From c1e5745147537d7a45b5c6979ed9962eecefcd2b Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 09:43:08 +0900
Subject: [PATCH 01/33] feat(mq-h3): crate skeleton, h3wire submodule,
 pass-through decorator

---
 .gitmodules                       |   3 +
 Cargo.lock                        |  18 ++
 Cargo.toml                        |   2 +-
 crates/mq-h3/Cargo.toml           |  18 ++
 crates/mq-h3/src/lib.rs           | 295 ++++++++++++++++++++++++++++++
 crates/mq-h3/src/queue.rs         | 118 ++++++++++++
 crates/mq-h3/tests/passthrough.rs | 217 ++++++++++++++++++++++
 third_party/h3wire                |   1 +
 8 files changed, 671 insertions(+), 1 deletion(-)
 create mode 100644 crates/mq-h3/Cargo.toml
 create mode 100644 crates/mq-h3/src/lib.rs
 create mode 100644 crates/mq-h3/src/queue.rs
 create mode 100644 crates/mq-h3/tests/passthrough.rs
 create mode 160000 third_party/h3wire

diff --git a/.gitmodules b/.gitmodules
index b0e229a2..b5cde45b 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -2,3 +2,6 @@
 	path = third_party/xquic
 	url = https://github.com/mp0rta/xquic.git
 	branch = mqvpn-main
+[submodule "third_party/h3wire"]
+	path = third_party/h3wire
+	url = https://github.com/mp0rta/h3wire.git
diff --git a/Cargo.lock b/Cargo.lock
index 730fc95a..59f9b213 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -377,6 +377,13 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "h3wire"
+version = "0.1.0"
+dependencies = [
+ "proptest",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.17.1"
@@ -526,6 +533,17 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "mq-h3"
+version = "0.0.4"
+dependencies = [
+ "h3wire",
+ "log",
+ "mq-runtime",
+ "mq-transport-api",
+ "proptest",
+]
+
 [[package]]
 name = "mq-http"
 version = "0.0.4"
diff --git a/Cargo.toml b/Cargo.toml
index 2f3433b9..f2a51d1c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ resolver = "2"
 members = [
   "crates/xquic-sys", "crates/mq-linux", "crates/mq-wire", "crates/mq-http", "crates/mq-wire-difftest",
   "crates/mq-transport-api", "crates/mq-transport", "crates/mq-runtime",
-  "crates/mq-proxy", "crates/mqproxy", "crates/mq-integration",
+  "crates/mq-h3", "crates/mq-proxy", "crates/mqproxy", "crates/mq-integration",
 ]
 exclude = ["crates/mq-wire/fuzz", "crates/mq-proxy/fuzz", "crates/mq-http/fuzz"]   # cargo-fuzz crates are their own workspaces
 
diff --git a/crates/mq-h3/Cargo.toml b/crates/mq-h3/Cargo.toml
new file mode 100644
index 00000000..52273871
--- /dev/null
+++ b/crates/mq-h3/Cargo.toml
@@ -0,0 +1,18 @@
+[package]
+name = "mq-h3"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[dependencies]
+h3wire = { path = "../../third_party/h3wire/h3wire" }
+mq-transport-api = { path = "../mq-transport-api" }
+log = { workspace = true }
+
+[features]
+test-support = []
+
+[dev-dependencies]
+mq-runtime = { path = "../mq-runtime", features = ["test-support"] }
+proptest = { workspace = true }
diff --git a/crates/mq-h3/src/lib.rs b/crates/mq-h3/src/lib.rs
new file mode 100644
index 00000000..af3f1d1c
--- /dev/null
+++ b/crates/mq-h3/src/lib.rs
@@ -0,0 +1,295 @@
+//! `H3Wire<T>`: a `TransportOps` decorator serving HTTP/3 from h3wire (adoption spec §4.1).
+//!
+//! C1 scope: the pass-through decorator and the outer event queue. H3 conns served from
+//! h3wire (`H3Wire::new`) are filled in by the later tasks.
+#![forbid(unsafe_code)]
+
+mod queue;
+
+use mq_transport_api::{
+    ConnConfig, ConnId, ConnStats, ConnectError, DatagramError, Error, Event, H3Header, H3ReqId,
+    H3ReqInfo, PathError, PathId, StreamError, StreamId, StreamInfo, Time, Transmit, TransportOps,
+    TxKey,
+};
+use queue::OutQueue;
+use std::collections::HashSet;
+use std::net::SocketAddr;
+
+/// Bootstrap read size for a request stream (adoption spec §4.4).
+pub const BOOT_READ: usize = 4096;
+
+pub struct H3Wire<T> {
+    inner: T,
+    /// `false`: create no H3 state; every op and event passes through (adoption spec §4.1).
+    active: bool,
+    queue: OutQueue,
+    /// Requests this wrapper holds; always empty until request state lands (later tasks).
+    reqs: HashSet<H3ReqId>,
+}
+
+impl<T: TransportOps> H3Wire<T> {
+    /// Serves H3 conns from h3wire (inner must be `h3_backend: Raw`).
+    pub fn new(inner: T) -> Self {
+        Self::make(inner, true)
+    }
+
+    /// Creates no H3 state: every op and event passes through unfiltered (inner may be xqc_h3).
+    pub fn passthrough(inner: T) -> Self {
+        Self::make(inner, false)
+    }
+
+    fn make(inner: T, active: bool) -> Self {
+        H3Wire {
+            inner,
+            active,
+            queue: OutQueue::default(),
+            reqs: HashSet::new(),
+        }
+    }
+
+    pub fn inner(&self) -> &T {
+        &self.inner
+    }
+
+    pub fn inner_mut(&mut self) -> &mut T {
+        &mut self.inner
+    }
+
+    pub fn into_inner(self) -> T {
+        self.inner
+    }
+
+    /// Moves the inner queue into ours; runs at the end of every method that takes `now`
+    /// (adoption spec §4.1).
+    fn drive_inner(&mut self, _now: Time) {
+        while let Some(e) = self.inner.poll_event() {
+            self.queue.push(e);
+        }
+    }
+
+    /// An active wrapper holds no request it did not create: anything else is stale.
+    fn known(&self, r: H3ReqId) -> bool {
+        self.reqs.contains(&r)
+    }
+}
+
+/// Runs a forwarding op, then drains the inner queue.
+macro_rules! fwd {
+    ($self:ident, $now:ident, $e:expr) => {{
+        let out = $e;
+        $self.drive_inner($now);
+        out
+    }};
+}
+
+impl<T: TransportOps> TransportOps for H3Wire<T> {
+    fn recv_datagram(&mut self, now: Time, local: SocketAddr, peer: SocketAddr, data: &[u8]) {
+        fwd!(self, now, self.inner.recv_datagram(now, local, peer, data))
+    }
+
+    fn drive(&mut self, now: Time) {
+        fwd!(self, now, self.inner.drive(now))
+    }
+
+    fn pending_transmit(&self, out: &mut Vec<TxKey>) {
+        self.inner.pending_transmit(out)
+    }
+
+    fn peek_transmit(&mut self, key: TxKey) -> Option<Transmit<'_>> {
+        self.inner.peek_transmit(key)
+    }
+
+    fn transmit_done(&mut self, key: TxKey, datagrams: usize) {
+        self.inner.transmit_done(key, datagrams)
+    }
+
+    fn resume_pending(&self) -> bool {
+        self.inner.resume_pending()
+    }
+
+    /// Pops our own queue; stale readiness/creation events are dropped, close events never
+    /// (adoption spec §4.1).
+    fn poll_event(&mut self) -> Option<Event> {
+        let Self {
+            inner,
+            active,
+            queue,
+            reqs,
+        } = self;
+        queue.pop(|e| match e {
+            Event::NewStream(_, s, _)
+            | Event::StreamReadable(s)
+            | Event::StreamWritable(s)
+            | Event::StreamPeerReset(s, _)
+            | Event::StreamStopSending(s, _) => inner.stream_info(*s).is_ok(),
+            // The inner transport already filtered passthrough H3 events.
+            Event::H3Request(_, r) | Event::H3Readable(r) | Event::H3Writable(r) => {
+                !*active || reqs.contains(r)
+            }
+            _ => true,
+        })
+    }
+
+    fn next_timeout(&self) -> Option<Time> {
+        self.inner.next_timeout()
+    }
+
+    fn connect(&mut self, now: Time, cfg: &ConnConfig) -> Result<ConnId, ConnectError> {
+        fwd!(self, now, self.inner.connect(now, cfg))
+    }
+
+    fn open_stream(&mut self, now: Time, conn: ConnId) -> Result<StreamId, Error> {
+        fwd!(self, now, self.inner.open_stream(now, conn))
+    }
+
+    fn stream_send(
+        &mut self,
+        now: Time,
+        s: StreamId,
+        data: &[u8],
+        fin: bool,
+    ) -> Result<usize, StreamError> {
+        fwd!(self, now, self.inner.stream_send(now, s, data, fin))
+    }
+
+    fn stream_recv(
+        &mut self,
+        now: Time,
+        s: StreamId,
+        buf: &mut [u8],
+    ) -> Result<(usize, bool), StreamError> {
+        fwd!(self, now, self.inner.stream_recv(now, s, buf))
+    }
+
+    fn stream_reset(&mut self, now: Time, s: StreamId) {
+        fwd!(self, now, self.inner.stream_reset(now, s))
+    }
+
+    fn open_uni(&mut self, now: Time, conn: ConnId) -> Result<StreamId, Error> {
+        fwd!(self, now, self.inner.open_uni(now, conn))
+    }
+
+    fn stream_reset_send(&mut self, now: Time, s: StreamId, code: u64) {
+        fwd!(self, now, self.inner.stream_reset_send(now, s, code))
+    }
+
+    fn stream_stop_sending(&mut self, now: Time, s: StreamId, code: u64) {
+        fwd!(self, now, self.inner.stream_stop_sending(now, s, code))
+    }
+
+    fn add_path(&mut self, now: Time, conn: ConnId, standby: bool) -> Result<PathId, PathError> {
+        fwd!(self, now, self.inner.add_path(now, conn, standby))
+    }
+
+    fn close_conn(&mut self, now: Time, conn: ConnId) {
+        fwd!(self, now, self.inner.close_conn(now, conn))
+    }
+
+    fn close_conn_with(&mut self, now: Time, conn: ConnId, code: u64) {
+        fwd!(self, now, self.inner.close_conn_with(now, conn, code))
+    }
+
+    fn mark_conn_authed(&mut self, conn: ConnId) {
+        self.inner.mark_conn_authed(conn)
+    }
+
+    fn conn_stats(&self, conn: ConnId) -> Result<ConnStats, Error> {
+        self.inner.conn_stats(conn)
+    }
+
+    fn stream_info(&self, s: StreamId) -> Result<StreamInfo, Error> {
+        self.inner.stream_info(s)
+    }
+
+    fn datagram_send(&mut self, now: Time, conn: ConnId, data: &[u8]) -> Result<(), DatagramError> {
+        fwd!(self, now, self.inner.datagram_send(now, conn, data))
+    }
+
+    fn datagram_mss(&self, conn: ConnId) -> usize {
+        self.inner.datagram_mss(conn)
+    }
+
+    fn datagram_recv(&mut self, conn: ConnId, buf: &mut [u8]) -> Option<usize> {
+        self.inner.datagram_recv(conn, buf)
+    }
+
+    // H3 ops. Active: C1 holds no request, so every id is stale (adoption spec §4.1);
+    // later tasks serve them from h3wire.
+    fn open_h3_request(&mut self, now: Time, conn: ConnId) -> Result<H3ReqId, Error> {
+        if self.active {
+            return Err(Error::Other); // filled in by C2
+        }
+        fwd!(self, now, self.inner.open_h3_request(now, conn))
+    }
+
+    fn h3_send_headers(
+        &mut self,
+        now: Time,
+        r: H3ReqId,
+        hs: &[H3Header<'_>],
+        fin: bool,
+    ) -> Result<(), StreamError> {
+        if self.active && !self.known(r) {
+            return Err(StreamError::Stale);
+        }
+        fwd!(self, now, self.inner.h3_send_headers(now, r, hs, fin))
+    }
+
+    fn h3_send_body(
+        &mut self,
+        now: Time,
+        r: H3ReqId,
+        data: &[u8],
+        fin: bool,
+    ) -> Result<usize, StreamError> {
+        if self.active && !self.known(r) {
+            return Err(StreamError::Stale);
+        }
+        fwd!(self, now, self.inner.h3_send_body(now, r, data, fin))
+    }
+
+    fn h3_finish(&mut self, now: Time, r: H3ReqId) -> Result<(), StreamError> {
+        if self.active && !self.known(r) {
+            return Err(StreamError::Stale);
+        }
+        fwd!(self, now, self.inner.h3_finish(now, r))
+    }
+
+    fn h3_recv_headers(
+        &mut self,
+        now: Time,
+        r: H3ReqId,
+        each: &mut dyn FnMut(&[u8], &[u8]),
+    ) -> Result<bool, StreamError> {
+        if self.active && !self.known(r) {
+            return Err(StreamError::Stale);
+        }
+        fwd!(self, now, self.inner.h3_recv_headers(now, r, each))
+    }
+
+    fn h3_recv_body(
+        &mut self,
+        now: Time,
+        r: H3ReqId,
+        buf: &mut [u8],
+    ) -> Result<(usize, bool), StreamError> {
+        if self.active && !self.known(r) {
+            return Err(StreamError::Stale);
+        }
+        fwd!(self, now, self.inner.h3_recv_body(now, r, buf))
+    }
+
+    fn h3_reset(&mut self, now: Time, r: H3ReqId) {
+        if self.active && !self.known(r) {
+            return;
+        }
+        fwd!(self, now, self.inner.h3_reset(now, r))
+    }
+
+    fn h3_req_info(&self, r: H3ReqId) -> Result<H3ReqInfo, Error> {
+        if self.active && !self.known(r) {
+            return Err(Error::Stale);
+        }
+        self.inner.h3_req_info(r)
+    }
+}
diff --git a/crates/mq-h3/src/queue.rs b/crates/mq-h3/src/queue.rs
new file mode 100644
index 00000000..76629309
--- /dev/null
+++ b/crates/mq-h3/src/queue.rs
@@ -0,0 +1,118 @@
+//! Outer event queue (adoption spec §4.1): level events coalesce, stale ones drop on pop.
+
+use mq_transport_api::Event;
+use std::collections::VecDeque;
+
+#[derive(Default)]
+pub(crate) struct OutQueue {
+    q: VecDeque<Event>,
+}
+
+fn is_level(e: &Event) -> bool {
+    matches!(
+        e,
+        Event::StreamReadable(_)
+            | Event::StreamWritable(_)
+            | Event::DatagramReadable(_)
+            | Event::MpReady(_)
+            | Event::H3Readable(_)
+            | Event::H3Writable(_)
+    )
+}
+
+/// Close events are the last word on an id and are never dropped (adoption spec §4.1).
+fn is_close(e: &Event) -> bool {
+    matches!(
+        e,
+        Event::StreamClosed(_)
+            | Event::StreamCloseStats(..)
+            | Event::H3Closed(..)
+            | Event::ConnClosed(..)
+    )
+}
+
+impl OutQueue {
+    /// A level event already queued is not queued twice.
+    pub(crate) fn push(&mut self, e: Event) {
+        // ponytail: linear scan; queues are short per drain. Index by object if profiling says so.
+        if is_level(&e) && self.q.contains(&e) {
+            return;
+        }
+        self.q.push_back(e);
+    }
+
+    /// The next event that is a close event or that `live` accepts.
+    pub(crate) fn pop(&mut self, live: impl Fn(&Event) -> bool) -> Option<Event> {
+        while let Some(e) = self.q.pop_front() {
+            if is_close(&e) || live(&e) {
+                return Some(e);
+            }
+        }
+        None
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use mq_transport_api::{CloseReason, ConnId, ConnProto, ErrType, H3ReqId, SlotId, StreamId};
+
+    fn s(i: u32) -> StreamId {
+        StreamId::from_slot(SlotId::new(i, 1)).unwrap()
+    }
+    fn c(i: u32) -> ConnId {
+        ConnId::from_slot(SlotId::new(i, 1)).unwrap()
+    }
+
+    #[test]
+    fn level_events_coalesce() {
+        let mut q = OutQueue::default();
+        q.push(Event::StreamReadable(s(1)));
+        q.push(Event::StreamReadable(s(1)));
+        q.push(Event::StreamReadable(s(2)));
+        assert_eq!(q.pop(|_| true), Some(Event::StreamReadable(s(1))));
+        assert_eq!(q.pop(|_| true), Some(Event::StreamReadable(s(2))));
+        assert_eq!(q.pop(|_| true), None);
+        // After the pop the flag is clear again.
+        q.push(Event::StreamReadable(s(1)));
+        assert_eq!(q.pop(|_| true), Some(Event::StreamReadable(s(1))));
+    }
+
+    #[test]
+    fn close_events_never_dropped() {
+        let mut q = OutQueue::default();
+        let r = H3ReqId::from_slot(SlotId::new(3, 1)).unwrap();
+        let reason = CloseReason {
+            err_type: ErrType::Unknown,
+            code: 0,
+        };
+        q.push(Event::StreamClosed(s(1)));
+        q.push(Event::ConnClosed(c(1), reason));
+        q.push(Event::StreamReadable(s(1)));
+        q.push(Event::StreamWritable(s(1)));
+        q.push(Event::NewConn(c(2), ConnProto::H3));
+        q.push(Event::H3Readable(r));
+        assert_eq!(q.pop(|_| false), Some(Event::StreamClosed(s(1))));
+        assert_eq!(q.pop(|_| false), Some(Event::ConnClosed(c(1), reason)));
+        assert_eq!(q.pop(|_| false), None);
+    }
+
+    #[test]
+    fn order_is_fifo_otherwise() {
+        let mut q = OutQueue::default();
+        q.push(Event::StreamWritable(s(2)));
+        q.push(Event::StreamReadable(s(1)));
+        q.push(Event::StreamClosed(s(3)));
+        q.push(Event::StreamWritable(s(1)));
+        let got: Vec<_> = std::iter::from_fn(|| q.pop(|_| true)).collect();
+        assert_eq!(
+            got,
+            vec![
+                Event::StreamWritable(s(2)),
+                Event::StreamReadable(s(1)),
+                Event::StreamClosed(s(3)),
+                Event::StreamWritable(s(1)),
+            ]
+        );
+    }
+}
diff --git a/crates/mq-h3/tests/passthrough.rs b/crates/mq-h3/tests/passthrough.rs
new file mode 100644
index 00000000..6048a4fe
--- /dev/null
+++ b/crates/mq-h3/tests/passthrough.rs
@@ -0,0 +1,217 @@
+//! Pass-through behaviour of `H3Wire` over `ScriptedTransport` (adoption spec §4.1).
+
+use mq_h3::H3Wire;
+use mq_runtime::testing::{Call, ScriptedHandle, ScriptedTransport};
+use mq_transport_api::{
+    CloseReason, ConnConfig, ConnProto, ErrType, Error, Event, H3Close, H3ReqStats, StreamError,
+    StreamInfo, StreamKind, Time, TransportOps,
+};
+use std::net::SocketAddr;
+
+fn mk(active: bool) -> (H3Wire<ScriptedTransport>, ScriptedHandle) {
+    let (t, h) = ScriptedTransport::new();
+    (
+        if active {
+            H3Wire::new(t)
+        } else {
+            H3Wire::passthrough(t)
+        },
+        h,
+    )
+}
+
+const NOW: Time = Time::ZERO;
+
+fn addr() -> SocketAddr {
+    "127.0.0.1:4433".parse().unwrap()
+}
+
+fn raw_ops(active: bool) {
+    let (mut w, h) = mk(active);
+    let cfg = ConnConfig {
+        peer: addr(),
+        sni: "mqproxy",
+        idle_timeout: None,
+        proto: ConnProto::Raw,
+    };
+    let c = w.connect(NOW, &cfg).unwrap();
+    let s = w.open_stream(NOW, c).unwrap();
+    assert_eq!(w.stream_send(NOW, s, b"abc", true), Ok(3));
+    let mut buf = [0u8; 8];
+    assert_eq!(w.stream_recv(NOW, s, &mut buf), Err(StreamError::Blocked));
+    w.stream_reset(NOW, s);
+    w.stream_reset_send(NOW, s, 0x10c);
+    w.stream_stop_sending(NOW, s, 0x10b);
+    let u = w.open_uni(NOW, c).unwrap();
+    assert_eq!(w.add_path(NOW, c, true).map(|_| ()), Ok(()));
+    assert_eq!(w.datagram_send(NOW, c, b"dg"), Ok(()));
+    w.close_conn(NOW, c);
+    w.close_conn_with(NOW, c, 0x101);
+    let _ = w.conn_stats(c);
+    let _ = w.stream_info(s);
+    let log = h.log();
+    let want = [
+        Call::Connect(cfg),
+        Call::OpenStream(c),
+        Call::StreamSend {
+            s,
+            bytes: b"abc".to_vec(),
+            fin: true,
+        },
+        Call::StreamRecv { s, cap: 8 },
+        Call::StreamReset(s),
+        Call::StreamResetSend { s, code: 0x10c },
+        Call::StreamStopSending { s, code: 0x10b },
+        Call::OpenUni(c),
+        Call::AddPath {
+            conn: c,
+            standby: true,
+        },
+        Call::DatagramSend {
+            conn: c,
+            bytes: b"dg".to_vec(),
+        },
+        Call::CloseConn(c),
+        Call::CloseConnWith {
+            conn: c,
+            code: 0x101,
+        },
+    ];
+    assert_eq!(log, want);
+    let _ = u;
+}
+
+#[test]
+fn raw_ops_reach_inner() {
+    raw_ops(false);
+    raw_ops(true);
+}
+
+fn raw_events(active: bool) {
+    let (mut w, h) = mk(active);
+    let c = h.new_conn_id();
+    let s = h.new_stream_id();
+    let info = StreamInfo {
+        conn: c,
+        quic_id: 0,
+        kind: StreamKind::Bidi,
+    };
+    h.set_stream_info(s, info);
+    let reason = CloseReason {
+        err_type: ErrType::Unknown,
+        code: 0,
+    };
+    let evs = vec![
+        Event::NewConn(c, ConnProto::Raw),
+        Event::ConnEstablished(c),
+        Event::NewStream(c, s, info),
+        Event::StreamReadable(s),
+        Event::StreamWritable(s),
+        Event::StreamPeerReset(s, 0x10c),
+        Event::StreamStopSending(s, 0x10b),
+        Event::MpReady(c),
+        Event::DatagramReadable(c),
+        Event::StreamClosed(s),
+        Event::ConnClosed(c, reason),
+    ];
+    for e in &evs {
+        h.push_event(e.clone());
+    }
+    w.drive(NOW);
+    let got: Vec<_> = std::iter::from_fn(|| w.poll_event()).collect();
+    assert_eq!(got, evs);
+}
+
+#[test]
+fn raw_events_pop_out() {
+    raw_events(false);
+    raw_events(true);
+}
+
+#[test]
+fn passthrough_h3_ops_and_events() {
+    let (mut w, h) = mk(false);
+    let c = h.new_conn_id();
+    let r = h.new_h3_request(c);
+    h.expect_open_h3_request(c, Ok(r));
+    assert_eq!(w.open_h3_request(NOW, c), Ok(r));
+    assert_eq!(w.h3_send_body(NOW, r, b"x", false), Ok(1));
+    assert_eq!(w.h3_finish(NOW, r), Ok(()));
+    let mut buf = [0u8; 4];
+    assert_eq!(w.h3_recv_body(NOW, r, &mut buf), Err(StreamError::Blocked));
+    assert_eq!(
+        w.h3_recv_headers(NOW, r, &mut |_, _| {}),
+        Err(StreamError::Blocked)
+    );
+    w.h3_reset(NOW, r);
+    let log = h.log();
+    for call in [
+        Call::OpenH3Request(c),
+        Call::H3Finish(r),
+        Call::H3Reset(r),
+        Call::H3RecvHeaders(r),
+    ] {
+        assert!(log.contains(&call), "{call:?} missing in {log:?}");
+    }
+    assert!(log.contains(&Call::H3RecvBody { r, cap: 4 }));
+
+    // Events for ids the wrapper never saw pass unchanged.
+    let r2 = h.new_h3_request(c);
+    let stats = H3ReqStats {
+        send_body: 0,
+        recv_body: 0,
+        begin_us: 0,
+        header_send_us: 0,
+        fin_send_us: 0,
+        fin_ack_us: 0,
+        mp_state: 0,
+        stream_err: 0,
+        close_msg: None,
+    };
+    let closed = Event::H3Closed(
+        r2,
+        Box::new(H3Close {
+            stats,
+            unread: None,
+        }),
+    );
+    h.push_event(Event::H3Readable(r2));
+    h.push_event(Event::H3Writable(r2));
+    h.push_event(closed.clone());
+    w.drive(NOW);
+    let got: Vec<_> = std::iter::from_fn(|| w.poll_event()).collect();
+    assert_eq!(
+        got,
+        vec![
+            Event::H3Request(c, r),
+            Event::H3Request(c, r2),
+            Event::H3Readable(r2),
+            Event::H3Writable(r2),
+            closed
+        ]
+    );
+}
+
+#[test]
+fn active_unknown_id_is_stale_and_not_forwarded() {
+    let (mut w, h) = mk(true);
+    let c = h.new_conn_id();
+    let r = h.new_h3_request(c);
+    let mut buf = [0u8; 4];
+    assert_eq!(w.h3_recv_body(NOW, r, &mut buf), Err(StreamError::Stale));
+    assert_eq!(w.h3_send_body(NOW, r, b"x", false), Err(StreamError::Stale));
+    assert_eq!(w.h3_finish(NOW, r), Err(StreamError::Stale));
+    assert_eq!(w.h3_req_info(r), Err(Error::Stale));
+    w.h3_reset(NOW, r);
+    let log = h.log();
+    assert!(
+        !log.iter().any(|c| matches!(
+            c,
+            Call::H3RecvBody { .. }
+                | Call::H3SendBody { .. }
+                | Call::H3Finish(_)
+                | Call::H3Reset(_)
+        )),
+        "forwarded: {log:?}"
+    );
+}
diff --git a/third_party/h3wire b/third_party/h3wire
new file mode 160000
index 00000000..c78689b1
--- /dev/null
+++ b/third_party/h3wire
@@ -0,0 +1 @@
+Subproject commit c78689b13071540fb6d069eb26d4555b02e47494

