence-checker and 14 nonzero-guard tests pass, as do docs/tooling and dependency audits. The sandboxed full run denied existing TCP binds; unchanged loopback-enabled and final reviewed runs pass. Independent specification, tooling and code-quality reviews are clear.
• Inventory is now 33 ready / 478 planned across the unchanged 255 criteria / 511 legs, still unqualified. All four adapter legs of criterion 22 remain planned. Prior runtime timing misses, native body-entry witnesses, response-owned/callback lifecycle cases, candidate freeze and authorized hosted qualification remain open. No production API, implementation behavior, SDK/runtime pin, capability, frozen requirement or deployment changes.

Checkpoint: 279c5a93.

Earlier Checkpoint: Buffered Cap During Batch Progress

• Add the ninth caps-while-waiting lifetime case through the production clients: 128 KiB decoded gzip trickling over 300 ms, independent 1 MiB decoded / 64 KiB buffered / 256 KiB encoded limits, healthy B/C siblings, and the original 34/534 ms batch timeline.
• Record original slot-error provenance before bounded report-body reads. Prove the written over-cap prefix and both healthy payloads precede guest-response return in the same host clock, and that return precedes the source ending. Retain exact partial-write evidence, bounded encoding/retries and strict source cadence; no guest dependency or extra production path.
• Add negative controls for report-generated errors, impossible elapsed times, bunched writes, incorrect schedule labels and post-return sibling writes. Independent source, guest, validator and documentation reviews cover the checkpoint.
• Verification: all five root Rust gates pass, including 2,568 tests in 32 binaries (one ignored); 252 shared-harness tests (one ignored), 51 qualification guest tests, strict harness/all-four fixture Clippy, formatting, docs lint/format, dependency/legacy/docs/inventory guards and 36 evidence-checker regressions pass.
• Final local cap case passes on Axum, repaired Viceroy 0.21.0 and Spin 4.1.0. Workerd returns the correct original typed cap error early but fails its source-write precondition at 5.055 ms late against the unchanged 5 ms allowance. Preserve that failed run instead of substituting an earlier passing sample. Complete nine-case suites remain nonzero (8/9, 7/9, 7/9 and 6/9 respectively), with the other timing misses recorded in the tracker.
• No production API, outbound transport, scheduler, SDK/runtime pin or capability changes. D6, native SDK body-entry witnesses, acceptance bindings, candidate freeze and hosted qualification remain open; inventory is still 32 ready / 479 planned and unqualified. No deployment or qualification promotion.

Checkpoint: 8c11307d. Final local artifacts and individual failed timing preconditions are recorded in the D6 buffered-cap tracker checkpoint.

Earlier Checkpoint: Reviewed Spin SDK Integration

• Consume the reviewed Spin SDK contribution at immutable fork revision 6c59ed5b4fcb377072763aee0b27a3abdd8edb72 (WASIp3 0.10.0 / wit-bindgen 0.63.0). Align the root, demo, reusable/request-fidelity fixtures, generator and all four application lockfiles.
• Explicitly detach the SDK's new join handle at one private provider launcher. Preserve the existing scheduler, registration-before-spawn and cancellation ownership; do not add a compatibility entrypoint or another executor.
• Migrate native SDK request construction in its WASM refusal contract to the SDK executor. Preserve the exact status/header/body and handler/middleware assertions. Update the dependency audit, design, implementation tracker and changelog together.
• Local verification passes all five root gates (2,568 tests, one existing ignored), 35 Spin WASM contracts, 21 SDK-resource cases, the actual eager component, both strict Spin WASM Clippy configurations and all eight feature combinations. Demo tests/builds and the full ignored fresh generated-workspace gate pass, including all three WASM adapters and fallback TCP checks.
• Spin 4.1.0 passes all 68 wire exchanges with 84 correlated origin receipts. The eight-case D6 lifetime run passes six cases but retains two strict timing failures: slow-origin Begin timing and the CPU B-write window. The complete run still exits 1; no target is relaxed or capability promoted.

Checkpoint: 87b5e1ce. These are local regression results, not a frozen candidate or hosted qualification. D6 closure, native body-entry evidence, consumer acceptance and hosted qualification remain open. The acceptance inventory remains 32 ready / 479 planned and unqualified.

Earlier Checkpoint: Fourth-Slot Per-Call Expiry

Implemented in cd8e77e4, within the approved D6 acceptance work:

• Add an eighth lifetime case through the same production clients. Preserve the original slow-origin case, original 534 ms cutoff and A/B/C schedules; only fourth slot D has a 300 ms per-call timeout. Late observation returns indices 0/1/3 with typed D timeout and exact lossless collection states. D's source never responds and closes boundedly; this is not SDK-cancellation evidence.
• Validate C's actual late response or supported late peer close in both slow cases. Reject missing terminal evidence, early payload, extra writes, wrong timeout provenance and collection-stamped latency. Keep timeout-contract diagnostics separate from overall strict source-timing acceptance.
• Verification: all five root Rust gates pass, including 2,568 workspace tests in 32 binaries (one ignored); 243 shared-harness tests (one ignored), 49 qualification guest tests, strict harness/guest Clippy and formatting, docs lint/format, legacy/docs/inventory guards and 36 evidence-checker regressions pass. Independent specification, cleanup, code-quality and evidence reviews are clear.
• Reviewed local Axum, repaired Viceroy 0.21.0, Spin 4.1.0 and workerd 2026-09-10 runs all retain D's exact 300 ms PerCallTimeout and completed siblings. Only Spin passes the complete new case; all four eight-case suites exit 1 under unchanged strict timing targets. Source-timing misses remain visible, and no passing earlier sample replaces a failed final run.
• No production API, transport, scheduler, runtime/SDK pin or capability change. Inventory stays 32 ready / 479 planned, qualified: false. Native body-entry evidence, remaining lifetime/redirect acceptance, candidate freeze and hosted/resource qualification remain open. No deployment or qualification promotion is authorized by this checkpoint.

