@volter/twin-tunnel 0.1.0

package/src/tunnel-capabilities.ts

@@ -0,0 +1,1770 @@
+import { mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { hostname, tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { listActions, projectResources, worldPaths } from '@volter/world-core';
+import { checkCapabilities, type CapabilityReport, type CapabilitySpec, verifyBoundary } from '@volter/world-tooling';
+import { createTunnelTwinJwt, createTunnelTwinServer, tunnelControlPathIsReserved } from './tunnel-server.ts';
+import { handleTunnelRelayMessage, handleTunnelTwinRequest, markTunnelDisconnected, persistTunnelRelayRegistration, prepareTunnelRelayRegistration, TUNNEL_PROTOCOL_MESSAGE_TYPES, type RelaySession } from './tunnel-twin.ts';
+import { checkTunnelConformance } from './tunnel-conformance.ts';
+import { liveTunnelExecute, mapTunnelRelay, syncTunnelFromReal } from './tunnel-connector.ts';
+import { TunnelBudget, TunnelBudgetError, TUNNEL_BUDGET_CEILING, TUNNEL_CALL_WEIGHTS } from './tunnel-budget.ts';
+
+const done = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier'], verify: CapabilitySpec['verify']): CapabilitySpec =>
+  ({ id, area, title, dimension, tier, expected: 'done', verify });
+const todo = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier']): CapabilitySpec =>
+  ({ id, area, title, dimension, tier, expected: 'todo' });
+
+const AT = '2026-01-01T00:00:00.000Z';
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function withRoot(fn: (root: string) => Promise<boolean>): Promise<boolean> {
+  const root = mkdtempSync(join(tmpdir(), 'tunnel-cap-'));
+  try { return await verifyBoundary('tunnel.withRoot', () => fn(root)); }
+  finally { rmSync(root, { recursive: true, force: true }); }
+}
+
+async function quick(root: string, over: Partial<{ method: string; path: string; readOnly: boolean }> = {}) {
+  return handleTunnelTwinRequest({ method: over.method ?? 'POST', path: over.path ?? '/tunnel', readOnly: over.readOnly, root, occurredAt: AT });
+}
+
+function nextSocketMessage(socket: WebSocket, type: string, timeoutMs = 3_000): Promise<Record<string, any>> {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => { cleanup(); reject(new Error(`timed out waiting for ${type}`)); }, timeoutMs);
+    const onMessage = (event: MessageEvent) => {
+      const message = JSON.parse(String(event.data)) as Record<string, any>;
+      if (message.type !== type) return;
+      cleanup(); resolve(message);
+    };
+    const cleanup = () => { clearTimeout(timer); socket.removeEventListener('message', onMessage); };
+    socket.addEventListener('message', onMessage);
+  });
+}
+
+function nextSocketOutcome(socket: WebSocket, types: string[], timeoutMs = 3_000): Promise<Record<string, any>> {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => { cleanup(); reject(new Error(`timed out waiting for ${types.join('/')}`)); }, timeoutMs);
+    const onMessage = (event: MessageEvent) => {
+      const message = JSON.parse(String(event.data)) as Record<string, any>;
+      if (!types.includes(String(message.type))) return;
+      cleanup(); resolve(message);
+    };
+    const cleanup = () => { clearTimeout(timer); socket.removeEventListener('message', onMessage); };
+    socket.addEventListener('message', onMessage);
+  });
+}
+
+async function relayFrameOutcome(
+  control: Awaited<ReturnType<typeof openControl>>,
+  path: string,
+  frames: Array<Record<string, unknown>>,
+): Promise<{ kind: 'response'; status: number; body: string } | { kind: 'error'; error: string } | { kind: 'timeout' }> {
+  const aborter = new AbortController();
+  const requestFrame = nextSocketMessage(control.socket, 'request');
+  const observed = fetch(`${control.url}${path}`, { signal: aborter.signal }).then(async (response) => {
+    try { return { kind: 'response' as const, status: response.status, body: await response.text() }; }
+    catch (error) { return { kind: 'error' as const, error: String(error) }; }
+  }, (error) => ({ kind: 'error' as const, error: String(error) }));
+  const request = await requestFrame;
+  for (const frame of frames) control.socket.send(JSON.stringify({ ...frame, reqId: request.reqId }));
+  let timeout: ReturnType<typeof setTimeout> | undefined;
+  const outcome = await Promise.race([
+    observed,
+    new Promise<{ kind: 'timeout' }>((resolve) => { timeout = setTimeout(() => resolve({ kind: 'timeout' }), 500); }),
+  ]);
+  if (timeout) clearTimeout(timeout);
+  if (outcome.kind === 'timeout') aborter.abort();
+  return outcome;
+}
+
+async function openControl(relayUrl: string, tunnelId: string, options: { replace?: boolean; authRequired?: boolean } = {}) {
+  const socket = new WebSocket(`${relayUrl.replace(/^http/, 'ws')}/ws`);
+  const registered = nextSocketMessage(socket, 'registered');
+  await new Promise<void>((resolve, reject) => {
+    socket.addEventListener('open', () => resolve(), { once: true });
+    socket.addEventListener('error', () => reject(new Error('control socket failed')), { once: true });
+  });
+  socket.send(JSON.stringify({
+    type: 'register', tunnelId, secret: 'vt_fake_local', ...(options.replace ? { replace: true } : {}),
+    ...(options.authRequired !== undefined ? { authRequired: options.authRequired } : {}),
+  }));
+  const message = await registered;
+  return { socket, url: String(message.url), tunnelId: String(message.tunnelId) };
+}
+
+/**
+ * A relay, a registered control socket, and a REAL local WebSocket server — with the control
+ * socket bridging between them exactly as the owned client does.
+ *
+ * A HARNESS SHAPED AFTER `handleWsUpgrade`, not a reproduction of it — §9 was right to refuse
+ * the stronger word. What it does share with the vendor's client is everything the relay is
+ * judged on: dial the local server on `ws-upgrade` carrying the offered subprotocols, answer
+ * `ws-ready` when it opens and `ws-error` when it FAILS (a real listener, not a scripted one),
+ * strip the hop-by-hop handshake headers the client strips, forward local frames back as
+ * `ws-message` with the `binary` flag, and relay `ws-close`. What it does NOT reproduce, and
+ * does not need to because no assertion depends on it: the client's `x-forwarded-*`/`origin`
+ * re-stamping, its 15-second dial timeout, and `safeClose`'s FIN-not-RST teardown. Driving the
+ * twin over a genuine loopback WebSocket against a real local server is what makes these
+ * verifies transport proofs rather than assertions about the relay talking to itself.
+ *
+ * `mode` selects what the pretend client does with an upgrade: bridge it for real, hold `ws-ready`
+ * back (so the queueing behaviour is observable), or refuse it with `ws-error`.
+ */
+async function openWsBridge(root: string, mode: 'bridge' | 'hold' | 'refuse' = 'bridge') {
+  const app = Bun.serve<{ path: string }>({
+    hostname: '127.0.0.1',
+    port: 0,
+    fetch(request, server) {
+      const url = new URL(request.url);
+      // A real local server negotiates the subprotocol it was offered; without that, the
+      // relay's own echo could look correct while nothing downstream honoured it.
+      const offered = (request.headers.get('sec-websocket-protocol') ?? '').split(',').map((p) => p.trim()).filter(Boolean);
+      return server.upgrade(request, {
+        ...(offered[0] ? { headers: { 'sec-websocket-protocol': offered[0] } } : {}),
+        data: { path: url.pathname + url.search },
+      }) ? undefined : new Response('expected websocket', { status: 426 });
+    },
+    websocket: {
+      message(ws, raw) {
+        // Text echoes with a marker; binary comes back REVERSED, so a verify can tell a genuine
+        // binary round trip from a text one that happened to survive.
+        if (typeof raw === 'string') ws.send(`echo:${ws.data.path}:${raw}`);
+        else ws.send(new Uint8Array([...Buffer.from(raw)].reverse()));
+      },
+    },
+  });
+  const relay = createTunnelTwinServer({ root });
+  const control = await openControl(relay.url, 'ws-bridge', { authRequired: false });
+  const locals = new Map<string, WebSocket>();
+  const frames: Array<Record<string, any>> = [];
+  const held: Array<Record<string, any>> = [];
+  control.socket.addEventListener('message', (event) => {
+    const message = JSON.parse(String(event.data)) as Record<string, any>;
+    frames.push(message);
+    if (message.type === 'ws-upgrade') {
+      if (mode === 'refuse') {
+        control.socket.send(JSON.stringify({ type: 'ws-error', connId: message.connId, error: 'ECONNREFUSED dialling local server' }));
+        return;
+      }
+      // The vendor's `handleWsUpgrade` reads `sec-websocket-protocol` off the frame's headers
+      // and passes it to the local dial as `protocols`; reproducing that is what makes the
+      // subprotocol assertion below a claim about the WHOLE path, not just the relay's 101.
+      const offered = String(message.headers?.['sec-websocket-protocol'] ?? '').split(',').map((p: string) => p.trim()).filter(Boolean);
+      const local = offered.length > 0
+        ? new WebSocket(`ws://127.0.0.1:${app.port}${message.path}`, offered)
+        : new WebSocket(`ws://127.0.0.1:${app.port}${message.path}`);
+      local.binaryType = 'arraybuffer';
+      // The client's REAL failure path: a local socket that errors reports `ws-error` rather
+      // than leaving the browser hanging. `refuse` mode scripts that answer without dialling;
+      // this is the same frame arriving from an actual failed dial.
+      local.addEventListener('error', () => {
+        if (locals.get(String(message.connId)) !== local) return;
+        locals.delete(String(message.connId));
+        control.socket.send(JSON.stringify({ type: 'ws-error', connId: message.connId, error: 'local websocket failed' }));
+      });
+      locals.set(String(message.connId), local);
+      local.addEventListener('open', () => {
+        if (mode === 'hold') { held.push(message); return; }
+        control.socket.send(JSON.stringify({ type: 'ws-ready', connId: message.connId }));
+      });
+      local.addEventListener('message', (localEvent) => {
+        const binary = typeof localEvent.data !== 'string';
+        const bytes = binary ? Buffer.from(localEvent.data as ArrayBuffer) : Buffer.from(String(localEvent.data), 'utf8');
+        control.socket.send(JSON.stringify({ type: 'ws-message', connId: message.connId, data: bytes.toString('base64'), binary }));
+      });
+      local.addEventListener('close', (closeEvent) => {
+        control.socket.send(JSON.stringify({ type: 'ws-close', connId: message.connId, code: closeEvent.code, reason: closeEvent.reason }));
+        locals.delete(String(message.connId));
+      });
+      return;
+    }
+    if (message.type === 'ws-message') {
+      const local = locals.get(String(message.connId));
+      const bytes = Buffer.from(String(message.data), 'base64');
+      if (local?.readyState === WebSocket.OPEN) local.send(message.binary === true ? new Uint8Array(bytes) : bytes.toString('utf8'));
+      return;
+    }
+    if (message.type === 'ws-close') {
+      const local = locals.get(String(message.connId));
+      if (local) { local.close(); locals.delete(String(message.connId)); }
+    }
+  });
+  return {
+    relay, control, app, frames, held, locals,
+    /** Release a held `ws-ready` — the "the local socket finally came up" moment. */
+    release() { for (const message of held.splice(0)) control.socket.send(JSON.stringify({ type: 'ws-ready', connId: message.connId })); },
+    /**
+     * Open a BROWSER socket through the tunnel and return it with the `connId` the relay
+     * announced for it.
+     *
+     * It waits for the `ws-upgrade` FRAME, not just for the browser handshake: the browser's
+     * `open` fires before the relay's own socket-open handler has sent the frame, so reading
+     * `frames` straight after the handshake is a race that reports "no upgrade" on a bridge that
+     * is about to work.
+     */
+    async visitor(path: string, protocols: string[] = []): Promise<{ socket: WebSocket; upgrade: Record<string, any> }> {
+      const before = frames.filter((frame) => frame.type === 'ws-upgrade').length;
+      const socket = protocols.length > 0
+        ? new WebSocket(`${control.url.replace(/^http/, 'ws')}${path}`, protocols)
+        : new WebSocket(`${control.url.replace(/^http/, 'ws')}${path}`);
+      socket.binaryType = 'arraybuffer';
+      await new Promise<void>((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error('visitor websocket did not open')), 3_000);
+        socket.addEventListener('open', () => { clearTimeout(timer); resolve(); }, { once: true });
+        socket.addEventListener('error', () => { clearTimeout(timer); reject(new Error('visitor websocket failed')); }, { once: true });
+      });
+      const deadline = Date.now() + 3_000;
+      let upgrades = frames.filter((frame) => frame.type === 'ws-upgrade');
+      while (upgrades.length <= before) {
+        if (Date.now() > deadline) throw new Error('the relay never sent ws-upgrade for the visitor socket');
+        await new Promise((resolve) => setTimeout(resolve, 5));
+        upgrades = frames.filter((frame) => frame.type === 'ws-upgrade');
+      }
+      return { socket, upgrade: upgrades[upgrades.length - 1]! };
+    },
+    stop() {
+      for (const local of locals.values()) local.close();
+      control.socket.close();
+      relay.stop();
+      app.stop(true);
+    },
+  };
+}
+
+/**
+ * READ THE 101 ITSELF — the raw bytes of a WebSocket handshake response.
+ *
+ * §9 caught the subprotocol assertion being a fixture artifact: Bun's WebSocket CLIENT does not
+ * enforce RFC 6455 §4.1 for a single-element offer, so `socket.protocol` reports what the client
+ * REQUESTED and stays green whether or not the relay echoed anything. Response headers are
+ * likewise invisible to that client, so `Set-Cookie` on an upgrade cannot be seen through it at
+ * all. A raw TCP handshake reads what the relay actually WROTE, which is the only thing either
+ * claim is about.
+ */
+async function readUpgradeHandshake(url: string, headers: Record<string, string> = {}): Promise<{ status: number; headers: Record<string, string> }> {
+  const target = new URL(url.replace(/^ws/, 'http'));
+  const lines = [
+    `GET ${target.pathname}${target.search} HTTP/1.1`,
+    `Host: ${target.host}`,
+    'Upgrade: websocket',
+    'Connection: Upgrade',
+    // A fixed key: `Sec-WebSocket-Accept` is not what is under test, and a fixed one keeps the
+    // handshake a pure function of the request.