From 42a090059a08ade200019f1121eec5f19b76589c Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 09:54:53 +0900
Subject: [PATCH 02/33] feat(mq-h3): connection setup, actions and the test rig

---
 crates/mq-h3/src/conn.rs                  | 165 +++++++++++
 crates/mq-h3/src/lib.rs                   |  68 +++--
 crates/mq-h3/src/send.rs                  | 102 +++++++
 crates/mq-h3/tests/common/mod.rs          | 321 ++++++++++++++++++++++
 crates/mq-h3/tests/setup.rs               | 123 +++++++++
 crates/mq-runtime/src/testing/scripted.rs |   4 +
 6 files changed, 757 insertions(+), 26 deletions(-)
 create mode 100644 crates/mq-h3/src/conn.rs
 create mode 100644 crates/mq-h3/src/send.rs
 create mode 100644 crates/mq-h3/tests/common/mod.rs
 create mode 100644 crates/mq-h3/tests/setup.rs

diff --git a/crates/mq-h3/src/conn.rs b/crates/mq-h3/src/conn.rs
new file mode 100644
index 00000000..b296a43c
--- /dev/null
+++ b/crates/mq-h3/src/conn.rs
@@ -0,0 +1,165 @@
+//! One `h3wire::Connection` per H3 conn, and the raw events it consumes (adoption spec §4.2,
+//! §4.4).
+
+use crate::{BOOT_READ, H3Wire};
+use h3wire::{Config, Connection, H3Code, Role, StreamId as Q};
+use mq_transport_api::{ConnId, ConnProto, Event, StreamError, StreamId, Time, TransportOps};
+use std::collections::{HashMap, HashSet};
+
+/// Equals `mq_transport::H3_FIELD_SECTION_MAX`; mq-h3 does not depend on mq-transport.
+const FIELD_SECTION_MAX: usize = 64 * 1024;
+
+/// adoption spec §4.2.
+pub(crate) fn h3_config() -> Config {
+    let mut c = Config::default();
+    c.max_encoded_field_section_size = FIELD_SECTION_MAX;
+    c.max_field_section_size = Some(FIELD_SECTION_MAX as u64);
+    c.grease = true;
+    c.enable_connect_protocol = false;
+    c.h3_datagram = false;
+    c
+}
+
+pub(crate) struct H3Conn {
+    pub(crate) h3: Connection,
+    pub(crate) client: bool,
+    /// The mq id of each quic id: local and peer uni streams, request streams.
+    pub(crate) mq: HashMap<u64, StreamId>,
+    /// Peer uni streams read to FIN or reset: never fed again, since h3wire would take
+    /// further bytes for a new stream's type.
+    pub(crate) uni_done: HashSet<StreamId>,
+    /// We closed the transport; h3wire's actions and bytes are dropped from then on.
+    pub(crate) closing: bool,
+}
+
+impl H3Conn {
+    pub(crate) fn is_local(&self, q: Q) -> bool {
+        q.is_client_initiated() == self.client
+    }
+}
+
+impl<T: TransportOps> H3Wire<T> {
+    pub(crate) fn add_conn(&mut self, now: Time, c: ConnId, role: Role) {
+        let conn = H3Conn {
+            h3: Connection::new(role, h3_config()),
+            client: role == Role::Client,
+            mq: HashMap::new(),
+            uni_done: HashSet::new(),
+            closing: false,
+        };
+        self.conns.insert(c, conn);
+        self.service(now, c);
+    }
+
+    /// An inner event, active mode. Returns it if it passes through; the raw stream events
+    /// of H3 conns are consumed here (adoption spec §4.1).
+    pub(crate) fn on_event(&mut self, now: Time, e: Event) -> Option<Event> {
+        match e {
+            Event::NewConn(c, ConnProto::H3) => self.add_conn(now, c, Role::Server),
+            // ponytail: C2 drops the conn outright; Task C5 adds the request fan-out.
+            Event::ConnClosed(c, _) => {
+                if let Some(conn) = self.conns.remove(&c) {
+                    for s in conn.mq.values() {
+                        self.streams.remove(s);
+                    }
+                }
+            }
+            Event::NewStream(c, s, info) => {
+                let Some(conn) = self.conns.get_mut(&c) else {
+                    return Some(e);
+                };
+                conn.mq.insert(info.quic_id, s);
+                self.streams.insert(s, (c, Q(info.quic_id)));
+                return None;
+            }
+            Event::StreamReadable(s)
+            | Event::StreamWritable(s)
+            | Event::StreamPeerReset(s, _)
+            | Event::StreamStopSending(s, _)
+            | Event::StreamCloseStats(s, _)
+            | Event::StreamClosed(s) => {
+                let Some(&(c, q)) = self.streams.get(&s) else {
+                    return Some(e);
+                };
+                self.on_stream_event(now, c, s, q, e);
+                self.service(now, c);
+                return None;
+            }
+            _ => {}
+        }
+        Some(e)
+    }
+
+    fn on_stream_event(&mut self, now: Time, c: ConnId, s: StreamId, q: Q, e: Event) {
+        let conn = self
+            .conns
+            .get_mut(&c)
+            .expect("streams only name live conns");
+        let peer_uni = q.is_uni() && !conn.is_local(q);
+        match e {
+            Event::StreamReadable(_) if peer_uni => self.read_uni(now, c, s, q),
+            Event::StreamPeerReset(_, code) => {
+                if peer_uni && conn.uni_done.insert(s) {
+                    log_closed(conn.h3.stream_reset_received(q, H3Code(code)));
+                }
+                // Retirement probe (adoption spec §3); request streams: Task C3/C5.
+                if peer_uni {
+                    self.read_uni(now, c, s, q);
+                }
+            }
+            Event::StreamStopSending(_, code) => {
+                log_closed(conn.h3.stop_sending_received(q, H3Code(code)));
+            }
+            Event::StreamClosed(_) => {
+                conn.mq.remove(&q.0);
+                conn.uni_done.remove(&s);
+                self.streams.remove(&s);
+            }
+            // Writable: `service` flushes. CloseStats of a non-request stream: ignored.
+            _ => {}
+        }
+    }
+
+    /// Reads a peer uni stream eagerly to the transport's end (adoption spec §4.4).
+    fn read_uni(&mut self, now: Time, c: ConnId, s: StreamId, q: Q) {
+        let mut buf = [0u8; BOOT_READ];
+        loop {
+            let r = self.inner.stream_recv(now, s, &mut buf);
+            let conn = self
+                .conns
+                .get_mut(&c)
+                .expect("streams only name live conns");
+            match r {
+                Ok((n, fin)) => {
+                    if !conn.uni_done.contains(&s) {
+                        // A uni stream always consumes everything.
+                        log_closed(conn.h3.recv(q, &buf[..n], fin).map(drop));
+                    }
+                    if fin {
+                        conn.uni_done.insert(s);
+                    }
+                    if fin || n == 0 {
+                        return;
+                    }
+                }
+                Err(StreamError::Reset) => {
+                    // Reset, code pending (adoption spec §4.4): the code only matters on a
+                    // critical stream, which closes the conn whatever it is.
+                    if conn.uni_done.insert(s) {
+                        log_closed(conn.h3.stream_reset_received(q, H3Code::REQUEST_CANCELLED));
+                    }
+                    return;
+                }
+                Err(_) => return,
+            }
+        }
+    }
+}
+
+/// `ConnectionError` is a state notification; the wire effect is a queued action
+/// (adoption spec §5.1).
+fn log_closed(r: Result<(), h3wire::ConnectionError>) {
+    if let Err(e) = r {
+        log::debug!("h3wire: {e}");
+    }
+}
diff --git a/crates/mq-h3/src/lib.rs b/crates/mq-h3/src/lib.rs
index af3f1d1c..706a375b 100644
--- a/crates/mq-h3/src/lib.rs
+++ b/crates/mq-h3/src/lib.rs
@@ -1,18 +1,21 @@
 //! `H3Wire<T>`: a `TransportOps` decorator serving HTTP/3 from h3wire (adoption spec §4.1).
 //!
-//! C1 scope: the pass-through decorator and the outer event queue. H3 conns served from
-//! h3wire (`H3Wire::new`) are filled in by the later tasks.
+//! Active mode (`H3Wire::new`) runs one h3wire `Connection` per H3 conn; requests are served
+//! from it by the later tasks (C3–C5).
 #![forbid(unsafe_code)]
 
+mod conn;
 mod queue;
+mod send;
 
+use conn::H3Conn;
 use mq_transport_api::{
-    ConnConfig, ConnId, ConnStats, ConnectError, DatagramError, Error, Event, H3Header, H3ReqId,
-    H3ReqInfo, PathError, PathId, StreamError, StreamId, StreamInfo, Time, Transmit, TransportOps,
-    TxKey,
+    ConnConfig, ConnId, ConnProto, ConnStats, ConnectError, DatagramError, Error, Event, H3Header,
+    H3ReqId, H3ReqInfo, PathError, PathId, StreamError, StreamId, StreamInfo, Time, Transmit,
+    TransportOps, TxKey,
 };
 use queue::OutQueue;
-use std::collections::HashSet;
+use std::collections::{HashMap, HashSet};
 use std::net::SocketAddr;
 
 /// Bootstrap read size for a request stream (adoption spec §4.4).
@@ -25,6 +28,9 @@ pub struct H3Wire<T> {
     queue: OutQueue,
     /// Requests this wrapper holds; always empty until request state lands (later tasks).
     reqs: HashSet<H3ReqId>,
+    conns: HashMap<ConnId, H3Conn>,
+    /// Every stream of an H3 conn: its conn and quic id.
+    streams: HashMap<StreamId, (ConnId, h3wire::StreamId)>,
 }
 
 impl<T: TransportOps> H3Wire<T> {
@@ -44,6 +50,8 @@ impl<T: TransportOps> H3Wire<T> {
             active,
             queue: OutQueue::default(),
             reqs: HashSet::new(),
+            conns: HashMap::new(),
+            streams: HashMap::new(),
         }
     }
 
@@ -59,18 +67,20 @@ impl<T: TransportOps> H3Wire<T> {
         self.inner
     }
 
-    /// Moves the inner queue into ours; runs at the end of every method that takes `now`
-    /// (adoption spec §4.1).
-    fn drive_inner(&mut self, _now: Time) {
+    /// Moves the inner queue into ours, consuming what belongs to H3 conns; runs at the end
+    /// of every method that takes `now` (adoption spec §4.1).
+    fn drive_inner(&mut self, now: Time) {
         while let Some(e) = self.inner.poll_event() {
-            self.queue.push(e);
+            let out = if self.active {
+                self.on_event(now, e)
+            } else {
+                Some(e)
+            };
+            if let Some(e) = out {
+                self.queue.push(e);
+            }
         }
     }
-
-    /// An active wrapper holds no request it did not create: anything else is stale.
-    fn known(&self, r: H3ReqId) -> bool {
-        self.reqs.contains(&r)
-    }
 }
 
 /// Runs a forwarding op, then drains the inner queue.
@@ -115,6 +125,7 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
             active,
             queue,
             reqs,
+            ..
         } = self;
         queue.pop(|e| match e {
             Event::NewStream(_, s, _)
@@ -135,7 +146,12 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
     }
 
     fn connect(&mut self, now: Time, cfg: &ConnConfig) -> Result<ConnId, ConnectError> {
-        fwd!(self, now, self.inner.connect(now, cfg))
+        let r = self.inner.connect(now, cfg);
+        if let (true, ConnProto::H3, Ok(c)) = (self.active, cfg.proto, r) {
+            self.add_conn(now, c, h3wire::Role::Client);
+        }
+        self.drive_inner(now);
+        r
     }
 
     fn open_stream(&mut self, now: Time, conn: ConnId) -> Result<StreamId, Error> {
@@ -213,11 +229,11 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         self.inner.datagram_recv(conn, buf)
     }
 