Earlier Checkpoint: Readiness-Driven Test Origins

Implemented in d3f48564, under the requester's scoped fixture-accept approval:

CI diagnostic follow-up 11b8f2c4 adds underlying errors to two existing request-fidelity version-test assertions. The prior Linux workspace failure occurred before the collector tests; its OS/process cause was not exposed and remains unproven. The fresh run passes both the request-fidelity step and the complete shared-harness tests on Linux. No test conditions, retries, version policy or subprocess behavior changed; other CI checks and provider qualification remain separate.

• Replace the test origin's 5 ms accept sleep with one private, pinned Mio 1.2.1 readiness owner per listener. Register both listeners/wakers before spawning; drain accepts through WouldBlock and check sticky stop before accounting or worker creation. No alternate collector, raw-handle code, synthetic TCP wakes or production dependency changes.
• Stop releases existing gates and attempts both wakes outside the accounting mutex. Each collector retains its wake owner until exit; a finite 50 ms poll fallback protects against missed/failed stop wakes. Preserve 128 cumulative/eight-active connections, existing parser/I/O/gate budgets and collector-before-worker joins. This is not a realtime or whole-shutdown guarantee.
• Add colocated queue, wake-race, idle finish/drop, stop-after-accept, capacity, partial-header and failed-wake regressions. Synchronize both collectors past their last stop check before failure injection. Removing the poll timeout makes both watchdog tests fail cleanly around two seconds, with real-waker rescue and joined cleanup; restore the finite timeout before all passing runs.
• Verification: all five primary Rust gates, 2,568 workspace tests (one ignored), 238 harness tests (one ignored), 48 qualification-enabled fixture tests, strict harness Clippy/formatting, docs lint/format, legacy/docs/inventory guards and 36 evidence-checker regressions pass. Independent code, test and documentation reviews are clear; forced failure of the second OS thread spawn remains reviewed rather than directly injected.
• All four ordinary outbound-wire suites pass: 68 exchanges / 84 correlated origin requests each. Final seven-case timing runs remain failed/unqualified: four controls pass per target; fast-origin passes on Axum and repaired Viceroy; only Spin's CPU case passes. Slow-origin misses remain on every target. Retain actual all-offset failures rather than selecting earlier passing runs or relaxing targets.
• Fixture accept polling is now implemented. Remaining timing/native SDK body-entry evidence, measurement-approval and hosted qualification gates stay open. Requirements, public APIs, production transport/code, SDK/runtime pins and capabilities are unchanged. Inventory remains 32 ready / 479 planned, unqualified; no deployment or candidate freeze is authorized.

Earlier Checkpoint: Same-Client CPU Calibration

Implemented in 0d09236a, under the requester's scoped calibration approval:

• Add one buffered calibration Send through the same injected client after origin consumption: 64-byte cap, one-second timeout, absolute request-start-relative 520 ms safety deadline, bodyless 204. A/B/C wait boundedly for its causal sample; only a scheduling estimate uses the midpoint.
• Keep A's entire arrival interval inside that EdgeZero Send. End the calibration hold at 450 ms plus the causal upper offset bound, then use the original timer for next500. Preserve A180/B530/C900, batch34/cutoff534, CPU520..560, all-offset source proof, invocation-epoch bracketing and strict SDK receipt cutoffs.
• Close an independently reproduced evidence defect: calibration receipt cannot precede the source payload's pre-write sample. This proves necessary host ordering, not peer receipt; a post-flush sample could incorrectly reject legitimate preemption.
• Verification: all five primary Rust gates, 2,568 workspace tests (one ignored), 229 harness tests (one ignored), 48 qualification-enabled guest tests, strict native/three-target fixture Clippy, formatting/docs lint, legacy/docs/inventory guards and 36 evidence-checker tests pass. Independent guest, host and documentation reviews are clear.
• Final local CPU characterization: workerd passes unqualified; Axum, repaired Viceroy and Spin fail the full B-write timing proof. All four complete seven-case suites still exit 1 because earlier slow/fast timing misses remain; four controls pass per target. Retain the earlier intermediate runs rather than selecting passing samples.
• The shared origin's existing 5 ms accept polling adds fixture-side uncertainty. Its bounded readiness/wake replacement is separately proposed, not implemented or approved here. No production API/transport/pin/capability changes, deployment, candidate freeze or hosted qualification. Inventory stays 32 ready / 479 planned, unqualified; native SDK body-entry evidence and remaining acceptance gates stay open.

Earlier Checkpoint: CPU Stretch Characterization

Implemented in 44baaf3b:

• Extend the existing Rust harness/guest to seven lifetime cases with bounded synchronous CPU work from 520 to 560 ms, the original 34/534 ms batch start/cutoff, B's unchanged 530 +/-5 ms source target, and both permitted B outcomes. No new production API, transport, runtime pin or capability change.
• Require the complete actual B write to fit every possible causal host/guest clock offset. Bracket core's batch epoch by the full measured invocation before reconstructing receipt arrival; equality at the original cutoff cannot pass. Reject collection-stamped arrivals, early C bodies hidden by late closure, frozen/backwards clocks and finite-work exhaustion.
• Verification: all five primary Rust gates pass, including 2,568 workspace tests (one ignored); 223 shared-harness tests (one ignored), 47 qualification-enabled fixture tests, native/three-target fixture Clippy, formatting, docs lint, legacy/docs/inventory guards and 36 evidence-checker tests pass. Independent reviews found and closed the batch-epoch proof issue.
• Local runtime characterization remains failed/unqualified on all four targets: each has four passing controls, the earlier slow/fast timing misses, and a CPU source-timing precondition failure. Cold-connection clock bounds are too wide/late to prove B's required write. These failures do not establish a production batch defect and do not qualify the CPU scenario.
• Fixture-only clock calibration is proposed, not approved or implemented. Native SDK body-entry evidence, remaining lifetime/redirect acceptance and hosted qualification stay open. Inventory remains 32 ready / 479 planned, unqualified. No deployment or candidate freeze is authorized.