+    'Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==',
+    'Sec-WebSocket-Version: 13',
+    ...Object.entries(headers).map(([key, value]) => `${key}: ${value}`),
+  ];
+  return new Promise((resolve, reject) => {
+    let buffer = '';
+    let settled = false;
+    const timer = setTimeout(() => { if (!settled) { settled = true; reject(new Error('handshake timed out')); } }, 3_000);
+    const finish = (fn: () => void) => { if (settled) return; settled = true; clearTimeout(timer); fn(); };
+    void Bun.connect({
+      hostname: target.hostname,
+      port: Number(target.port),
+      socket: {
+        open(socket) { socket.write(`${lines.join('\r\n')}\r\n\r\n`); },
+        data(socket, chunk) {
+          buffer += Buffer.from(chunk).toString('latin1');
+          const end = buffer.indexOf('\r\n\r\n');
+          if (end === -1) return;
+          finish(() => {
+            const [statusLine, ...rest] = buffer.slice(0, end).split('\r\n');
+            const parsed: Record<string, string> = {};
+            for (const line of rest) {
+              const colon = line.indexOf(':');
+              if (colon > 0) parsed[line.slice(0, colon).trim().toLowerCase()] = line.slice(colon + 1).trim();
+            }
+            socket.end();
+            resolve({ status: Number(statusLine?.split(' ')[1] ?? 0), headers: parsed });
+          });
+        },
+        error(_socket, error) { finish(() => reject(error)); },
+        close() { finish(() => reject(new Error('handshake socket closed before a response head'))); },
+      },
+    }).catch((error: unknown) => finish(() => reject(error as Error)));
+  });
+}
+
+/** The next frame a visitor socket receives, or `undefined` if it closes first. */
+function nextVisitorFrame(socket: WebSocket, timeoutMs = 3_000): Promise<{ data: string | ArrayBuffer } | { closed: { code: number; reason: string } }> {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => { cleanup(); reject(new Error('timed out waiting for a visitor frame')); }, timeoutMs);
+    const onMessage = (event: MessageEvent) => { cleanup(); resolve({ data: event.data as string | ArrayBuffer }); };
+    const onClose = (event: CloseEvent) => { cleanup(); resolve({ closed: { code: event.code, reason: event.reason } }); };
+    const cleanup = () => { clearTimeout(timer); socket.removeEventListener('message', onMessage); socket.removeEventListener('close', onClose); };
+    socket.addEventListener('message', onMessage);
+    socket.addEventListener('close', onClose);
+  });
+}
+
+async function protocolRoundtrip(root: string, options: { basicAuth?: { user: string; pass: string }; sendBasicAuth?: boolean; request?: RequestInit; path?: string } = {}) {
+  const app = Bun.serve({ hostname: '127.0.0.1', port: 0, async fetch(req) {
+    const body = await req.text();
+    return new Response(JSON.stringify({ method: req.method, path: new URL(req.url).pathname + new URL(req.url).search, body, marker: 'genuine-origin' }), {
+      status: 201, headers: { 'content-type': 'application/json', 'x-origin': 'loopback' },
+    });
+  } });
+  const relay = createTunnelTwinServer({ root });
+  const socket = new WebSocket(relay.url.replace(/^http/, 'ws') + '/ws');
+  try {
+    const handle = await new Promise<{ tunnelId: string; url: string }>((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error('relay registration timed out')), 5_000);
+      socket.addEventListener('open', () => socket.send(JSON.stringify({
+        type: 'register', tunnelId: 'protocol-proof', secret: 'vt_fake_local', authRequired: false,
+        ...(options.basicAuth ? { basicAuth: options.basicAuth } : {}),
+      })));
+      socket.addEventListener('message', (event) => {
+        const message = JSON.parse(String(event.data)) as Record<string, unknown>;
+        if (message.type === 'registered') { clearTimeout(timer); resolve({ tunnelId: String(message.tunnelId), url: String(message.url) }); }
+        if (message.type === 'error') { clearTimeout(timer); reject(new Error(String(message.message))); }
+      });
+      socket.addEventListener('error', () => { clearTimeout(timer); reject(new Error('relay socket failed')); });
+    });
+    socket.addEventListener('message', async (event) => {
+      const message = JSON.parse(String(event.data)) as Record<string, any>;
+      if (message.type !== 'request') return;
+      const originResponse = await fetch(`http://127.0.0.1:${app.port}${message.path}`, {
+        method: message.method,
+        headers: message.headers,
+        ...(message.body ? { body: Buffer.from(message.body, 'base64') } : {}),
+      });
+      const responseHeaders: Record<string, string> = {};
+      originResponse.headers.forEach((value, key) => { responseHeaders[key] = value; });
+      socket.send(JSON.stringify({
+        type: 'response', reqId: message.reqId, status: originResponse.status,
+        headers: responseHeaders, body: Buffer.from(await originResponse.arrayBuffer()).toString('base64'),
+      }));
+    });
+    const headers = new Headers(options.request?.headers);
+    if (options.basicAuth && options.sendBasicAuth !== false) headers.set('authorization', `Basic ${Buffer.from(`${options.basicAuth.user}:${options.basicAuth.pass}`).toString('base64')}`);
+    const response = await fetch(`${handle.url}${options.path ?? '/hello?x=1'}`, { ...options.request, headers });
+    const responseBody = await response.text();
+    let body: Record<string, unknown> = {};
+    try { body = JSON.parse(responseBody) as Record<string, unknown>; } catch { body = { text: responseBody }; }
+    return { response, body, handle };
+  } finally {
+    socket.close(); relay.stop(); app.stop(true);
+  }
+}
+
+async function jwtCookieProof(root: string): Promise<boolean> {
+  const relay = createTunnelTwinServer({ root });
+  const control = await openControl(relay.url, 'cookie-proof');
+  try {
+    const token = relay.mintToken('cookie-proof');
+    const wrongBootstrap = await fetch(relay.authUrl('cookie-proof', relay.mintToken('different-tunnel')));
+    if (wrongBootstrap.status !== 401 || wrongBootstrap.headers.get('set-cookie') !== null) return false;
+    const bootstrap = await fetch(relay.authUrl('cookie-proof', token));
+    const cookie = bootstrap.headers.get('set-cookie')?.split(';')[0];
+    if (bootstrap.status !== 200 || !cookie) return false;
+    const requestFrame = nextSocketMessage(control.socket, 'request');
+    const responsePromise = fetch(`${control.url}/cookie`, { headers: { cookie } });
+    const request = await requestFrame;
+    control.socket.send(JSON.stringify({ type: 'response', reqId: request.reqId, status: 200, headers: {}, body: btoa('cookie-ok') }));
+    const response = await responsePromise;
+    const wrongToken = relay.mintToken('different-tunnel');
+    const wrong = await fetch(`${control.url}/cookie`, { headers: { authorization: `Bearer ${wrongToken}` } });
+    return response.status === 200 && await response.text() === 'cookie-ok'
+      && !String(request.headers.cookie ?? '').includes('__volter_auth') && wrong.status === 401;
+  } finally { control.socket.close(); relay.stop(); }
+}
+
+export const TUNNEL_CAPABILITIES: CapabilitySpec[] = [
+  // Cloudflare Quick Tunnels — control plane from the official cloudflared source + docs.
+  done('tunnel.cloudflare.quick.create', 'cloudflare_quick', 'POST /tunnel allocates a successful quick tunnel', 'api', 'core', () => withRoot(async (root) => {
+    const r = await quick(root); const b = r.body as any;
+    return r.status === 200 && b.success === true && b.errors.length === 0 && UUID_PATTERN.test(b.result.id);
+  })),
+  done('tunnel.cloudflare.quick.response_shape', 'cloudflare_quick', 'Allocation returns id/name/hostname/account_tag/secret in cloudflared\'s first-party response shape', 'api', 'core', () => withRoot(async (root) => {
+    const b = (await quick(root)).body as any;
+    return JSON.stringify(Object.keys(b).sort()) === JSON.stringify(['errors', 'result', 'success'])
+      && JSON.stringify(Object.keys(b.result).sort()) === JSON.stringify(['account_tag', 'hostname', 'id', 'name', 'secret'])
+      && UUID_PATTERN.test(b.result.id)
+      && typeof b.result.name === 'string' && b.result.name.length > 0
+      && typeof b.result.hostname === 'string' && /^[^.]+\.trycloudflare\.com$/.test(b.result.hostname)
+      && typeof b.result.account_tag === 'string' && b.result.account_tag.length > 0
+      && typeof b.result.secret === 'string' && b.result.secret.length > 0
+      && Buffer.from(b.result.secret, 'base64').toString('base64') === b.result.secret;
+  })),
+  done('tunnel.cloudflare.quick.no_account', 'cloudflare_quick', 'Quick allocation requires no Cloudflare account token', 'api', 'core', () => withRoot(async (root) => {
+    const r = await handleTunnelTwinRequest({ method: 'POST', path: '/tunnel', headers: {}, root, occurredAt: AT });
+    return r.status === 200 && (r.body as any).success === true;
+  })),
+  done('tunnel.cloudflare.quick.unique_allocations', 'cloudflare_quick', 'Two allocations receive different ids, hostnames, and secrets', 'api', 'common', () => withRoot(async (root) => {
+    const a = (await quick(root)).body as any; const b = (await quick(root)).body as any;
+    return a.result.id !== b.result.id && a.result.hostname !== b.result.hostname && a.result.secret !== b.result.secret;
+  })),
+  done('tunnel.cloudflare.quick.persisted', 'cloudflare_quick', 'Allocation is folded into the kernel as an ephemeral quick_tunnel resource', 'api', 'common', () => withRoot(async (root) => {
+    const r = await quick(root); const id = (r.body as any).result.id;
+    return projectResources('tunnel', root).some((x) => x.id === `quick:${id}` && x.type === 'quick_tunnel' && x.ephemeral === true);
+  })),
+  done('tunnel.cloudflare.quick.readonly_refusal', 'cloudflare_quick', 'Twin-only read-only mode refuses allocation without claiming a Cloudflare error code', 'api', 'niche', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root, readOnly: true });
+    try {
+      const response = await fetch(`${relay.url}/tunnel`, { method: 'POST' });
+      const body = await response.json() as any;
+      return response.status === 405 && response.headers.get('content-type')?.startsWith('application/json') === true
+        && body.success === false && body.errors.length === 1
+        && JSON.stringify(Object.keys(body.errors[0]).sort()) === JSON.stringify(['message'])
+        && body.errors[0].message === 'tunnel twin is read-only' && body.errors[0].code === undefined
+        && listActions('tunnel', root).length === 0;
+    } finally { relay.stop(); }
+  })),
+  done('tunnel.cloudflare.quick.unknown_route', 'cloudflare_quick', 'An unmodeled Cloudflare route fails locally instead of fabricating success', 'api', 'common', () => withRoot(async (root) => (await quick(root, { method: 'GET', path: '/accounts' })).status === 404)),
+  done('tunnel.cloudflare.quick.adapter_route_boundary', 'cloudflare_quick', 'Reserved management paths still refuse after origin registration while ordinary app paths forward', 'api', 'core', () => withRoot(async (root) => {
+    const hits: string[] = [];
+    const origin = Bun.serve({ hostname: '127.0.0.1', port: 0, fetch: (request) => {
+      hits.push(new URL(request.url).pathname);
+      return new Response('app-route');
+    } });
+    const relay = createTunnelTwinServer({ root });
+    try {
+      const allocated = await fetch(`${relay.url}/tunnel`, { method: 'POST' }).then((r) => r.json()) as any;
+      relay.registerQuickOrigin(allocated.result.id, `http://127.0.0.1:${origin.port}`);
+      const reservedPaths = [
+        '/', '/docs', '/__volter_inspect', '/__volter_replay',
+        '/accounts', '/client/v4/accounts', '/me', '/admin/accounts', '/signup/github', '/report', '/waitlist',
+        '/api/status/unmodeled', '/%2Faccounts', '/%252Fadmin/accounts', '//signup/github',
+        '/%25252525252525252Faccounts',
+      ];
+      if (!tunnelControlPathIsReserved(`/${'x'.repeat(8_193)}`)
+        || !tunnelControlPathIsReserved('/%ZZ/accounts')
+        || tunnelControlPathIsReserved('/product/%252Ffloor')) return false;
+      const reserved = await Promise.all(reservedPaths.map(async (path) => {
+        const response = await fetch(`${relay.url}${path}`);
+        return response.status === 404 && (await response.json() as any).error === 'not found';
+      }));
+      const app = await fetch(`${relay.url}/product/floor`);
+      const appApi = await fetch(`${relay.url}/api/application`);
+      const encodedApp = await fetch(`${relay.url}/product/%252Ffloor`);
+      return reserved.every(Boolean) && app.status === 200 && await app.text() === 'app-route'
+        && appApi.status === 200 && await appApi.text() === 'app-route'
+        && encodedApp.status === 200 && await encodedApp.text() === 'app-route'
+        && JSON.stringify(hits) === JSON.stringify(['/product/floor', '/api/application', '/product/%252Ffloor']);
+    } finally { relay.stop(); origin.stop(true); }
+  })),
+  done('tunnel.cloudflare.quick.local_http_path', 'cloudflare_quick', 'Local quick adapter forwards bytes over a genuine loopback HTTP path', 'api', 'core', () => withRoot(async (root) => {
+    const origin = Bun.serve({ hostname: '127.0.0.1', port: 0, fetch: () => new Response('real-loopback-body', { headers: { 'x-origin': 'yes' } }) });
+    const relay = createTunnelTwinServer({ root });
+    try {
+      const allocated = await fetch(`${relay.url}/tunnel`, { method: 'POST' }).then((r) => r.json()) as any;
+      relay.registerQuickOrigin(allocated.result.id, `http://127.0.0.1:${origin.port}`);
+      const response = await fetch(`${relay.quickUrl(allocated.result.id)}/health`);
+      return response.headers.get('x-origin') === 'yes' && await response.text() === 'real-loopback-body';
+    } finally { relay.stop(); origin.stop(true); }
+  })),
+  done('tunnel.cloudflare.quick.origin_boundary', 'cloudflare_quick', 'Quick-origin registration accepts allocated credential-free IPv4/IPv6 loopback http(s) URLs and forwarded paths cannot replace that origin', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root });
+    const registeredHits: Array<{ path: string; search: string }> = [];
+    const decoyHits: Array<{ path: string; search: string }> = [];
+    const registeredOrigin = Bun.serve({ hostname: '127.0.0.1', port: 0, fetch: (request) => {
+      const url = new URL(request.url);
+      registeredHits.push({ path: url.pathname, search: url.search });
+      return new Response('registered-origin');
+    } });
+    const decoyOrigin = Bun.serve({ hostname: '127.0.0.1', port: 0, fetch: (request) => {
+      const url = new URL(request.url);
+      decoyHits.push({ path: url.pathname, search: url.search });
+      return new Response('decoy-origin');
+    } });
+    try {
+      const allocated = await fetch(`${relay.url}/tunnel`, { method: 'POST' }).then((r) => r.json()) as any;
+      let remote = false; let scheme = false; let unknown = false; let credentialed = false;
+      let decorated = false; let backslash = false; let strictRaw = true;
+      try { relay.registerQuickOrigin(allocated.result.id, 'https://example.com'); } catch { remote = true; }
+      try { relay.registerQuickOrigin(allocated.result.id, 'file:///tmp/secret'); } catch { scheme = true; }
+      try { relay.registerQuickOrigin('not-allocated', 'http://127.0.0.1:3000'); } catch { unknown = true; }
+      try { relay.registerQuickOrigin(allocated.result.id, 'http://user:pass@127.0.0.1:3000'); } catch { credentialed = true; }
+      try { relay.registerQuickOrigin(allocated.result.id, 'http://127.0.0.1:3000/base?secret=1#fragment'); } catch { decorated = true; }
+      try { relay.registerQuickOrigin(allocated.result.id, 'http:\\\\127.0.0.1:3000'); } catch { backslash = true; }
+      for (const invalid of [
+        'http://127.0.0.1:3000/%2e%2e',
+        'http://127.1:3000',
+        'http://2130706433:3000',
+        'http://0x7f000001:3000',
+        'http://0177.0.0.1:3000',
+        'http://127.000.000.001:3000',
+        'http://%31%32%37.0.0.1:3000',