-    // H3 ops. Active: C1 holds no request, so every id is stale (adoption spec §4.1);
-    // later tasks serve them from h3wire.
+    // H3 ops. Active: never forwarded; no request is held yet, so every id is stale
+    // (adoption spec §4.1). Tasks C3–C5 serve them from h3wire.
     fn open_h3_request(&mut self, now: Time, conn: ConnId) -> Result<H3ReqId, Error> {
         if self.active {
-            return Err(Error::Other); // filled in by C2
+            return Err(Error::Other); // Task C4
         }
         fwd!(self, now, self.inner.open_h3_request(now, conn))
     }
@@ -229,7 +245,7 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         hs: &[H3Header<'_>],
         fin: bool,
     ) -> Result<(), StreamError> {
-        if self.active && !self.known(r) {
+        if self.active {
             return Err(StreamError::Stale);
         }
         fwd!(self, now, self.inner.h3_send_headers(now, r, hs, fin))
@@ -242,14 +258,14 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         data: &[u8],
         fin: bool,
     ) -> Result<usize, StreamError> {
-        if self.active && !self.known(r) {
+        if self.active {
             return Err(StreamError::Stale);
         }
         fwd!(self, now, self.inner.h3_send_body(now, r, data, fin))
     }
 
     fn h3_finish(&mut self, now: Time, r: H3ReqId) -> Result<(), StreamError> {
-        if self.active && !self.known(r) {
+        if self.active {
             return Err(StreamError::Stale);
         }
         fwd!(self, now, self.inner.h3_finish(now, r))
@@ -261,7 +277,7 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         r: H3ReqId,
         each: &mut dyn FnMut(&[u8], &[u8]),
     ) -> Result<bool, StreamError> {
-        if self.active && !self.known(r) {
+        if self.active {
             return Err(StreamError::Stale);
         }
         fwd!(self, now, self.inner.h3_recv_headers(now, r, each))
@@ -273,21 +289,21 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         r: H3ReqId,
         buf: &mut [u8],
     ) -> Result<(usize, bool), StreamError> {
-        if self.active && !self.known(r) {
+        if self.active {
             return Err(StreamError::Stale);
         }
         fwd!(self, now, self.inner.h3_recv_body(now, r, buf))
     }
 
     fn h3_reset(&mut self, now: Time, r: H3ReqId) {
-        if self.active && !self.known(r) {
+        if self.active {
             return;
         }
         fwd!(self, now, self.inner.h3_reset(now, r))
     }
 
     fn h3_req_info(&self, r: H3ReqId) -> Result<H3ReqInfo, Error> {
-        if self.active && !self.known(r) {
+        if self.active {
             return Err(Error::Stale);
         }
         self.inner.h3_req_info(r)
diff --git a/crates/mq-h3/src/send.rs b/crates/mq-h3/src/send.rs
new file mode 100644
index 00000000..5ec8d454
--- /dev/null
+++ b/crates/mq-h3/src/send.rs
@@ -0,0 +1,102 @@
+//! h3wire actions and core bytes on the transport (adoption spec §4.5).
+
+use crate::H3Wire;
+use h3wire::{Action, H3Code, StreamId as Q};
+use mq_transport_api::{ConnId, Time, TransportOps};
+
+impl<T: TransportOps> H3Wire<T> {
+    /// Executes `c`'s actions and writes its core bytes; runs whenever `c`'s h3wire state
+    /// may have changed.
+    pub(crate) fn service(&mut self, now: Time, c: ConnId) {
+        self.run_actions(now, c);
+        self.flush(now, c);
+        self.run_actions(now, c); // `sent` may queue FinishStream
+    }
+
+    fn run_actions(&mut self, now: Time, c: ConnId) {
+        let Some(conn) = self.conns.get_mut(&c) else {
+            return;
+        };
+        // C3 dispatches these; nothing in C2 needs them.
+        while conn.h3.poll_event().is_some() {}
+        while let Some(a) = conn.h3.poll_action() {
+            if conn.closing {
+                continue; // drained and dropped
+            }
+            let mq = |q: Q| conn.mq.get(&q.0).copied();
+            match a {
+                Action::OpenUni(kind) => {
+                    let inner = &mut self.inner;
+                    let bound = inner.open_uni(now, c).ok().and_then(|s| {
+                        let q = inner.stream_info(s).ok()?.quic_id;
+                        conn.h3.bind_uni(kind, Q(q)).ok()?;
+                        Some((s, q))
+                    });
+                    match bound {
+                        Some((s, q)) => {
+                            conn.mq.insert(q, s);
+                            self.streams.insert(s, (c, Q(q)));
+                        }
+                        // The peer granted fewer than three uni streams (RFC 9114 §6.2).
+                        None => {
+                            let code = H3Code::GENERAL_PROTOCOL_ERROR.0;
+                            self.inner.close_conn_with(now, c, code);
+                            conn.closing = true;
+                        }
+                    }
+                }
+                Action::CloseConnection { code, .. } => {
+                    self.inner.close_conn_with(now, c, code.0);
+                    conn.closing = true;
+                }
+                // Task C4 keeps a pending FIN when this is `Blocked`.
+                Action::FinishStream(q) => {
+                    if let Some(s) = mq(q) {
+                        let _ = self.inner.stream_send(now, s, &[], true);
+                    }
+                }
+                // Direction guard (adoption spec §4.5): the transport ops do not check.
+                Action::ResetStream { stream: q, code } => {
+                    let ok = q.is_request() || conn.is_local(q);
+                    debug_assert!(ok, "ResetStream on a stream with no send side");
+                    if let (true, Some(s)) = (ok, mq(q)) {
+                        self.inner.stream_reset_send(now, s, code.0);
+                    }
+                }
+                Action::StopSending { stream: q, code } => {
+                    let ok = q.is_request() || !conn.is_local(q);
+                    debug_assert!(ok, "StopSending on a stream with no receive side");
+                    if let (true, Some(s)) = (ok, mq(q)) {
+                        self.inner.stream_stop_sending(now, s, code.0);
+                    }
+                }
+            }
+        }
+    }
+
+    /// Writes core bytes per stream until the transport accepts less than offered.
+    fn flush(&mut self, now: Time, c: ConnId) {
+        let Some(conn) = self.conns.get_mut(&c) else {
+            return;
+        };
+        if conn.closing {
+            return;
+        }
+        for q in conn.h3.sendable().collect::<Vec<_>>() {
+            let Some(&s) = conn.mq.get(&q.0) else {
+                continue;
+            };
+            while let Some(bytes) = conn.h3.poll_send(q).filter(|b| !b.is_empty()) {
+                let len = bytes.len();
+                let Ok(n) = self.inner.stream_send(now, s, bytes, false) else {
+                    break;
+                };
+                let sent = conn.h3.sent(q, n);
+                debug_assert!(sent.is_ok(), "sent({q:?}, {n}): {sent:?}");
+                if n < len {
+                    break;
+                }
+            }
+        }
+    }
+}
diff --git a/crates/mq-h3/tests/common/mod.rs b/crates/mq-h3/tests/common/mod.rs
new file mode 100644
index 00000000..3cbc5819
--- /dev/null
+++ b/crates/mq-h3/tests/common/mod.rs
@@ -0,0 +1,321 @@
+//! `Rig`: an `H3Wire<ScriptedTransport>` joined to a real `h3wire::Connection` peer.
+#![allow(dead_code)]
+
+use h3wire::{Action, Config, Connection, Recv, Role, StreamId as Q};
+use mq_h3::H3Wire;
+use mq_runtime::testing::{ScriptedHandle, ScriptedTransport};
+use mq_transport_api::{
+    CloseReason, ConnConfig, ConnId, ConnProto, ErrType, Event, StreamError, StreamId, StreamInfo,
+    StreamKind, Time, TransportOps,
+};
+use std::collections::{BTreeMap, HashMap};
+use std::sync::{Arc, Mutex, MutexGuard};
+
+/// `w` → peer bytes of one stream, as the transport accepted them.
+#[derive(Default)]
+struct Out {
+    buf: Vec<u8>,
+    /// Bytes already fed to the peer.
+    at: usize,
+    fin: bool,
+    fin_fed: bool,
+}
+
+/// State shared with the `on_stream_send` / `on_open_stream` rules.
+#[derive(Default)]
+struct Wire {
+    q_of: HashMap<StreamId, u64>,
+    mq_of: HashMap<u64, StreamId>,
+    out: BTreeMap<StreamId, Out>,
+    /// One-shot cap on the next `stream_send` per stream.
+    limit: HashMap<StreamId, usize>,
+    /// Quic id of the next request stream `w` opens.
+    next_req: u64,
+}
+
+impl Wire {
+    fn map(&mut self, s: StreamId, q: u64) {
+        self.q_of.insert(s, q);
+        self.mq_of.insert(q, s);
+    }
+}
+
+pub struct Rig {
+    pub w: H3Wire<ScriptedTransport>,
+    pub h: ScriptedHandle,
+    pub peer: Connection,
+    pub peer_events: Vec<h3wire::Event>,
+    pub conn: ConnId,
+    pub now: Time,
+    wire: Arc<Mutex<Wire>>,
+    /// Peer → `w` bytes not yet delivered, and whether FIN follows them.
+    to_w: BTreeMap<u64, (Vec<u8>, bool)>,
+    /// Quic id of the next uni stream the peer opens.
+    next_peer_uni: u64,
+}
+
+/// Generous; hitting it means the two sides never settle.
+const MAX_ROUNDS: usize = 1000;
+
+impl Rig {
+    /// `w` is the server; the peer is an h3wire client.
+    pub fn server() -> Rig {
+        let rig = Rig::new(Role::Client, [3, 7, 11]);
+        rig.h.push_event(Event::NewConn(rig.conn, ConnProto::H3));
+        rig
+    }
+
+    /// `w` is the client; the peer is an h3wire server.
+    pub fn client() -> Rig {
+        let mut rig = Rig::new(Role::Server, [2, 6, 10]);
+        rig.h.expect_connect(Ok(rig.conn));
+        let cfg = ConnConfig {
+            peer: "127.0.0.1:4433".parse().unwrap(),
+            sni: "mqproxy",
+            idle_timeout: None,
+            proto: ConnProto::H3,
+        };
+        assert_eq!(rig.w.connect(rig.now, &cfg), Ok(rig.conn));
+        rig.h.push_event(Event::ConnEstablished(rig.conn));
+        rig
+    }
+
+    /// `local_uni`: the quic ids of `w`'s three uni streams, in open order.
+    fn new(peer_role: Role, local_uni: [u64; 3]) -> Rig {
+        let (t, h) = ScriptedTransport::new();
+        let conn = h.new_conn_id();
+        let wire = Arc::new(Mutex::new(Wire::default()));
+        for q in local_uni {
+            let s = h.new_stream_id();
+            h.set_stream_info(s, info(conn, q));
+            h.expect_open_uni(Ok(s));
+            lock(&wire).map(s, q);
+        }
+        let ww = wire.clone();
+        h.on_open_stream(move |h, conn| {
+            let s = h.new_stream_id();
+            let mut w = lock(&ww);
+            let q = w.next_req;
+            w.next_req += 4;
+            w.map(s, q);
+            h.set_stream_info(s, info(conn, q));
+            Ok(s)
+        });
+        let ww = wire.clone();
+        h.on_stream_send(move |_, s, data, fin| {
+            let mut w = lock(&ww);
+            let n = match w.limit.remove(&s) {
+                Some(0) => return Err(StreamError::Blocked),
+                Some(cap) => data.len().min(cap),
+                None => data.len(),
+            };
+            let out = w.out.entry(s).or_default();
+            out.buf.extend_from_slice(&data[..n]);
+            out.fin |= fin && n == data.len();
+            Ok(n)
+        });
+        Rig {
+            w: H3Wire::new(t),
+            h,
+            peer: Connection::new(peer_role, Config::default()),
+            peer_events: Vec::new(),
+            conn,
+            now: Time::ZERO,
+            wire,
+            to_w: BTreeMap::new(),
+            next_peer_uni: if peer_role == Role::Client { 2 } else { 3 },
+        }
+    }
+
+    /// Moves accepted bytes both ways and executes actions on both sides until nothing moves.
+    pub fn pump(&mut self) {
+        for _ in 0..MAX_ROUNDS {
+            self.w.drive(self.now);
+            let mut moved = self.feed_peer();
+            moved |= self.drain_peer();
+            moved |= self.flush_to_w();
+            if !moved {
+                return;
+            }
+        }
+        panic!("pump did not settle");
+    }
+
+    /// Drains `w.poll_event()`.
+    pub fn events(&mut self) -> Vec<Event> {
+        std::iter::from_fn(|| self.w.poll_event()).collect()
+    }
+
+    /// The mq id of a quic id (either side's stream).
+    pub fn peer_stream(&self, q: Q) -> StreamId {
+        lock(&self.wire).mq_of[&q.0]
+    }
+
+    /// Caps how many bytes the next `stream_send` on `s` accepts (None = all); 0 is `Blocked`.
+    pub fn limit(&mut self, s: StreamId, n: Option<usize>) {
+        let mut w = lock(&self.wire);
+        match n {
+            Some(n) => w.limit.insert(s, n),
+            None => w.limit.remove(&s),
+        };
+    }
+
+    /// Peer DATA through send_data / data_written; the bytes reach `w` on the next pump.
+    pub fn peer_send_body(&mut self, q: Q, body: &[u8], fin: bool) {
+        self.drain_peer(); // queued HEADERS go first
+        let f = self
+            .peer
+            .send_data(q, body.len() as u64, fin)
+            .expect("peer send_data");
+        let pipe = &mut self.to_w.entry(q.0).or_default().0;
+        pipe.extend_from_slice(f.prefix());
+        pipe.extend_from_slice(body);
+        self.peer
+            .data_written(q, f.prefix().len() + body.len())
+            .expect("peer data_written");
+    }
+
+    /// Raw bytes on a peer stream (the "raw" cases only).
+    pub fn deliver(&mut self, q: Q, bytes: &[u8], fin: bool) {
+        let e = self.to_w.entry(q.0).or_default();
+        e.0.extend_from_slice(bytes);
+        e.1 |= fin;
+    }
+
+    /// Pushes ConnClosed(conn, reason) into the inner transport (transport close, not H3).
+    pub fn close_transport(&mut self, reason: CloseReason) {
+        self.h.push_event(Event::ConnClosed(self.conn, reason));
+    }
+
+    /// Feeds every accepted `w` → peer byte to the peer; returns whether anything moved.
+    fn feed_peer(&mut self) -> bool {
+        let wire = self.wire.clone();
+        let mut w = lock(&wire);
+        let Wire { q_of, out, .. } = &mut *w;
+        let mut moved = false;
+        for (s, o) in out.iter_mut() {
+            let q = Q(q_of[s]);
+            loop {
+                let rest = &o.buf[o.at..];
+                let fin = o.fin && !o.fin_fed;
+                if rest.is_empty() && !fin {
+                    break;
+                }
+                let n = match self.peer.recv(q, rest, fin) {
+                    Ok(Recv::Paused) => break,
+                    Ok(
+                        Recv::Consumed(n)
+                        | Recv::Body { consumed: n, .. }
+                        | Recv::Frame { consumed: n, .. }
+                        | Recv::Raw { consumed: n, .. },
+                    ) => n,
+                    Err(_) => rest.len(), // the peer is closed: discard
+                };
+                moved = true;
+                o.at += n;
+                o.fin_fed |= fin && n == rest.len();
+            }
+        }
+        moved
+    }
+
+    /// Records peer events, executes peer actions and stages its core bytes for `w`.
+    fn drain_peer(&mut self) -> bool {
+        let mut moved = false;
+        loop {
+            self.peer_events
+                .extend(std::iter::from_fn(|| self.peer.poll_event()));
+            let mut any = false;
+            while let Some(a) = self.peer.poll_action() {
+                any = true;
+                self.peer_action(a);
+            }
+            for q in self.peer.sendable().collect::<Vec<_>>() {
+                let Some(bytes) = self.peer.poll_send(q) else {
+                    continue;
+                };
+                let n = bytes.len();
+                self.to_w.entry(q.0).or_default().0.extend_from_slice(bytes);
+                self.peer.sent(q, n).expect("peer sent");
+                any = true;
+            }
+            if !any {
+                return moved;
+            }
+            moved = true;
+        }
+    }
+
+    fn peer_action(&mut self, a: Action) {
+        match a {
+            Action::OpenUni(kind) => {
+                let q = self.next_peer_uni;
+                self.next_peer_uni += 4;
+                self.peer.bind_uni(kind, Q(q)).expect("peer bind_uni");
+                self.mq(q);
+            }
+            Action::FinishStream(q) => self.to_w.entry(q.0).or_default().1 = true,
+            Action::ResetStream { stream, code } => {
+                self.to_w.remove(&stream.0); // RESET_STREAM abandons what is unsent
+                let s = self.mq(stream.0);
+                self.h.expect_stream_recv(s, Err(StreamError::Reset));
+                self.h.push_event(Event::StreamPeerReset(s, code.0));
+            }
+            Action::StopSending { stream, code } => {
+                let s = self.mq(stream.0);
+                self.h.push_event(Event::StreamStopSending(s, code.0));
+            }
+            Action::CloseConnection { code, .. } => self.close_transport(CloseReason {
+                err_type: ErrType::Application,
+                code: code.0,
+            }),
+        }
+    }
+
+    /// Delivers staged peer bytes: one `stream_recv` chunk plus `StreamReadable` per stream.
+    fn flush_to_w(&mut self) -> bool {
+        let staged = std::mem::take(&mut self.to_w);
+        let mut moved = false;
+        for (q, (bytes, fin)) in staged {
+            if bytes.is_empty() && !fin {
+                continue;
+            }
+            let s = self.mq(q);
+            self.h.expect_stream_recv(s, Ok((bytes, fin)));
+            self.h.push_event(Event::StreamReadable(s));
+            moved = true;
+        }
+        moved
+    }
+
+    /// The mq id of quic id `q`; a stream the peer opens is announced with `NewStream`.
+    fn mq(&mut self, q: u64) -> StreamId {
+        let mut w = lock(&self.wire);
+        if let Some(&s) = w.mq_of.get(&q) {
+            return s;
+        }
+        let s = self.h.new_stream_id();
+        w.map(s, q);
+        let i = info(self.conn, q);
+        self.h.set_stream_info(s, i);
+        self.h.push_event(Event::NewStream(self.conn, s, i));
+        s
+    }
+}
+
+fn info(conn: ConnId, q: u64) -> StreamInfo {
+    let kind = if q & 2 != 0 {
+        StreamKind::Uni
+    } else {
+        StreamKind::Bidi
+    };
+    StreamInfo {
+        conn,
+        quic_id: q,
+        kind,
+    }
+}
+
+fn lock(w: &Mutex<Wire>) -> MutexGuard<'_, Wire> {
+    w.lock().unwrap_or_else(|e| e.into_inner())
+}
diff --git a/crates/mq-h3/tests/setup.rs b/crates/mq-h3/tests/setup.rs
new file mode 100644
index 00000000..9cfcc266
--- /dev/null
+++ b/crates/mq-h3/tests/setup.rs
@@ -0,0 +1,123 @@
+//! H3 connection setup over the `Rig` (adoption spec §4.2, §4.4, §4.5).
+
+mod common;
+
+use common::Rig;
+use h3wire::StreamId as Q;
+use mq_h3::H3Wire;
+use mq_runtime::testing::{Call, ScriptedTransport};
+use mq_transport_api::{ConnId, ConnProto, Error, Event, Time, TransportOps};
+
+fn close_codes(r: &Rig) -> Vec<u64> {
+    r.h.log()
+        .into_iter()
+        .filter_map(|c| match c {
+            Call::CloseConnWith { conn, code } if conn == r.conn => Some(code),
+            _ => None,
+        })
+        .collect()
+}
+
+/// `peer_uni`: the quic ids of the peer's control, encoder and decoder streams.
+fn setup_exchange(mut r: Rig, peer_uni: [u64; 3]) {
+    r.pump();
+    let opens =
+        r.h.log()
+            .iter()
+            .filter(|c| **c == Call::OpenUni(r.conn))
+            .count();
+    assert_eq!(opens, 3);
+    assert!(r.peer_events.contains(&h3wire::Event::PeerSettings));
+    let ps = r.peer.peer_settings().expect("peer saw our SETTINGS");
+    assert_eq!(ps.max_field_section_size, Some(65536));
+    assert_eq!(ps.qpack_max_table_capacity, 0);
+    for q in peer_uni {
+        let s = r.peer_stream(Q(q));
+        assert!(r.h.log().contains(&Call::StreamRecv { s, cap: 4096 }));
+        assert_eq!(r.h.recv_pending(s), 0, "peer stream {q} read to the end");
+    }
+    assert!(close_codes(&r).is_empty());
+}
+
+#[test]
+fn server_setup_exchange() {
+    setup_exchange(Rig::server(), [2, 6, 10]);
+}
+
+#[test]
+fn client_setup_exchange() {
+    setup_exchange(Rig::client(), [3, 7, 11]);
+}
+
+#[test]
+fn peer_critical_stream_reset_closes() {
+    let mut r = Rig::server();
+    r.pump();
+    let ctrl = r.peer_stream(Q(2));
+    r.h.push_event(Event::StreamPeerReset(ctrl, 0x10c));
+    r.w.drive(r.now);
+    assert_eq!(close_codes(&r), [0x104]);
+}
+
+#[test]
+fn unexpected_frame_on_control_closes() {
+    let mut r = Rig::server();
+    r.pump();
+    // DATA (type 0x00), length 1, one payload byte.
+    r.deliver(Q(2), &[0x00, 0x01, 0xaa], false);
+    r.pump();
+    assert_eq!(close_codes(&r), [0x105]);
+}
+
+#[test]
+fn open_uni_failure_closes() {
+    let (t, h) = ScriptedTransport::new();
+    let mut w = H3Wire::new(t);
+    let c: ConnId = h.new_conn_id();
+    h.expect_open_uni(Err(Error::Other));
+    h.push_event(Event::NewConn(c, ConnProto::H3));
+    w.drive(Time::ZERO);
+    let calls: Vec<_> = h
+        .log()
+        .into_iter()
+        .filter(|c| !matches!(c, Call::Drive(_)))
+        .collect();
+    assert_eq!(
+        calls,
+        [
+            Call::OpenUni(c),
+            Call::CloseConnWith {
+                conn: c,
+                code: 0x101
+            }
+        ]
+    );
+}
+
+#[test]
+fn core_bytes_resume_on_writable() {
+    let mut r = Rig::server();
+    let ctrl = r.peer_stream(Q(3)); // w's control stream
+    r.limit(ctrl, Some(3));
+    r.w.drive(r.now);
+    assert_eq!(r.h.sent_bytes(ctrl).len(), 3);
+    r.h.push_event(Event::StreamWritable(ctrl));
+    r.w.drive(r.now);
+    assert!(r.h.sent_bytes(ctrl).len() > 3);
+    let sends =
+        r.h.log()
+            .into_iter()
+            .filter(|c| matches!(c, Call::StreamSend { s, .. } if *s == ctrl));
+    assert_eq!(sends.count(), 2, "one short write, then the rest");
+    r.pump();
+    assert!(r.peer_events.contains(&h3wire::Event::PeerSettings));
+    assert!(close_codes(&r).is_empty());
+}
+
+/// The raw stream events of an H3 conn stay inside `H3Wire` (adoption spec §4.1).
+#[test]
+fn raw_stream_events_of_h3_conns_are_consumed() {
+    let mut r = Rig::server();
+    r.pump();
+    assert_eq!(r.events(), [Event::NewConn(r.conn, ConnProto::H3)]);
+}
diff --git a/crates/mq-runtime/src/testing/scripted.rs b/crates/mq-runtime/src/testing/scripted.rs
index c9592fd2..6afaf4e8 100644
--- a/crates/mq-runtime/src/testing/scripted.rs
+++ b/crates/mq-runtime/src/testing/scripted.rs
@@ -288,6 +288,10 @@ impl ScriptedHandle {
     pub fn expect_stream_recv(&self, s: StreamId, r: Result<(Vec<u8>, bool), StreamError>) {
         self.st().recv.entry(s).or_default().push_back(r);
     }
+    /// Scripted `stream_recv` results on `s` not yet fully returned.
+    pub fn recv_pending(&self, s: StreamId) -> usize {
+        self.st().recv.get(&s).map_or(0, VecDeque::len)
+    }
     pub fn expect_add_path(&self, r: Result<PathId, PathError>) {
         self.st().add_path.push_back(r);
     }

