f2babb36

test(wan): named sessions over the real link

a73x 2026-08-15 12:22

Commit message

test(wan): named sessions over the real link

The WAN harness drove only the default session. This leg asks the one
question a loopback and a container bridge cannot: does a session NAME
survive a real link. Three claims, each its own assertion — two named
sessions on one remote daemon hold only their own content (positive AND
negative grep per session, since "a holds a's marker" is satisfied just
as well by one shared shell); the default session, which every other leg
drives, holds neither; and re-attaching BY NAME rejoins the shell that
name already had, proven by both markers on one grid with sessions=3
unmoved. A fresh shell would carry the new marker alone, which is exactly
what a name resolving per-connection would produce.

Placed after every measurement: it leaves two more shells on the box, and
a session that exists is a session the timing legs would have shared a
daemon with. Re-running is safe — attach-or-create rejoins, and the
markers carry $$ so a stale grid cannot satisfy a later run.

Falsified before being trusted, by driving both clients into session `a`.
That caught a defect in its own first draft: the leg set $FAILED, which
drives the "kill criteria (M6 + M7)" line, so a named-session failure
printed as an M6/M7 failure — a verdict for a defect in neither. The two
gates are independent and fold into the exit status separately.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

test/wan.sh

@@ @@ -1297,8 +1297,105 @@ if [ "${MUX_WAN_PREDICT:-}" = "1" ]; then @@
+    netem_off
+fi
+# ---- M18: named sessions over the real link -------------------------------
+# Everything above drives the DEFAULT session, because everything above
+# predates M18. This is the leg that asks whether a session NAME survives a
+# real link — not a loopback, not a container bridge. Three claims, each its
+# own assertion: two named sessions on one remote daemon hold only their own
+# content; the default session holds neither; and re-attaching BY NAME lands
+# back in the shell that name already had rather than in a fresh one.
+#
+# Deliberately placed after every measurement above. It leaves two more
+# shells on the box, and a session that exists is a session the timing legs
+# would otherwise have shared a daemon with.
+#
+# Those two shells are left behind ON PURPOSE and re-running is safe, which
+# is worth saying because "leaves sessions on the box" reads as a leak. The
+# daemon here is this run's own ($RBIN on $RSOCK, torn down with it), so
+# nothing outlives the harness. And within a run the leg is idempotent by
+# construction: attach-or-create REJOINS `a` and `b` rather than failing on
+# them, and every marker carries $$, so a grid left by an earlier run can
+# never satisfy a later run's grep.
+say "M18: named sessions over the real link"
+M18_OK=1
+M18_N="$$"
+for S in a b; do
+    # A marker the REMOTE shell has to expand: the typed line carries a
+    # literal %s, so the joined form can only exist if bash on the box ran
+    # printf. An echo of our own keystrokes cannot satisfy the greps below.
+    { printf 'printf "wansess-%s-%%s\\n" %s\n' "$S" "$M18_N"; sleep 3; printf '\034'; } | \
+        timeout 90 "$MUX" --via "$VIA" --session "$S" > "$WORK/m18-$S.out" 2>&1
+    rc=$?
+    if [ "$rc" -ne 0 ]; then
+        echo "   FAIL: --session $S over --via exited $rc"
+        sed -n '1,3p' "$WORK/m18-$S.out"
+        M18_OK=0
+    fi
+done
+if [ "$M18_OK" -eq 1 ]; then
+    A_GRID="$(timeout 60 $MUX_WAN_SSH "$RBIN dump --sock $RSOCK --session a" 2>/dev/null)"
+    B_GRID="$(timeout 60 $MUX_WAN_SSH "$RBIN dump --sock $RSOCK --session b" 2>/dev/null)"
+    D_GRID="$(timeout 60 $MUX_WAN_SSH "$RBIN dump --sock $RSOCK" 2>/dev/null)"
+    # Positive AND negative per session: "a holds a's marker" is satisfied
