MLLP and TCP deliveries refuse a payload holding more than one MSH (BACKLOG #2858, ADR 0209)

[wshallwshall]

Batch 265 (transports), BACKLOG #2858. This is its own PR because it changes a delivery control and adds ADR 0209. The decision it records was made by the batch 265 Manager under the owner's driver rule, the same way batch 186 decided ADR 0205 and 0206. The owner may overrule it at review. The decision is: refuse, with no batch-sender opt-out, and with HTTP and File out of scope.

Merge danger

Reversible: yes. A hand revert of ee1d77e and 86f08bf undoes it, ADR 0209 included.

Blast radius:

• Every MLLP and TCP delivery, through check_frame_bytes in messagefoundry/transports/framing.py. It is reached by a live send (frame_for_delivery), by each MLLP batch member (check_frame(rewrite=False)) and by a shadow outbound (check_frame).
• _holds_more_than_one_message moved unchanged into parsing/split.py. pipeline/ingress_guards.py imports it, and ingress behaviour is unchanged.
• Docstring-only edits in mllp.py, tcp.py and base.py.
• ADR 0209 and its index row, a forward link in ADR 0206, docs/CONNECTIONS.md, and a changelog fragment.
• pipeline/wiring_runner.py is not edited.

Evidence

• Before: with transports/framing.py put back to origin/main, 25 tests fail: the refusal, check_frame, shadow and batch-member tests. The single-message controls pass. Today two MSH in one Send go out as one frame.
• After: all of them pass.
  • All four MLLP send paths and both TCP send paths refuse before any dial, with CR, LF, CRLF, leading whitespace, a leading BOM and a BOM between messages. The refusal is NegativeAckError(permanent=True), code multiple-messages.
  • Single-message controls go out. An X12 relay and any payload not led by MSH go out over TCP.
  • The BHS/BTS envelope still goes out as one frame through the real MLLPDestination.send.
  • A batch member holding two messages is dead-lettered alone, live and in shadow, with BTS and BHS-11 correct.
  • The refusal text carries no message content.

Builder report: lane M, BACKLOG #2858

The source branch is b265-2858, head 86f08bf007c4e502f9ff5c648094542996472154, with 2 commits on origin/main 6f66234: ee1d77e8 (code and tests) and 86f08bf0 (ADR, docs and changelog).

• Where the brief and the tree disagree:
  • The brief put the check in MLLPDestination.check_frame and TcpDestination.check_frame. The live single-row path calls send(), which frames through frame_for_delivery and never calls check_frame. So the check is in the shared check_frame_bytes.
  • TCP has no batch aggregation, because wiring refuses batch on anything but MLLP. "Batch sending exists through ADR 0082" is therefore true for MLLP only. ADR 0209 says so and accepts that cost for TCP.
• Checks:
  • ruff is clean, and all three mypy legs are clean.
  • Targeted pytest passed: 466 tests.
  • The full suite (pytest -n 8 -x) exited 0, but its summary line was not captured. A pre-commit stash ran during it.
• QA: /simplify ran, then two code-review rounds at xhigh (13 findings, then 14), each followed by a repair round.
• Open findings, not fixed:
  1. In pipeline/wiring_runner.py, the _split_unframeable_members docstring and the _dead_letter_refused log line still say "its frame cannot carry it" and "names a byte and an offset". For a multiple-messages member that misleads triage.
  2. These design gaps are recorded in ADR 0209's Consequences and are not built:
     • a batch member led by anything but MSH is not read;
     • a second message behind a CR plus another character (such as \r\x0bMSH toward stx_etx TCP, or a space) is not refused;
     • HTTP outbounds keep the count gap;
     • a non-hl7v2 MLLP or TCP inbound admits multi-message bodies, which then dead-letter at an MLLP or TCP outbound;
     • dry-run, check and the Test Bench still preview such a payload as delivered (vault #2824). The reviewer suggested moving the check to where a Send becomes an outbox row.
  3. Minor:
     • parsing/split.py now holds four MSH-boundary readings kept in step by hand;
     • a clean payload pays two str.find scans;
     • the new destination tests do not aclose();
     • the new send-path tests sit beside near-copies of the ADR 0205 tests.
• Banner: DONE -- an MLLP or TCP delivery refuses an MSH-led payload holding a second MSH line as a permanent "multiple-messages" dead-letter, on the live send, each batch member and a shadow outbound; the BHS envelope and X12 relays are not read. The decision (refuse, no batch-sender opt-out, HTTP and File out of scope) is the batch 265 Manager's under the owner's driver rule, recorded in ADR 0209; the owner may overrule at review.

Hosted legs to read

• The standard required contexts. None of them is specific to this change.
• The docstring edits in mllp.py and tcp.py may need a trivial rebase against PR 2353.

[wshallwshall]

QA (lane M, BACKLOG #2858, head 86f08bf): /simplify (four agents), then code-review skill at level xhigh (BUILDER.md step 11), args as briefed plus "including the uncommitted working-tree changes". Two rounds (the cap), 13 then 14 findings; each run returned a JSON findings list and printed no separate tag. Fixed: BOM handling leading and between messages, ASCII source, a false ADR claim that TCP has a batch path, completeness overclaims reworded, ADR prose on rewrite ordering, stale docstrings in tcp/mllp/base and a stale test comment, head-member batch case, TCP tests parametrized. Shipped open: findings 1-3 in the PR body.

[wshallwshall]

Lander: enqueuing at pinned head 86f08bf. QA names this head. The refusal with no opt-out is the batch 265 Manager's decision under the owner's driver rule (ADR 0209), which the owner may overrule. Its open findings are filed as vault #3759, with a note on #2824 (PR 2503, merged). Required checks are green.