From b7ce3aace17fee131057f81ebcefbb74fc64b769 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 10:00:42 +0900
Subject: [PATCH 03/33] fix(mq-h3): flush core bytes after every call, exact
 direction guard

---
 crates/mq-h3/src/conn.rs    |  6 ++++--
 crates/mq-h3/src/lib.rs     | 13 +++++++++++--
 crates/mq-h3/src/send.rs    |  4 ++--
 crates/mq-h3/tests/setup.rs | 16 ++++++++++++++++
 4 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/crates/mq-h3/src/conn.rs b/crates/mq-h3/src/conn.rs
index b296a43c..bde14743 100644
--- a/crates/mq-h3/src/conn.rs
+++ b/crates/mq-h3/src/conn.rs
@@ -143,8 +143,10 @@ impl<T: TransportOps> H3Wire<T> {
                     }
                 }
                 Err(StreamError::Reset) => {
-                    // Reset, code pending (adoption spec §4.4): the code only matters on a
-                    // critical stream, which closes the conn whatever it is.
+                    // adoption spec §4.4: a deliberate uni-only shortcut. The code only matters
+                    // on a critical stream, which closes the conn whatever it is, so the reset
+                    // is passed now with REQUEST_CANCELLED. Request streams instead follow the
+                    // deferred "reset, code pending" rule (Task C3).
                     if conn.uni_done.insert(s) {
                         log_closed(conn.h3.stream_reset_received(q, H3Code::REQUEST_CANCELLED));
                     }
diff --git a/crates/mq-h3/src/lib.rs b/crates/mq-h3/src/lib.rs
index 706a375b..908a70bd 100644
--- a/crates/mq-h3/src/lib.rs
+++ b/crates/mq-h3/src/lib.rs
@@ -67,9 +67,18 @@ impl<T: TransportOps> H3Wire<T> {
         self.inner
     }
 
-    /// Moves the inner queue into ours, consuming what belongs to H3 conns; runs at the end
-    /// of every method that takes `now` (adoption spec §4.1).
+    /// Services every H3 conn, then moves the inner queue into ours, consuming what belongs
+    /// to H3 conns; runs at the end of every method that takes `now` (adoption spec §4.1).
     fn drive_inner(&mut self, now: Time) {
+        if self.active {
+            // Core bytes and actions after every call that takes `now` (adoption spec §4.5).
+            // Running first covers what this call changed; each event below services its
+            // own conn. ponytail: O(conns) per call; keep a dirty set if shards grow large.
+            let cs: Vec<ConnId> = self.conns.keys().copied().collect();
+            for c in cs {
+                self.service(now, c);
+            }
+        }
         while let Some(e) = self.inner.poll_event() {
             let out = if self.active {
                 self.on_event(now, e)
diff --git a/crates/mq-h3/src/send.rs b/crates/mq-h3/src/send.rs
index 5ec8d454..e3269086 100644
--- a/crates/mq-h3/src/send.rs
+++ b/crates/mq-h3/src/send.rs
@@ -57,14 +57,14 @@ impl<T: TransportOps> H3Wire<T> {
                 }
                 // Direction guard (adoption spec §4.5): the transport ops do not check.
                 Action::ResetStream { stream: q, code } => {
-                    let ok = q.is_request() || conn.is_local(q);
+                    let ok = q.is_request() || (q.is_uni() && conn.is_local(q));
                     debug_assert!(ok, "ResetStream on a stream with no send side");
                     if let (true, Some(s)) = (ok, mq(q)) {
                         self.inner.stream_reset_send(now, s, code.0);
                     }
                 }
                 Action::StopSending { stream: q, code } => {
-                    let ok = q.is_request() || !conn.is_local(q);
+                    let ok = q.is_request() || (q.is_uni() && !conn.is_local(q));
                     debug_assert!(ok, "StopSending on a stream with no receive side");
                     if let (true, Some(s)) = (ok, mq(q)) {
                         self.inner.stream_stop_sending(now, s, code.0);
diff --git a/crates/mq-h3/tests/setup.rs b/crates/mq-h3/tests/setup.rs
index 9cfcc266..1d5edf95 100644
--- a/crates/mq-h3/tests/setup.rs
+++ b/crates/mq-h3/tests/setup.rs
@@ -121,3 +121,19 @@ fn raw_stream_events_of_h3_conns_are_consumed() {
     r.pump();
     assert_eq!(r.events(), [Event::NewConn(r.conn, ConnProto::H3)]);
 }
+
+/// A blocked core-bytes write is retried by any call that takes `now`, without a
+/// `StreamWritable` (adoption spec §4.5).
+#[test]
+fn core_bytes_retried_on_bare_drive() {
+    let mut r = Rig::server();
+    let ctrl = r.peer_stream(Q(3)); // w's control stream
+    r.limit(ctrl, Some(0));
+    r.w.drive(r.now);
+    assert!(r.h.sent_bytes(ctrl).is_empty());
+    r.w.drive(r.now);
+    assert!(!r.h.sent_bytes(ctrl).is_empty());
+    r.pump();
+    assert!(r.peer_events.contains(&h3wire::Event::PeerSettings));
+    assert!(close_codes(&r).is_empty());
+}

From 76f750d41ccb7c45e387add2d7f27a39ff60bb02 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 10:13:11 +0900
Subject: [PATCH 04/33] =?UTF-8?q?feat(mq-h3):=20request=20receive=20?=
 =?UTF-8?q?=E2=80=94=20bootstrap,=20headers,=20body=20pull?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crates/mq-h3/src/conn.rs   |  14 +-
 crates/mq-h3/src/lib.rs    |  50 ++--
 crates/mq-h3/src/recv.rs   | 362 +++++++++++++++++++++++++++
 crates/mq-h3/src/req.rs    |  79 ++++++
 crates/mq-h3/src/send.rs   |  70 +++++-
 crates/mq-h3/tests/recv.rs | 498 +++++++++++++++++++++++++++++++++++++
 6 files changed, 1047 insertions(+), 26 deletions(-)
 create mode 100644 crates/mq-h3/src/recv.rs
 create mode 100644 crates/mq-h3/src/req.rs
 create mode 100644 crates/mq-h3/tests/recv.rs

diff --git a/crates/mq-h3/src/conn.rs b/crates/mq-h3/src/conn.rs
index bde14743..c8ae8a73 100644
--- a/crates/mq-h3/src/conn.rs
+++ b/crates/mq-h3/src/conn.rs
@@ -1,6 +1,7 @@
 //! One `h3wire::Connection` per H3 conn, and the raw events it consumes (adoption spec §4.2,
 //! §4.4).
 
+use crate::req::{Req, req_id};
 use crate::{BOOT_READ, H3Wire};
 use h3wire::{Config, Connection, H3Code, Role, StreamId as Q};
 use mq_transport_api::{ConnId, ConnProto, Event, StreamError, StreamId, Time, TransportOps};
@@ -70,6 +71,12 @@ impl<T: TransportOps> H3Wire<T> {
                 };
                 conn.mq.insert(info.quic_id, s);
                 self.streams.insert(s, (c, Q(info.quic_id)));
+                // A peer request stream (server): h3wire holds its state from the first
+                // sight; the gateway learns of it at its HEADERS (adoption spec §4.3).
+                if Q(info.quic_id).is_request() && !conn.client {
+                    let req = Req::new(c, s, info.quic_id, false);
+                    self.reqs.insert(req_id(s), req);
+                }
                 return None;
             }
             Event::StreamReadable(s)
@@ -91,6 +98,9 @@ impl<T: TransportOps> H3Wire<T> {
     }
 
     fn on_stream_event(&mut self, now: Time, c: ConnId, s: StreamId, q: Q, e: Event) {
+        if q.is_request() && self.on_req_event(now, c, s, q, &e) {
+            return;
+        }
         let conn = self
             .conns
             .get_mut(&c)
@@ -102,7 +112,7 @@ impl<T: TransportOps> H3Wire<T> {
                 if peer_uni && conn.uni_done.insert(s) {
                     log_closed(conn.h3.stream_reset_received(q, H3Code(code)));
                 }
-                // Retirement probe (adoption spec §3); request streams: Task C3/C5.
+                // Retirement probe (adoption spec §3).
                 if peer_uni {
                     self.read_uni(now, c, s, q);
                 }
@@ -160,7 +170,7 @@ impl<T: TransportOps> H3Wire<T> {
 
 /// `ConnectionError` is a state notification; the wire effect is a queued action
 /// (adoption spec §5.1).
-fn log_closed(r: Result<(), h3wire::ConnectionError>) {
+pub(crate) fn log_closed(r: Result<(), h3wire::ConnectionError>) {
     if let Err(e) = r {
         log::debug!("h3wire: {e}");
     }
diff --git a/crates/mq-h3/src/lib.rs b/crates/mq-h3/src/lib.rs
index 908a70bd..058db38a 100644
--- a/crates/mq-h3/src/lib.rs
+++ b/crates/mq-h3/src/lib.rs
@@ -1,11 +1,13 @@
 //! `H3Wire<T>`: a `TransportOps` decorator serving HTTP/3 from h3wire (adoption spec §4.1).
 //!
-//! Active mode (`H3Wire::new`) runs one h3wire `Connection` per H3 conn; requests are served
-//! from it by the later tasks (C3–C5).
+//! Active mode (`H3Wire::new`) runs one h3wire `Connection` per H3 conn and serves the
+//! requests from it.
 #![forbid(unsafe_code)]
 
 mod conn;
 mod queue;
+mod recv;
+mod req;
 mod send;
 
 use conn::H3Conn;
@@ -15,7 +17,8 @@ use mq_transport_api::{
     TransportOps, TxKey,
 };
 use queue::OutQueue;
-use std::collections::{HashMap, HashSet};
+use req::Req;
+use std::collections::HashMap;
 use std::net::SocketAddr;
 
 /// Bootstrap read size for a request stream (adoption spec §4.4).
@@ -26,8 +29,8 @@ pub struct H3Wire<T> {
     /// `false`: create no H3 state; every op and event passes through (adoption spec §4.1).
     active: bool,
     queue: OutQueue,
-    /// Requests this wrapper holds; always empty until request state lands (later tasks).
-    reqs: HashSet<H3ReqId>,
+    /// Request streams of H3 conns, by request id (adoption spec §4.3).
+    reqs: HashMap<H3ReqId, Req>,
     conns: HashMap<ConnId, H3Conn>,
     /// Every stream of an H3 conn: its conn and quic id.
     streams: HashMap<StreamId, (ConnId, h3wire::StreamId)>,
@@ -49,7 +52,7 @@ impl<T: TransportOps> H3Wire<T> {
             inner,
             active,
             queue: OutQueue::default(),
-            reqs: HashSet::new(),
+            reqs: HashMap::new(),
             conns: HashMap::new(),
             streams: HashMap::new(),
         }
@@ -142,10 +145,10 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
             | Event::StreamWritable(s)
             | Event::StreamPeerReset(s, _)
             | Event::StreamStopSending(s, _) => inner.stream_info(*s).is_ok(),
-            // The inner transport already filtered passthrough H3 events.
-            Event::H3Request(_, r) | Event::H3Readable(r) | Event::H3Writable(r) => {
-                !*active || reqs.contains(r)
-            }
+            // The inner transport already filtered passthrough H3 events. An H3Readable
+            // after the receive end was handed over has nothing to deliver.
+            Event::H3Readable(r) => !*active || reqs.get(r).is_some_and(|q| !q.handed),
+            Event::H3Request(_, r) | Event::H3Writable(r) => !*active || reqs.contains_key(r),
             _ => true,
         })
     }
@@ -238,11 +241,11 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         self.inner.datagram_recv(conn, buf)
     }
 
-    // H3 ops. Active: never forwarded; no request is held yet, so every id is stale
-    // (adoption spec §4.1). Tasks C3–C5 serve them from h3wire.
+    // H3 ops. Active: served from h3wire, never forwarded; an id not held is stale
+    // (adoption spec §4.1).
     fn open_h3_request(&mut self, now: Time, conn: ConnId) -> Result<H3ReqId, Error> {
         if self.active {
-            return Err(Error::Other); // Task C4
+            return self.open_req(now, conn);
         }
         fwd!(self, now, self.inner.open_h3_request(now, conn))
     }
@@ -255,7 +258,7 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         fin: bool,
     ) -> Result<(), StreamError> {
         if self.active {
-            return Err(StreamError::Stale);
+            return self.send_headers(now, r, hs, fin);
         }
         fwd!(self, now, self.inner.h3_send_headers(now, r, hs, fin))
     }
@@ -268,14 +271,14 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         fin: bool,
     ) -> Result<usize, StreamError> {
         if self.active {
-            return Err(StreamError::Stale);
+            return Err(StreamError::Stale); // Task C4
         }
         fwd!(self, now, self.inner.h3_send_body(now, r, data, fin))
     }
 
     fn h3_finish(&mut self, now: Time, r: H3ReqId) -> Result<(), StreamError> {
         if self.active {
-            return Err(StreamError::Stale);
+            return Err(StreamError::Stale); // Task C4
         }
         fwd!(self, now, self.inner.h3_finish(now, r))
     }
@@ -287,7 +290,7 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         each: &mut dyn FnMut(&[u8], &[u8]),
     ) -> Result<bool, StreamError> {
         if self.active {
-            return Err(StreamError::Stale);
+            return self.recv_headers(now, r, each);
         }
         fwd!(self, now, self.inner.h3_recv_headers(now, r, each))
     }
@@ -299,21 +302,28 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         buf: &mut [u8],
     ) -> Result<(usize, bool), StreamError> {
         if self.active {
-            return Err(StreamError::Stale);
+            return self.recv_body(now, r, buf);
         }
         fwd!(self, now, self.inner.h3_recv_body(now, r, buf))
     }
 
     fn h3_reset(&mut self, now: Time, r: H3ReqId) {
         if self.active {
-            return;
+            return; // Task C5
         }
         fwd!(self, now, self.inner.h3_reset(now, r))
     }
 