+        'http://127%2e0%2e0%2e1:3000',
+        'http://127.0.0.1.:3000',
+        'http://127.0.0.1:03000',
+        'http://[::ffff:127.0.0.1]:3000',
+      ]) {
+        try { relay.registerQuickOrigin(allocated.result.id, invalid); strictRaw = false; } catch { /* expected */ }
+      }
+      relay.registerQuickOrigin(allocated.result.id, 'http://localhost:3000');
+      relay.registerQuickOrigin(allocated.result.id, 'https://localhost:3000');
+      relay.registerQuickOrigin(allocated.result.id, 'http://127.255.255.254:3000');
+      relay.registerQuickOrigin(allocated.result.id, 'http://[::1]:3000');
+      relay.registerQuickOrigin(allocated.result.id, 'http://[0:0:0:0:0:0:0:1]:3000');
+      relay.registerQuickOrigin(allocated.result.id, `http://127.0.0.1:${registeredOrigin.port}`);
+      const explicit = await fetch(`${relay.quickUrl(allocated.result.id)}//127.0.0.1:${decoyOrigin.port}/explicit?next=https%3A%2F%2Fdecoy.example`);
+      const explicitEncoded = await fetch(`${relay.quickUrl(allocated.result.id)}/%2F%2F127.0.0.1:${decoyOrigin.port}/encoded?q=%2F%2Fevil.example`);
+      const fallback = await fetch(`${relay.url}//127.0.0.1:${decoyOrigin.port}/fallback?next=https%3A%2F%2Fdecoy.example`);
+      const fallbackEncoded = await fetch(`${relay.url}/%2F%2F127.0.0.1:${decoyOrigin.port}/encoded?q=%2F%2Fevil.example`);
+      return remote && scheme && unknown && credentialed && decorated && backslash && strictRaw
+        && (await Promise.all([explicit, explicitEncoded, fallback, fallbackEncoded].map(async (response) => response.status === 200 && await response.text() === 'registered-origin'))).every(Boolean)
+        && JSON.stringify(registeredHits) === JSON.stringify([
+          { path: `/127.0.0.1:${decoyOrigin.port}/explicit`, search: '?next=https%3A%2F%2Fdecoy.example' },
+          { path: `/%2F%2F127.0.0.1:${decoyOrigin.port}/encoded`, search: '?q=%2F%2Fevil.example' },
+          { path: `/127.0.0.1:${decoyOrigin.port}/fallback`, search: '?next=https%3A%2F%2Fdecoy.example' },
+          { path: `/%2F%2F127.0.0.1:${decoyOrigin.port}/encoded`, search: '?q=%2F%2Fevil.example' },
+        ])
+        && decoyHits.length === 0;
+    } finally { relay.stop(); registeredOrigin.stop(true); decoyOrigin.stop(true); }
+  })),
+  done('tunnel.conformance.control_probe', 'volter_management', 'Offline conformance drives each claimed control route and relay registration through live seams', 'api', 'core', async () => {
+    const report = await checkTunnelConformance();
+    return report.ok && report.probes === 4 && report.violations.length === 0;
+  }),
+  done('tunnel.errors.json_containment', 'volter_management', 'HTTP, storage, and origin failures stay in stable JSON envelopes without runtime stack pages', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root: '/dev/null/tunnel-impossible' });
+    try {
+      const storage = await fetch(`${relay.url}/tunnel`, { method: 'POST' });
+      const disconnected = await fetch(`${relay.url}/__twin/tunnels/missing/path`);
+      const storageBody = await storage.json() as Record<string, unknown>;
+      const disconnectedBody = await disconnected.json() as Record<string, unknown>;
+      if (storage.status !== 500 || storageBody.error !== 'Tunnel twin request failed'
+        || disconnected.status !== 502 || disconnectedBody.error !== 'Tunnel not connected') return false;
+    } finally { relay.stop(); }
+    const stoppedOrigin = Bun.serve({ hostname: '127.0.0.1', port: 0, fetch: () => new Response('never') });
+    const stoppedPort = stoppedOrigin.port;
+    stoppedOrigin.stop(true);
+    const originRelay = createTunnelTwinServer({ root });
+    try {
+      const allocated = await fetch(`${originRelay.url}/tunnel`, { method: 'POST' }).then((response) => response.json()) as any;
+      originRelay.registerQuickOrigin(allocated.result.id, `http://127.0.0.1:${stoppedPort}`);
+      const explicitUnavailable = await fetch(`${originRelay.quickUrl(allocated.result.id)}/health`);
+      const fallbackUnavailable = await fetch(`${originRelay.url}/health`);
+      return explicitUnavailable.status === 502 && (await explicitUnavailable.json() as any).error === 'Quick tunnel origin unavailable'
+        && fallbackUnavailable.status === 502 && (await fallbackUnavailable.json() as any).error === 'Quick tunnel origin unavailable';
+    } finally { originRelay.stop(); }
+  })),
+  todo('tunnel.cloudflare.quick.concurrent_200_limit', 'cloudflare_quick', 'Enforce Cloudflare Quick Tunnels\' documented 200 concurrent in-flight request cap with 429', 'api', 'common'),
+  todo('tunnel.cloudflare.quick.no_sse', 'cloudflare_quick', 'Reject Server-Sent Events like the documented Quick Tunnel limitation', 'api', 'niche'),
+  todo('tunnel.cloudflare.managed.named_tunnel', 'cloudflare_managed', 'Named tunnel creation and credentials', 'api', 'common'),
+  todo('tunnel.cloudflare.managed.ingress_rules', 'cloudflare_managed', 'Managed ingress configuration and hostname routing', 'api', 'common'),
+  todo('tunnel.cloudflare.managed.account_auth', 'cloudflare_managed', 'Account-scoped API token authentication', 'api', 'common'),
+  todo('tunnel.cloudflare.managed.replicas', 'cloudflare_managed', 'Multiple cloudflared replicas for one named tunnel', 'api', 'niche'),
+
+  // Owned Volter relay protocol.
+  done('tunnel.volter.control.register', 'volter_control', 'Relay register receives registered with the requested id and a reachable URL', 'api', 'core', () => withRoot(async (root) => {
+    const x = await protocolRoundtrip(root); return x.handle.tunnelId === 'protocol-proof' && x.handle.url.includes('/__twin/tunnels/protocol-proof');
+  })),
+  done('tunnel.volter.http.forward_get', 'volter_http', 'Relay frames forward GET path/query to a real local HTTP server', 'api', 'core', () => withRoot(async (root) => {
+    const x = await protocolRoundtrip(root); return x.response.status === 201 && x.body.path === '/hello?x=1' && x.body.marker === 'genuine-origin';
+  })),
+  done('tunnel.volter.http.forward_post_body', 'volter_http', 'POST method and body survive relay framing', 'api', 'core', () => withRoot(async (root) => {
+    const x = await protocolRoundtrip(root, { path: '/submit', request: { method: 'POST', body: 'payload-123' } });
+    return x.body.method === 'POST' && x.body.path === '/submit' && x.body.body === 'payload-123';
+  })),
+  done('tunnel.volter.http.response_status_headers', 'volter_http', 'Origin response status and headers survive relay framing', 'api', 'core', () => withRoot(async (root) => {
+    const x = await protocolRoundtrip(root); return x.response.status === 201 && x.response.headers.get('x-origin') === 'loopback';
+  })),
+  done('tunnel.volter.http.owned_header_rules', 'volter_http', 'Owned relay header rules strip framing headers, replace downstream CORS, and default dynamic traffic to no-store', 'api', 'common', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root }); const control = await openControl(relay.url, 'headers-proof', { authRequired: false });
+    try {
+      const roundtrip = async (path: string, headers: Record<string, string>) => {
+        const frame = nextSocketMessage(control.socket, 'request');
+        const pending = fetch(`${control.url}${path}`, { headers: { origin: 'https://caller.example' } });
+        const req = await frame;
+        control.socket.send(JSON.stringify({ type: 'response', reqId: req.reqId, status: 203, headers, body: '' }));
+        return pending;
+      };
+      const dynamic = await roundtrip('/headers', {
+        'x-frame-options': 'DENY',
+        'content-security-policy': "default-src 'self'; frame-ancestors 'none'",
+        'access-control-allow-origin': 'https://wrong.example',
+      });
+      if (dynamic.status !== 203 || dynamic.headers.get('x-frame-options') !== null
+        || String(dynamic.headers.get('content-security-policy')).includes('frame-ancestors')
+        || dynamic.headers.get('access-control-allow-origin') !== 'https://caller.example') return false;
+
+      const privateCases: Response[] = [];
+      for (const [path, headers] of [
+        ['/asset-conflict', { 'cache-control': 'public, private', vary: 'Accept-Encoding' }],
+        ['/asset-no-store', { 'cache-control': 'public, no-store' }],
+        ['/asset-no-cache', { 'cache-control': 'public, no-cache' }],
+        // The owned relay never caches API paths even when downstream says public.
+        ['/api/private', { 'cache-control': 'public, max-age=3600' }],
+      ] as Array<[string, Record<string, string>]>) privateCases.push(await roundtrip(path, headers));
+      for (const response of [dynamic, ...privateCases]) {
+        const vary = (response.headers.get('vary') ?? '').toLowerCase().split(',').map((value) => value.trim());
+        if (response.headers.get('cache-control') !== 'private, no-store, max-age=0'
+          || response.headers.get('cloudflare-cdn-cache-control') !== 'no-store'
+          || response.headers.get('cdn-cache-control') !== 'no-store'
+          || !vary.includes('cookie') || !vary.includes('authorization')) return false;
+      }
+      if (!(privateCases[0]!.headers.get('vary') ?? '').toLowerCase().includes('accept-encoding')) return false;
+
+      const publicAsset = await roundtrip('/asset-public', { 'cache-control': 'public, max-age=3600' });
+      return publicAsset.headers.get('cache-control') === 'public, max-age=3600'
+        && publicAsset.headers.get('cloudflare-cdn-cache-control') === null
+        && publicAsset.headers.get('cdn-cache-control') === null;
+    } finally { control.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.http.basic_auth', 'volter_auth', 'Non-empty Basic auth gates ingress while owned empty-value configs remain unconfigured', 'api', 'common', () => withRoot(async (root) => {
+    const basicAuth = { user: 'human', pass: 'remember-me' };
+    const denied = await protocolRoundtrip(root, { basicAuth, sendBasicAuth: false });
+    const allowed = await protocolRoundtrip(root, { basicAuth });
+    if (denied.response.status !== 401 || denied.response.headers.get('www-authenticate')?.includes('Basic') !== true
+      || allowed.response.status !== 201 || allowed.body.marker !== 'genuine-origin') return false;
+    for (const empty of [{ user: 'human', pass: '' }, { user: '', pass: 'secret' }, { user: '', pass: '' }]) {
+      const prepared = prepareTunnelRelayRegistration({
+        message: { type: 'register', tunnelId: 'empty-basic', secret: 'x', authRequired: false, basicAuth: empty },
+        session: {}, publicBaseUrl: 'http://127.0.0.1:1',
+      });
+      if (!('persistence' in prepared) || prepared.session.basicAuth !== undefined
+        || prepared.persistence.fields.basic_auth_configured !== false
+        || prepared.persistence.fields.basic_auth_sha256 !== null) return false;
+      const ungated = await protocolRoundtrip(root, { basicAuth: empty, sendBasicAuth: false, path: '/empty-basic' });
+      if (ungated.response.status !== 201 || ungated.body.marker !== 'genuine-origin') return false;
+    }
+    return true;
+  })),
+  done('tunnel.volter.control.missing_secret', 'volter_auth', 'Missing credentials and malformed Basic-auth registration frames are rejected fatally without changing session state', 'api', 'core', async () => {
+    const session = (): RelaySession => ({
+      tunnelId: 'healthy-owner', authRequired: true,
+      basicAuth: { user: 'sentinel', pass: 'untouched' }, registered: true,
+    });
+    const original = session();
+    const originalJson = JSON.stringify(original);
+    const missing = await handleTunnelRelayMessage({ message: { type: 'register', tunnelId: 'x', authRequired: false }, session: original, publicBaseUrl: 'http://127.0.0.1:1' });
+    if (missing.outbound?.type !== 'error' || missing.outbound.fatal !== true || !String(missing.outbound.message).includes('credential')
+      || missing.session !== original || JSON.stringify(original) !== originalJson) return false;
+    for (const basicAuth of [null, 'user:pass', {}, { user: 'only' }, { pass: 'only' }, { user: 7, pass: 'x' }]) {
+      const existing = session();
+      const before = JSON.stringify(existing);
+      const invalid = await handleTunnelRelayMessage({ message: { type: 'register', tunnelId: 'x', secret: 'credential', basicAuth }, session: existing, publicBaseUrl: 'http://127.0.0.1:1' });
+      if (invalid.outbound?.type !== 'error' || invalid.outbound.fatal !== true || !String(invalid.outbound.message).includes('basic-auth')
+        || invalid.session !== existing || JSON.stringify(existing) !== before) return false;
+    }
+    return true;
+  }),
+  done('tunnel.volter.control.readonly_refusal', 'volter_control', 'Read-only mode refuses relay registration without persisting or creating a live owner', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root, readOnly: true });
+    const socket = new WebSocket(`${relay.url.replace(/^http/, 'ws')}/ws`);
+    try {
+      await new Promise<void>((resolve, reject) => {
+        socket.addEventListener('open', () => resolve(), { once: true });
+        socket.addEventListener('error', () => reject(new Error('read-only socket failed')), { once: true });
+      });
+      const outcome = nextSocketOutcome(socket, ['registered', 'error']);
+      socket.send(JSON.stringify({ type: 'register', tunnelId: 'read-only', secret: 'x', authRequired: false }));
+      const result = await outcome;
+      const status = await fetch(`${relay.url}/api/status`).then((response) => response.json()) as any;
+      return result.type === 'error' && result.fatal === true && String(result.message).includes('read-only')
+        && status.tunnels === 0 && listActions('tunnel', root).length === 0
+        && !projectResources('tunnel', root).some((resource) => resource.id === 'relay:read-only');
+    } finally { socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.control.invalid_id', 'volter_control', 'Invalid tunnel ids are rejected instead of routed ambiguously', 'api', 'common', async () => {
+    const r = await handleTunnelRelayMessage({ message: { type: 'register', tunnelId: '../bad', secret: 'x', authRequired: false }, session: {}, publicBaseUrl: 'http://127.0.0.1:1' });
+    return r.outbound?.type === 'error' && r.outbound.fatal === true && String(r.outbound.message).includes('Invalid');
+  }),
+  done('tunnel.volter.control.persisted_registration', 'volter_control', 'Registration folds a relay_tunnel resource into the kernel', 'api', 'common', () => withRoot(async (root) => {
+    await handleTunnelRelayMessage({ message: { type: 'register', tunnelId: 'persisted', secret: 'x', authRequired: false }, session: {}, publicBaseUrl: 'http://127.0.0.1:1', root, occurredAt: AT });
+    return projectResources('tunnel', root).some((x) => x.id === 'relay:persisted' && x.type === 'relay_tunnel' && x.connected === true);
+  })),
+  done('tunnel.volter.control.basic_auth_log_secrecy', 'volter_auth', 'Basic-auth plaintext stays session-only; the append-only log stores only a hash and configured bit', 'api', 'core', () => withRoot(async (root) => {
+    await handleTunnelRelayMessage({
+      message: { type: 'register', tunnelId: 'secret-log', secret: 'x', basicAuth: { user: 'operator', pass: 'never-persist-this' } },
+      session: {}, publicBaseUrl: 'http://127.0.0.1:1', root, occurredAt: AT,
+    });
+    const serialized = JSON.stringify(listActions('tunnel', root));
+    const resource = projectResources('tunnel', root).find((x) => x.id === 'relay:secret-log');
+    const basicAuthKeys = Object.keys(resource ?? {}).filter((key) => key.startsWith('basic_auth_')).sort();
+    const expectedHash = createHash('sha256').update('operator:never-persist-this').digest('hex');
+    return !serialized.includes('never-persist-this') && !serialized.includes('operator')
+      && JSON.stringify(basicAuthKeys) === JSON.stringify(['basic_auth_configured', 'basic_auth_sha256'])
+      && resource?.basic_auth_configured === true && resource.basic_auth_sha256 === expectedHash;
+  })),