Earlier Checkpoint: Pending Cutoff Lifetime Probes

Implemented in 73ed39ba, following the main integration:

• Extend the existing Rust harness and production-client guest to six lifetime cases, adding pending heads and host-written heads with withheld bodies. Preserve the original request-start-relative 200 ms observation cutoff, genuinely Pending polling, three unresolved slots and the 205 ms return target.
• Fix two independently reproduced evidence bugs: record operation return before formatting the report, and require host phases before actual guest-response return rather than merely before a later fixture release. Preserve event-index ordering even when timestamps tie.
• Verification: all five primary Rust gates, 212 shared-harness tests (one ignored), 43 qualification-enabled fixture tests, strict native/three-target fixture Clippy, formatting and legacy/docs/inventory guards pass. The existing CI groups cover these tests; no per-case workflow is added.
• Local characterization: the two new cases pass on Axum, repaired Viceroy 0.21.0, Spin 4.1.0 and workerd, returning between 201.179 and 204 ms. Each complete six-case run still exits 1 because its original slow/fast timeline cases miss strict targets. Do not present these as passing six-case inventories or widen tolerances.
• Pending-body evidence remains explicitly host-head-written-only, not proof that the SDK consumed headers or entered a body read. Full criterion 16, remaining D6 work and hosted qualification stay open. Production outbound code, signed SDK/decoder pins, frozen requirements/interfaces and capability levels are unchanged; inventory remains 32 ready/479 planned and unqualified.
• Main integration preserves route-aware admission and adapter-owned egress while adding request fidelity and pre-dispatch hooks; the signed SDK pin and existing outbound implementation remain intact. The current checkpoint does not rerun the expensive ignored generated-workspace matrix.

Earlier Checkpoint: Coordinated Spin SDK Executor Upgrade

Implemented in 7b68f737:

• Create the public Stackpop Spin SDK fork and submit spinframework/spin-rust-sdk#169. Pin the signed SDK revision e65ff90dadf4173b08b14194e878ad3acd555337; its DCO check passes. Upstream Rust 1.94 CI remains separate from local Rust 1.98.1 verification.
• Upgrade the coordinated chain to WASIp3 0.9.0 / wit-bindgen 0.62.0, retaining WASI 0.3.0 and one SDK executor. The upstream nested-spawn regression fails on the old chain and passes after this change. No observer-driven producers, second executor, vendoring or compatibility alias.
• Hard-migrate callers to spawn_local. Root, demo, reusable fixture and generator use identical Git URL/revision and package version; guards compare all three. Lock changes stay within the affected SDK/bindings/macro graph. Decoder/map contracts remain unchanged.
• Verification: all five root Rust gates; both affected Spin WASM strict Clippy combinations; 35 Spin WASM contracts, 21 resource tests and the eager ownership component on exact Wasmtime 48.0.2; 60 demo-core, 42 fixture-core, 33 fresh-scaffold-core tests, demo/scaffold Spin compile checks and scaffold Spin Clippy; docs/build/dependency/legacy/evidence guards pass. The expensive ignored full generated-workspace gate was not rerun locally.
• Actual Spin 4.1 wire controls pass 68 exchanges/84 receipts. Slow-origin batch starvation is removed. The four fixed lifetime cases remain two passes and two strict timing failures; do not widen tolerances or extend deadlines. A pre-existing host worker diagnostic was reproduced after requested shutdown with identical guest artifacts; retain that limitation, not a clean-hosted-shutdown claim.
• Keep the frozen requirements/Interfaces, all outbound guarantees and capability values unchanged. Inventory stays 32 ready/479 planned and qualified: false; full acceptance binding, candidate freeze and authorized hosted qualification remain open.

Earlier Checkpoint: Begin/Batch Lifetime Probes and SDK Gap

Implemented in 834a009e:

• Add four fixed EZ-6 lifetime scenarios to the standalone Rust harness and existing production-client guests. Reuse the bounded origin parser/collector, process supervision and cleanup; no new transport, executor or host-language runner.
• Preserve actual host receipts/writes, measured guest observations, original cutoffs, arrival elapsed, typed mediator errors and exact mixed collection states. Add conservative quiet-window clock bounds, cold-entry and timestamp-reanchoring regressions, and late-cleanup failure coverage.
• Verification: 203 harness tests, 42 fixture-core tests, the five root Rust gates, strict harness/fixture lint, docs and legacy/evidence checks pass. The existing Axum redirect regression remains 68 exchanges/84 receipts.
• Actual local lifetime results: Begin/unobserved-batch cases 4/5 pass on all four adapters. Slow/fast timeline cases 1/2 do not pass their strict timing targets. Spin additionally loses the slow-origin batch before dispatch; tracing confirms newly spawned work can wait until the origin responds in pinned wit-bindgen 0.57.1.
• Remove all temporary diagnostics. A compatible audited SDK scheduler repair remains an explicit dependency decision, not an observer-polling workaround or another executor. No production API, SDK/runtime pin or capability claim changes in this checkpoint.
• Keep all new lifetime bindings planned: inventory remains 32 ready/479 planned and qualified: false. CPU-stretch, remaining lifetime/registration/consumer acceptance, candidate freeze and authorized hosted qualification remain open.

This is a verified test/diagnostic checkpoint, not a passing full lifetime suite or completed feature qualification.