     fn h3_req_info(&self, r: H3ReqId) -> Result<H3ReqInfo, Error> {
         if self.active {
-            return Err(Error::Stale);
+            // Cached at request start: the inner slot is gone before StreamClosed.
+            return match self.reqs.get(&r) {
+                Some(q) if q.known => Ok(H3ReqInfo {
+                    conn: q.conn,
+                    quic_id: q.quic_id,
+                }),
+                _ => Err(Error::Stale),
+            };
         }
         self.inner.h3_req_info(r)
     }
diff --git a/crates/mq-h3/src/recv.rs b/crates/mq-h3/src/recv.rs
new file mode 100644
index 00000000..ff2d94dc
--- /dev/null
+++ b/crates/mq-h3/src/recv.rs
@@ -0,0 +1,362 @@
+//! Request receive: HEADERS bootstrap, header delivery, body pull and the request-stream
+//! transport events (adoption spec §4.3, §4.4).
+
+use crate::conn::log_closed;
+use crate::req::{Terminal, no_stats, req_id};
+use crate::{BOOT_READ, H3Wire};
+use h3wire::{Event as H3Event, H3Code, HeadersKind, Recv, StreamId as Q};
+use mq_transport_api::{
+    ConnId, Event, H3Close, H3ReqId, StreamError, StreamId, Time, TransportOps,
+};
+
+/// The carry slice to feed with a `cap`-byte buffer: its length, and whether the carried
+/// FIN goes with it (only with the whole remaining carry; adoption spec §4.4).
+fn slice(carry: usize, carry_fin: bool, cap: usize) -> (usize, bool) {
+    let n = carry.min(cap);
+    (n, carry_fin && n == carry)
+}
+
+impl<T: TransportOps> H3Wire<T> {
+    /// Applies `c`'s h3wire events to the requests and queues what the gateway sees
+    /// (adoption spec §4.3 "Start", §4.4).
+    pub(crate) fn dispatch(&mut self, c: ConnId) {
+        let Some(conn) = self.conns.get_mut(&c) else {
+            return;
+        };
+        while let Some(e) = conn.h3.poll_event() {
+            let q = match e {
+                H3Event::Headers { stream, .. }
+                | H3Event::Finished(stream)
+                | H3Event::StreamAborted { stream, .. } => stream,
+                // SendStopped, GoAway: Task C4. Closed: Task C5. PeerSettings, UniStream:
+                // nothing to do.
+                _ => continue,
+            };
+            let id = conn.mq.get(&q.0).map(|&s| req_id(s));
+            let req = id.and_then(|id| Some((id, self.reqs.get_mut(&id)?)));
+            let Some((id, req)) = req else {
+                if let H3Event::Headers { block, .. } = e {
+                    conn.h3.release(block);
+                }
+                continue;
+            };
+            match e {
+                H3Event::Headers {
+                    block,
+                    kind: HeadersKind::Request | HeadersKind::Response,
+                    ..
+                } => {
+                    req.pending_block = Some(block);
+                    req.booted = true;
+                    if !req.known {
+                        // The gateway creates its record on this, and starts intake on
+                        // the H3Readable that follows.
+                        req.known = true;
+                        self.queue.push(Event::H3Request(c, id));
+                    }
+                    self.queue.push(Event::H3Readable(id));
+                    continue;
+                }
+                // Informational and trailers are released internally.
+                H3Event::Headers { block, .. } => {
+                    conn.h3.release(block);
+                    continue;
+                }
+                H3Event::Finished(_) => req.terminal = Some(Terminal::Finished),
+                H3Event::StreamAborted { code, source, .. } => {
+                    req.terminal = Some(Terminal::Aborted { code, source });
+                    if let Some(b) = req.pending_block.take() {
+                        conn.h3.release(b);
+                    }
+                    req.carry = Vec::new();
+                    req.carry_fin = false;
+                }
+                _ => unreachable!("filtered above"),
+            }
+            req.booted = true;
+            if req.known && !req.handed {
+                self.queue.push(Event::H3Readable(id));
+            }
+        }
+    }
+
+    /// Feeds request `id` until a stop condition (adoption spec §4.4).
+    ///
+    /// `out = None` is the bootstrap: `BOOT_READ` reads, stopping at a gateway-visible
+    /// block. `Some(buf)` is a body pull: reads and carry slices of at most `buf.len()`,
+    /// stopping at the first payload, which is copied into `buf`. Both stop at a terminal
+    /// event, `Paused` and a blocked transport. Returns the payload bytes copied.
+    fn feed(
+        &mut self,
+        now: Time,
+        id: H3ReqId,
+        mut out: Option<&mut [u8]>,
+    ) -> Result<usize, StreamError> {
+        let cap = out.as_ref().map_or(BOOT_READ, |b| b.len());
+        loop {
+            let Some(req) = self.reqs.get_mut(&id) else {
+                return Err(StreamError::Stale);
+            };
+            if req.terminal.is_some() || req.reset_code_pending || (out.is_none() && req.booted) {
+                return Ok(0);
+            }
+            if req.carry.is_empty() && !req.carry_fin {
+                req.carry.resize(cap, 0);
+                match self.inner.stream_recv(now, req.stream, &mut req.carry) {
+                    Ok((n, fin)) => {
+                        req.carry.truncate(n);
+                        req.carry_fin = fin;
+                        if n == 0 && !fin {
+                            return Ok(0);
+                        }
+                    }
+                    Err(e) => {
+                        req.carry.clear();
+                        // "Reset, code pending": fed nothing more until the code pops.
+                        req.reset_code_pending = e == StreamError::Reset;
+                        return Err(e);
+                    }
+                }
+            }
+            let (len, fin) = slice(req.carry.len(), req.carry_fin, cap);
+            let Some(conn) = self.conns.get_mut(&req.conn) else {
+                return Err(StreamError::Conn);
+            };
+            let (consumed, body) = match conn.h3.recv(Q(req.quic_id), &req.carry[..len], fin) {
+                Err(e) => {
+                    log::debug!("h3wire: {e}");
+                    return Err(StreamError::Conn);
+                }
+                Ok(Recv::Paused) => return Ok(0),
+                Ok(Recv::Body { consumed, range }) => (consumed, Some(range)),
+                Ok(
+                    Recv::Consumed(n)
+                    | Recv::Frame { consumed: n, .. }
+                    | Recv::Raw { consumed: n, .. },
+                ) => (n, None),
+            };
+            let mut n = 0;
+            if let Some(range) = body {
+                // The range lies inside a slice of at most `buf.len()` bytes.
+                match out.as_deref_mut() {
+                    Some(buf) => {
+                        n = range.len();
+                        buf[..n].copy_from_slice(&req.carry[range]);
+                    }
+                    None => debug_assert!(false, "the bootstrap never produces body bytes"),
+                }
+            }
+            let fin_fed = fin && consumed == len;
+            req.carry.drain(..consumed);
+            req.carry_fin &= !fin_fed;
+            let c = req.conn;
+            self.dispatch(c);
+            if n > 0 || (consumed == 0 && !fin_fed) {
+                return Ok(n);
+            }
+        }
+    }
+
+    pub(crate) fn recv_headers(
+        &mut self,
+        now: Time,
+        id: H3ReqId,
+        each: &mut dyn FnMut(&[u8], &[u8]),
+    ) -> Result<bool, StreamError> {
+        let req = self
+            .reqs
+            .get_mut(&id)
+            .filter(|r| r.known)
+            .ok_or(StreamError::Stale)?;
+        if req.aborted() || req.reset_code_pending {
+            req.handed = true;
+            return Err(StreamError::Reset);
+        }
+        let b = req.pending_block.ok_or(StreamError::Blocked)?;
+        let conn = self.conns.get_mut(&req.conn).ok_or(StreamError::Conn)?;
+        match conn.h3.headers(b) {
+            Ok(block) => {
+                let p = block.pseudo();
+                let pseudo = [
+                    (&b":method"[..], p.method),
+                    (b":scheme", p.scheme),
+                    (b":authority", p.authority),
+                    (b":path", p.path),
+                    (b":protocol", p.protocol),
+                ];
+                for (n, v) in pseudo {
+                    if let Some(v) = v {
+                        each(n, v);
+                    }
+                }
+                if let Some(s) = p.status {
+                    let d = [s / 100, s / 10 % 10, s % 10].map(|d| b'0' + d as u8);
+                    each(b":status", &d);
+                }
+                for f in block.iter() {
+                    each(f.name, f.value);
+                }
+            }
+            Err(h3wire::UsageError::Closed(_)) => return Err(StreamError::Conn),
+            Err(e) => {
+                debug_assert!(false, "headers({b:?}): {e:?}");
+                return Err(StreamError::Conn);
+            }
+        }
+        conn.h3.release(b);
+        req.pending_block = None;
+        let fin = req.terminal == Some(Terminal::Finished);
+        req.handed |= fin;
+        if !req.carry.is_empty() || req.carry_fin {
+            self.queue.push(Event::H3Readable(id));
+        }
+        self.drive_inner(now);
+        Ok(fin)
+    }
+
+    pub(crate) fn recv_body(
+        &mut self,
+        now: Time,
+        id: H3ReqId,
+        buf: &mut [u8],
+    ) -> Result<(usize, bool), StreamError> {
+        let req = self
+            .reqs
+            .get(&id)
+            .filter(|r| r.known)
+            .ok_or(StreamError::Stale)?;
+        if !req.booted {
+            return Err(StreamError::Blocked); // no head yet: body bytes wait
+        }
+        let r = self.feed(now, id, Some(buf));
+        let req = self.reqs.get_mut(&id).ok_or(StreamError::Stale)?;
+        let out = match r {
+            _ if req.aborted() || req.reset_code_pending => Err(StreamError::Reset),
+            Ok(n) if req.terminal == Some(Terminal::Finished) => Ok((n, true)),
+            Ok(0) => Err(StreamError::Blocked),
+            Ok(n) => Ok((n, false)),
+            Err(e) => Err(e),
+        };
+        req.handed |= matches!(out, Ok((_, true)) | Err(StreamError::Reset));
+        self.drive_inner(now);
+        out
+    }
+
+    /// `StreamReadable`, `StreamPeerReset` and `StreamClosed` of request stream `s`
+    /// (adoption spec §4.3, §4.4). Returns false for the other events.
+    pub(crate) fn on_req_event(
+        &mut self,
+        now: Time,
+        c: ConnId,
+        s: StreamId,
+        q: Q,
+        e: &Event,
+    ) -> bool {
+        let id = req_id(s);
+        match *e {
+            Event::StreamReadable(_) => {
+                let Some(req) = self.reqs.get(&id) else {
+                    return true;
+                };
+                if req.reset_code_pending {
+                    // Fed nothing more until the code pops (adoption spec §4.4).
+                } else if req.aborted() {
+                    self.retire_read(now, s);
+                } else if !req.booted {
+                    let _ = self.feed(now, id, None);
+                } else if req.known && !req.handed {
+                    self.queue.push(Event::H3Readable(id));
+                }
+            }
+            Event::StreamPeerReset(_, code) => {
+                // Not passed on for a request h3wire already aborted or holds no state for.
+                if let Some(req) = self.reqs.get_mut(&id)
+                    && req.core
+                    && !req.aborted()
+                {
+                    req.reset_code_pending = false;
+                    self.peer_reset(c, q, H3Code(code));
+                }
+                self.retire_read(now, s);
+            }
+            Event::StreamClosed(_) => {
+                // A pending code was dropped with the slot: "reset, code unknown".
+                if let Some(req) = self.reqs.get_mut(&id)
+                    && req.reset_code_pending
+                {
+                    req.reset_code_pending = false;
+                    self.peer_reset(c, q, H3Code::REQUEST_CANCELLED);
+                }
+                // Unmapped first, so actions queued for the gone stream are dropped.
+                if let Some(conn) = self.conns.get_mut(&c) {
+                    conn.mq.remove(&q.0);
+                }
+                self.streams.remove(&s);
+                self.close_req(id);
+            }
+            _ => return false,
+        }
+        true
+    }
+
+    fn peer_reset(&mut self, c: ConnId, q: Q, code: H3Code) {
+        if let Some(conn) = self.conns.get_mut(&c) {
+            log_closed(conn.h3.stream_reset_received(q, code));
+        }
+        self.dispatch(c);
+    }
+
+    /// Closure on `StreamClosed` (adoption spec §4.3): `H3Closed` once the gateway has
+    /// the receive end or the request was aborted; a request it never saw just goes.
+    fn close_req(&mut self, id: H3ReqId) {
+        let Some(req) = self.reqs.get(&id) else {
+            return;
+        };
+        let closed = req.handed || req.aborted();
+        if req.known && !closed {
+            return; // ponytail: Task C5 defers closure until the gateway has the end
+        }
+        let req = self.reqs.remove(&id).expect("present");
+        if let (Some(b), Some(conn)) = (req.pending_block, self.conns.get_mut(&req.conn)) {
+            conn.h3.release(b);
+        }
+        if req.known {
+            let close = H3Close {
+                stats: no_stats(),
+                unread: None,
+            };
+            self.queue.push(Event::H3Closed(id, Box::new(close)));
+        }
+    }
+
+    /// Retirement read (adoption spec §3): discards what is left until FIN, the reset
+    /// or a blocked transport.
+    fn retire_read(&mut self, now: Time, s: StreamId) {
+        let mut buf = [0u8; BOOT_READ];
+        while let Ok((n, fin)) = self.inner.stream_recv(now, s, &mut buf) {
+            if fin || n == 0 {
+                return;
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::slice;
+
+    #[test]
+    fn carry_slices_fit_the_buffer() {
+        assert_eq!(slice(3003, false, 1024), (1024, false));
+        assert_eq!(
+            slice(3003, true, 1024),
+            (1024, false),
+            "FIN only with the rest"
+        );
+        assert_eq!(slice(955, true, 1024), (955, true));
+        assert_eq!(slice(1024, true, 1024), (1024, true));
+        assert_eq!(slice(0, true, 1024), (0, true), "a bare carried FIN");
+        assert_eq!(slice(10, true, 0), (0, false), "an empty buf feeds nothing");
+        assert_eq!(slice(0, true, 0), (0, true), "but takes a bare FIN");
+    }
+}
diff --git a/crates/mq-h3/src/req.rs b/crates/mq-h3/src/req.rs
new file mode 100644
index 00000000..83aa422c
--- /dev/null
+++ b/crates/mq-h3/src/req.rs
@@ -0,0 +1,79 @@
+//! Per-request state (adoption spec §4.3).
+
+use h3wire::{AbortSource, H3Code, HeaderBlockId};
+use mq_transport_api::{ConnId, H3ReqId, H3ReqStats, StreamId};
+
+/// The h3wire terminal event of a request's receive side.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum Terminal {
+    Finished,
+    Aborted { code: H3Code, source: AbortSource },
+}
+
+pub(crate) struct Req {
+    pub(crate) conn: ConnId,
+    pub(crate) stream: StreamId,
+    pub(crate) quic_id: u64,
+    /// The gateway saw `H3Request` (server) or opened it (client).
+    pub(crate) known: bool,
+    /// h3wire holds request state: from the first sight (server) or a successful
+    /// `send_headers` (client).
+    pub(crate) core: bool,
+    /// The bootstrap is over: the gateway-visible block or a terminal event arrived.
+    pub(crate) booted: bool,
+    pub(crate) pending_block: Option<HeaderBlockId>,
+    pub(crate) terminal: Option<Terminal>,
+    /// The gateway has been given `fin` or `Err(Reset)`.
+    pub(crate) handed: bool,
+    /// The transport read failed with `Reset` before its `StreamPeerReset` popped
+    /// (adoption spec §4.4).
+    pub(crate) reset_code_pending: bool,
+    /// Raw bytes read and not consumed by h3wire; never parsed payload.
+    pub(crate) carry: Vec<u8>,
+    /// The transport reported FIN after the carry; not yet fed.
+    pub(crate) carry_fin: bool,
+    // send-side fields: Task C4; stats: Task C6
+}
+
+impl Req {
+    pub(crate) fn new(conn: ConnId, stream: StreamId, quic_id: u64, client: bool) -> Req {
+        Req {
+            conn,
+            stream,
+            quic_id,
+            known: client,
+            core: !client,
+            booted: false,
+            pending_block: None,
+            terminal: None,
+            handed: false,
+            reset_code_pending: false,
+            carry: Vec::new(),
+            carry_fin: false,
+        }
+    }
+
+    pub(crate) fn aborted(&self) -> bool {
+        matches!(self.terminal, Some(Terminal::Aborted { .. }))
+    }
+}
+
+/// The request id is the request stream's slot (adoption spec §4.1).
+pub(crate) fn req_id(s: StreamId) -> H3ReqId {
+    H3ReqId::from_slot(s.slot()).expect("a live slot has a nonzero generation")
+}
+
+/// Task C6 fills these from `StreamCloseStats`.
+pub(crate) fn no_stats() -> H3ReqStats {
+    H3ReqStats {
+        send_body: 0,
+        recv_body: 0,
+        begin_us: 0,
+        header_send_us: 0,
+        fin_send_us: 0,
+        fin_ack_us: 0,
+        mp_state: 0,
+        stream_err: 0,
+        close_msg: None,
+    }
+}
diff --git a/crates/mq-h3/src/send.rs b/crates/mq-h3/src/send.rs
index e3269086..6e7f31a7 100644
--- a/crates/mq-h3/src/send.rs
+++ b/crates/mq-h3/src/send.rs
@@ -1,10 +1,73 @@
 //! h3wire actions and core bytes on the transport (adoption spec §4.5).
 
 use crate::H3Wire;
-use h3wire::{Action, H3Code, StreamId as Q};
-use mq_transport_api::{ConnId, Time, TransportOps};
+use crate::req::{Req, req_id};
+use h3wire::{Action, FieldRef, H3Code, StreamId as Q, UsageError};
+use mq_transport_api::{ConnId, Error, H3Header, H3ReqId, StreamError, Time, TransportOps};
+
+/// A refused h3wire call (Global Constraints error table, adoption spec §5.1).
+pub(crate) fn usage_err(e: UsageError) -> StreamError {
+    match e {
+        UsageError::Blocked => StreamError::Blocked,
+        UsageError::Closed(_) | UsageError::GoingAway => StreamError::Conn,
+        UsageError::InvalidField | UsageError::WrongPhase | UsageError::ForbiddenCode => {
+            log::warn!("h3wire refused gateway output: {e}");
+            StreamError::Reset
+        }
+        UsageError::UnknownStream => StreamError::Stale,
+        UsageError::WrongStreamKind
+        | UsageError::NotNegotiated
+        | UsageError::StaleBlock
+        | UsageError::Reserved
+        | UsageError::OutOfRange => {
+            debug_assert!(false, "unreachable by construction: {e:?}");
+            StreamError::Conn
+        }
+    }
+}
 
 impl<T: TransportOps> H3Wire<T> {
+    /// Client request start (adoption spec §4.3): the request exists from `open_stream`;
+    /// h3wire holds state for it once `send_headers` succeeds.
+    pub(crate) fn open_req(&mut self, now: Time, c: ConnId) -> Result<H3ReqId, Error> {
+        let r = match self.conns.get(&c) {
+            None => Err(Error::Stale),
+            Some(conn) if !conn.client => Err(Error::Role),
+            Some(_) => self.inner.open_stream(now, c).and_then(|s| {
+                let q = self.inner.stream_info(s)?.quic_id;
+                let conn = self.conns.get_mut(&c).expect("checked above");
+                conn.mq.insert(q, s);
+                self.streams.insert(s, (c, Q(q)));
+                let id = req_id(s);
+                self.reqs.insert(id, Req::new(c, s, q, true));
+                Ok(id)
+            }),
+        };
+        self.drive_inner(now);
+        r
+    }
+
+    /// `send_headers`, all-or-error (adoption spec §4.5). Task C4 adds the send-side state.
+    pub(crate) fn send_headers(
+        &mut self,
+        now: Time,
+        id: H3ReqId,
+        hs: &[H3Header<'_>],
+        fin: bool,
+    ) -> Result<(), StreamError> {
+        let req = self
+            .reqs
+            .get_mut(&id)
+            .filter(|r| r.known)
+            .ok_or(StreamError::Stale)?;
+        let conn = self.conns.get_mut(&req.conn).ok_or(StreamError::Conn)?;
+        let fields: Vec<_> = hs.iter().map(|h| FieldRef::new(h.name, h.value)).collect();
+        let r = conn.h3.send_headers(Q(req.quic_id), &fields, fin);
+        req.core |= r.is_ok();
+        self.drive_inner(now);
+        r.map_err(usage_err)
+    }
+
     /// Executes `c`'s actions and writes its core bytes; runs whenever `c`'s h3wire state
     /// may have changed.
     pub(crate) fn service(&mut self, now: Time, c: ConnId) {
@@ -14,11 +77,10 @@ impl<T: TransportOps> H3Wire<T> {
     }
 