+  done('tunnel.volter.status.health', 'volter_management', 'GET /api/status reports the twin-local live socket count independently from persisted historical connection state', 'api', 'core', () => withRoot(async (root) => {
+    await handleTunnelRelayMessage({ message: { type: 'register', tunnelId: 'historical-only', secret: 'x', authRequired: false }, session: {}, publicBaseUrl: 'http://127.0.0.1:1', root, occurredAt: AT });
+    const persisted = projectResources('tunnel', root).find((resource) => resource.id === 'relay:historical-only');
+    const relay = createTunnelTwinServer({ root });
+    try {
+      const r = await fetch(`${relay.url}/api/status`);
+      const body = await r.json() as any;
+      return persisted?.connected === true && r.status === 200 && body.ok === true && body.relay === 'twin-local' && body.tunnels === 0;
+    } finally { relay.stop(); }
+  })),
+  done('tunnel.volter.control.response_ownership', 'volter_control', 'Unguessable request correlations are socket-owned and an unregistered socket cannot spoof a response', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root });
+    let owner: Awaited<ReturnType<typeof openControl>> | undefined;
+    let rogue: WebSocket | undefined;
+    try {
+      owner = await openControl(relay.url, 'owned-response', { authRequired: false });
+      const rogueSocket = new WebSocket(`${relay.url.replace(/^http/, 'ws')}/ws`);
+      rogue = rogueSocket;
+      await new Promise<void>((resolve) => rogueSocket.addEventListener('open', () => resolve(), { once: true }));
+      const requestFrame = nextSocketMessage(owner.socket, 'request');
+      const responsePromise = fetch(`${owner.url}/ownership`);
+      const request = await requestFrame;
+      const rogueError = nextSocketMessage(rogueSocket, 'error');
+      rogueSocket.send(JSON.stringify({ type: 'response', reqId: request.reqId, status: 299, headers: {}, body: btoa('rogue') }));
+      if (!(await rogueError).message.includes('not the registered')) return false;
+      const rogueRegistered = nextSocketMessage(rogueSocket, 'registered');
+      rogueSocket.send(JSON.stringify({ type: 'register', tunnelId: 'rogue-response', secret: 'vt_fake_local', authRequired: false }));
+      await rogueRegistered;
+      const correlationError = nextSocketMessage(rogueSocket, 'error');
+      rogueSocket.send(JSON.stringify({ type: 'response', reqId: request.reqId, status: 299, headers: {}, body: btoa('rogue') }));
+      if (!(await correlationError).message.includes('not owned')) return false;
+      owner.socket.send(JSON.stringify({ type: 'response', reqId: request.reqId, status: 200, headers: {}, body: btoa('owner') }));
+      const response = await responsePromise;
+      return /^[0-9a-f-]{36}$/.test(String(request.reqId)) && response.status === 200 && await response.text() === 'owner';
+    } finally { owner?.socket.close(); rogue?.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.control.replace', 'volter_control', 'replace:true makes the prior socket inert and fails its in-flight requests before transfer', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root });
+    let old: Awaited<ReturnType<typeof openControl>> | undefined;
+    let replacement: Awaited<ReturnType<typeof openControl>> | undefined;
+    try {
+      old = await openControl(relay.url, 'replace-proof', { authRequired: false });
+      const requestFrame = nextSocketMessage(old.socket, 'request');
+      const responsePromise = fetch(`${old.url}/slow`);
+      const request = await requestFrame;
+      replacement = await openControl(relay.url, 'replace-proof', { replace: true, authRequired: false });
+      const response = await responsePromise;
+      const body = await response.json() as Record<string, unknown>;
+      old.socket.send(JSON.stringify({ type: 'response', reqId: request.reqId, status: 200, headers: {}, body: btoa('late') }));
+      const successorFrame = nextSocketMessage(replacement.socket, 'request');
+      const successorPromise = fetch(`${replacement.url}/successor`);
+      const successorRequest = await successorFrame;
+      try { old.socket.send(JSON.stringify({ type: 'response', reqId: successorRequest.reqId, status: 299, headers: {}, body: btoa('superseded') })); } catch { /* closed as required */ }
+      replacement.socket.send(JSON.stringify({ type: 'response', reqId: successorRequest.reqId, status: 200, headers: {}, body: btoa('successor') }));
+      const successor = await successorPromise;
+      return response.status === 502 && body.error === 'Tunnel replaced'
+        && successor.status === 200 && await successor.text() === 'successor'
+        && (await fetch(`${relay.url}/api/status`).then((r) => r.json()) as any).tunnels === 1;
+    } finally { old?.socket.close(); replacement?.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.control.replace_auth_before_transfer', 'volter_control', 'An invalid replace:true candidate cannot evict or disarm the valid owner', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root }); const owner = await openControl(relay.url, 'auth-before-replace', { authRequired: false });
+    const attacker = new WebSocket(`${relay.url.replace(/^http/, 'ws')}/ws`);
+    const malformed = new WebSocket(`${relay.url.replace(/^http/, 'ws')}/ws`);
+    try {
+      await Promise.all([attacker, malformed].map((socket) => new Promise<void>((resolve, reject) => {
+        socket.addEventListener('open', () => resolve(), { once: true });
+        socket.addEventListener('error', () => reject(new Error('replacement candidate failed')), { once: true });
+      })));
+      const actionsBefore = listActions('tunnel', root).length;
+      const rejected = nextSocketMessage(attacker, 'error');
+      attacker.send(JSON.stringify({ type: 'register', tunnelId: 'auth-before-replace', replace: true }));
+      if (!(await rejected).fatal) return false;
+      const malformedRejected = nextSocketMessage(malformed, 'error');
+      malformed.send(JSON.stringify({
+        type: 'register', tunnelId: 'auth-before-replace', secret: 'x', replace: true,
+        basicAuth: { user: 'missing-pass' },
+      }));
+      const malformedError = await malformedRejected;
+      if (!malformedError.fatal || !String(malformedError.message).includes('basic-auth')
+        || listActions('tunnel', root).length !== actionsBefore) return false;
+      const frame = nextSocketMessage(owner.socket, 'request');
+      const responsePromise = fetch(`${owner.url}/still-owned`);
+      const request = await frame;
+      owner.socket.send(JSON.stringify({ type: 'response', reqId: request.reqId, status: 200, headers: {}, body: btoa('owner-survived') }));
+      const response = await responsePromise;
+      return response.status === 200 && await response.text() === 'owner-survived'
+        && (await fetch(`${relay.url}/api/status`).then((r) => r.json()) as any).tunnels === 1;
+    } finally { attacker.close(); malformed.close(); owner.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.control.replace_persist_before_transfer', 'volter_control', 'A replacement persistence failure leaves the healthy owner and ingress live', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root });
+    const owner = await openControl(relay.url, 'persist-before-replace', { authRequired: false });
+    const replacement = new WebSocket(`${relay.url.replace(/^http/, 'ws')}/ws`);
+    const savedRoot = `${root}-healthy`;
+    let displacedRoot = false;
+    try {
+      await new Promise<void>((resolve, reject) => {
+        replacement.addEventListener('open', () => resolve(), { once: true });
+        replacement.addEventListener('error', () => reject(new Error('replacement socket failed')), { once: true });
+      });
+      renameSync(root, savedRoot);
+      displacedRoot = true;
+      writeFileSync(root, 'not a state directory');
+      const rejected = nextSocketMessage(replacement, 'error');
+      replacement.send(JSON.stringify({
+        type: 'register', tunnelId: 'persist-before-replace', secret: 'x', replace: true, authRequired: false,
+      }));
+      if (!(await rejected).fatal) return false;
+      const requestFrame = nextSocketMessage(owner.socket, 'request');
+      const responsePromise = fetch(`${owner.url}/still-live`);
+      const request = await requestFrame;
+      owner.socket.send(JSON.stringify({ type: 'response', reqId: request.reqId, status: 200, headers: {}, body: btoa('healthy-owner') }));
+      const response = await responsePromise;
+      const status = await fetch(`${relay.url}/api/status`).then((r) => r.json()) as any;
+      return response.status === 200 && await response.text() === 'healthy-owner' && status.tunnels === 1;
+    } finally {
+      if (displacedRoot) {
+        rmSync(root, { force: true });
+        renameSync(savedRoot, root);
+      }
+      replacement.close(); owner.socket.close(); relay.stop();
+    }
+  })),
+  done('tunnel.volter.control.replace_disconnect_durable_order', 'volter_control', 'A prior owner closing during replacement persistence cannot overwrite the sole successor\'s durable connected generation', 'api', 'core', () => withRoot(async (root) => {
+    let persistenceCalls = 0;
+    let enteredReplacement!: () => void;
+    let releaseReplacement!: () => void;
+    const entered = new Promise<void>((resolve) => { enteredReplacement = resolve; });
+    const held = new Promise<void>((resolve) => { releaseReplacement = resolve; });
+    const relay = createTunnelTwinServer({
+      root,
+      persistRegistration: async (candidate, options) => {
+        await persistTunnelRelayRegistration(candidate, options);
+        persistenceCalls += 1;
+        if (persistenceCalls === 2) {
+          enteredReplacement();
+          await held;
+        }
+      },
+    });
+    const owner = await openControl(relay.url, 'disconnect-order', { authRequired: false });
+    const first = projectResources('tunnel', root).find((resource) => resource.id === 'relay:disconnect-order');
+    const replacement = new WebSocket(`${relay.url.replace(/^http/, 'ws')}/ws`);
+    try {
+      await new Promise<void>((resolve, reject) => {
+        replacement.addEventListener('open', () => resolve(), { once: true });
+        replacement.addEventListener('error', () => reject(new Error('replacement ordering socket failed')), { once: true });
+      });
+      const registered = nextSocketOutcome(replacement, ['registered', 'error']);
+      replacement.send(JSON.stringify({
+        type: 'register', tunnelId: 'disconnect-order', secret: 'x', replace: true, authRequired: false,
+      }));
+      const persistenceEntered = await Promise.race([
+        entered.then(() => true),
+        new Promise<false>((resolve) => setTimeout(() => resolve(false), 1_000)),
+      ]);
+      if (!persistenceEntered) return false;
+      owner.socket.close();
+      for (let i = 0; i < 40; i++) {
+        if ((await fetch(`${relay.url}/api/status`).then((response) => response.json()) as any).tunnels === 0) break;
+        await new Promise((resolve) => setTimeout(resolve, 10));
+      }
+      releaseReplacement();
+      const outcome = await registered;
+      if (outcome.type !== 'registered') return false;
+
+      // Let the old close's queued generation-conditional disconnect run after the replacement
+      // turn. It must observe the successor registration id and become a no-op.
+      await new Promise((resolve) => setTimeout(resolve, 25));
+      const current = projectResources('tunnel', root).find((resource) => resource.id === 'relay:disconnect-order');
+      const status = await fetch(`${relay.url}/api/status`).then((response) => response.json()) as any;
+      const frame = nextSocketMessage(replacement, 'request');
+      const responsePromise = fetch(`${String(outcome.url)}/successor`);
+      const request = await frame;
+      replacement.send(JSON.stringify({ type: 'response', reqId: request.reqId, status: 200, headers: {}, body: btoa('successor-live') }));
+      const response = await responsePromise;
+      return persistenceCalls === 2 && first?.connected === true
+        && typeof first.registration_id === 'string'
+        && current?.connected === true && typeof current.registration_id === 'string'
+        && current.registration_id !== first.registration_id
+        && status.tunnels === 1 && response.status === 200 && await response.text() === 'successor-live';
+    } finally { releaseReplacement(); replacement.close(); owner.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.control.postappend_persist_failure_reverted', 'volter_control', 'A registration action appended before persistence reports failure is reverted by exact action id, preserving disconnected durable state and truthful audit history', 'api', 'core', () => withRoot(async (root) => {
+    await markTunnelDisconnected('postappend-failure', root, AT);
+    const relay = createTunnelTwinServer({
+      root,
+      persistRegistration: async (candidate, options) => {
+        await persistTunnelRelayRegistration(candidate, options);
+        throw new Error('injected failure after durable append');
+      },
+    });
+    const socket = new WebSocket(`${relay.url.replace(/^http/, 'ws')}/ws`);
+    try {
+      await new Promise<void>((resolve, reject) => {
+        socket.addEventListener('open', () => resolve(), { once: true });
+        socket.addEventListener('error', () => reject(new Error('post-append socket failed')), { once: true });
+      });
+      const rejected = nextSocketMessage(socket, 'error');
+      socket.send(JSON.stringify({ type: 'register', tunnelId: 'postappend-failure', secret: 'x', authRequired: false }));
+      if (!(await rejected).fatal) return false;
+      const actions = listActions('tunnel', root);
+      const registration = actions.find((action) => action.operation === 'relay.register'
+        && action.subject.id === 'relay:postappend-failure'
+        && (action.fields as Record<string, unknown> | undefined)?.registration_id);
+      const rollback = actions.find((action) => action.operation === 'relay.register.rollback'
+        && action.subject.id === 'relay:postappend-failure');
+      const resource = projectResources('tunnel', root).find((candidate) => candidate.id === 'relay:postappend-failure');
+      const status = await fetch(`${relay.url}/api/status`).then((response) => response.json()) as any;
+      return registration !== undefined && rollback?.op === 'revert'
+        && rollback.revertsActionId === registration.id
+        && resource?.connected === false && resource.registration_id === undefined
+        && status.tunnels === 0;
+    } finally { socket.close(); relay.stop(); }
+  })),
+  // ONE rule decides ownership: is the claim's own heartbeat fresh. The relay writes that
+  // heartbeat (reservation, control frames, idle keepalive); nothing here reads a process table,
+  // so the same answer holds for a claim written by another host or another shell. The four
+  // fixtures below all carry THIS host's pid — a stale local claim (its owner stopped writing,
+  // whatever became of the pid) is reclaimed exactly like a stale foreign one, and a fresh claim
+  // stays exclusive whoever wrote it.
+  done('tunnel.volter.control.stale_claim_recovery', 'volter_control', 'Relay claims live or die by bounded heartbeat freshness alone, so stale local and expired or far-future foreign reservations are reclaimed while any fresh owner stays exclusive', 'api', 'core', () => withRoot(async (root) => {
+    const claimsDir = join(worldPaths('tunnel', root).dir, 'relay-claims');
+    mkdirSync(claimsDir, { recursive: true });
+    const writeClaim = (tunnelId: string, claim: Record<string, unknown>) => writeFileSync(join(claimsDir, `${tunnelId}.json`), `${JSON.stringify({
+      tunnelId, token: `old-${tunnelId}`, serverId: 'old-server', socketId: 'old-socket', pid: process.pid,
+      hostname: hostname(), state: 'reserving', claimedAt: '2000-01-01T00:00:00.000Z', heartbeatAt: new Date().toISOString(),
+      ...claim,
+    })}\n`);
+    // Stopped writing: this host, a live pid (ours), and no heartbeat since 2000 — reclaimable.