Earlier Checkpoint: Standalone Test Harness and Redirect Bindings

Implemented in b5f94c70:

• Move the shared native Rust runner to crates/edgezero-test-harness, with a non-published standalone workspace and its own lockfile. Remove the old runner package/directory without an alias or duplicate implementation. Keep deployable fixture apps separate and unit/contract tests in their owning crates.
• Preserve fixture cwd, target directories, staging, selected runtimes and evidence paths. Record the fixture and runner locks as different artifacts. Preserve all 23 runner registry package versions/checksums and all 329 retained fixture-lock entries; the root lockfile and SDK/decoder/runtime pins are unchanged.
• Fix launcher cwd selection so repository-pinned tools work when invoked from outside the checkout. Verify both an unrelated working directory and paths containing spaces with real Axum exchanges. Cargo metadata regressions prove isolation from both production and fixture dependency graphs.
• Extend the same wire matrix to Axum and Fastly: all four adapters pass 68 exchanges/84 ordered origin requests. Preserve Spin's bodyless/upload/scope/SDK-terminal controls, Fastly smoke exit 0 and its separate 12/18 plus 23/43 progress inventories with unqualified exit 2.
• Strengthen existing core redirect tests with the literal signed-date header, first-hop cancellation and two-hop query-redaction controls, preserving the older tests. Bind EZ-9 unit criteria 01-15 to all 51 guarded core tests and runtime criteria 16/17 to six exact environment legs.
• The inventory is now 32 ready legs and 479 planned, with qualified: false. Readiness records executable assertions, not consumer adoption, applicability approval or exact-candidate qualification.
• Update active scripts, guides, changelog, tracker and CI fetch/cache/fmt/lint/test commands for separate workspaces. Axum/Fastly/Spin execute the declared runtime paths with strict inventory guards; workerd runtime CI activation remains explicitly pending tool setup, separate from its passing local execution.
• Verification: 185 standalone harness tests, 35 fixture-core tests, 36 evidence-checker tests, 51 guarded core redirect tests, all five root Rust gates, strict fixture/harness lint, docs checks, dependency/legacy guards and workflow lint pass. The one ignored Rust subprocess helper is explicitly exercised by parent tests. Independent reviews have no remaining concrete findings.

This completes the approved runner relocation and local redirect binding checkpoint, not the whole adoption plan. Lifetime/registration acceptance, successful native optimizer transformation/redirect/performance evidence, consumer integration, candidate freeze and authorized hosted qualification remain open. Optional idle-body policy is not silently adopted. No deployment, capability promotion or production outbound behavior change occurs.

Earlier Checkpoint: Local Workerd Redirect Acceptance

Implemented in 4e64db99:

• Run Cloudflare through the same Rust outbound-wire matrix and bounded two-origin servers as Spin. A fixture-only route obtains the production client from the canonical request context; no Fetch replacement, parallel outbound transport or new host-language runner is used.
• Pass all 68 local workerd exchanges and 84 ordered origin receipts. Assert exact bytes, coding and cap parity, manual redirects, unread intermediate-body progress, stopped/limited final bodies, cross-origin hops, streamed final responses and terminal metadata.
• Preserve exact provider error classification: workerd requires 502 Transport at ResponseBodyRead with the observed sanitized Unknown cause; Spin retains its existing Protocol expectation. Negative controls reject wrong reasons, phases, causes and status.
• Record the selected workerd executable/version and effective compatibility settings. Local execution uses Wrangler 4.131.0, workerd 2026-09-10 and worker 0.8.5 with the existing compatibility date/flags. Rebuild only the exact cached wasm-bindgen 0.2.129 CLI offline in a temporary directory; no global tools or project pins change.
• Extend the common cleanup scope before local binding/build/startup work. Preserve primary failures, clean partial state and finish runtime/origins before publishing an inventory. Accept wrapper exit 143 only after confirmed sent TERM; premature 143 and failed/absent signaling remain rejected by regression controls.
• Independently review the probe and host lifecycle changes. Pass 35 fixture-core tests, 184 harness tests, strict fixture/native/provider-target checks, all five root Rust gates, documentation checks and dependency/evidence/legacy guards. The intentional Rust subprocess helper remains parent-test-driven.
• Rerun Spin's unchanged 68/84 inventory and bodyless/upload/scope/SDK-terminal controls. Preserve Fastly's 12/18 and 23/43 progress inventories with their unqualified exit 2. Missing workerd tools produce unsupported exit 2 and no success inventory.
• Update the changelog, fixture guide and master tracker. No production API, SDK/runtime pin, capability promotion, hosted deployment or candidate freeze occurs.

Successful native optimizer redirects, conditional idle-policy coverage, complete criterion-level binding and consumer/hosted acceptance remain open. The inventory remains eleven ready legs, 500 planned and qualified: false.

Earlier Checkpoint: Rust Spin Wire Harness

Implemented in 361da4f1:

• Replace the Python wire runner with --adapter spin --suite outbound-wire in the existing Rust fixture harness. No Python or Node replacement runner, compatibility wrapper, dependency changes or second process supervisor remains.
• Reuse bounded raw HTTP parsing/capture, two tracked origins, file-backed runtime logs and process-group ownership. Preserve the unchanged Spin guest and all 68 exchanges/84 correlated origin requests, plus bodyless, upload, canonical-scope and attached Begin/Batch handoff controls.
• Fail closed on late worker errors, malformed framing, non-text wire payloads, altered raw handoff bytes, premature runtime exits and cleanup failures. Keep unconfirmed cleanup retryable and reap timed-out signal helpers within bounded deadlines.
• Verify 180 Rust harness tests and 29 qualification-enabled fixture-core tests. The one ignored Rust subprocess helper is explicitly invoked by its parent regression tests. Independent network and process-cleanup reviews report no unresolved findings.
• Pass all five root Rust gates, strict fixture Clippy/format, documentation lint/format/build, workflow lint and dependency/evidence/legacy guards.
• Rerun the actual pinned Spin runtime with exit 0 and the complete 68/84 inventory. Preserve Fastly smoke exit 0 and both progress inventories (12 probes/18 receipts plus 23 probes/43 receipts) with their required unqualified exit 2.
• Keep the same CI job and pinned runtimes. Validate the Spin inventory predicate against complete evidence and missing-case, wrong-count and cleanup-failure controls. Preserve all production outbound contracts, frozen requirements and qualification status.

This checkpoint is test-tooling only. No hosted deployment, capability promotion, candidate freeze or optimizer performance claim is made. The inventory remains eleven ready legs, 500 planned and qualified: false.

