feat: complete wgcloak v1 transports

docs/DEVELOPMENT_STATE.md

@@ -1,71 +1,103 @@
 # Development state
 
-Checkpoint: 2026-09-15 end of day. Branch: `main`. Latest commit:
-`586ff8f` (`checkpoint: integrate authenticated transports`). The working tree
-is clean. Config and client-ID changes are included in this commit. The
-resumed recovery-only assignments after this commit made no edits.
+Checkpoint: 2026-09-19. Branch: `main`. HEAD: `49ec9d8`
+(`docs: refresh development checkpoint`). The working tree is not clean: this
+checkout contains concurrent implementation, documentation, benchmark, fuzz,
+and integration-test changes. No commit was created for this checkpoint.
 
 ## Implemented behavior
 
-- The package has a reusable Rust library and a thin binary. Integration tests
-  import the library; module unit tests run once in the library test target.
+- The package provides a reusable Rust library and thin binary. Integration
+  tests use the library rather than path-including production modules.
 - Client and server runtimes support authenticated direct UDP, QUIC DATAGRAM,
   HTTP/3 CONNECT-UDP with HTTP Datagrams, and TLS/TCP length-framed fallback.
   TLS client connections use normal certificate-chain and hostname verification.
-  Shared-secret authentication precedes encrypted server backend-session
-  activation.
-- Client `auto` follows configured order and bounded probes, stops on
-  authentication rejection, and reconnects with jittered 250 ms–30 s backoff.
-  Successful connections reset the backoff. Client control supports explicit
-  reconnect.
-- The server runs enabled listeners concurrently, rejects incompatible UDP
-  listener port conflicts, aggregates listener/session statistics, and gives
-  sessions isolated backend UDP sockets. Admission limits cover sessions,
-  per-IP sessions, pending handshakes, and authentication attempts.
-- The Unix control socket uses a private runtime directory and mode `0600`,
-  refuses an active socket, and removes only a verified stale socket. `status`,
-  `stats`, and `shutdown` are supported; `reconnect` is client-only. Config and
-  certificate/key reload remain unsupported.
-- A client currently tracks one most-recent local UDP application peer, so
-  concurrent local sources can replace the return target. Direct UDP
-  keepalives are one-way; silent peer loss may require explicit reconnect or a
-  local transport error to be noticed.
+  Shared-secret authentication precedes encrypted backend-session activation.
+- `auto` follows configured transport order, uses bounded probes/retries, stops
+  on authentication rejection, and reconnects with jittered 250 ms–30 s
+  backoff. Successful connections reset the backoff.
+- Enabled server listeners run concurrently, reject incompatible UDP bind
+  conflicts, isolate backend UDP sockets per authenticated session, enforce
+  admission limits, and publish aggregate status/statistics.
+- The Unix control socket uses a private runtime directory and `0600` socket
+  permissions. It refuses active sockets, removes only verified stale sockets,
+  parses/serializes newline-delimited JSON structurally, limits concurrent
+  clients, and bounds idle/oversized requests. `status`, `stats`, `shutdown`,
+  and client-only `reconnect` are supported. `reload` explicitly reports
+  unsupported.
+- Secret-file loading opens one descriptor, uses Linux `O_NOFOLLOW` and
+  `O_NONBLOCK`, validates a regular file and permissions from that descriptor,
+  and reads the opened descriptor. Secret contents are not logged.
+- Systemd templates run as an unprivileged user with hardening enabled;
+  `CAP_NET_BIND_SERVICE` is documented as an optional, narrowly scoped aid for
+  ports below 1024. No WireGuard, TUN/TAP, routing, or firewall management is
+  implemented.
+- `tests/encrypted_runtime.rs` covers daemon-level QUIC/TLS forwarding,
+  authentication rejection, cancellation, session identity, and QUIC restart
+  reconnect. `tests/server_capabilities.rs` covers the server datagram
+  capability boundary.
+- A deterministic Criterion target exists in `benches/protocol_transports.rs`
+  for protocol/framing/HTTP Datagram/replay microbenchmarks. The repository
+  also contains four isolated cargo-fuzz targets under `fuzz/` for direct
+  packets, TLS frames, HTTP/3 parsing, and TOML parsing.
 