+    writeClaim('stale-local', { heartbeatAt: '2000-01-01T00:00:00.000Z' });
+    writeClaim('expired-foreign', { hostname: 'retired-host.invalid', heartbeatAt: '2000-01-01T00:00:00.000Z' });
+    writeClaim('future-foreign', { hostname: 'bad-clock-host.invalid', heartbeatAt: '2999-01-01T00:00:00.000Z' });
+    writeClaim('fresh-foreign', { hostname: 'other-live-host.invalid' });
+    writeClaim('fresh-local', {});
+    const relay = createTunnelTwinServer({ root });
+    let stale: Awaited<ReturnType<typeof openControl>> | undefined;
+    let expired: Awaited<ReturnType<typeof openControl>> | undefined;
+    let future: Awaited<ReturnType<typeof openControl>> | undefined;
+    const contenders: WebSocket[] = [];
+    /** Register `tunnelId` on a socket that expects to be REFUSED. */
+    const refusedRegistration = async (tunnelId: string): Promise<Record<string, any>> => {
+      const socket = new WebSocket(`${relay.url.replace(/^http/, 'ws')}/ws`);
+      contenders.push(socket);
+      await new Promise<void>((resolve, reject) => {
+        socket.addEventListener('open', () => resolve(), { once: true });
+        socket.addEventListener('error', () => reject(new Error(`contender for ${tunnelId} failed`)), { once: true });
+      });
+      const refused = nextSocketMessage(socket, 'error');
+      socket.send(JSON.stringify({ type: 'register', tunnelId, secret: 'x', authRequired: false }));
+      return refused;
+    };
+    try {
+      stale = await openControl(relay.url, 'stale-local', { authRequired: false });
+      expired = await openControl(relay.url, 'expired-foreign', { authRequired: false });
+      future = await openControl(relay.url, 'future-foreign', { authRequired: false });
+      const foreignRefusal = await refusedRegistration('fresh-foreign');
+      const localRefusal = await refusedRegistration('fresh-local');
+      const registrations = listActions('tunnel', root).filter((action) => action.operation === 'relay.register');
+      return foreignRefusal.type === 'error' && localRefusal.type === 'error'
+        && registrations.some((action) => action.subject.id === 'relay:stale-local')
+        && registrations.some((action) => action.subject.id === 'relay:expired-foreign')
+        && registrations.some((action) => action.subject.id === 'relay:future-foreign')
+        && !registrations.some((action) => action.subject.id === 'relay:fresh-foreign')
+        && !registrations.some((action) => action.subject.id === 'relay:fresh-local');
+    } finally { for (const socket of contenders) socket.close(); stale?.socket.close(); expired?.socket.close(); future?.socket.close(); relay.stop(); }
+  })),
+  // The other half of the rule above: WHO writes the heartbeat. The relay does, out of its own
+  // traffic — so liveness is a fact this twin holds in state rather than something the serve path
+  // asks the host operating system.
+  done('tunnel.volter.control.heartbeat_written_by_traffic', 'volter_control', 'A relay\'s own control frame stamps its ownership claim with the world instant, so liveness is state the relay writes rather than a process-table probe', 'api', 'core', () => withRoot(async (root) => {
+    const claimPath = join(worldPaths('tunnel', root).dir, 'relay-claims', 'beating.json');
+    const heartbeatAt = (): number => Date.parse(String((JSON.parse(readFileSync(claimPath, 'utf8')) as Record<string, unknown>).heartbeatAt));
+    const relay = createTunnelTwinServer({ root });
+    let control: Awaited<ReturnType<typeof openControl>> | undefined;
+    try {
+      control = await openControl(relay.url, 'beating', { authRequired: false });
+      const atRegistration = heartbeatAt();
+      if (!Number.isFinite(atRegistration)) return false;
+      // Past the millisecond the registration stamped, so a later stamp is strictly greater.
+      await new Promise((resolve) => setTimeout(resolve, 25));
+      control.socket.send(JSON.stringify({ type: 'ws-message', data: 'a frame from a live relay' }));
+      for (let attempt = 0; attempt < 50; attempt++) {
+        if (heartbeatAt() > atRegistration) return true;
+        await new Promise((resolve) => setTimeout(resolve, 20));
+      }
+      return false;
+    } finally { control?.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.control.concurrent_claim_single_owner', 'volter_control', 'Concurrent claims without replace permission leave exactly one registered traffic owner', 'api', 'core', () => withRoot(async (root) => {
+    let persisted = 0;
+    let enteredPersistence: (() => void) | undefined;
+    let releasePersistence: (() => void) | undefined;
+    const entered = new Promise<void>((resolve) => { enteredPersistence = resolve; });
+    const overlap = new Promise<void>((resolve) => { releasePersistence = resolve; });
+    const relay = createTunnelTwinServer({
+      root,
+      persistRegistration: async (candidate, options) => {
+        await persistTunnelRelayRegistration(candidate, options);
+        persisted += 1;
+        enteredPersistence?.();
+        await overlap;
+      },
+    });
+    const first = new WebSocket(`${relay.url.replace(/^http/, 'ws')}/ws`);
+    const second = new WebSocket(`${relay.url.replace(/^http/, 'ws')}/ws`);
+    try {
+      await Promise.all([first, second].map((socket) => new Promise<void>((resolve, reject) => {
+        socket.addEventListener('open', () => resolve(), { once: true });
+        socket.addEventListener('error', () => reject(new Error('claim socket failed')), { once: true });
+      })));
+      // Attach rejection handlers immediately: the mutation harness deliberately replaces the
+      // registration seam with a no-op response, so neither socket is guaranteed to reach the
+      // persistence rendezvous below. A pending outcome must become a named red verify, not an
+      // unhandled timer rejection that aborts the entire mutation run.
+      const firstOutcome = nextSocketOutcome(first, ['registered', 'error'])
+        .catch((error): Record<string, any> => ({ type: 'timeout', message: String(error) }));
+      const secondOutcome = nextSocketOutcome(second, ['registered', 'error'])
+        .catch((error): Record<string, any> => ({ type: 'timeout', message: String(error) }));
+      const claim = JSON.stringify({ type: 'register', tunnelId: 'single-owner', secret: 'x', authRequired: false });
+      first.send(claim);
+      const enteredBeforeTimeout = await Promise.race([
+        entered.then(() => true),
+        new Promise<false>((resolve) => setTimeout(() => resolve(false), 3_100)),
+      ]);
+      if (!enteredBeforeTimeout) return false;
+      second.send(claim);
+      // The second frame is now pending at the same id while the first persistence seam is held.
+      // It must not enter persistence or append an action; only releasing the first winner lets the
+      // serialized ownership decision reject it.
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      if (persisted !== 1 || listActions('tunnel', root).filter((action) => action.operation === 'relay.register').length !== 1) return false;
+      releasePersistence?.();
+      const outcomes = await Promise.all([firstOutcome, secondOutcome]);
+      const winnerIndex = outcomes.findIndex((outcome) => outcome.type === 'registered');
+      if (winnerIndex < 0 || outcomes.filter((outcome) => outcome.type === 'registered').length !== 1
+        || outcomes.filter((outcome) => outcome.type === 'error').length !== 1) return false;
+      const winner = winnerIndex === 0 ? first : second;
+      const url = String(outcomes[winnerIndex]!.url);
+      const requestFrame = nextSocketMessage(winner, 'request');
+      const responsePromise = fetch(`${url}/winner`);
+      const request = await requestFrame;
+      winner.send(JSON.stringify({ type: 'response', reqId: request.reqId, status: 200, headers: {}, body: btoa('one-owner') }));
+      const response = await responsePromise;
+      const status = await fetch(`${relay.url}/api/status`).then((r) => r.json()) as any;
+      if (persisted !== 1 || response.status !== 200 || await response.text() !== 'one-owner' || status.tunnels !== 1) return false;
+
+      // A second OS process with a separate server/controls map but the SAME root must observe the
+      // transient live-ownership claim and reject before append too. This is the branch an
+      // in-process Map-only mutex cannot cover.
+      const moduleUrl = new URL('./tunnel-server.ts', import.meta.url).href;
+      const childScript = `
+        const { createTunnelTwinServer } = await import(${JSON.stringify(moduleUrl)});
+        const relay = createTunnelTwinServer({ root: ${JSON.stringify(root)} });
+        const socket = new WebSocket(relay.url.replace(/^http/, 'ws') + '/ws');
+        const outcome = await new Promise((resolve, reject) => {
+          const timer = setTimeout(() => reject(new Error('cross-process claim timeout')), 3000);
+          socket.addEventListener('open', () => socket.send(JSON.stringify({ type: 'register', tunnelId: 'single-owner', secret: 'x', authRequired: false })));
+          socket.addEventListener('message', (event) => {
+            const message = JSON.parse(String(event.data));
+            if (message.type === 'registered' || message.type === 'error') { clearTimeout(timer); resolve(message); }
+          });
+          socket.addEventListener('error', () => reject(new Error('cross-process claim socket failed')));
+        });
+        console.log(JSON.stringify(outcome));
+        socket.close(); relay.stop();
+      `;
+      const child = Bun.spawn([process.execPath, '-e', childScript], { stdout: 'pipe', stderr: 'pipe' });
+      const [childStdout, childStderr, childExit] = await Promise.all([
+        new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited,
+      ]);
+      const crossProcess = JSON.parse(childStdout.trim()) as Record<string, unknown>;
+      return childExit === 0 && childStderr === '' && crossProcess.type === 'error'
+        && listActions('tunnel', root).filter((action) => action.operation === 'relay.register').length === 1;
+    } finally { releasePersistence?.(); first.close(); second.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.control.socket_single_identity', 'volter_control', 'One socket can own only one current ID; valid alias movement retires and disconnects the old mapping', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root }); const socket = new WebSocket(`${relay.url.replace(/^http/, 'ws')}/ws`);
+    try {
+      await new Promise<void>((resolve) => socket.addEventListener('open', () => resolve(), { once: true }));
+      let registered = nextSocketMessage(socket, 'registered');
+      socket.send(JSON.stringify({ type: 'register', tunnelId: 'alias-a', secret: 'x', authRequired: false }));
+      const first = await registered;
+      registered = nextSocketMessage(socket, 'registered');
+      socket.send(JSON.stringify({ type: 'register', tunnelId: 'alias-b', secret: 'x', authRequired: false }));
+      const second = await registered;
+      const old = await fetch(String(first.url));
+      const frame = nextSocketMessage(socket, 'request');
+      const responsePromise = fetch(`${String(second.url)}/active`);
+      const request = await frame;
+      socket.send(JSON.stringify({ type: 'response', reqId: request.reqId, status: 200, headers: {}, body: btoa('alias-b') }));
+      const current = await responsePromise;
+      const oldResource = projectResources('tunnel', root).find((x) => x.id === 'relay:alias-a');
+      return old.status === 502 && current.status === 200 && await current.text() === 'alias-b'
+        && oldResource?.connected === false
+        && (await fetch(`${relay.url}/api/status`).then((r) => r.json()) as any).tunnels === 1;
+    } finally { socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.status.live_disconnect', 'volter_management', 'Live status and persisted connected state fall to zero/false after the owning socket closes', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root });
+    const control = await openControl(relay.url, 'close-proof', { authRequired: false });
+    try {
+      if ((await fetch(`${relay.url}/api/status`).then((r) => r.json()) as any).tunnels !== 1) return false;
+      const requestFrame = nextSocketMessage(control.socket, 'request');
+      const pendingResponse = fetch(`${control.url}/pending-at-close`);
+      await requestFrame;
+      control.socket.close();
+      const failed = await pendingResponse;
+      if (failed.status !== 502 || (await failed.json() as any).error !== 'Tunnel disconnected') return false;
+      for (let i = 0; i < 40; i++) {
+        const status = await fetch(`${relay.url}/api/status`).then((r) => r.json()) as any;
+        const resource = projectResources('tunnel', root).find((x) => x.id === 'relay:close-proof');
+        if (status.tunnels === 0 && resource?.connected === false) return true;
+        await new Promise((resolve) => setTimeout(resolve, 10));
+      }
+      return false;
+    } finally { control.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.auth.jwt_default', 'volter_auth', 'SDK-default authRequired=true denies anonymous traffic and accepts valid owned shared-SSO or tunnel-bound HS256 tokens', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root });
+    const control = await openControl(relay.url, 'jwt-default');
+    try {
+      const denied = await fetch(`${control.url}/private`);
+      if (denied.status !== 401) return false;
+      const sharedToken = createTunnelTwinJwt({ sub: 'shared-user', exp: Math.floor(Date.now() / 1000) + 60 });
+      let requestFrame = nextSocketMessage(control.socket, 'request');
+      const sharedPromise = fetch(`${control.url}/shared?keep=1&__volter_token=${encodeURIComponent(sharedToken)}`);
+      let request = await requestFrame;
+      control.socket.send(JSON.stringify({ type: 'response', reqId: request.reqId, status: 200, headers: {}, body: btoa(String(request.path)) }));
+      const shared = await sharedPromise;
+      if (shared.status !== 200 || await shared.text() !== '/shared?keep=1') return false;
+      requestFrame = nextSocketMessage(control.socket, 'request');
+      const allowedPromise = fetch(`${control.url}/private?keep=1&__volter_token=${encodeURIComponent(relay.mintToken('jwt-default'))}`);
+      request = await requestFrame;
+      control.socket.send(JSON.stringify({ type: 'response', reqId: request.reqId, status: 200, headers: {}, body: btoa(String(request.path)) }));
+      const allowed = await allowedPromise;
+      return allowed.status === 200 && await allowed.text() === '/private?keep=1' && allowed.headers.get('set-cookie')?.includes('__volter_auth=') === true;
+    } finally { control.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.auth.jwt_claim_types', 'volter_auth', 'JWT exp/nbf and present tid claims are validated, with missing tid rejected only in explicit requireTid mode', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root }); const control = await openControl(relay.url, 'jwt-types');
+    try {
+      const exp = await fetch(`${control.url}/x?__volter_token=${encodeURIComponent(relay.mintToken('jwt-types', { exp: 'never' }))}`);
+      const nbf = await fetch(`${control.url}/x?__volter_token=${encodeURIComponent(relay.mintToken('jwt-types', { nbf: 'later' }))}`);
+      const mismatch = await fetch(`${control.url}/x?__volter_token=${encodeURIComponent(relay.mintToken('another-tunnel'))}`);
+      if (exp.status !== 401 || nbf.status !== 401 || mismatch.status !== 401) return false;
+
+      const strictRelay = createTunnelTwinServer({ root, requireTid: true, requestTimeoutMs: 200 });
+      const strict = await openControl(strictRelay.url, 'jwt-strict');
+      try {
+        const missingTid = createTunnelTwinJwt({ sub: 'twin-local', exp: Math.floor(Date.now() / 1000) + 60 });
+        const nonStringTid = createTunnelTwinJwt({ sub: 'twin-local', tid: 7 as unknown as string, exp: Math.floor(Date.now() / 1000) + 60 });
+        const missing = await fetch(`${strict.url}/x?__volter_token=${encodeURIComponent(missingTid)}`);
+        const typed = await fetch(`${strict.url}/x?__volter_token=${encodeURIComponent(nonStringTid)}`);
+        const requestFrame = nextSocketMessage(strict.socket, 'request');
+        const exactPromise = fetch(`${strict.url}/x?__volter_token=${encodeURIComponent(strictRelay.mintToken('jwt-strict'))}`);
+        const request = await requestFrame;
+        strict.socket.send(JSON.stringify({ type: 'response', reqId: request.reqId, status: 200, headers: {}, body: btoa('bound') }));
+        const exact = await exactPromise;
+        return missing.status === 401 && typed.status === 401 && exact.status === 200 && await exact.text() === 'bound';
+      } finally { strict.socket.close(); strictRelay.stop(); }
+    } finally { control.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.http.malformed_response_contained', 'volter_http', 'Malformed complete response status/headers/body fail the owned visitor with stable JSON 502 instead of stranding it', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root }); const control = await openControl(relay.url, 'malformed-response', { authRequired: false });
+    try {
+      for (const malformed of [
+        { status: 999, headers: {}, body: '' },
+        { status: 200, headers: { 'bad\nname': 'x' }, body: '' },
+        { status: 200, headers: {}, body: '***not-base64***' },
+      ]) {
+        const frame = nextSocketMessage(control.socket, 'request');
+        const responsePromise = fetch(`${control.url}/malformed`);
+        const request = await frame;
+        control.socket.send(JSON.stringify({ type: 'response', reqId: request.reqId, ...malformed }));
+        const response = await responsePromise;
+        if (response.status !== 502 || (await response.json() as any).error !== 'Malformed tunnel response frame') return false;
+      }
+      return true;
+    } finally { control.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.http.malformed_stream_sequence_contained', 'volter_http', 'Malformed or mixed stream response sequences terminate with a bounded error instead of stranding the visitor', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root }); const control = await openControl(relay.url, 'malformed-stream', { authRequired: false });
+    try {
+      const beforeStart = [
+        await relayFrameOutcome(control, '/chunk-before-start', [{ type: 'response-chunk', data: btoa('x') }]),
+        await relayFrameOutcome(control, '/end-before-start', [{ type: 'response-end' }]),
+        await relayFrameOutcome(control, '/bad-start', [{ type: 'response-start', status: 999, headers: {} }]),
+      ];
+      if (!beforeStart.every((outcome) => outcome.kind === 'response' && outcome.status === 502)) return false;
+      const afterStart = [
+        await relayFrameOutcome(control, '/duplicate-start', [
+          { type: 'response-start', status: 200, headers: {} },
+          { type: 'response-chunk', data: btoa('first') },
+          { type: 'response-start', status: 201, headers: {} },
+        ]),
+        await relayFrameOutcome(control, '/complete-after-start', [
+          { type: 'response-start', status: 200, headers: {} },
+          { type: 'response-chunk', data: btoa('first') },
+          { type: 'response', status: 200, headers: {}, body: btoa('wrong-shape') },
+        ]),
+        await relayFrameOutcome(control, '/bad-chunk-after-start', [
+          { type: 'response-start', status: 200, headers: {} },
+          { type: 'response-chunk', data: btoa('first') },
+          { type: 'response-chunk', data: '***not-base64***' },
+        ]),
+      ];
+      // The 502 is only reachable because the head is NOT committed at `response-start`
+      // (tunnel-server.ts says why, and tunnel-stream-boundary.test.ts pins the runtime fact
+      // behind it). Each sequence now carries a VALID chunk before the malformed frame, so a
+      // relay that had already begun delivering would answer these with a truncated 200 —
+      // which is what this half would then be asserting away.
