mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-09 16:24:45 +00:00
Johnathan Corgan
cf1c957336
The pending-handshake PeerConnection map and the per-peer control machine map were parallel LinkId-keyed structures whose keysets must stay coherent by hand. With every leg now born with a machine, the leg becomes storage inside its machine (leg: Option<PeerConnection>, pure storage the machine never reads or drives) and Node loses the connections field; every access routes through the machine. The non-mechanical lowerings, each argued at the site: the rekey-vs-establish gate in handle_msg2 tests leg-absence (an established peer's machine stays keyed by its link, so machine-presence would misclassify every rekey msg2 as a fresh establish); the connecting-predicates, peering observation, and handshake-slot budget iterate machines-with-legs so connect-window machines (leg not yet born) are excluded exactly as before and never double-counted against their pending-connect slot; the cross-connection extract takes the leg before disposing the machine; the stale reaper takes the leg and leaves the machine untouched when none is present, matching the old early return. The map-coherence debug check keeps its machine-has-carrier direction with the embedded leg as a carrier; the leg-to-machine direction is now true by construction and its gate const is gone. connection_count() counts machines with legs; the connections() iterator, the test seams, and the control-socket connection rows are re-implemented over the embedded legs with unchanged output.