-## Verification
+## Current worktree inventory
 
-The latest full gates passed on commit `586ff8f`, including the config and
-client-ID changes:
+Modified files include `Cargo.toml`, `Cargo.lock`, `README.md`,
+`docs/OPERATIONS.md`, both advanced/minimal server examples, both systemd
+templates, runtime/config/control/server/transport sources, and related tests.
+Untracked assets include `benches/`, `fuzz/`, `docs/BENCHMARKS.md`,
+`docs/FUZZING.md`, `tests/encrypted_runtime.rs`, and
+`tests/server_capabilities.rs`. `docs/DEVELOPMENT_STATE.md` and
+`docs/IMPLEMENTATION_CHECKLIST.md` are also modified by this reconciliation.
+Treat these as shared worktree state; do not discard them with a cleanup
+command.
+
+## Verification performed in this worktree
+
+The following checks passed:
 
 - `cargo fmt --all -- --check`
 - `cargo check --all-targets`
 - `cargo clippy --all-targets -- -D warnings`
-- `cargo test --all-targets --quiet` — 76 tests passed.
+- `cargo test --tests -- --test-threads=1` — 95 tests passed
+- `cargo bench --bench protocol_transports --no-run`
+- `cargo check --manifest-path fuzz/Cargo.toml`
 
-The tree was clean at this checkpoint. No uncommitted file inventory applies.
+`cargo-fuzz` is not installed on this host, so no fuzzing session or sanitizer
+run is claimed. No network/loopback benchmark was run; only deterministic
+benchmark compilation was checked. These gates ran against the shared dirty
+worktree, not a clean checkout.
 
-## Remaining work, prioritized
+## Remaining work
 
-1. Add `tests/encrypted_runtime.rs` for daemon-level QUIC and TLS proof through
-   the client runtime, encrypted transport, server runtime, and UDP echo
-   backend. Cover auth rejection, session independence, control status/stats,
-   and bounded shutdown. Lower-level transport tests are not a substitute.
-2. Start fuzzing: `fuzz/**` and `docs/FUZZING.md` are unstarted. Cover packet
-   parsers, authentication/framing boundaries, and malformed transport input.
-3. Add benchmarks; benchmark targets and baselines are unstarted.
-4. Decide a practical maximum datagram-size cap and justify it against transport
-   overhead and MTU constraints; add boundary/config tests.
-5. Decide whether config and certificate/key reload are optional or required by
-   the spec/product scope. They are currently unsupported. Finish a final
-   spec-to-implementation audit and update the acceptance checklist with
-   evidence; do not claim unsupported behavior.
+Required before an unconditional release sign-off:
 
-## First tasks for tomorrow
+1. Re-run the documented gates from the final clean checkout after concurrent
+   changes are integrated and reviewed.
+2. Install/use `cargo-fuzz` and run bounded smoke sessions for each target;
+   retain the compile-only result as the current evidence until then.
+3. Make and test a final practical datagram-size-cap decision. The benchmark
+   analysis recommends 1200 bytes, while configuration still permits the
+   larger protocol-bound ceiling.
 
-1. Implement the focused daemon-level QUIC/TLS test in `tests/encrypted_runtime.rs`,
-   then run `cargo test --test encrypted_runtime -- --nocapture`.
-2. Run the full gate sequence after the test lands:
-   `cargo fmt --all -- --check`, `cargo check --all-targets`,
-   `cargo clippy --all-targets -- -D warnings`, and
-   `cargo test --all-targets --quiet`.
-3. Review the spec checklist, decide the datagram cap and reload scope, and
-   record acceptance evidence plus the unstarted fuzz/benchmark work.
+Optional or explicitly out of scope for the current prototype:
+
+- Config and certificate/key reload remain unsupported; the control command
+  reports this explicitly. Spec language makes certificate reload desirable
+  but optional and does not require full hot reload for the first milestone.
+- A network benchmark remains opt-in work because its results depend on host
+  scheduling, kernel buffers, MTU, and runtime conditions. The deterministic
+  microbenchmarks are present and compile.
+- A measured benchmark report and sanitizer fuzz report are release artifacts,
+  not evidence currently available from this host.
+
+## First three recovery/release tasks
+
+1. Review and commit the shared implementation/docs/bench/fuzz work as one
+   coherent checkpoint, then repeat the full gates from that clean checkout.
+2. Run the four cargo-fuzz targets for bounded smoke sessions and record the
+   toolchain/host results in the fuzzing notes.
+3. Decide whether to enforce the documented 1200-byte practical cap or retain
+   the protocol-bound configurable ceiling, then add the corresponding
+   boundary evidence and update the acceptance checklist.