     fn run_actions(&mut self, now: Time, c: ConnId) {
+        self.dispatch(c);
         let Some(conn) = self.conns.get_mut(&c) else {
             return;
         };
-        // C3 dispatches these; nothing in C2 needs them.
-        while conn.h3.poll_event().is_some() {}
         while let Some(a) = conn.h3.poll_action() {
             if conn.closing {
                 continue; // drained and dropped
diff --git a/crates/mq-h3/tests/recv.rs b/crates/mq-h3/tests/recv.rs
new file mode 100644
index 00000000..9b5d30a5
--- /dev/null
+++ b/crates/mq-h3/tests/recv.rs
@@ -0,0 +1,498 @@
+//! Request receive: HEADERS bootstrap, `h3_recv_headers`, body pull, carry and
+//! "reset, code pending" (adoption spec §4.3 "Start", §4.4, §5.3 (2), (3), (6)).
+
+mod common;
+
+use common::Rig;
+use h3wire::{FieldRef, HeaderBlockId, HeadersKind, StreamId as Q};
+use mq_runtime::testing::Call;
+use mq_transport_api::{
+    Error, Event, H3Header, H3ReqId, H3ReqInfo, StreamError, StreamId, TransportOps,
+};
+
+fn f<'a>(n: &'a str, v: &'a str) -> FieldRef<'a> {
+    FieldRef::new(n.as_bytes(), v.as_bytes())
+}
+
+fn h<'a>(n: &'a str, v: &'a str) -> H3Header<'a> {
+    H3Header {
+        name: n.as_bytes(),
+        value: v.as_bytes(),
+    }
+}
+
+fn get_request() -> Vec<FieldRef<'static>> {
+    vec![
+        f(":method", "GET"),
+        f(":scheme", "https"),
+        f(":authority", "example.com"),
+        f(":path", "/x"),
+        f("user-agent", "t"),
+        f("accept", "*/*"),
+    ]
+}
+
+/// Server rig with SETTINGS exchanged and `NewConn` drained.
+fn server() -> Rig {
+    let mut r = Rig::server();
+    r.pump();
+    r.events();
+    r
+}
+
+/// Client rig with SETTINGS exchanged and a request on quic id 0 whose HEADERS reached
+/// the peer (`fin`: the request ends with them).
+fn client_request(fin: bool) -> (Rig, H3ReqId) {
+    let mut r = Rig::client();
+    r.pump();
+    r.events();
+    let id = r.w.open_h3_request(r.now, r.conn).expect("open_h3_request");
+    let hs = [
+        h(":method", "GET"),
+        h(":scheme", "https"),
+        h(":authority", "example.com"),
+        h(":path", "/"),
+    ];
+    r.w.h3_send_headers(r.now, id, &hs, fin)
+        .expect("send_headers");
+    r.pump();
+    let b = peer_block(&r, HeadersKind::Request);
+    r.peer.release(b);
+    (r, id)
+}
+
+/// The peer's last received header block of `kind`.
+fn peer_block(r: &Rig, kind: HeadersKind) -> HeaderBlockId {
+    r.peer_events
+        .iter()
+        .rev()
+        .find_map(|e| match *e {
+            h3wire::Event::Headers { block, kind: k, .. } if k == kind => Some(block),
+            _ => None,
+        })
+        .expect("peer got the block")
+}
+
+/// The id from the single `H3Request`, asserting `[H3Request, H3Readable]`.
+fn started(r: &mut Rig) -> H3ReqId {
+    let ev = r.events();
+    let Some(&Event::H3Request(c, id)) = ev.first() else {
+        panic!("no H3Request: {ev:?}");
+    };
+    assert_eq!(c, r.conn);
+    assert_eq!(ev, [Event::H3Request(c, id), Event::H3Readable(id)]);
+    id
+}
+
+fn recv_headers(r: &mut Rig, id: H3ReqId) -> (Result<bool, StreamError>, Vec<(String, String)>) {
+    let mut got = Vec::new();
+    let res = r.w.h3_recv_headers(r.now, id, &mut |n, v| {
+        got.push((
+            String::from_utf8(n.to_vec()).unwrap(),
+            String::from_utf8(v.to_vec()).unwrap(),
+        ))
+    });
+    (res, got)
+}
+
+/// `h3_recv_body` with a `cap`-byte buf until `fin`, an error or `Blocked`; every result.
+fn pull(r: &mut Rig, id: H3ReqId, cap: usize) -> Vec<Result<(Vec<u8>, bool), StreamError>> {
+    let mut out = Vec::new();
+    let mut buf = vec![0u8; cap];
+    loop {
+        let res = r.w.h3_recv_body(r.now, id, &mut buf);
+        let done = !matches!(res, Ok((_, false)));
+        out.push(res.map(|(n, fin)| (buf[..n].to_vec(), fin)));
+        if done {
+            return out;
+        }
+    }
+}
+
+/// Asserts the pulled results deliver `body` exactly, with `fin` only on the call that
+/// returns its last byte, and each slice ≤ `cap`.
+fn assert_body(got: &[Result<(Vec<u8>, bool), StreamError>], body: &[u8], cap: usize) {
+    let mut all = Vec::new();
+    for (i, g) in got.iter().enumerate() {
+        let (bytes, fin) = g.as_ref().expect("no error");
+        assert!(bytes.len() <= cap, "slice {i} is {} > {cap}", bytes.len());
+        assert!(!bytes.is_empty() || *fin, "Ok((0, false)) at call {i}");
+        all.extend_from_slice(bytes);
+        assert_eq!(*fin, i == got.len() - 1, "fin only on the last call");
+    }
+    assert_eq!(all.len(), body.len());
+    assert!(all == body, "body bytes differ");
+}
+
+/// Reset / STOP_SENDING calls on `s`, in order.
+fn aborts(r: &Rig, s: StreamId) -> Vec<Call> {
+    r.h.log()
+        .into_iter()
+        .filter(|c| {
+            matches!(c, Call::StreamResetSend { s: x, .. } | Call::StreamStopSending { s: x, .. }
+                | Call::StreamReset(x) if *x == s)
+        })
+        .collect()
+}
+
+fn recvs(r: &Rig, s: StreamId) -> usize {
+    r.h.log()
+        .iter()
+        .filter(|c| matches!(c, Call::StreamRecv { s: x, .. } if *x == s))
+        .count()
+}
+
+fn close_codes(r: &Rig) -> Vec<u64> {
+    r.h.log()
+        .into_iter()
+        .filter_map(|c| match c {
+            Call::CloseConnWith { code, .. } => Some(code),
+            _ => None,
+        })
+        .collect()
+}
+
+fn body_of(len: usize) -> Vec<u8> {
+    (0..len).map(|i| (i * 7 % 251) as u8).collect()
+}
+
+/// A raw HEADERS frame over a static-only QPACK section of `fields` (no validation).
+fn raw_headers(fields: &[FieldRef]) -> Vec<u8> {
+    let mut p = Vec::new();
+    h3wire::qpack::encoder::encode_field_section(fields, &mut p);
+    let mut out = Vec::new();
+    h3wire::frame::encode_header(0x01, p.len() as u64, &mut out);
+    out.extend_from_slice(&p);
+    out
+}
+
+#[test]
+fn request_headers_only() {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &get_request(), true).unwrap();
+    r.pump();
+    let id = started(&mut r);
+    let (res, got) = recv_headers(&mut r, id);
+    assert_eq!(res, Ok(true));
+    let names: Vec<_> = got.iter().map(|(n, _)| n.as_str()).collect();
+    assert_eq!(
+        names,
+        [
+            ":method",
+            ":scheme",
+            ":authority",
+            ":path",
+            "user-agent",
+            "accept"
+        ]
+    );
+    assert_eq!(got[0].1, "GET");
+    assert_eq!(got[2].1, "example.com");
+    assert_eq!(got[3].1, "/x");
+    assert_eq!(
+        r.w.h3_req_info(id),
+        Ok(H3ReqInfo {
+            conn: r.conn,
+            quic_id: 0
+        })
+    );
+}
+
+#[test]
+fn request_with_body() {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &get_request(), false).unwrap();
+    r.pump();
+    let id = started(&mut r);
+    assert_eq!(recv_headers(&mut r, id).0, Ok(false));
+    let mut buf = [0u8; 16 * 1024];
+    assert_eq!(
+        r.w.h3_recv_body(r.now, id, &mut buf),
+        Err(StreamError::Blocked),
+        "nothing arrived since the last pump"
+    );
+    let body = body_of(100 * 1024);
+    r.peer_send_body(Q(0), &body, true);
+    r.pump();
+    let got = pull(&mut r, id, 16 * 1024);
+    assert_body(&got, &body, 16 * 1024);
+}
+
+/// Review Focus 1.
+#[test]
+fn carry_fed_to_smaller_buf() {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &get_request(), false).unwrap();
+    let body = body_of(3000);
+    r.peer_send_body(Q(0), &body, true);
+    r.pump();
+    let s = r.peer_stream(Q(0));
+    assert_eq!(
+        r.h.recv_pending(s),
+        0,
+        "one delivery, read whole by the bootstrap"
+    );
+    let id = started(&mut r);
+    assert_eq!(recv_headers(&mut r, id).0, Ok(false));
+    let reads = recvs(&r, s);
+    let got = pull(&mut r, id, 1024);
+    assert_body(&got, &body, 1024);
+    assert_eq!(recvs(&r, s), reads, "fed from the carry only");
+}
+
+#[test]
+fn framing_only_read_continues() {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &get_request(), false).unwrap();
+    r.pump();
+    let id = started(&mut r);
+    assert_eq!(recv_headers(&mut r, id).0, Ok(false));
+    let payload = body_of(500);
+    let frame = r.peer.send_data(Q(0), payload.len() as u64, false).unwrap();
+    let prefix = frame.prefix().to_vec();
+    r.deliver(Q(0), &prefix, false);
+    r.pump(); // chunk 1: the DATA prefix only
+    r.deliver(Q(0), &payload, false);
+    r.peer
+        .data_written(Q(0), prefix.len() + payload.len())
+        .unwrap();
+    r.pump(); // chunk 2: the payload
+    let mut buf = [0u8; 4096];
+    assert_eq!(r.w.h3_recv_body(r.now, id, &mut buf), Ok((500, false)));
+    assert!(buf[..500] == payload[..]);
+}
+
+#[test]
+fn trailers_discarded() {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &get_request(), false).unwrap();
+    let body = body_of(6000);
+    r.peer_send_body(Q(0), &body, false);
+    r.peer
+        .send_headers(Q(0), &[f("x-checksum", "abc")], true)
+        .unwrap();
+    r.pump();
+    let id = started(&mut r);
+    assert_eq!(recv_headers(&mut r, id).0, Ok(false));
+    let got = pull(&mut r, id, 16 * 1024);
+    assert_eq!(got.last(), Some(&Ok((vec![], true))), "fin after the body");
+    let all: Vec<u8> = got
+        .iter()
+        .flat_map(|g| g.as_ref().unwrap().0.clone())
+        .collect();
+    assert!(all == body);
+    assert_eq!(recv_headers(&mut r, id).0, Err(StreamError::Blocked));
+    assert!(!r.events().iter().any(|e| matches!(e, Event::H3Readable(_))));
+}
+
+/// Review Focus 2.
+#[test]
+fn informational_at_read_boundary() {
+    let (mut r, id) = client_request(true);
+    r.events();
+    r.peer
+        .send_headers(Q(0), &[f(":status", "103"), f("link", "</a>")], false)
+        .unwrap();
+    r.peer
+        .send_headers(Q(0), &[f(":status", "200"), f("server", "p")], false)
+        .unwrap();
+    r.pump();
+    let s = r.peer_stream(Q(0));
+    assert_eq!(recvs(&r, s), 1, "both blocks in one transport read");
+    let ev = r.events();
+    assert_eq!(ev, [Event::H3Readable(id)]);
+    let (res, got) = recv_headers(&mut r, id);
+    assert_eq!(res, Ok(false));
+    assert_eq!(
+        got,
+        [
+            (":status".to_string(), "200".to_string()),
+            ("server".to_string(), "p".to_string())
+        ]
+    );
+}
+
+#[test]
+fn headers_blocked_when_none() {
+    // Server: the request block was taken; no further block.
+    let mut r = server();
+    r.peer.send_headers(Q(0), &get_request(), false).unwrap();
+    r.pump();
+    let id = started(&mut r);
+    assert_eq!(recv_headers(&mut r, id).0, Ok(false));
+    assert_eq!(recv_headers(&mut r, id).0, Err(StreamError::Blocked));
+    // Client: no response block yet.
+    let (mut r, id) = client_request(true);
+    assert_eq!(recv_headers(&mut r, id).0, Err(StreamError::Blocked));
+}
+
+#[test]
+fn paused_until_release() {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &get_request(), false).unwrap();
+    r.peer_send_body(Q(0), b"0123456789", false);
+    r.peer.send_headers(Q(0), &[f("x-t", "1")], true).unwrap();
+    r.pump();
+    let id = started(&mut r);
+    // The request block is still unreleased: the body flows, the trailers wait.
+    let mut buf = [0u8; 1024];
+    assert_eq!(r.w.h3_recv_body(r.now, id, &mut buf), Ok((10, false)));
+    assert_eq!(
+        r.w.h3_recv_body(r.now, id, &mut buf),
+        Err(StreamError::Blocked)
+    );
+    assert_eq!(r.events(), []);
+    assert_eq!(recv_headers(&mut r, id).0, Ok(false));
+    assert_eq!(r.events(), [Event::H3Readable(id)], "carry and FIN remain");
+    assert_eq!(r.w.h3_recv_body(r.now, id, &mut buf), Ok((0, true)));
+}
+
+/// Server request with HEADERS read; returns (rig, id, stream).
+fn reading_request() -> (Rig, H3ReqId, StreamId) {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &get_request(), false).unwrap();
+    r.pump();
+    let id = started(&mut r);
+    assert_eq!(recv_headers(&mut r, id).0, Ok(false));
+    let s = r.peer_stream(Q(0));
+    (r, id, s)
+}
+
+#[test]
+fn reset_code_pending() {
+    let (mut r, id, s) = reading_request();
+    r.h.expect_stream_recv(s, Err(StreamError::Reset));
+    let mut buf = [0u8; 1024];
+    assert_eq!(
+        r.w.h3_recv_body(r.now, id, &mut buf),
+        Err(StreamError::Reset)
+    );
+    let reads = recvs(&r, s);
+    assert_eq!(
+        r.w.h3_recv_body(r.now, id, &mut buf),
+        Err(StreamError::Reset)
+    );
+    assert_eq!(recvs(&r, s), reads, "nothing more is read or fed");
+    assert_eq!(aborts(&r, s), [], "the code is not known yet");
+    r.h.push_event(Event::StreamPeerReset(s, 0x10c));
+    r.w.drive(r.now);
+    // stream_reset_received ran once: h3wire reset our send side with the peer's code.
+    assert_eq!(aborts(&r, s), [Call::StreamResetSend { s, code: 0x10c }]);
+}
+
+#[test]
+fn reset_code_pending_then_stream_closed() {
+    let (mut r, id, s) = reading_request();
+    r.h.expect_stream_recv(s, Err(StreamError::Reset));
+    let mut buf = [0u8; 1024];
+    assert_eq!(
+        r.w.h3_recv_body(r.now, id, &mut buf),
+        Err(StreamError::Reset)
+    );
+    // The transport dropped the StreamPeerReset: only StreamClosed arrives.
+    r.h.push_event(Event::StreamClosed(s));
+    r.w.drive(r.now);
+    let ev = r.events();
+    let closed: Vec<_> = ev
+        .iter()
+        .filter(|e| matches!(e, Event::H3Closed(..)))
+        .collect();
+    assert_eq!(closed.len(), 1, "{ev:?}");
+    let Event::H3Closed(cid, close) = closed[0] else {
+        unreachable!()
+    };
+    assert_eq!(*cid, id);
+    assert_eq!(close.unread, None);
+    assert_eq!(aborts(&r, s), [], "actions on the gone stream are dropped");
+    // The id is stale from now on.
+    let now = r.now;
+    assert_eq!(recv_headers(&mut r, id).0, Err(StreamError::Stale));
+    assert_eq!(r.w.h3_recv_body(now, id, &mut buf), Err(StreamError::Stale));
+    assert_eq!(
+        r.w.h3_send_headers(now, id, &[h(":status", "200")], false),
+        Err(StreamError::Stale)
+    );
+    assert_eq!(
+        r.w.h3_send_body(now, id, b"x", false),
+        Err(StreamError::Stale)
+    );
+    assert_eq!(r.w.h3_finish(now, id), Err(StreamError::Stale));
+    assert_eq!(r.w.h3_req_info(id), Err(Error::Stale));
+    let calls = r.h.log().len();
+    r.w.h3_reset(now, id);
+    let after: Vec<_> = r.h.log()[calls..]
+        .iter()
+        .filter(|c| !matches!(c, Call::Drive(_)))
+        .cloned()
+        .collect();
+    assert_eq!(after, [], "h3_reset on a stale id is a no-op");
+    r.w.drive(now);
+    assert!(!r.events().iter().any(|e| matches!(e, Event::H3Closed(..))));
+}
+
+/// adoption spec §5.3 (6).
+#[test]
+fn malformed_headers_never_reach_gateway() {
+    let mut r = server();
+    let mut fields = get_request();
+    fields.push(f("X-Upper", "1"));
+    r.deliver(Q(0), &raw_headers(&fields), false);
+    r.pump();
+    assert_eq!(r.events(), []);
+    let s = r.peer_stream(Q(0));
+    assert_eq!(
+        aborts(&r, s),
+        [
+            Call::StreamResetSend { s, code: 0x10e },
+            Call::StreamStopSending { s, code: 0x10e }
+        ]
+    );
+}
+
+/// adoption spec §5.3 (2), server.
+#[test]
+fn fin_without_headers() {
+    let mut r = server();
+    r.deliver(Q(0), &[], true);
+    r.pump();
+    assert_eq!(r.events(), []);
+    let s = r.peer_stream(Q(0));
+    assert_eq!(aborts(&r, s), [Call::StreamResetSend { s, code: 0x10d }]);
+}
+
+/// adoption spec §5.3 (2), client.
+#[test]
+fn no_final_response() {
+    let (mut r, id) = client_request(false);
+    r.events();
+    r.peer
+        .send_headers(Q(0), &[f(":status", "103")], false)
+        .unwrap();
+    r.deliver(Q(0), &[], true); // raw FIN: h3wire cannot end a stream without a response
+    r.pump();
+    assert_eq!(r.events(), [Event::H3Readable(id)]);
+    assert_eq!(recv_headers(&mut r, id).0, Err(StreamError::Reset));
+    let mut buf = [0u8; 64];
+    assert_eq!(
+        r.w.h3_recv_body(r.now, id, &mut buf),
+        Err(StreamError::Reset)
+    );
+    let s = r.peer_stream(Q(0));
+    assert_eq!(aborts(&r, s), [Call::StreamResetSend { s, code: 0x10e }]);
+}
+
+/// adoption spec §5.3 (3).
+#[test]
+fn oversized_headers_closes() {
+    let mut r = server();
+    let mut hdr = Vec::new();
+    h3wire::frame::encode_header(0x01, 65537, &mut hdr);
+    r.deliver(Q(0), &hdr, false); // the frame header alone: no payload to buffer
+    r.pump();
+    assert_eq!(close_codes(&r), [0x107]);
+    assert!(
+        !r.events()
+            .iter()
+            .any(|e| matches!(e, Event::H3Request(..) | Event::H3Readable(_)))
+    );
+}

From bb1cc50f39d11d4cd39796fb7e1dbe60b25f4392 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 10:22:08 +0900
Subject: [PATCH 05/33] fix(mq-h3): retire a request stream aborted during a
 feed; xqc_h3 open_h3_request errors