+      return afterStart.every((outcome) => outcome.kind === 'response' && outcome.status === 502);
+    } finally { control.socket.close(); relay.stop(); }
+  })),
+  // ── THE THREE STREAMING GAPS, AND THE MEASURED REASON THEY STAY TODO ────────────────
+  //
+  // All three need the relay to COMMIT a response head at `response-start` and deliver chunks
+  // as they land. The blocker is not effort: through `Bun.serve`'s Response surface — the HTTP
+  // host this relay uses, because it is also where `server.upgrade` and therefore the whole
+  // WebSocket bridge come from — a body that has begun cannot be failed. Erroring the
+  // `ReadableStream` behind a Response ends the chunked body cleanly, so a visitor reads a
+  // truncated payload as a successful 200 and cannot tell it from a complete one — a fake
+  // success — and a `content-length` that would have made the truncation detectable is dropped
+  // the moment the body is a stream.
+  //
+  // §9 refuted the BROADER form of that sentence, correctly: `node:http` can signal a mid-body
+  // failure on this same runtime, in this same process. So this is a TRADE with a named
+  // alternative (re-host the HTTP plane, lose `server.upgrade`), not an impossibility, and
+  // `tunnel-stream-boundary.test.ts` measures all three facts — the two limitations AND the
+  // alternative — rather than only the half that supports the decision. Until the first two
+  // flip, this relay buffers to `response-end`, which is what keeps
+  // `malformed_stream_sequence_contained`'s 502 reachable at all.
+  //
+  // `stream_backpressure` has a second, independent blocker worth stating: the owned protocol's
+  // fifteen discriminators contain no pause frame, so a relay cannot ask a client to slow down.
+  // The only expressible bound is `request-abort`, which STOPS the request rather than pacing it.
+  todo('tunnel.volter.http.streaming', 'volter_http', 'Reliable incremental visitor delivery for response-start/chunk/end (blocked: a committed body cannot be failed on this runtime — see tunnel-stream-boundary.test.ts)', 'api', 'core'),
+  todo('tunnel.volter.http.stream_backpressure', 'volter_http', 'Backpressure from a slow visitor pauses or bounds client response-chunk production (blocked twice: no committed body, and the protocol has no pause frame)', 'api', 'core'),
+  todo('tunnel.volter.http.stream_cancel_abort', 'volter_http', 'Canceling a streamed visitor response reliably sends request-abort (blocked: there is no committed visitor body to cancel while the relay buffers)', 'api', 'core'),
+  // A STRUCTURAL gap in the protocol, filed rather than papered over (§9). `server.upgrade`
+  // answers the browser's FIRST offered subprotocol, and the 101 must go out before `ws-ready`
+  // exists — so the relay commits to one before the client has dialled the local server, which
+  // may pick a DIFFERENT member of the full list the `ws-upgrade` frame forwards. None of the
+  // vendor's fifteen discriminators can carry that choice back: `ws-ready` carries only `connId`.
+  // A single-offer browser (the overwhelmingly common case, and what `websocket.upgrade` proves
+  // end to end) cannot hit it; a multi-offer one can, silently.
+  todo('tunnel.volter.websocket.subprotocol_negotiation', 'volter_websocket', 'A multi-offer subprotocol is negotiated with the LOCAL server rather than committed on the 101 (blocked: no discriminator carries the local choice back — ws-ready is connId only)', 'api', 'common'),
+  todo('tunnel.volter.control.reconnect_backoff', 'volter_control', 'Client reconnect and stable-link backoff reset behavior', 'api', 'common'),
+  todo('tunnel.volter.control.quota_frame', 'volter_control', 'Quota level frames with daily/monthly windows', 'api', 'common'),
+  done('tunnel.volter.http.visitor_disconnect_abort', 'volter_http', 'A visitor TCP disconnect before response-start reliably sends request-abort through Bun\'s server boundary', 'api', 'core', () => withRoot(async (root) => {
+    // The visitor walks away while the local server is still working. Unlike the streamed-response
+    // reliability gaps, this one IS observable on this runtime: `Request.signal` fires on a
+    // visitor hang-up, and what the relay must do with it is stop the client.
+    const relay = createTunnelTwinServer({ root, requestTimeoutMs: 30_000 });
+    const control = await openControl(relay.url, 'visitor-hangup', { authRequired: false });
+    try {
+      const aborter = new AbortController();
+      const requestFrame = nextSocketMessage(control.socket, 'request');
+      const visitorFailure = fetch(`${control.url}/slow`, { signal: aborter.signal }).then(() => 'completed' as const, () => 'aborted' as const);
+      const request = await requestFrame;
+      // No response frame at all: the client is still reading its local server when the browser
+      // hangs up. The relay's request timeout is 30s, so a `request-abort` arriving here can only
+      // have come from the disconnect.
+      aborter.abort();
+      const abort = await nextSocketMessage(control.socket, 'request-abort');
+      const visitor = await visitorFailure;
+
+      // …and the request is genuinely FORGOTTEN: a late response frame for it is refused rather
+      // than resolving a visitor that is already gone.
+      const late = nextSocketMessage(control.socket, 'error');
+      control.socket.send(JSON.stringify({ type: 'response', reqId: request.reqId, status: 200, headers: {}, body: btoa('too late') }));
+      const refusal = await late;
+      return (
+        abort.reqId === request.reqId &&
+        visitor === 'aborted' &&
+        String(refusal.message).includes('not owned by this control socket')
+      );
+    } finally { control.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.http.cors_preflight', 'volter_http', 'CORS preflight succeeds before visitor auth and is not forwarded to the origin', 'api', 'common', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root }); const control = await openControl(relay.url, 'cors-proof');
+    try {
+      let forwarded = 0;
+      const observe = (event: MessageEvent) => {
+        const message = JSON.parse(String(event.data)) as Record<string, unknown>;
+        if (message.type === 'request') forwarded += 1;
+      };
+      control.socket.addEventListener('message', observe);
+      const response = await fetch(`${control.url}/anything`, {
+        method: 'OPTIONS', headers: { origin: 'https://caller.example', 'access-control-request-headers': 'x-custom' },
+      });
+      await new Promise((resolve) => setTimeout(resolve, 25));
+      control.socket.removeEventListener('message', observe);
+      return response.status === 204 && response.headers.get('access-control-allow-origin') === 'https://caller.example'
+        && response.headers.get('access-control-allow-headers') === 'x-custom' && forwarded === 0;
+    } finally { control.socket.close(); relay.stop(); }
+  })),
+  todo('tunnel.volter.http.forwarded_headers', 'volter_http', 'x-forwarded-for/host/proto are normalized like the owned relay', 'api', 'common'),
+  todo('tunnel.volter.http.response_header_rules', 'volter_http', 'Operator response-header remove/set/append rules', 'api', 'niche'),
+  todo('tunnel.volter.http.rate_burst', 'volter_http', 'Per-tunnel burst limiter returns 429 with Retry-After', 'api', 'common'),
+  done('tunnel.volter.websocket.upgrade', 'volter_websocket', 'Browser WebSocket upgrade bridges ws-upgrade/ws-ready', 'api', 'core', () => withRoot(async (root) => {
+    const bridge = await openWsBridge(root);
+    try {
+      // A SUBPROTOCOL is offered, because a browser that asks for one and gets a 101 without
+      // `Sec-WebSocket-Protocol` back fails the connection outright — the vendor's own client
+      // names Vite's `vite-hmr` as the case that breaks.
+      //
+      // TWO are offered, and the 101 is read as RAW BYTES. §9 caught the single-offer version of
+      // this assertion being a fixture artifact: Bun's WebSocket client does not enforce RFC 6455
+      // §4.1 for a one-element offer, so `socket.protocol` echoed the client's own REQUEST.
+      // Reading the response head is what makes this a claim about what the relay wrote — and it
+      // is the pin on a contract the RUNTIME currently satisfies (`server.upgrade` answers with
+      // the first offer by itself), which is exactly why it needs one: without it, nothing would
+      // notice the day that stopped being true.
+      const handshake = await readUpgradeHandshake(`${bridge.control.url.replace(/^http/, 'ws')}/socket?room=1`, {
+        'Sec-WebSocket-Protocol': 'vite-hmr, graphql-ws',
+      });
+      const { socket: visitor, upgrade } = await bridge.visitor('/socket?room=1', ['vite-hmr', 'graphql-ws']);
+      // The bridge is LIVE, not merely announced: a frame sent by the browser reaches the real
+      // local server and its answer comes back. That is what an upgrade with no bridge behind it
+      // could not do.
+      visitor.send('ping');
+      const echoed = await nextVisitorFrame(visitor);
+      visitor.close();
+      return (
+        upgrade !== undefined &&
+        UUID_PATTERN.test(String(upgrade.connId)) &&
+        // the tunnelled path and query reach the client, which is what it dials locally
+        upgrade.path === '/socket?room=1' &&
+        typeof upgrade.headers?.['sec-websocket-key'] === 'string' &&
+        // negotiated end to end: the relay's own 101 names it (read off the wire, not off the
+        // client's request), the browser's socket agrees, and the frame forwarded the full offer
+        // so the client can dial the local server with it
+        handshake.status === 101 &&
+        handshake.headers['sec-websocket-protocol'] === 'vite-hmr' &&
+        visitor.protocol === 'vite-hmr' &&
+        upgrade.headers['sec-websocket-protocol'] === 'vite-hmr, graphql-ws' &&
+        'data' in echoed &&
+        echoed.data === 'echo:/socket?room=1:ping'
+      );
+    } finally { bridge.stop(); }
+  })),
+  done('tunnel.volter.websocket.messages', 'volter_websocket', 'Text and binary WebSocket frames bridge bidirectionally', 'api', 'core', () => withRoot(async (root) => {
+    const bridge = await openWsBridge(root);
+    try {
+      const { socket: visitor } = await bridge.visitor('/echo');
+      visitor.send('hello');
+      const text = await nextVisitorFrame(visitor);
+      // The local server REVERSES binary payloads, so an accidental text round trip cannot
+      // satisfy this half — and the `binary` flag has to survive both directions for the local
+      // server to have received a binary frame at all.
+      visitor.send(new Uint8Array([1, 2, 3, 4]));
+      const binary = await nextVisitorFrame(visitor);
+      visitor.close();
+      const relayedBinary = bridge.frames.filter((frame) => frame.type === 'ws-message' && frame.binary === true);
+      const relayedText = bridge.frames.filter((frame) => frame.type === 'ws-message' && frame.binary === false);
+      return (
+        'data' in text && text.data === 'echo:/echo:hello' &&
+        'data' in binary && binary.data instanceof ArrayBuffer &&
+        [...new Uint8Array(binary.data)].join(',') === '4,3,2,1' &&
+        relayedText.length >= 1 && relayedBinary.length >= 1
+      );
+    } finally { bridge.stop(); }
+  })),
+  done('tunnel.volter.websocket.close', 'volter_websocket', 'Close code/reason bridges in both directions and the reason is clamped to 123 bytes', 'api', 'common', () => withRoot(async (root) => {
+    const bridge = await openWsBridge(root);
+    try {
+      // ── browser → client: the visitor hangs up, the client is told ──
+      const { socket: visitor } = await bridge.visitor('/bye');
+      visitor.send('ping');
+      await nextVisitorFrame(visitor);
+      visitor.close(4123, 'visitor done');
+      const relayed = await nextSocketMessage(bridge.control.socket, 'ws-close');
+
+      // ── client → browser: a ws-close frame closes the visitor, with the code and a reason
+      //    clamped to the 123 bytes a close frame can carry ──
+      const second = await bridge.visitor('/bye2');
+      const closing = nextVisitorFrame(second.socket);
+      bridge.control.socket.send(JSON.stringify({ type: 'ws-close', connId: second.upgrade.connId, code: 4004, reason: 'x'.repeat(200) }));
+      const closed = await closing;
+      // …and an impossible code is normalised rather than sent: 1006 may never appear on the wire.