Earlier Checkpoint: Provider Redirect Boundaries

Implemented in 699cd49c:

• Exercise the actual clients through the shared Send/Follow pipeline: Cloudflare guest fetch fixtures, local Spin HTTP wire controls and the explicitly selected repaired Viceroy.
• Pass the complete Cloudflare suites: 82 guest library tests, 29 contracts and 12 Node fixture tests. New cases cover coding/cap parity, unread intermediate bodies, final stream behavior, original deadlines, drop cancellation and fixture cleanup. Guest abort observations are not workerd cancellation evidence.
• Pass 68 Spin redirect exchanges with 84 origin-observed requests, preserving the existing bodyless, upload, canonical-scope and attached Begin/Batch handoff controls. Teardown joins request handlers before validating their outcomes and rejects unexpected runtime exits. Both false-green paths reproduce before the fix and are rejected afterward.
• Preserve Fastly's original 12 progress probes and 18 origin receipts; require an additional 23 redirect probes and 43 receipts. Validate exact typed cap causes, normal-decoding unsupported-token passthrough, two-origin behavior, pending unread heads and native optimizer unavailable boundaries.
• Close the reviewed evidence-validation gap: correlate overflow Follow metadata or exact hop-failure indices, reject contradictory/missing/foreign data, and preserve the original inventories. The new regression fails before the fix; all 149 harness and 29 qualification-enabled fixture-core tests pass afterward.
• Run the Spin wire harness in its existing CI job using the checksum-verified pinned CLI. Extend Fastly's existing predicate without adding another job or weakening its required unqualified exit-2 disposition.
• Pass all five root Rust gates, affected WASM clippy/build checks, docs lint/format/build, workflow lint and dependency/evidence guards. Core remains at 1,044 passing unit tests.
• Update the changelog, fixture guide and requirement tracker. No production API, SDK/decoder/runtime pin or capability guarantee changes in this checkpoint.

Workerd/origin parity, successful optimized-first-hop redirects, conditional idle-policy coverage, complete criterion-level acceptance binding, candidate freeze and consumer/hosted qualification remain open. Native optimizer dispatch is preserved; unavailable-boundary controls do not establish transformation or performance. No deployment is performed. The inventory remains eleven ready legs, 500 planned and qualified: false.

Earlier Checkpoint: Fastly Cooperative-Wake CI Repair

Implemented in f57b8130:

• Reproduce the red reusable-HTTP smoke locally: the first real outbound origin request stalls after earlier lifecycle probes pass. The dependency future-incompatibility warning is not the failure.
• Fix the existing Fastly progress loop to honor cooperative source wakes before host selection. A yielding body must not enter an empty-handle wait until its 30-second deadline.
• Preserve direct/nested progress, retained older wakers and current-caller notification, expiry publication and normal waiting on later pending polls. Retain only a shared notification flag in progress state, not a parent task waker.
• Add three colocated deterministic regressions. The direct/nested and retained-waker assertions fail before the fix; all thirty progress tests pass afterward.
• Verify the exact unchanged Fastly smoke with exit 0 across every existing variant and assertion. All five root gates, four Fastly WASM clippy configurations, 265 guest library tests and 36 contracts pass.
• Verify all twelve production-client progress probes and eighteen expected origin requests using the unchanged CI assertions. Its expected exit 2 preserves qualification: false.
• Update changelog and tracker. No new CI job, public API, deadline, read-size policy, runtime pin, capability promotion or hosted deployment.

Still open: provider-runtime redirect acceptance, exact-candidate criterion bindings, resource-policy decisions and consumer/hosted qualification. All previous outbound guarantees and direct native Image Optimizer integration remain intact.

Earlier Checkpoint: Explicit Redirect Following

Implemented in e02c2360:

• Add the approved HttpClient::follow API with a required synchronous application policy and validated 1..=20 redirect limit. Plain Send, Begin and Batch remain unfollowed.
• Route every hop through the same supplied client, prepared dispatch and shared head finalizer. Preserve method/replay precedence, original Location evidence, unchanged request bounds, typed hop errors and arbitrary application-policy errors.
• Replay buffered Bytes by sharing storage; never buffer streamed uploads for replay. Drop followed heads unread, without draining, decoding or applying final-body caps to intermediate payloads.
• Preserve the original absolute chain deadline through replacement requests and final streamed consumption. Retain per-hop timeouts/defaults, injected time, B31, indexed batches and direct native Image Optimizer dispatch without another fetch.
• Strip only Authorization, Cookie and authority overrides from automatically prepared cross-origin hops; deliberate policy replacements remain application-owned. Demo and generator enforce initial and per-hop same-origin policy.
• Close independently reproduced scope-reentrancy and backwards-clock gaps in shared preparation/source binding/finalization, including terminal cleanup. No compatibility transport, second collector or adapter-specific cancellation engine.
• Verification: all five root gates; 1,044 core unit tests and 14 integration tests, including 50 redirect cases; 261 native TCP library tests plus 27 contracts; 60 demo-core tests; 33 fresh generated-core tests and strict generated-workspace clippy. The separate expensive ignored full-generator gate was not rerun locally.
• Guest verification on final source: all eight WASM feature clippy configurations; Cloudflare 74 unit/29 contract cases plus nine Node fixture cases; Spin 35 contracts/21 SDK-resource cases and an executed eager-exchange component; Fastly 262 unit/36 contract cases with zero filtering under the approved repaired Viceroy. Fastly uses the system CA bundle with TLS verification intact, not a runtime-pin promotion.
• Update guides, capability declarations, changelog, tracker and documentation guards. Frozen requirements, approved Interfaces and audited dependency/runtime pins are unchanged.

Still open: other provider-runtime Follow parity, actual Fastly optimizer-hop mapping, consumer composition, exact-candidate criterion bindings, resource-policy decisions and hosted qualification. The inventory remains eleven ready legs, 500 planned and qualified: false. No deployment or capability promotion occurred, and the PR remains draft. Current tracker.

