Johnathan Corgan 0bf031dd32 node: drive net-new inbound establish through the per-peer machine ...

Cut the net-new inbound handshake (a fresh msg1 that promotes to a new
peer, plus the at-capacity reject) over from the inline handle_msg1 logic
to the per-peer control machine. handle_msg1 still classifies via
establish_inbound and still owns the Noise wire step, the late ACL check,
and the promote_connection registry surgery; for the net-new path it now
builds the machine, steps it, and executes the returned actions.

Authorization is interposed between two machine steps so the session
index is allocated only after the ACL check passes: a rejected or
unauthorized msg1 consumes no index, matching the prior order exactly.
The msg2 wire bytes, the index-allocation sequence, and the reject
metrics are all byte-neutral. Restart, resend, rekey-respond, and the
other reject arms stay inline unchanged; they move to the machine once
outbound establish is cut over and every promoted peer has a machine.

Also fills in the executor's send-failure and promote-failure cleanup so
a mid-establish error tears the leg down and frees its index exactly as
before.

2026-07-13 12:05:17 +00:00

..

connected_udp

peer/connected_udp: own the connected-socket fd with OwnedFd

2026-07-13 09:20:04 +00:00

active.rs

peer: split ActivePeer send-state into PeerSendState (two-tier boundary)

2026-07-13 10:36:15 +00:00

connection.rs

proto/fmp: sans-IO connection-lifecycle state machine

2026-07-07 06:20:02 +00:00

machine.rs

node: drive net-new inbound establish through the per-peer machine

2026-07-13 12:05:17 +00:00

mod.rs

peer: add the per-peer FMP control state machine (unwired)

2026-07-13 09:58:45 +00:00