+      const third = await bridge.visitor('/bye3');
+      const thirdClosing = nextVisitorFrame(third.socket);
+      bridge.control.socket.send(JSON.stringify({ type: 'ws-close', connId: third.upgrade.connId, code: 1006 }));
+      const thirdClosed = await thirdClosing;
+      return (
+        // The CODE is what the relay carries outward; the reason a browser sends is not
+        // delivered to the server handler on this runtime, so asserting it here would be
+        // asserting something the relay never sees. The reason IS asserted in the other
+        // direction, below, where the relay is the one producing it.
+        relayed.code === 4123 && typeof relayed.reason === 'string' &&
+        'closed' in closed && closed.closed.code === 4004 && closed.closed.reason === 'x'.repeat(123) &&
+        'closed' in thirdClosed && thirdClosed.closed.code === 1000
+      );
+    } finally { bridge.stop(); }
+  })),
+  done('tunnel.volter.auth.jwt_cookie', 'volter_auth', 'JWT cookie authentication strips the relay cookie before forwarding and enforces tunnel-id binding', 'api', 'core', () => withRoot(jwtCookieProof)),
+  done('tunnel.volter.auth.cookie_bootstrap', 'volter_auth', 'GET /__volter_auth validates a token and mints a path-scoped local relay cookie', 'api', 'common', () => withRoot(jwtCookieProof)),
+  todo('tunnel.volter.auth.constant_time_secret', 'volter_auth', 'Shared secret verification is constant-time', 'api', 'common'),
+  todo('tunnel.volter.reservations.claim', 'volter_reservations', 'Persistent tunnel-id reservation claim/refresh/reclaim', 'api', 'common'),
+  todo('tunnel.volter.reservations.release_self', 'volter_reservations', 'DELETE /me/reservations/:tunnelId releases the caller-owned reservation', 'api', 'common'),
+  todo('tunnel.volter.reservations.release_admin', 'volter_reservations', 'DELETE /admin/reservations/:tunnelId revokes a reservation as root', 'api', 'niche'),
+  todo('tunnel.volter.accounts.whoami', 'volter_accounts', 'GET /me returns account and usage snapshot', 'api', 'common'),
+  todo('tunnel.volter.accounts.device_tokens_list', 'volter_accounts', 'GET /me/tokens lists the caller account device credentials', 'api', 'niche'),
+  todo('tunnel.volter.accounts.device_tokens_restore', 'volter_accounts', 'POST /me/tokens/:tokenId/restore restores a revoked device credential', 'api', 'niche'),
+  todo('tunnel.volter.accounts.device_tokens_revoke', 'volter_accounts', 'DELETE /me/tokens/:tokenId revokes a device credential', 'api', 'niche'),
+  todo('tunnel.volter.accounts.admin_list', 'volter_accounts', 'GET /admin/accounts lists accounts', 'api', 'niche'),
+  todo('tunnel.volter.accounts.admin_create', 'volter_accounts', 'POST /admin/accounts creates an account', 'api', 'niche'),
+  todo('tunnel.volter.accounts.admin_tokens_list', 'volter_accounts', 'GET /admin/accounts/:slug/tokens lists service tokens', 'api', 'niche'),
+  todo('tunnel.volter.accounts.admin_tokens_create', 'volter_accounts', 'POST /admin/accounts/:slug/tokens creates a service token', 'api', 'niche'),
+  todo('tunnel.volter.accounts.admin_tokens_revoke', 'volter_accounts', 'DELETE /admin/accounts/:slug/tokens/:tokenId revokes a service token', 'api', 'niche'),
+  todo('tunnel.volter.accounts.admin_limits_patch', 'volter_accounts', 'PATCH /admin/accounts/:slug/limits updates account limits', 'api', 'niche'),
+  todo('tunnel.volter.accounts.admin_suspend', 'volter_accounts', 'POST /admin/accounts/:slug/suspend suspends an account', 'api', 'niche'),
+  todo('tunnel.volter.accounts.admin_resume', 'volter_accounts', 'POST /admin/accounts/:slug/resume resumes an account', 'api', 'niche'),
+  todo('tunnel.volter.accounts.admin_usage', 'volter_accounts', 'GET /admin/accounts/:slug/usage returns one account usage snapshot', 'api', 'niche'),
+  todo('tunnel.volter.usage.metering', 'volter_usage', 'Request/WebSocket/byte/second credit metering', 'api', 'common'),
+  todo('tunnel.volter.usage.admin_summary', 'volter_usage', 'GET /admin/usage returns the fleet usage summary', 'api', 'niche'),
+  todo('tunnel.volter.management.report_create', 'volter_management', 'POST /report submits a public abuse report', 'api', 'niche'),
+  todo('tunnel.volter.management.reports_admin_list', 'volter_management', 'GET /admin/reports lists abuse reports as root', 'api', 'niche'),
+  todo('tunnel.volter.signup.github_token', 'volter_signup', 'POST /signup/github signs up using a GitHub access token', 'api', 'niche'),
+  todo('tunnel.volter.signup.github_gist_start', 'volter_signup', 'POST /signup/github/gist/start starts gist-based identity verification', 'api', 'niche'),
+  todo('tunnel.volter.signup.github_gist_verify', 'volter_signup', 'POST /signup/github/gist/verify completes gist-based identity verification', 'api', 'niche'),
+  todo('tunnel.volter.signup.waitlist_create', 'volter_signup', 'POST /waitlist submits a public waitlist request', 'api', 'niche'),
+  todo('tunnel.volter.signup.waitlist_admin_list', 'volter_signup', 'GET /admin/waitlist lists waitlist requests as root', 'api', 'niche'),
+  todo('tunnel.volter.signup.waitlist_admin_remove', 'volter_signup', 'DELETE /admin/waitlist/:githubUser removes a waitlist entry', 'api', 'niche'),
+  todo('tunnel.volter.inspector.list', 'volter_inspector', 'GET /__volter_inspect returns the owner-authenticated live request ring', 'api', 'niche'),
+  todo('tunnel.volter.inspector.replay', 'volter_inspector', 'POST /__volter_replay reissues a captured request', 'api', 'niche'),
+  todo('tunnel.volter.management.landing', 'volter_management', 'GET / serves the owned relay public landing surface', 'api', 'niche'),
+  todo('tunnel.volter.management.docs', 'volter_management', 'GET /docs serves the owned relay documentation surface', 'api', 'niche'),
+
+  // The owned protocol's authoritative 15 message discriminators. Implemented frames have
+  // transport proofs above; every remaining frame stays visible here instead of disappearing
+  // from the denominator behind broader feature labels.
+  done('tunnel.volter.protocol.register', 'volter_control', 'Protocol frame: register', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root }); const control = await openControl(relay.url, 'frame-register', { authRequired: false });
+    try {
+      const resource = projectResources('tunnel', root).find((candidate) => candidate.id === 'relay:frame-register');
+      return control.tunnelId === 'frame-register' && resource?.connected === true
+        && listActions('tunnel', root).some((action) => action.operation === 'relay.register' && action.subject.id === 'relay:frame-register');
+    } finally { control.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.protocol.registered', 'volter_control', 'Protocol frame: registered', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root }); const control = await openControl(relay.url, 'frame-registered', { authRequired: false });
+    try { return control.tunnelId === 'frame-registered' && control.url === `${relay.url}/__twin/tunnels/frame-registered`; }
+    finally { control.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.protocol.request', 'volter_http', 'Protocol frame: request', 'api', 'core', () => withRoot(async (root) => (await protocolRoundtrip(root)).body.marker === 'genuine-origin')),
+  done('tunnel.volter.protocol.response', 'volter_http', 'Protocol frame: response', 'api', 'core', () => withRoot(async (root) => (await protocolRoundtrip(root)).response.status === 201)),
+  done('tunnel.volter.protocol.response_start', 'volter_http', 'Protocol frame: response-start', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root }); const control = await openControl(relay.url, 'frame-start', { authRequired: false });
+    try {
+      const frame = nextSocketMessage(control.socket, 'request'); const p = fetch(`${control.url}/x`); const req = await frame;
+      control.socket.send(JSON.stringify({ type: 'response-start', reqId: req.reqId, status: 206, headers: {} }));
+      control.socket.send(JSON.stringify({ type: 'response-chunk', reqId: req.reqId, data: btoa('x') }));
+      control.socket.send(JSON.stringify({ type: 'response-end', reqId: req.reqId }));
+      const res = await p; await res.arrayBuffer();
+      // The frame is ACCEPTED — and the three reliability capabilities that depend on COMMITTING
+      // the head at this point are still honestly `todo`. That list shrank by one when
+      // `visitor_disconnect_abort` was built (it never needed a committed head: a visitor hang-up
+      // before `response-start` is observable on this runtime), which is exactly the kind of
+      // silent staleness this cross-check exists to force.
+      const reliabilityTodos = ['tunnel.volter.http.streaming', 'tunnel.volter.http.stream_backpressure', 'tunnel.volter.http.stream_cancel_abort'];
+      return res.status === 206 && reliabilityTodos.every((id) => {
+        const capability = TUNNEL_CAPABILITIES.find((candidate) => candidate.id === id);
+        return capability?.expected === 'todo' && capability.verify === undefined && capability.tier === 'core';
+      });
+    }
+    finally { control.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.protocol.response_chunk', 'volter_http', 'Protocol frame: response-chunk', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root }); const control = await openControl(relay.url, 'frame-chunk', { authRequired: false });
+    try { const frame = nextSocketMessage(control.socket, 'request'); const p = fetch(`${control.url}/x`); const req = await frame; control.socket.send(JSON.stringify({ type: 'response-start', reqId: req.reqId, status: 200, headers: {} })); control.socket.send(JSON.stringify({ type: 'response-chunk', reqId: req.reqId, data: btoa('chunk') })); control.socket.send(JSON.stringify({ type: 'response-end', reqId: req.reqId })); const res = await p; return await res.text() === 'chunk'; }
+    finally { control.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.protocol.response_end', 'volter_http', 'Protocol frame: response-end', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root }); const control = await openControl(relay.url, 'frame-end', { authRequired: false });
+    try { const frame = nextSocketMessage(control.socket, 'request'); const p = fetch(`${control.url}/x`); const req = await frame; control.socket.send(JSON.stringify({ type: 'response-start', reqId: req.reqId, status: 200, headers: {} })); control.socket.send(JSON.stringify({ type: 'response-end', reqId: req.reqId })); const res = await p; return (await res.arrayBuffer()).byteLength === 0; }
+    finally { control.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.protocol.request_abort', 'volter_http', 'Protocol frame: request-abort', 'api', 'core', () => withRoot(async (root) => {
+    // A request that ends badly must STOP the client, not just answer the visitor. The client's
+    // own handler destroys the local request on this frame, so a relay that forgot to send it
+    // would leave the local server producing a response nobody will ever read.
+    // 400ms, not 120: §9 ranked the old budget the flakiest thing in this file — the second
+    // half needs a whole fetch/frame/response round trip inside it while the catalog's other T0s
+    // run alongside. It fails RED when missed (504 ≠ 200), so this only buys headroom.
+    const relay = createTunnelTwinServer({ root, requestTimeoutMs: 400 });
+    const control = await openControl(relay.url, 'frame-abort', { authRequired: false });
+    try {
+      // (1) The TIMEOUT path: the client never answers, the relay gives up.
+      const timedOutFrame = nextSocketMessage(control.socket, 'request');
+      const timedOut = fetch(`${control.url}/never-answered`);
+      const first = await timedOutFrame;
+      const abortOnTimeout = await nextSocketMessage(control.socket, 'request-abort');
+      const timedOutResponse = await timedOut;
+      const timedOutBody = await timedOutResponse.json() as { error?: string };
+
+      // (2) The COMPLETED path: a request the client answers must NOT be aborted. Without this
+      // half, a relay that sent `request-abort` after every request would pass the first half.
+      const okFrame = nextSocketMessage(control.socket, 'request');
+      const okResponse = fetch(`${control.url}/answered`);
+      const second = await okFrame;
+      control.socket.send(JSON.stringify({ type: 'response', reqId: second.reqId, status: 200, headers: {}, body: btoa('done') }));
+      const settled = await okResponse;
+      const body = await settled.text();
+      const strayAbort = await Promise.race([
+        nextSocketMessage(control.socket, 'request-abort', 250).then(() => true).catch(() => false),
+        new Promise<boolean>((resolve) => setTimeout(() => resolve(false), 300)),
+      ]);
+      return (
+        abortOnTimeout.reqId === first.reqId &&
+        UUID_PATTERN.test(String(first.reqId)) &&
+        timedOutResponse.status === 504 &&
+        timedOutBody.error === 'Tunnel request timed out' &&
+        settled.status === 200 && body === 'done' &&
+        strayAbort === false
+      );
+    } finally { control.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.protocol.error', 'volter_control', 'Protocol frame: error', 'api', 'core', () => withRoot(async (root) => {
+    const relay = createTunnelTwinServer({ root }); const socket = new WebSocket(`${relay.url.replace(/^http/, 'ws')}/ws`);
+    try {
+      await new Promise<void>((resolve, reject) => {
+        socket.addEventListener('open', () => resolve(), { once: true });
+        socket.addEventListener('error', () => reject(new Error('error-frame socket failed')), { once: true });
+      });
+      const rejected = nextSocketMessage(socket, 'error');
+      socket.send(JSON.stringify({ type: 'register', tunnelId: 'frame-error' }));
+      const error = await rejected;
+      return error.type === 'error' && error.fatal === true && listActions('tunnel', root).length === 0;
+    } finally { socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.protocol.ws_ready', 'volter_websocket', 'Protocol frame: ws-ready', 'api', 'core', () => withRoot(async (root) => {
+    // A browser usually speaks FIRST (a client library sends its hello immediately), and that
+    // happens while the client is still dialling its local server. `ws-ready` is the frame that
+    // says the bridge exists — so what it must prove is that frames sent BEFORE it are delivered
+    // after it, in order, rather than dropped into a bridge that did not exist yet.
+    const bridge = await openWsBridge(root, 'hold');
+    try {
+      const { socket: visitor } = await bridge.visitor('/ready');
+      visitor.send('early-one');
+      visitor.send('early-two');
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      const beforeReady = bridge.frames.filter((frame) => frame.type === 'ws-message');
+      bridge.release();
+      const first = await nextVisitorFrame(visitor);
+      const second = await nextVisitorFrame(visitor);
+      visitor.close();
+      return (
+        // nothing was relayed while the bridge was still coming up…
+        beforeReady.length === 0 &&
+        // …and then BOTH queued frames arrive, in the order the browser sent them
+        'data' in first && first.data === 'echo:/ready:early-one' &&
+        'data' in second && second.data === 'echo:/ready:early-two'
+      );
+    } finally { bridge.stop(); }
+  })),
+  done('tunnel.volter.protocol.ws_error', 'volter_websocket', 'Protocol frame: ws-error', 'api', 'core', () => withRoot(async (root) => {
+    // The client could not reach the local server. The browser must be TOLD — a bridge that
+    // silently stayed open would leave a page waiting forever on a socket that goes nowhere.
+    const bridge = await openWsBridge(root, 'refuse');
+    try {
+      // Opened by hand rather than through `visitor()`: the refusal can land before the browser's
+      // own `open` fires, so the outcome to wait for is "opened OR closed", not "opened".