+    # just as well by one shared shell, so only the negative separates them.
+    case "$A_GRID" in *"wansess-a-$M18_N"*) ;; *)
+        echo "   FAIL: session a's marker is not on session a's grid"; M18_OK=0 ;; esac
+    case "$A_GRID" in *"wansess-b-$M18_N"*)
+        echo "   FAIL: session b's marker is on session a's grid — one shell, not two"
+        M18_OK=0 ;; esac
+    case "$B_GRID" in *"wansess-b-$M18_N"*) ;; *)
+        echo "   FAIL: session b's marker is not on session b's grid"; M18_OK=0 ;; esac
+    case "$B_GRID" in *"wansess-a-$M18_N"*)
+        echo "   FAIL: session a's marker is on session b's grid — one shell, not two"
+        M18_OK=0 ;; esac
+    # The default session is the one every leg above drove. Neither name may
+    # have leaked into it.
+    case "$D_GRID" in *"wansess-a-$M18_N"*|*"wansess-b-$M18_N"*)
+        echo "   FAIL: a named session's marker reached the default grid"; M18_OK=0 ;; esac
+fi
+if [ "$M18_OK" -eq 1 ]; then
+    # Re-attach by name: this must JOIN the shell `a` already has. The proof
+    # is both markers on one grid afterwards — a fresh shell would carry the
+    # new marker alone, which is exactly the failure a name that resolved
+    # per-connection would produce.
+    { printf 'printf "wanre-%%s\\n" %s\n' "$M18_N"; sleep 3; printf '\034'; } | \
+        timeout 90 "$MUX" --via "$VIA" --session a > "$WORK/m18-re.out" 2>&1
+    rc=$?
+    if [ "$rc" -ne 0 ]; then
+        echo "   FAIL: re-attach to session a exited $rc"; M18_OK=0
+    else
+        A2="$(timeout 60 $MUX_WAN_SSH "$RBIN dump --sock $RSOCK --session a" 2>/dev/null)"
+        case "$A2" in *"wanre-$M18_N"*) ;; *)
+            echo "   FAIL: the re-attach's own marker never reached session a"; M18_OK=0 ;; esac
+        case "$A2" in *"wansess-a-$M18_N"*) ;; *)
+            echo "   FAIL: re-attaching to 'a' found a FRESH shell, not the one it named"
+            M18_OK=0 ;; esac
+        # ...and it joined rather than created: a fourth session here would
+        # mean the name resolved per-connection.
+        M18_STATS="$(timeout 60 $MUX_WAN_SSH "$RBIN stats --sock $RSOCK" 2>/dev/null)"
+        case "$M18_STATS" in *"sessions=3"*) ;; *)
+            echo "   FAIL: re-attach by name changed the session count: $M18_STATS"
+            M18_OK=0 ;; esac
+    fi
+fi
+if [ "$M18_OK" -eq 1 ]; then
+    echo "   two named sessions isolated over the link; re-attach by name rejoined"
+    echo "   its own shell; default session untouched; sessions=3"
+fi
+# ---- summary + the kill criterion -----------------------------------------
+FAILED=0
+# M18's leg is a functional gate, not a measured one. It is deliberately
+# kept OUT of $FAILED: that variable drives the "kill criteria (M6 + M7)"
+# line, and a named-session failure is not an M6 or M7 failure. Reported
+# on its own below, and folded into the exit status there. (The first
+# version of this did set FAILED, and the falsification run printed
+# "kill criteria (M6 + M7): FAIL" for a defect in neither — which is how
+# the mistake was found.)
+phase_block() {
+    local phase="$1" label="$2"
@@ @@ -1458,10 +1555,13 @@ if [ "${MUX_WAN_QUIC:-}" = "1" ]; then @@
+    echo "  client slots held at peak during tears: $q_clients"
+fi
+echo
+if [ "${M18_OK:-1}" -eq 1 ]; then
+    echo "M18 named sessions over the link: PASS"
+else
+    echo "M18 named sessions over the link: FAIL"
+fi
+if [ "$FAILED" -eq 0 ]; then
+    echo "kill criteria (M6 + M7): PASS"
+else
+    echo "kill criteria (M6 + M7): FAIL — report the numbers; do not tune the thresholds."
+fi
@@ @@ -1557,4 +1657,6 @@ if [ -n "$(val predict predict med)" ]; then @@
+    fi
+fi
+echo "=================================================================="
+# Either gate can fail the run; neither speaks for the other.
+[ "${M18_OK:-1}" -eq 1 ] || FAILED=1
+exit "$FAILED"