Earlier Checkpoint: Shared Outbound Pipeline and Ownership

Implemented in 2be1dd87:

• Hard-cut prepared dispatch, paired time/progress, eager Begin and identity-bound batch receipts. Core shares validation, GET/HEAD settlement, normalization, decoding, limits, revocation, task cleanup and Body source binding; adapters retain provider I/O and scheduling.
• Capture complete unpolled operations at invocation. Accept exact provisional Body owners before egress policy/framing, preserve response completion through fallback terminal, and keep source EOF distinct from terminal transmission.
• Make nonblocking readiness observation SDK-pump-free. Preserve original deadlines, timeout causes, partial results, cutoff equality, independent caps, pooling and direct native Image Optimizer integration.
• Retire Fastly's separately approved preparation-slack rejection while retaining B31 and actual expiry/backwards-clock checks. No compatibility aliases, duplicate lifetime registry or alternate transport remains.
• Migrate all adapters, supplied clients, demo, generator, fixtures, guides, changelog and guards atomically.
• Local verification: five primary Rust gates; 984 core unit tests; 261 native TCP cases plus 25 contracts; Cloudflare 74 guest unit/29 contract cases; repaired-Viceroy Fastly 262 unit/36 contract cases, zero filtered; Spin 56 guest cases. Refreshed demo default-core 55, rendered scaffold 28 and qualification fixture 29 tests pass. Strict provider lint and documentation/dependency/legacy guards pass.
• Record the scoped interface authorization separately from historical exact-digest approvals. Normative requirements and audited SDK/decoder pins are unchanged.

Open at that checkpoint: explicit same-client redirect following (now implemented in the checkpoint above), remaining exact-candidate acceptance bindings, resource-policy decisions and hosted qualification. Local runtime evidence does not promote capabilities or prove end-client delivery. The PR remains draft. See the current tracker.

Earlier Checkpoint: Live Paired Time

Implemented in d86d4c0d, with the isolated Cloudflare test-ordering correction in f4d660b1:

• Hard-migrate all four clients and injectors to with_time / Axum try_with_time, removing clock-only constructors without aliases.
• Use OutboundTime for live asynchronous deadline handling. Check timers before source polling, preserve operational errors and diagnostics, retain clock high-water observations across chunks/yields, and release terminal/cancelled ownership.
• Integrate timer-only waits into Fastly's existing progress multiplexer. Bound nested engines by original ancestor deadlines, isolate expired mailboxes, and wake outside state borrows.
• Preserve B31, cutoffs/partial results, limits, coding/provenance and direct native Image Optimizer dispatch. Demo/templates remain aligned through standard injection.
• Local verification passes: five required Rust gates, 2,293 workspace tests (one existing ignored test), strict provider WASM Clippy, Cloudflare 53 library/29 contract cases, Fastly 238 library/36 contract cases, and Spin 15 SDK-resource cases on Wasmtime 48.0.2. Demo, fixtures, documentation and dependency/legacy checks pass.
• Actual-client Fastly receive probes and Spin local component functional cases pass, but both smoke suites correctly remain unqualified (exit 2). No hosted deployment or capability promotion occurred.

This completes only the approved sequencing checkpoint. The public head-first trait, settlement/context issuance, batch receipts, eager Begin, redirect integration and hosted qualification remain open. Requirements and frozen Plan 02 hashes are unchanged. See the verification audit.

Earlier Checkpoint: Bounded Synthesized Headers

Added in d47c8026:

• Immutable app-level and validated Fastly per-request response-header sets, bounded to 32 values and 4096 serialized field-section bytes. Preserve canonical field precedence, ordered repeated values, typed overflow retry suppression, completion ownership and fallback budgets.
• Cover normalized ingress errors, admitted source errors, canonical 404/405 and adapter fallbacks; do not decorate matched application responses/errors, admission refusals or failed application assembly.
• Align the demo, generated application, specifications, implementation plans and changelog.
• Local verification: all five required Rust gates, 2,193 workspace tests, 99 fixture tests, strict provider-target Clippy and documentation checks pass.
• Actual local runtime evidence: 55 header wire cases, 40 assembly wire exchanges and one Axum pre-listener startup control pass. HEAD payload absence requires clean EOF; Fastly reports are request-correlated, and failed state release is observed before retry.
• Evidence: header matrix, assembly and repeated header matrix.

This checkpoint is not completion of the broader adoption plan or hosted qualification. The full head-first/eager/redirect migration, Fastly's failed G2 preserving-read proof, all nine failed Fastly framing SDK parity controls, Cloudflare overflow recovery, consumer integration and exact-candidate hosted qualification remain open. No capability is promoted, no compatibility layer is restored, and the PR remains draft.

Reviewer correctness follow-up

Addressed R1–R4 in 92111839:

• Axum validates exact-length source EOF before handing Hyper the final frame, validates transmitted zero-length streams before handoff under the original deadline, and preserves detached fallback payloads with HEAD suppression.
• Batch completion requires clean driver EOF; trailing failures and malformed events are checked even after the last item or with zero slots. Collected slots survive driver failure.
• Application assembly rejects changed platform metadata after successful configuration while preserving hook-error precedence.
• Added regression coverage and aligned specs, implementation plans, guides, changelog, and the docs checker. Local workspace tests (720 core unit tests), strict native/WASM clippy, explicit adapter contracts, and demo/docs checks pass. Local WASM results are compilation/lint evidence; hosted lifecycle qualification requires separate deployed runtime artifacts.