---
 crates/mq-h3/src/conn.rs   |  7 ++++-
 crates/mq-h3/src/lib.rs    |  4 +++
 crates/mq-h3/src/recv.rs   | 13 +++++++-
 crates/mq-h3/src/send.rs   |  4 ++-
 crates/mq-h3/tests/recv.rs | 64 +++++++++++++++++++++++++++++++++++---
 5 files changed, 85 insertions(+), 7 deletions(-)

diff --git a/crates/mq-h3/src/conn.rs b/crates/mq-h3/src/conn.rs
index c8ae8a73..c1788bc6 100644
--- a/crates/mq-h3/src/conn.rs
+++ b/crates/mq-h3/src/conn.rs
@@ -56,7 +56,12 @@ impl<T: TransportOps> H3Wire<T> {
     /// of H3 conns are consumed here (adoption spec §4.1).
     pub(crate) fn on_event(&mut self, now: Time, e: Event) -> Option<Event> {
         match e {
-            Event::NewConn(c, ConnProto::H3) => self.add_conn(now, c, Role::Server),
+            Event::NewConn(c, proto) => {
+                self.server = true;
+                if proto == ConnProto::H3 {
+                    self.add_conn(now, c, Role::Server);
+                }
+            }
             // ponytail: C2 drops the conn outright; Task C5 adds the request fan-out.
             Event::ConnClosed(c, _) => {
                 if let Some(conn) = self.conns.remove(&c) {
diff --git a/crates/mq-h3/src/lib.rs b/crates/mq-h3/src/lib.rs
index 058db38a..bbcde69b 100644
--- a/crates/mq-h3/src/lib.rs
+++ b/crates/mq-h3/src/lib.rs
@@ -34,6 +34,9 @@ pub struct H3Wire<T> {
     conns: HashMap<ConnId, H3Conn>,
     /// Every stream of an H3 conn: its conn and quic id.
     streams: HashMap<StreamId, (ConnId, h3wire::StreamId)>,
+    /// A `NewConn` was seen: the inner transport is a server. ponytail: learned, not
+    /// configured; before its first conn a server reports an unknown conn as `Stale`.
+    server: bool,
 }
 
 impl<T: TransportOps> H3Wire<T> {
@@ -55,6 +58,7 @@ impl<T: TransportOps> H3Wire<T> {
             reqs: HashMap::new(),
             conns: HashMap::new(),
             streams: HashMap::new(),
+            server: false,
         }
     }
 
diff --git a/crates/mq-h3/src/recv.rs b/crates/mq-h3/src/recv.rs
index ff2d94dc..ad3fd5e8 100644
--- a/crates/mq-h3/src/recv.rs
+++ b/crates/mq-h3/src/recv.rs
@@ -70,6 +70,8 @@ impl<T: TransportOps> H3Wire<T> {
                     }
                     req.carry = Vec::new();
                     req.carry_fin = false;
+                    // Aborted: a later StreamClosed is not a peer reset to pass on.
+                    req.reset_code_pending = false;
                 }
                 _ => unreachable!("filtered above"),
             }
@@ -125,6 +127,7 @@ impl<T: TransportOps> H3Wire<T> {
             let (consumed, body) = match conn.h3.recv(Q(req.quic_id), &req.carry[..len], fin) {
                 Err(e) => {
                     log::debug!("h3wire: {e}");
+                    req.carry = Vec::new(); // never fed again
                     return Err(StreamError::Conn);
                 }
                 Ok(Recv::Paused) => return Ok(0),
@@ -147,10 +150,18 @@ impl<T: TransportOps> H3Wire<T> {
                 }
             }
             let fin_fed = fin && consumed == len;
+            let fin_read = req.carry_fin;
             req.carry.drain(..consumed);
             req.carry_fin &= !fin_fed;
-            let c = req.conn;
+            let (c, s) = (req.conn, req.stream);
             self.dispatch(c);
+            // Aborted by this feed (malformed, content-length, no final response): read the
+            // rest to FIN or the reset so the stream retires; raw xquic does not re-notify
+            // for bytes it already holds, and later StreamReadables continue it (spec §3).
+            if !fin_read && self.reqs.get(&id).is_some_and(|r| r.aborted()) {
+                self.retire_read(now, s);
+                return Ok(0);
+            }
             if n > 0 || (consumed == 0 && !fin_fed) {
                 return Ok(n);
             }
diff --git a/crates/mq-h3/src/send.rs b/crates/mq-h3/src/send.rs
index 6e7f31a7..781c344e 100644
--- a/crates/mq-h3/src/send.rs
+++ b/crates/mq-h3/src/send.rs
@@ -30,9 +30,11 @@ impl<T: TransportOps> H3Wire<T> {
     /// Client request start (adoption spec §4.3): the request exists from `open_stream`;
     /// h3wire holds state for it once `send_headers` succeeds.
     pub(crate) fn open_req(&mut self, now: Time, c: ConnId) -> Result<H3ReqId, Error> {
+        // The xqc_h3 backend's order (`reserve_local`): role, conn, protocol.
         let r = match self.conns.get(&c) {
+            _ if self.server => Err(Error::Role),
+            None if self.inner.conn_stats(c).is_ok() => Err(Error::Other), // a raw conn
             None => Err(Error::Stale),
-            Some(conn) if !conn.client => Err(Error::Role),
             Some(_) => self.inner.open_stream(now, c).and_then(|s| {
                 let q = self.inner.stream_info(s)?.quic_id;
                 let conn = self.conns.get_mut(&c).expect("checked above");
diff --git a/crates/mq-h3/tests/recv.rs b/crates/mq-h3/tests/recv.rs
index 9b5d30a5..b88e399f 100644
--- a/crates/mq-h3/tests/recv.rs
+++ b/crates/mq-h3/tests/recv.rs
@@ -116,7 +116,10 @@ fn assert_body(got: &[Result<(Vec<u8>, bool), StreamError>], body: &[u8], cap: u
     for (i, g) in got.iter().enumerate() {
         let (bytes, fin) = g.as_ref().expect("no error");
         assert!(bytes.len() <= cap, "slice {i} is {} > {cap}", bytes.len());
-        assert!(!bytes.is_empty() || *fin, "Ok((0, false)) at call {i}");
+        assert!(
+            !bytes.is_empty(),
+            "an empty result at call {i} (fin comes with the last byte)"
+        );
         all.extend_from_slice(bytes);
         assert_eq!(*fin, i == got.len() - 1, "fin only on the last call");
     }
@@ -449,6 +452,50 @@ fn malformed_headers_never_reach_gateway() {
     );
 }
 
+/// A stream h3wire aborts during a feed is read to its FIN, so it can retire
+/// (adoption spec §3, §4.4).
+#[test]
+fn abort_in_feed_retires() {
+    let mut r = server();
+    let mut fields = get_request();
+    fields.push(f("X-Upper", "1"));
+    let mut bytes = raw_headers(&fields);
+    let mut data = Vec::new();
+    h3wire::frame::encode_header(0x00, 10_000, &mut data);
+    bytes.extend_from_slice(&data);
+    bytes.extend_from_slice(&body_of(10_000));
+    assert!(bytes.len() > 4096);
+    r.deliver(Q(0), &bytes, true);
+    r.pump();
+    assert_eq!(r.events(), []);
+    let s = r.peer_stream(Q(0));
+    assert_eq!(r.h.recv_pending(s), 0, "read to the FIN");
+    assert_eq!(
+        aborts(&r, s),
+        [
+            Call::StreamResetSend { s, code: 0x10e },
+            Call::StreamStopSending { s, code: 0x10e }
+        ]
+    );
+}
+
+/// The xqc_h3 backend's order (`reserve_local`): role, then conn, then protocol.
+#[test]
+fn open_h3_request_errors() {
+    let mut r = Rig::client();
+    r.pump();
+    let unknown = r.h.new_conn_id();
+    assert_eq!(r.w.open_h3_request(r.now, unknown), Err(Error::Stale));
+    let raw = r.h.new_conn_id();
+    r.h.set_conn_stats(raw, Default::default());
+    assert_eq!(r.w.open_h3_request(r.now, raw), Err(Error::Other));
+    let mut r = server();
+    assert_eq!(r.w.open_h3_request(r.now, r.conn), Err(Error::Role));
+    let unknown = r.h.new_conn_id();
+    assert_eq!(r.w.open_h3_request(r.now, unknown), Err(Error::Role));
+    assert!(!r.h.log().iter().any(|c| matches!(c, Call::OpenStream(_))));
+}
+
 /// adoption spec §5.3 (2), server.
 #[test]
 fn fin_without_headers() {
@@ -485,11 +532,20 @@ fn no_final_response() {
 #[test]
 fn oversized_headers_closes() {
     let mut r = server();
-    let mut hdr = Vec::new();
-    h3wire::frame::encode_header(0x01, 65537, &mut hdr);
-    r.deliver(Q(0), &hdr, false); // the frame header alone: no payload to buffer
+    let mut bytes = Vec::new();
+    h3wire::frame::encode_header(0x01, 65537, &mut bytes);
+    bytes.extend_from_slice(&body_of(10_000)); // payload follows the frame header
+    r.deliver(Q(0), &bytes, false);
     r.pump();
     assert_eq!(close_codes(&r), [0x107]);
+    // Closed at the frame header: the first read is dropped and nothing more is read.
+    let s = r.peer_stream(Q(0));
+    assert_eq!(recvs(&r, s), 1);
+    assert_eq!(
+        r.h.recv_pending(s),
+        1,
+        "the rest of the payload is never read"
+    );
     assert!(
         !r.events()
             .iter()

From 93cb2e0d17331398fa167fdf8ff6bc16c37e76b5 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 10:37:40 +0900
Subject: [PATCH 06/33] =?UTF-8?q?feat(mq-h3):=20request=20send=20=E2=80=94?=
 =?UTF-8?q?=20DATA=20framing,=20finish=20latch,=20pending=20FIN,=20GOAWAY?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crates/mq-h3/src/conn.rs         |   4 +
 crates/mq-h3/src/lib.rs          |  15 +-
 crates/mq-h3/src/recv.rs         |  37 ++-
 crates/mq-h3/src/req.rs          |  22 +-
 crates/mq-h3/src/send.rs         | 324 +++++++++++++++++++-
 crates/mq-h3/tests/common/mod.rs |  63 +++-
 crates/mq-h3/tests/recv.rs       |  20 +-
 crates/mq-h3/tests/send.rs       | 492 +++++++++++++++++++++++++++++++
 8 files changed, 923 insertions(+), 54 deletions(-)
 create mode 100644 crates/mq-h3/tests/send.rs

diff --git a/crates/mq-h3/src/conn.rs b/crates/mq-h3/src/conn.rs
index c1788bc6..dea4a1f8 100644
--- a/crates/mq-h3/src/conn.rs
+++ b/crates/mq-h3/src/conn.rs
@@ -31,6 +31,9 @@ pub(crate) struct H3Conn {
     pub(crate) uni_done: HashSet<StreamId>,
     /// We closed the transport; h3wire's actions and bytes are dropped from then on.
     pub(crate) closing: bool,
+    /// Request streams whose `FinishStream` write was `Blocked`: retried by `service`
+    /// (adoption spec §4.5). At most one per stream.
+    pub(crate) fins: HashSet<StreamId>,
 }
 
 impl H3Conn {
@@ -47,6 +50,7 @@ impl<T: TransportOps> H3Wire<T> {
             mq: HashMap::new(),
             uni_done: HashSet::new(),
             closing: false,
+            fins: HashSet::new(),
         };
         self.conns.insert(c, conn);
         self.service(now, c);
diff --git a/crates/mq-h3/src/lib.rs b/crates/mq-h3/src/lib.rs
index bbcde69b..b32f775f 100644
--- a/crates/mq-h3/src/lib.rs
+++ b/crates/mq-h3/src/lib.rs
@@ -74,6 +74,15 @@ impl<T: TransportOps> H3Wire<T> {
         self.inner
     }
 
+    /// The h3wire abort of request `r` (code, source), if it was aborted.
+    #[cfg(feature = "test-support")]
+    pub fn debug_abort(&self, r: H3ReqId) -> Option<(h3wire::H3Code, h3wire::AbortSource)> {
+        match self.reqs.get(&r)?.terminal? {
+            req::Terminal::Aborted { code, source } => Some((code, source)),
+            req::Terminal::Finished => None,
+        }
+    }
+
     /// Services every H3 conn, then moves the inner queue into ours, consuming what belongs
     /// to H3 conns; runs at the end of every method that takes `now` (adoption spec §4.1).
     fn drive_inner(&mut self, now: Time) {
@@ -275,14 +284,14 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         fin: bool,
     ) -> Result<usize, StreamError> {
         if self.active {
-            return Err(StreamError::Stale); // Task C4
+            return self.send_body(now, r, data, fin);
         }
         fwd!(self, now, self.inner.h3_send_body(now, r, data, fin))
     }
 
     fn h3_finish(&mut self, now: Time, r: H3ReqId) -> Result<(), StreamError> {
         if self.active {
-            return Err(StreamError::Stale); // Task C4
+            return self.finish(now, r);
         }
         fwd!(self, now, self.inner.h3_finish(now, r))
     }
@@ -313,7 +322,7 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
 
     fn h3_reset(&mut self, now: Time, r: H3ReqId) {
         if self.active {
-            return; // Task C5
+            return self.reset(now, r);
         }
         fwd!(self, now, self.inner.h3_reset(now, r))
     }
diff --git a/crates/mq-h3/src/recv.rs b/crates/mq-h3/src/recv.rs
index ad3fd5e8..6f4c1835 100644
--- a/crates/mq-h3/src/recv.rs
+++ b/crates/mq-h3/src/recv.rs
@@ -18,18 +18,21 @@ fn slice(carry: usize, carry_fin: bool, cap: usize) -> (usize, bool) {
 
 impl<T: TransportOps> H3Wire<T> {
     /// Applies `c`'s h3wire events to the requests and queues what the gateway sees
-    /// (adoption spec §4.3 "Start", §4.4).
-    pub(crate) fn dispatch(&mut self, c: ConnId) {
+    /// (adoption spec §4.3 "Start", §4.4). Returns the streams aborted with their FIN
+    /// unread: they need the retirement read of spec §3.
+    pub(crate) fn dispatch(&mut self, c: ConnId) -> Vec<StreamId> {
+        let mut retire = Vec::new();
         let Some(conn) = self.conns.get_mut(&c) else {
-            return;
+            return retire;
         };
         while let Some(e) = conn.h3.poll_event() {
             let q = match e {
                 H3Event::Headers { stream, .. }
                 | H3Event::Finished(stream)
-                | H3Event::StreamAborted { stream, .. } => stream,
-                // SendStopped, GoAway: Task C4. Closed: Task C5. PeerSettings, UniStream:
-                // nothing to do.
+                | H3Event::StreamAborted { stream, .. }
+                | H3Event::SendStopped { stream, .. } => stream,
+                // GoAway: its cutoff arrives as StreamAborted. Closed: Task C5.
+                // PeerSettings, UniStream: nothing to do.
                 _ => continue,
             };
             let id = conn.mq.get(&q.0).map(|&s| req_id(s));
@@ -62,9 +65,22 @@ impl<T: TransportOps> H3Wire<T> {
                     conn.h3.release(block);
                     continue;
                 }
+                // adoption spec §4.5: the client discards later body, the server resets.
+                H3Event::SendStopped { .. } => {
+                    req.send_stopped = true;
+                    req.frame = None;
+                    req.finish_latched = false;
+                    if req.known {
+                        self.queue.push(Event::H3Writable(id)); // a blocked pump learns it
+                    }
+                    continue;
+                }
                 H3Event::Finished(_) => req.terminal = Some(Terminal::Finished),
                 H3Event::StreamAborted { code, source, .. } => {
                     req.terminal = Some(Terminal::Aborted { code, source });
+                    if !req.carry_fin && !req.reset_code_pending {
+                        retire.push(req.stream);
+                    }
                     if let Some(b) = req.pending_block.take() {
                         conn.h3.release(b);
                     }
@@ -80,6 +96,7 @@ impl<T: TransportOps> H3Wire<T> {
                 self.queue.push(Event::H3Readable(id));
             }
         }
+        retire
     }
 
     /// Feeds request `id` until a stop condition (adoption spec §4.4).
@@ -290,6 +307,11 @@ impl<T: TransportOps> H3Wire<T> {
                 }
                 self.retire_read(now, s);
             }
+            Event::StreamWritable(_) => {
+                if self.reqs.get(&id).is_some_and(|r| r.known) {
+                    self.queue.push(Event::H3Writable(id)); // adoption spec §4.5
+                }
+            }
             Event::StreamClosed(_) => {
                 // A pending code was dropped with the slot: "reset, code unknown".
                 if let Some(req) = self.reqs.get_mut(&id)
@@ -301,6 +323,7 @@ impl<T: TransportOps> H3Wire<T> {
                 // Unmapped first, so actions queued for the gone stream are dropped.
                 if let Some(conn) = self.conns.get_mut(&c) {
                     conn.mq.remove(&q.0);
+                    conn.fins.remove(&s);
                 }
                 self.streams.remove(&s);
                 self.close_req(id);
@@ -342,7 +365,7 @@ impl<T: TransportOps> H3Wire<T> {
 
     /// Retirement read (adoption spec §3): discards what is left until FIN, the reset
     /// or a blocked transport.
-    fn retire_read(&mut self, now: Time, s: StreamId) {
+    pub(crate) fn retire_read(&mut self, now: Time, s: StreamId) {
         let mut buf = [0u8; BOOT_READ];
         while let Ok((n, fin)) = self.inner.stream_recv(now, s, &mut buf) {
             if fin || n == 0 {
diff --git a/crates/mq-h3/src/req.rs b/crates/mq-h3/src/req.rs
index 83aa422c..6650a99a 100644
--- a/crates/mq-h3/src/req.rs
+++ b/crates/mq-h3/src/req.rs
@@ -1,7 +1,8 @@
 //! Per-request state (adoption spec §4.3).
 