+      const visitor = new WebSocket(`${bridge.control.url.replace(/^http/, 'ws')}/refused`);
+      const closed = await new Promise<{ code: number; reason: string } | 'still-open'>((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error('the refused visitor socket was never closed')), 3_000);
+        visitor.addEventListener('close', (event) => { clearTimeout(timer); resolve({ code: event.code, reason: event.reason }); }, { once: true });
+      });
+      const upgrade = bridge.frames.find((frame) => frame.type === 'ws-upgrade');
+      return (
+        upgrade !== undefined &&
+        closed !== 'still-open' &&
+        // 1011 "internal error" with the client's OWN message — the browser learns why, and the
+        // relay does not invent a reason of its own.
+        closed.code === 1011 &&
+        closed.reason === 'ECONNREFUSED dialling local server'
+      );
+    } finally { bridge.stop(); }
+  })),
+  done('tunnel.volter.protocol.ws_message', 'volter_websocket', 'Protocol frame: ws-message', 'api', 'core', () => withRoot(async (root) => {
+    const bridge = await openWsBridge(root);
+    try {
+      const { socket: visitor, upgrade } = await bridge.visitor('/frames');
+      visitor.send(new Uint8Array([9, 8, 7]));
+      const reversed = await nextVisitorFrame(visitor);
+      const relayed = bridge.frames.filter((frame) => frame.type === 'ws-message');
+      visitor.close();
+      // The frame's own fields: correlated by connId, payload base64, and the `binary` flag the
+      // client uses to decide the local frame type. A relay that dropped `binary` would turn
+      // every binary frame into text without any error to notice.
+      return (
+        relayed.length === 1 &&
+        relayed[0]!.connId === upgrade.connId &&
+        relayed[0]!.binary === true &&
+        Buffer.from(String(relayed[0]!.data), 'base64').toString('hex') === '090807' &&
+        'closed' in reversed === false &&
+        'data' in reversed && reversed.data instanceof ArrayBuffer &&
+        [...new Uint8Array(reversed.data)].join(',') === '7,8,9'
+      );
+    } finally { bridge.stop(); }
+  })),
+  done('tunnel.volter.protocol.ws_close', 'volter_websocket', 'Protocol frame: ws-close', 'api', 'common', () => withRoot(async (root) => {
+    const bridge = await openWsBridge(root);
+    try {
+      const { socket: visitor, upgrade } = await bridge.visitor('/closing');
+      visitor.close(4200, 'done');
+      const relayed = await nextSocketMessage(bridge.control.socket, 'ws-close');
+      // …and a SECOND close is not sent when the close came from the client's own side: the
+      // relay would otherwise echo a close back at the party that sent it.
+      const second = await bridge.visitor('/closing2');
+      const before = bridge.frames.filter((frame) => frame.type === 'ws-close').length;
+      const closing = nextVisitorFrame(second.socket);
+      bridge.control.socket.send(JSON.stringify({ type: 'ws-close', connId: second.upgrade.connId, code: 1000 }));
+      await closing;
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      return (
+        relayed.connId === upgrade.connId && relayed.code === 4200 &&
+        bridge.frames.filter((frame) => frame.type === 'ws-close').length === before
+      );
+    } finally { bridge.stop(); }
+  })),
+  done('tunnel.volter.protocol.ws_upgrade', 'volter_websocket', 'Protocol frame: ws-upgrade', 'api', 'core', () => withRoot(async (root) => {
+    const bridge = await openWsBridge(root);
+    try {
+      const { socket: visitor, upgrade } = await bridge.visitor('/upgrade/path?x=1');
+      visitor.close();
+      // The frame the client dials from: a fresh connId, the TUNNELLED path (query included),
+      // and the browser's own handshake headers — which is how the client forwards a
+      // subprotocol and an auth cookie to the local server.
+      return (
+        UUID_PATTERN.test(String(upgrade.connId)) &&
+        upgrade.path === '/upgrade/path?x=1' &&
+        typeof upgrade.headers === 'object' &&
+        typeof upgrade.headers['sec-websocket-key'] === 'string' &&
+        upgrade.headers['x-forwarded-for'] === '0.0.0.0' &&
+        // one connId per socket — two browsers on one tunnel must not share a bridge
+        (await (async () => {
+          const other = await bridge.visitor('/upgrade/path?x=1');
+          other.socket.close();
+          return other.upgrade.connId !== upgrade.connId;
+        })())
+      );
+    } finally { bridge.stop(); }
+  })),
+  done('tunnel.volter.websocket.auth_gate', 'volter_auth', 'A browser WebSocket upgrade passes the SAME auth gates the HTTP path does — an unauthenticated upgrade never reaches a bridge', 'api', 'common', () => withRoot(async (root) => {
+    // The gate has to bite BEFORE `server.upgrade`, or the relay would have an unauthenticated
+    // hole sitting beside an authenticated door. `refused === 'closed'` is what proves the
+    // ORDER, and it needs no timing to do it: a relay that upgraded first would fire `open` on
+    // that socket before any close, and the promise below would resolve `'opened'`. The frame
+    // counts are the second, independent tooth — `afterAuth === 1` is an exact equality, so a
+    // stray `ws-upgrade` from the refused attempt reddens it. (§9 was right that the original
+    // comment credited the frame count for what the close proves, and that the negative half
+    // deserved the settle the positive one had.)
+    const relay = createTunnelTwinServer({ root });
+    // `authRequired` defaults to the owned relay's own default (true) — deliberately not passed.
+    const control = await openControl(relay.url, 'ws-auth');
+    try {
+      const frames: Array<Record<string, any>> = [];
+      control.socket.addEventListener('message', (event) => frames.push(JSON.parse(String(event.data)) as Record<string, any>));
+      const anonymous = new WebSocket(`${control.url.replace(/^http/, 'ws')}/private`);
+      const refused = await new Promise<string>((resolve) => {
+        const timer = setTimeout(() => resolve('still-open'), 2_000);
+        anonymous.addEventListener('open', () => { clearTimeout(timer); resolve('opened'); }, { once: true });
+        anonymous.addEventListener('close', () => { clearTimeout(timer); resolve('closed'); }, { once: true });
+        anonymous.addEventListener('error', () => { clearTimeout(timer); resolve('closed'); }, { once: true });
+      });
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      const afterRefusal = frames.filter((frame) => frame.type === 'ws-upgrade').length;
+      // …and the SAME upgrade with the relay's own minted, tunnel-bound token is accepted.
+      const token = relay.mintToken(control.tunnelId);
+      // THE 101's OWN BYTES: a query-token upgrade must hand back the same `__volter_auth`
+      // cookie the identical HTTP request does, so the page's later requests are authenticated
+      // without re-carrying the token. Bun's WebSocket client cannot see a response header at
+      // all, so this is read off the wire — §9 flagged the cookie as shipped-with-zero-coverage.
+      const handshake = await readUpgradeHandshake(`${control.url.replace(/^http/, 'ws')}/private?__volter_token=${encodeURIComponent(token)}`);
+      const authorised = new WebSocket(`${control.url.replace(/^http/, 'ws')}/private?__volter_token=${encodeURIComponent(token)}`);
+      const accepted = await new Promise<string>((resolve) => {
+        const timer = setTimeout(() => resolve('still-open'), 3_000);
+        authorised.addEventListener('open', () => { clearTimeout(timer); resolve('opened'); }, { once: true });
+        authorised.addEventListener('close', () => { clearTimeout(timer); resolve('closed'); }, { once: true });
+        authorised.addEventListener('error', () => { clearTimeout(timer); resolve('closed'); }, { once: true });
+      });
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      const afterAuth = frames.filter((frame) => frame.type === 'ws-upgrade').length;
+      authorised.close();
+      return (
+        refused === 'closed' &&
+        afterRefusal === 0 &&
+        accepted === 'opened' &&
+        afterAuth === 2 &&
+        handshake.status === 101 &&
+        handshake.headers['set-cookie']?.startsWith('__volter_auth=') === true &&
+        handshake.headers['set-cookie']?.includes('HttpOnly') === true
+      );
+    } finally { control.socket.close(); relay.stop(); }
+  })),
+  done('tunnel.volter.websocket.owner_scoping', 'volter_websocket', 'A control socket may only drive the bridges it owns; another tunnel\'s connId is refused', 'api', 'common', () => withRoot(async (root) => {
+    const bridge = await openWsBridge(root);
+    try {
+      const { socket: visitor, upgrade } = await bridge.visitor('/scoped');
+      // A SECOND registered client on the same relay, guessing the first tunnel's connId. If the
+      // relay correlated on connId alone, this would drive somebody else's browser socket.
+      const intruder = await openControl(bridge.relay.url, 'intruder', { authRequired: false });
+      try {
+        const refused = nextSocketMessage(intruder.socket, 'error');
+        intruder.socket.send(JSON.stringify({ type: 'ws-message', connId: upgrade.connId, data: btoa('stolen'), binary: false }));
+        const error = await refused;
+        // …and the victim's socket saw nothing.
+        // ONE wait, not a race whose second leg could never win (§9: the 250ms leg was dead code
+        // behind a 200ms one). A leak that arrived later than this would still read 'quiet', which
+        // is why the ERROR FRAME above — which is immediate and unconditional — is what actually
+        // proves the refusal; this is the corroborating half.
+        const quiet = await nextVisitorFrame(visitor, 300).then(() => 'leaked' as const).catch(() => 'quiet' as const);
+        visitor.close();
+        return String(error.message).includes('not owned by this control socket') && quiet === 'quiet';
+      } finally { intruder.socket.close(); }
+    } finally { bridge.stop(); }
+  })),
+  todo('tunnel.volter.protocol.quota', 'volter_control', 'Protocol frame: quota', 'api', 'common'),
+  done('tunnel.volter.control.protocol_census', 'volter_control', 'Every authoritative owned relay message discriminator has exactly one explicit protocol capability row', 'api', 'core', async () => {
+    const declared = TUNNEL_CAPABILITIES
+      .filter((capability) => capability.id.startsWith('tunnel.volter.protocol.'))
+      .map((capability) => capability.id.slice('tunnel.volter.protocol.'.length).replaceAll('_', '-'))
+      .sort();
+    return JSON.stringify(declared) === JSON.stringify([...TUNNEL_PROTOCOL_MESSAGE_TYPES].sort());
+  }),
+
+  // Connector + safety.
+  done('tunnel.connector.pull_status', 'connector', 'Pull the exact owned relay health shape through an injected client and fold it into state', 'connector', 'core', () => withRoot(async (root) => {
+    const result = await syncTunnelFromReal(async () => ({ status: 200, body: { ok: true, relay: 'cloudflare-do' } }), { root, occurredAt: AT });
+    const resource = projectResources('tunnel', root).find((x) => x.id === 'relay:default');
+    return result.observed === 1 && result.deltasAppended === 1 && resource?.relay === 'cloudflare-do' && resource?.tunnels === undefined;
+  })),
+  done('tunnel.connector.pull_idempotent', 'connector', 'Identical status re-pull appends no delta', 'connector', 'common', () => withRoot(async (root) => {
+    const client = async () => ({ status: 200, body: { ok: true, relay: 'cloudflare-do' } });
+    await syncTunnelFromReal(client, { root, occurredAt: AT });
+    return (await syncTunnelFromReal(client, { root, occurredAt: AT })).deltasAppended === 0;
+  })),
+  done('tunnel.connector.refusal_not_empty', 'connector', 'A refused status read throws instead of overwriting state with an empty relay', 'connector', 'core', () => withRoot(async (root) => {
+    await syncTunnelFromReal(async () => ({ status: 200, body: { ok: true, relay: 'cloudflare-do' } }), { root, occurredAt: AT });
+    const beforeResources = JSON.stringify(projectResources('tunnel', root));
+    const beforeActions = listActions('tunnel', root).length;
+    try {
+      await syncTunnelFromReal(async () => ({ status: 503, body: { error: 'down' } }), { root, occurredAt: '2026-01-02T00:00:00.000Z' });
+      return false;
+    } catch (error) {
+      return String(error).includes('refused')
+        && JSON.stringify(projectResources('tunnel', root)) === beforeResources
+        && listActions('tunnel', root).length === beforeActions;
+    }
+  })),
+  done('tunnel.connector.mapper', 'connector', 'Status mapper preserves the owned health identity without inventing a tunnel count', 'connector', 'common', async () => {
+    const x = mapTunnelRelay({ ok: true, relay: 'cloudflare-do' }); return x.fields.ok === true && x.fields.relay === 'cloudflare-do' && x.fields.tunnels === undefined;
+  }),
+  done('tunnel.connector.exact_status_shape', 'connector', 'Pull refuses extra status fields that are not present in the owned public contract', 'connector', 'core', async () => {
+    try { await syncTunnelFromReal(async () => ({ status: 200, body: { ok: true, relay: 'cloudflare-do', tunnels: 7 } })); return false; }
+    catch (error) { return String(error).includes('no healthy relay'); }
+  }),
+  done('tunnel.connector.rate_budget_fail_closed', 'connector', 'Saturated client budget refuses before fetch', 'connector', 'common', () => withRoot(async (root) => {
+    let calls = 0; const now = () => Date.parse(AT); const path = join(root, 'budget.json');
+    const fake = (async () => { calls++; return new Response('{"ok":true,"relay":"x"}'); }) as unknown as typeof fetch;
+    const execute = liveTunnelExecute('token', 'https://relay.test', { fetchImpl: fake, budget: new TunnelBudget({ path, now }) });
+    const allowed = Math.floor(TUNNEL_BUDGET_CEILING / TUNNEL_CALL_WEIGHTS.other);
+    for (let i = 0; i < allowed; i++) await execute('GET', '/api/status');
+    try { await execute('GET', '/api/status'); return false; } catch (e) { return e instanceof TunnelBudgetError && calls === allowed; }
+  })),
+  done('tunnel.connector.rate_budget_persists', 'connector', 'Budget persists across client instances sharing a ledger', 'connector', 'common', () => withRoot(async (root) => {
+    let calls = 0; const now = () => Date.parse(AT); const path = join(root, 'budget.json');
+    const fake = (async () => { calls++; return new Response('{"ok":true,"relay":"x"}'); }) as unknown as typeof fetch;
+    const allowed = Math.floor(TUNNEL_BUDGET_CEILING / TUNNEL_CALL_WEIGHTS.other);
+    const first = liveTunnelExecute('token', 'https://relay.test', { fetchImpl: fake, budget: new TunnelBudget({ path, now }) });
+    for (let i = 0; i < allowed; i++) await first('GET', '/api/status');
+    const second = liveTunnelExecute('token', 'https://relay.test', { fetchImpl: fake, budget: new TunnelBudget({ path, now }) });
+    try { await second('GET', '/api/status'); return false; } catch (e) { return e instanceof TunnelBudgetError && calls === allowed; }
+  })),
+  todo('tunnel.connector.push_public', 'connector', 'Push a local registration to a real provider under explicit operator confirmation', 'connector', 'common'),
+  todo('tunnel.connector.pull_accounts', 'connector', 'Pull owned relay accounts/reservations/usage through admin APIs', 'connector', 'niche'),
+];
+
+export const TUNNEL_AREAS = [
+  'cloudflare_quick', 'cloudflare_managed', 'volter_control', 'volter_http',
+  'volter_websocket', 'volter_auth', 'volter_reservations', 'volter_accounts', 'volter_usage',
+  'volter_signup', 'volter_inspector', 'volter_management', 'connector',
+] as const;
+
+export function tunnelCapabilities(): Promise<CapabilityReport> { return checkCapabilities('tunnel', TUNNEL_CAPABILITIES); }