Main merge and shared-policy follow-up

Addressed R5 and R6 in 91f4af38, merging main 683202c6 without restoring superseded APIs:

• Axum, Cloudflare, and Spin share OutboundBatch::from_futures; adapters retain preflight validation, exchange ownership, clocks, and terminal samples. Ready results remain retained, driver EOF/index invariants remain enforced, and cutoff releases pending futures before reporting termination. Fastly retains its distinct provider-handle driver.
• All four adapters share ResponseBodyPolicy and apply_response_body_policy, preserving declared-length checks, encoded limits, decoding/header rewriting, decoded limits, passthrough, and rechunk order. Transport reads, bodyless handling, deadlines, cancellation, and final buffering remain adapter-owned.
• Main's opt-in reusable application lifecycles now use fallible assembly, fresh request registries, canonical admission, and lazy owned egress. Fastly custom callbacks return terminal Result<(), E> through a wrapper that prevents SDK-generated second responses.
• Migrated the reusable fixtures to the current SDK pins and hard-cut APIs; expanded the legacy guard and CI coverage. Updated the outbound specification, lifecycle specification, implementation plans, guides, and changelog.
• Local verification passes: full workspace tests (733 core unit tests), strict native/provider-WASM Clippy, Cloudflare/Fastly/Spin runtime contract suites, reusable fixture tests (5 core and 26 harness), Fastly fixture finalization and Viceroy 0.21.0 HTTP smoke, demo host/lint/WASM checks, fresh generated-project compilation, and docs/dependency/legacy gates.
• Physical partial delivery is proved by a client-observed handshake before upstream truncation. Immediate zero-byte source failures are verified through exactly-once correlated completion with no fallback; only no-status EOF/reset is accepted, never timeouts or malformed responses. Local smoke evidence does not promote deployed capability guarantees.

R7's dependency-audit-script deduplication remains deferred; dependency contract checks remain unchanged and pass.

Bounded native ingress and config follow-up

• Axum owns a bounded HTTP/1 accept loop and parser boundary: finite live connections, joint wire-head bytes, field count, parser buffers, absolute header-read deadlines, and idle keep-alive expiry. Capacity is acquired before parser construction; saturation closes the one accepted overshoot without spawning a refusal task. HTTP/2 is not enabled.
• Axum loads immutable local config snapshots before listener binding. Validated file, entry, decoded key/value, registry-residency, and sequential startup-staging limits are enforced before owned snapshot allocation. Duplicate keys are rejected; allocation overflow fails startup; unavailable declarations remain typed failed bindings.
• Hard-cut all four adapters and fixtures to shared UTF-8 ConfigValue returns. Axum constructors require ConfigStoreLimits; from_map is fallible. Reads share payloads, and local config push updates require a server restart.
• Pin the parser allocation audit to serde_json 1.0.150, hash canonical JSON incrementally, and release extraction's raw handle before secret retrieval. A moving-reallocation malformed-root probe measured 36,428 requested peak bytes under a 100,060-byte staging cap, with zero retained bytes after rejection.
• Add real local TCP tests for HEAD/204/304 suppression, stalled producers, non-reading clients, disconnects, exactly-once completion/resource release, and connection-capacity recovery. These prove the adapter-owned native boundary, not confirmed client delivery.
• Align the demo, generator, migration guide, specs, plans, and changelog. Fresh local verification passes: full workspace tests (737 core unit tests), strict native and three-provider WASM Clippy, demo tests/lint, generated all-adapter host/WASM builds, docs checks, and dependency audits.
• Hosted config preallocation and response-lifecycle qualification remain open. Provider whole-value materialization and complete RSS accounting are not certified; broad config-allocation support remains Unsupported and response egress remains BestEffort. Local emulators and guest contract tests are not deployed runtime evidence.

Bounded provider reads and lifecycle qualification infrastructure

• Cloudflare bounded config reads now use caller-sized BYOB byte streams, strict UTF-8, independent byte allowances, clock checks and cooperative task yields. Reader termination cancels the stream; an acquisition owner also cancels a stream arriving after the waiter was abandoned. Cancellation rejections cannot publish provider diagnostics.
• Bounded KV dispatch requires FinalizationRegistry cleanup support. Generated and demo Workers explicitly enable enable_weak_ref, and regression tests inspect their TOML rather than assuming an exact one-flag string.
• Fastly uses the pinned config-store host ABI with one initialized caller-sized buffer and no oversized-buffer retry. Root/pointer/chunk limits, declared-total preflight, transport integrity and reassembly bounds precede envelope materialization. Duplicate reserved discriminators fail closed, deadline expiry wins metadata errors, and try_open now returns typed ConfigStoreError.
• Publish conservative requested-payload charges and retain explicit exclusions for opaque provider buffering, JS GC retention, synchronous interruption and complete allocation certification.
• Add default-off qualification applications through all four standard adapter entrypoints, an allowlisted finite HTTPS probe runner and a fail-closed correlated ownership-evidence validator. CI runs the validator/fixture unit tests and compiles every qualification target without deploying anything.
• Local verification: workspace tests, strict native and three-provider WASM Clippy, feature checks, Cloudflare WASM tests (28), Fastly bounded-config Viceroy tests (18), fixture tests (7 core/26 harness), validator tests (5), demo-core tests (48), dependency/legacy/documentation checks and docs build. A temporary native Axum fixture exercised nine normal/bodyless/failure/deadline scenarios with one terminal report and one resource release each, then was stopped.
• Still open: a bounded Spin host/backend interface or independently verified read-allocation ceiling, plus actual hosted qualification with authorized isolated targets and complete revision-pinned telemetry. The validator qualifies only ownership for scheduled probes; it does not authenticate telemetry, prove same-instance recovery, confirm client delivery or promote capabilities.

Downstream acceptance impact

Cloudflare outbound-deadlines and streamed-upload-deadlines are BestEffort, not Native. Downstream acceptance suites must use best-effort deadline wording and must not claim exact cancellation enforcement until deployed host-observed evidence exists.

The response completion, ingress abort, and fallible application-assembly changes are intentional breaking changes. Consumers must provide a completion on every response-producing admission decision and propagate App::build::<A>(platform) failures.

Evidence boundaries

Capability declarations remain conservative where provider behavior is not proved:

• Raw request-target/header accounting and parser-boundary CL/TE rejection are Unsupported on all adapters.
• Inbound read deadlines are Native on Axum and BestEffort on Cloudflare, Fastly, and Spin because finite host-side teardown is not proved or synchronously preemptible.
• Ingress admission abort is Native on Axum's owned HTTP/1 connection and BestEffort on Cloudflare, Fastly, and Spin because provider transport reset/close is not directly observable.
• Response-egress abort, backpressure, completion, and write deadlines remain BestEffort on every adapter because no boundary proves end-client receipt; provider-specific blocking and teardown limits are documented.
• Complete outbound and configuration-read allocation accounting is Unsupported; provider parsing/materialization, SDK copies, informational responses, trailers, allocator overhead, and other host-owned memory remain outside guest-visible caps.
• Configuration-read deadlines are BestEffort on every adapter because provider operations are not proved cancellable within a finite wall-clock interval.
• Cloudflare outbound deadlines and streamed-upload deadlines remain BestEffort pending a deployed host-observed cancellation artifact. Fastly and Spin retain their separately documented deadline, phase-budget, and isolation limitations.
• Batch completion/cancellation/isolation and authority-override support are reported independently per adapter in the public capability matrix.

Validation

This checklist records validation across PR checkpoints. The exact latest reruns and remaining acceptance failures are listed above; it is not a claim of hosted qualification or a fresh run of every historical matrix.

• scripts/run_tests.sh
• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-targets
• cargo check --workspace --all-targets --features "fastly cloudflare spin"
• Native and WASM adapter feature matrices for Axum, Cloudflare, Fastly, and Spin
• Fastly WASM/Viceroy contract and runtime suites
• Reconciled reusable-app fixture tests, provider-target lint, and Fastly lifecycle HTTP smoke
• Fresh generated all-adapter project host tests and all provider WASM builds
• Checked-in demo host tests, strict Clippy, and all provider WASM builds
• Documentation format, lint, build, contract, dependency, and legacy API guards

Closes

Closes #436.

[aram356]

Round 50 — Fastly SDK correctness pass (commit 647489a)

Reviewer flagged four normative claims about Fastly that didn't match the actual SDK / public API. All fixes verified against docs.rs/fastly and Fastly's public Backend API docs before edit.

HIGH — lazy-streamed-response-passthrough on Fastly: downgraded Native → BestEffort. Response::with_streaming_body does not exist (only on Request). Response::stream_to_client() is the real API but is incompatible with #[fastly::main]. Default scaffold falls back to buffered passthrough; the non-#[fastly::main] entry-point template is tracked in new §8 risk 12.

HIGH — NameInUse semantics: rewritten. Fastly's session-uniqueness rule is unconditional — no "identical re-registration returns Ok" carve-out. Backend::from_str(name) returns a handle only, no property inspection. NameInUse on a name not in this adapter's collision map is now an explicit fail-closed EdgeError::internal.

MEDIUM — between_bytes_timeout direction: dropped the false write-side claim per Fastly's public Backend API docs (receive-side only). Streamed-upload host-write phase downgraded to BestEffort; cooperative inter-chunk check is the only adapter-side bound.

MEDIUM — Streamed-upload response overshoot: tightened from per-chunk accumulator to closed-form bound — first_byte_ms (headers wait) + one between_bytes_timeout (worst-case first-body-chunk read), one-shot. Footnote 1 single-send section and new §5.4 test row added.

LOW — App-facing consuming body accessor: added OutboundResponse::into_body(self) -> Body. send_all rustdoc now recommends single send + futures::join_all + into_body() as the canonical streamed-response orchestration path on Axum/CF/Spin.

Appendix AY records all five resolutions. Status bumped to rounds 1–50.

[aram356]

Round 51 — round-50 carry-overs + Spin WASI write mechanics (commit 8df9d80)

Five follow-up findings from the round-50 reviewer pass. All verified against the cited external docs before edit.

HIGH — Fastly dynamic-backend semantics contradictory across sections. Round 50 fixed the §4.3 step-5 algorithm but the earlier Dynamic backends introductory paragraph still preserved the false "identical name + identical properties re-registers / returns Ok" carve-out. Rewritten in place: session-uniqueness is unconditional per the SDK; EdgeZero owns the entire uniqueness story at the guest layer via the adapter-local cache; NameInUse outside that cache is fail-closed EdgeError::internal. Two historical Appendix-AK entries marked "Superseded by Appendix AY."

MEDIUM — Fastly buffered-fallback named an unavailable cap; §5.4 still bundled Fastly with CF/Spin. Added FASTLY_RESPONSE_STREAM_BUFFER_BYTES (default 16 MiB, mirrors AXUM_RESPONSE_STREAM_BUFFER_BYTES). §5.4 lazy-passthrough rows split: (a) CF/Spin yield-first-bytes row excludes Fastly; (b) CF/Spin mid-stream abort row excludes Fastly; (c) new Axum-and-Fastly buffered-fallback row with both adapter constants named.

MEDIUM — Residual between_bytes_timeout write-side claims. The "stalled streamed-upload mechanics differ per adapter" §5.4 row and §8 risk 7 both still claimed the Fastly between-bytes-timeout bounded guest-to-origin writes. Scrubbed both — Fastly's write phase is BestEffort uniformly. §8 risk 7 retitled and rewritten to track the symmetric "if Fastly adds a documented guest-write timeout in the future" follow-up.

MEDIUM — Spin host-write race mechanically wrong vs WASI. Old wording raced each OutgoingBody::write against a timer; WASI output-stream is nonblocking + readiness-polled. Rewritten as the four-step pattern: subscribe() pollable → futures::select! pollable-ready vs monotonic-clock timer → on timer-win drop the handle + return gateway_timeout → on pollable-win call nonblocking check_write() for permitted byte count + write() within that bound, looping. §5.4 row updated to match.

LOW — Typo: docsare migrated → docs are migrated in §1.3.

Appendix AZ records all five resolutions; status bumped to rounds 1–51.