+use crate::send::InFlight;
 use h3wire::{AbortSource, H3Code, HeaderBlockId};
-use mq_transport_api::{ConnId, H3ReqId, H3ReqStats, StreamId};
+use mq_transport_api::{ConnId, H3ReqId, H3ReqStats, StreamId, Time};
 
 /// The h3wire terminal event of a request's receive side.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -32,7 +33,19 @@ pub(crate) struct Req {
     pub(crate) carry: Vec<u8>,
     /// The transport reported FIN after the carry; not yet fed.
     pub(crate) carry_fin: bool,
-    // send-side fields: Task C4; stats: Task C6
+    /// The DATA frame `h3_send_body` started and has not written whole (adoption spec §4.5).
+    pub(crate) frame: Option<InFlight>,
+    /// `h3_finish` (or a bare `fin`) is waiting for `send_data(0, true)` to stop being
+    /// `Blocked` behind queued HEADERS bytes.
+    pub(crate) finish_latched: bool,
+    /// `h3_send_body` returned `Blocked` behind queued HEADERS bytes: `H3Writable` once
+    /// they drain.
+    pub(crate) writable_wanted: bool,
+    /// The peer's STOP_SENDING ended our send side.
+    pub(crate) send_stopped: bool,
+    /// `now` when the first HEADERS byte was accepted (adoption spec §4.6).
+    pub(crate) headers_sent_at: Option<Time>,
+    // stats: Task C6
 }
 
 impl Req {
@@ -50,6 +63,11 @@ impl Req {
             reset_code_pending: false,
             carry: Vec::new(),
             carry_fin: false,
+            frame: None,
+            finish_latched: false,
+            writable_wanted: false,
+            send_stopped: false,
+            headers_sent_at: None,
         }
     }
 
diff --git a/crates/mq-h3/src/send.rs b/crates/mq-h3/src/send.rs
index 781c344e..e13a4d25 100644
--- a/crates/mq-h3/src/send.rs
+++ b/crates/mq-h3/src/send.rs
@@ -2,8 +2,71 @@
 
 use crate::H3Wire;
 use crate::req::{Req, req_id};
-use h3wire::{Action, FieldRef, H3Code, StreamId as Q, UsageError};
-use mq_transport_api::{ConnId, Error, H3Header, H3ReqId, StreamError, Time, TransportOps};
+use h3wire::{Action, Connection, DataFrame, FieldRef, H3Code, StreamId as Q, UsageError};
+use mq_transport_api::{ConnId, Error, Event, H3Header, H3ReqId, StreamError, Time, TransportOps};
+
+/// The DATA frame `h3_send_body` started: its prefix, then `payload_left` bytes the
+/// gateway re-offers (adoption spec §4.5). Fixed-size (spec §5.4).
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct InFlight {
+    prefix: DataFrame,
+    prefix_written: usize,
+    payload_left: u64,
+    /// Started with `end`: h3wire queues the FIN once the frame is written.
+    end: bool,
+}
+
+impl InFlight {
+    fn new(prefix: DataFrame, payload: usize, end: bool) -> InFlight {
+        InFlight {
+            prefix,
+            prefix_written: 0,
+            payload_left: payload as u64,
+            end,
+        }
+    }
+
+    /// The prefix bytes not yet accepted.
+    fn prefix_rest(&self) -> &[u8] {
+        &self.prefix.prefix()[self.prefix_written..]
+    }
+
+    /// Payload bytes to offer from `avail` re-offered ones: none until the prefix is
+    /// accepted whole.
+    fn payload_take(&self, avail: usize) -> usize {
+        if self.prefix_rest().is_empty() {
+            avail.min(usize::try_from(self.payload_left).unwrap_or(usize::MAX))
+        } else {
+            0
+        }
+    }
+
+    /// The transport accepted `n` more bytes: the prefix first, then the payload.
+    fn advance(&mut self, n: usize) {
+        let p = n.min(self.prefix_rest().len());
+        self.prefix_written += p;
+        self.payload_left -= (n - p) as u64;
+    }
+
+    fn done(&self) -> bool {
+        self.prefix_rest().is_empty() && self.payload_left == 0
+    }
+}
+
+/// `send_data(0, true)` for a latched finish, once it is no longer `Blocked`
+/// (adoption spec §4.5); it queues `FinishStream`.
+fn try_finish(h3: &mut Connection, req: &mut Req) -> Result<(), StreamError> {
+    if !req.finish_latched {
+        return Ok(());
+    }
+    match h3.send_data(Q(req.quic_id), 0, true) {
+        Err(UsageError::Blocked) => Ok(()),
+        r => {
+            req.finish_latched = false;
+            r.map(drop).map_err(usage_err)
+        }
+    }
+}
 
 /// A refused h3wire call (Global Constraints error table, adoption spec §5.1).
 pub(crate) fn usage_err(e: UsageError) -> StreamError {
@@ -70,16 +133,191 @@ impl<T: TransportOps> H3Wire<T> {
         r.map_err(usage_err)
     }
 
+    /// The request's role, if `id` is a request the gateway knows (else `Stale`) on a
+    /// live conn (else `Conn`).
+    fn client_of(&self, id: H3ReqId) -> Result<bool, StreamError> {
+        let req = self
+            .reqs
+            .get(&id)
+            .filter(|r| r.known)
+            .ok_or(StreamError::Stale)?;
+        let conn = self.conns.get(&req.conn).ok_or(StreamError::Conn)?;
+        Ok(conn.client)
+    }
+
+    /// `h3_send_body` (adoption spec §4.5): `Ok(n)` counts accepted payload bytes, and
+    /// `fin` is committed only when `n == data.len()`.
+    pub(crate) fn send_body(
+        &mut self,
+        now: Time,
+        id: H3ReqId,
+        data: &[u8],
+        fin: bool,
+    ) -> Result<usize, StreamError> {
+        let client = self.client_of(id)?;
+        let r = self.body(now, id, data, fin, client);
+        self.drive_inner(now);
+        r
+    }
+
+    fn body(
+        &mut self,
+        now: Time,
+        id: H3ReqId,
+        data: &[u8],
+        fin: bool,
+        client: bool,
+    ) -> Result<usize, StreamError> {
+        let req = &self.reqs[&id];
+        if req.send_stopped {
+            // RFC 9114 §4.1: the client's response keeps flowing; xqc_h3 resets the server.
+            return if client {
+                Ok(data.len())
+            } else {
+                Err(StreamError::Reset)
+            };
+        }
+        if req.aborted() {
+            return Err(StreamError::Reset);
+        }
+        // Continue the frame in flight; the gateway re-offers from its first unaccepted
+        // byte. ponytail: a `fin` call offering less than the frame still needs cannot
+        // end it; the gateway never does that (it re-offers its whole pending buffer).
+        let mut n = 0;
+        if let Some(f) = req.frame {
+            n = self.write_frame(now, id, data)?;
+            if self.reqs[&id].frame.is_some() {
+                return if n == 0 {
+                    Err(StreamError::Blocked)
+                } else {
+                    Ok(n)
+                };
+            }
+            if f.end {
+                return Ok(n); // h3wire queues the FIN
+            }
+        }
+        let rest = &data[n..];
+        let req = self.reqs.get_mut(&id).expect("checked above");
+        let conn = self.conns.get_mut(&req.conn).expect("checked above");
+        if rest.is_empty() {
+            if fin {
+                req.finish_latched = true;
+                try_finish(&mut conn.h3, req)?;
+            }
+            return Ok(n);
+        }
+        match conn.h3.send_data(Q(req.quic_id), rest.len() as u64, fin) {
+            Ok(prefix) => req.frame = Some(InFlight::new(prefix, rest.len(), fin)),
+            Err(UsageError::Blocked) if n == 0 => {
+                req.writable_wanted = true; // HEADERS bytes are still queued
+                return Err(StreamError::Blocked);
+            }
+            Err(_) if n > 0 => return Ok(n),
+            Err(e) => return Err(usage_err(e)),
+        }
+        match self.write_frame(now, id, rest) {
+            Ok(0) if n == 0 => Err(StreamError::Blocked),
+            Ok(k) => Ok(n + k),
+            Err(_) if n > 0 => Ok(n),
+            Err(e) => Err(e),
+        }
+    }
+
+    /// Writes the rest of `id`'s frame in flight from the re-offered `data`: the prefix,
+    /// then the payload as a separate `stream_send`, reporting every accepted byte to
+    /// h3wire. Returns the payload bytes accepted.
+    fn write_frame(&mut self, now: Time, id: H3ReqId, data: &[u8]) -> Result<usize, StreamError> {
+        let req = self.reqs.get_mut(&id).expect("caller checked");
+        let f = req.frame.as_mut().expect("caller checked");
+        let (mut n, mut written, mut err) = (0, 0, None);
+        loop {
+            let (bytes, payload) = match f.prefix_rest() {
+                [] => match f.payload_take(data.len() - n) {
+                    0 => break,
+                    k => (&data[n..n + k], true),
+                },
+                p => (p, false),
+            };
+            let len = bytes.len();
+            match self.inner.stream_send(now, req.stream, bytes, false) {
+                Ok(k) => {
+                    f.advance(k);
+                    written += k;
+                    n += if payload { k } else { 0 };
+                    if k < len {
+                        break;
+                    }
+                }
+                Err(StreamError::Blocked) => break,
+                Err(e) => {
+                    err = Some(e);
+                    break;
+                }
+            }
+        }
+        if f.done() {
+            req.frame = None;
+        }
+        if written > 0 {
+            let conn = self.conns.get_mut(&req.conn).ok_or(StreamError::Conn)?;
+            let r = conn.h3.data_written(Q(req.quic_id), written);
+            debug_assert!(r.is_ok(), "data_written({written}): {r:?}");
+        }
+        err.map_or(Ok(n), Err)
+    }
+
+    /// `h3_finish`: latches the finish intent and returns `Ok` while HEADERS bytes are
+    /// queued, as xqc_h3 does (adoption spec §4.5).
+    pub(crate) fn finish(&mut self, now: Time, id: H3ReqId) -> Result<(), StreamError> {
+        let client = self.client_of(id)?;
+        let r = self.body(now, id, &[], true, client).map(drop);
+        self.drive_inner(now);
+        r
+    }
+
+    /// `h3_reset` (adoption spec §4.3). Without h3wire state (a client request whose
+    /// `send_headers` failed) the raw stream is reset directly.
+    pub(crate) fn reset(&mut self, now: Time, id: H3ReqId) {
+        let Some(req) = self.reqs.get(&id).filter(|r| r.known) else {
+            return; // stale: a no-op
+        };
+        if !req.core {
+            self.inner.stream_reset(now, req.stream);
+        } // ponytail: Task C5 adds `Connection::abort` for a request with h3wire state.
+        self.drive_inner(now);
+    }
+
     /// Executes `c`'s actions and writes its core bytes; runs whenever `c`'s h3wire state
-    /// may have changed.
+    /// may have changed, so also after every call that takes `now`.
     pub(crate) fn service(&mut self, now: Time, c: ConnId) {
+        self.retry_fins(now, c);
         self.run_actions(now, c);
         self.flush(now, c);
         self.run_actions(now, c); // `sent` may queue FinishStream
     }
 
+    /// Pending FINs (adoption spec §4.5): kept while `Blocked`, dropped on any other
+    /// result. Runs before the actions, so a FIN just blocked waits for the next call.
+    fn retry_fins(&mut self, now: Time, c: ConnId) {
+        let Some(conn) = self.conns.get_mut(&c) else {
+            return;
+        };
+        let inner = &mut self.inner;
+        conn.fins.retain(|&s| {
+            matches!(
+                inner.stream_send(now, s, &[], true),
+                Err(StreamError::Blocked)
+            )
+        });
+    }
+
     fn run_actions(&mut self, now: Time, c: ConnId) {
-        self.dispatch(c);
+        // Aborts from outside a feed (GOAWAY cutoff, local abort): read the stream to
+        // FIN or the reset so it retires (adoption spec §3).
+        for s in self.dispatch(c) {
+            self.retire_read(now, s);
+        }
         let Some(conn) = self.conns.get_mut(&c) else {
             return;
         };
@@ -113,10 +351,13 @@ impl<T: TransportOps> H3Wire<T> {
                     self.inner.close_conn_with(now, c, code.0);
                     conn.closing = true;
                 }
-                // Task C4 keeps a pending FIN when this is `Blocked`.
+                // A `Blocked` FIN is kept and retried; it survives a peer RESET_STREAM
+                // (adoption spec §3, §4.5).
                 Action::FinishStream(q) => {
-                    if let Some(s) = mq(q) {
-                        let _ = self.inner.stream_send(now, s, &[], true);
+                    if let Some(s) = mq(q)
+                        && self.inner.stream_send(now, s, &[], true) == Err(StreamError::Blocked)
+                    {
+                        conn.fins.insert(s);
                     }
                 }
                 // Direction guard (adoption spec §4.5): the transport ops do not check.
@@ -125,6 +366,7 @@ impl<T: TransportOps> H3Wire<T> {
                     debug_assert!(ok, "ResetStream on a stream with no send side");
                     if let (true, Some(s)) = (ok, mq(q)) {
                         self.inner.stream_reset_send(now, s, code.0);
+                        conn.fins.remove(&s);
                     }
                 }
                 Action::StopSending { stream: q, code } => {
@@ -138,9 +380,18 @@ impl<T: TransportOps> H3Wire<T> {
         }
     }
 
-    /// Writes core bytes per stream until the transport accepts less than offered.
+    /// Writes core bytes per stream until the transport accepts less than offered. A
+    /// request stream that drains fires its finish latch and wakes a gateway that was
+    /// `Blocked` behind them (adoption spec §4.5).
     fn flush(&mut self, now: Time, c: ConnId) {
-        let Some(conn) = self.conns.get_mut(&c) else {
+        let Self {
+            conns,
+            reqs,
+            inner,
+            queue,
+            ..
+        } = self;
+        let Some(conn) = conns.get_mut(&c) else {
             return;
         };
         if conn.closing {
@@ -150,17 +401,70 @@ impl<T: TransportOps> H3Wire<T> {
             let Some(&s) = conn.mq.get(&q.0) else {
                 continue;
             };
+            let mut req = reqs.get_mut(&req_id(s)).filter(|_| q.is_request());
             while let Some(bytes) = conn.h3.poll_send(q).filter(|b| !b.is_empty()) {
                 let len = bytes.len();
-                let Ok(n) = self.inner.stream_send(now, s, bytes, false) else {
+                let Ok(n) = inner.stream_send(now, s, bytes, false) else {
                     break;
                 };
+                if let Some(req) = req.as_mut().filter(|_| n > 0) {
+                    req.headers_sent_at.get_or_insert(now);
+                }
                 let sent = conn.h3.sent(q, n);
                 debug_assert!(sent.is_ok(), "sent({q:?}, {n}): {sent:?}");
                 if n < len {
                     break;
                 }
             }
+            if let Some(req) = req.filter(|_| conn.h3.poll_send(q).is_none()) {
+                let _ = try_finish(&mut conn.h3, req); // refused: logged by usage_err
+                if std::mem::take(&mut req.writable_wanted) && req.known {
+                    queue.push(Event::H3Writable(req_id(s)));
+                }
+            }
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::InFlight;
+
+    #[test]
+    fn in_flight_prefix_then_payload() {
+        let mut c = h3wire::Connection::new(h3wire::Role::Client, Default::default());
+        let q = h3wire::StreamId(0);
+        let get = [
+            h3wire::FieldRef::new(b":method", b"POST"),
+            h3wire::FieldRef::new(b":scheme", b"https"),
+            h3wire::FieldRef::new(b":authority", b"a"),
+            h3wire::FieldRef::new(b":path", b"/"),
+        ];
+        c.send_headers(q, &get, false).unwrap();
+        let n = c.poll_send(q).unwrap().len();
+        c.sent(q, n).unwrap();
+        let mut f = InFlight::new(c.send_data(q, 1000, false).unwrap(), 1000, false);
+        assert_eq!(f.prefix_rest(), [0x00, 0x43, 0xe8]);
+        assert_eq!(
+            f.payload_take(1000),
+            0,
+            "no payload before the whole prefix"
+        );
+        f.advance(1);
+        assert_eq!(f.prefix_rest(), [0x43, 0xe8]);
+        f.advance(2);
+        assert_eq!(f.payload_take(1000), 1000);
+        assert_eq!(f.payload_take(10), 10, "at most what is re-offered");
+        assert_eq!(
+            f.payload_take(5000),
+            1000,
+            "at most what the frame declares"
+        );
+        f.advance(10);
+        assert_eq!(f.payload_take(5000), 990);
+        assert!(!f.done());
+        f.advance(990);
+        assert!(f.done());
+        assert_eq!(f.payload_take(5000), 0);
+    }
+}
diff --git a/crates/mq-h3/tests/common/mod.rs b/crates/mq-h3/tests/common/mod.rs
index 3cbc5819..bd3de47a 100644
--- a/crates/mq-h3/tests/common/mod.rs
+++ b/crates/mq-h3/tests/common/mod.rs
@@ -3,12 +3,12 @@
 
 use h3wire::{Action, Config, Connection, Recv, Role, StreamId as Q};
 use mq_h3::H3Wire;
-use mq_runtime::testing::{ScriptedHandle, ScriptedTransport};
+use mq_runtime::testing::{Call, ScriptedHandle, ScriptedTransport};
 use mq_transport_api::{
     CloseReason, ConnConfig, ConnId, ConnProto, ErrType, Event, StreamError, StreamId, StreamInfo,
     StreamKind, Time, TransportOps,
 };
-use std::collections::{BTreeMap, HashMap};
+use std::collections::{BTreeMap, HashMap, VecDeque};
 use std::sync::{Arc, Mutex, MutexGuard};
 
 /// `w` → peer bytes of one stream, as the transport accepted them.
@@ -19,6 +19,8 @@ struct Out {
     at: usize,
     fin: bool,
     fin_fed: bool,
+    /// Accepted `stream_send` calls with `fin`.
+    fins: usize,
 }
 
 /// State shared with the `on_stream_send` / `on_open_stream` rules.
@@ -27,8 +29,8 @@ struct Wire {
     q_of: HashMap<StreamId, u64>,
     mq_of: HashMap<u64, StreamId>,
     out: BTreeMap<StreamId, Out>,
-    /// One-shot cap on the next `stream_send` per stream.
-    limit: HashMap<StreamId, usize>,
+    /// Caps on the next `stream_send` calls per stream, one each (None: uncapped).
+    limit: HashMap<StreamId, VecDeque<Option<usize>>>,
     /// Quic id of the next request stream `w` opens.
     next_req: u64,
 }
@@ -45,6 +47,8 @@ pub struct Rig {
     pub h: ScriptedHandle,
     pub peer: Connection,
     pub peer_events: Vec<h3wire::Event>,
+    /// DATA payload the peer received, per quic id.
+    peer_body: BTreeMap<u64, Vec<u8>>,
     pub conn: ConnId,
     pub now: Time,
     wire: Arc<Mutex<Wire>>,
@@ -104,14 +108,16 @@ impl Rig {
         let ww = wire.clone();
         h.on_stream_send(move |_, s, data, fin| {
             let mut w = lock(&ww);
-            let n = match w.limit.remove(&s) {
+            let n = match w.limit.get_mut(&s).and_then(VecDeque::pop_front).flatten() {
                 Some(0) => return Err(StreamError::Blocked),
                 Some(cap) => data.len().min(cap),
                 None => data.len(),
             };
             let out = w.out.entry(s).or_default();
             out.buf.extend_from_slice(&data[..n]);
-            out.fin |= fin && n == data.len();
+            let fin = fin && n == data.len();
+            out.fin |= fin;
+            out.fins += usize::from(fin);
             Ok(n)
         });
         Rig {
@@ -119,6 +125,7 @@ impl Rig {
             h,
             peer: Connection::new(peer_role, Config::default()),
             peer_events: Vec::new(),
+            peer_body: BTreeMap::new(),
             conn,
             now: Time::ZERO,
             wire,
@@ -151,13 +158,20 @@ impl Rig {
         lock(&self.wire).mq_of[&q.0]
     }
 
-    /// Caps how many bytes the next `stream_send` on `s` accepts (None = all); 0 is `Blocked`.
+    /// Caps how many bytes one later `stream_send` on `s` accepts (None = all); 0 is
+    /// `Blocked`. Caps queue: the n-th call caps the n-th following send.
     pub fn limit(&mut self, s: StreamId, n: Option<usize>) {
-        let mut w = lock(&self.wire);
-        match n {
-            Some(n) => w.limit.insert(s, n),
-            None => w.limit.remove(&s),
-        };
+        lock(&self.wire).limit.entry(s).or_default().push_back(n);
+    }
+
+    /// How many `stream_send` calls with `fin` on `s` the transport accepted.
+    pub fn fins(&self, s: StreamId) -> usize {
+        lock(&self.wire).out.get(&s).map_or(0, |o| o.fins)
+    }
+
+    /// The DATA payload the peer received on `q`.
+    pub fn peer_body(&self, q: Q) -> Vec<u8> {
+        self.peer_body.get(&q.0).cloned().unwrap_or_default()
     }
 
     /// Peer DATA through send_data / data_written; the bytes reach `w` on the next pump.
@@ -203,9 +217,13 @@ impl Rig {
                 }
                 let n = match self.peer.recv(q, rest, fin) {
                     Ok(Recv::Paused) => break,
+                    Ok(Recv::Body { consumed, range }) => {
+                        let body = self.peer_body.entry(q.0).or_default();
+                        body.extend_from_slice(&rest[range]);
+                        consumed
+                    }
                     Ok(
                         Recv::Consumed(n)
-                        | Recv::Body { consumed: n, .. }
                         | Recv::Frame { consumed: n, .. }
                         | Recv::Raw { consumed: n, .. },
                     ) => n,
@@ -319,3 +337,22 @@ fn info(conn: ConnId, q: u64) -> StreamInfo {
 fn lock(w: &Mutex<Wire>) -> MutexGuard<'_, Wire> {
     w.lock().unwrap_or_else(|e| e.into_inner())
 }
+
+/// Reset / STOP_SENDING calls on `s`, in order.
+pub fn aborts(r: &Rig, s: StreamId) -> Vec<Call> {
+    r.h.log()
+        .into_iter()
+        .filter(|c| {
+            matches!(c, Call::StreamResetSend { s: x, .. } | Call::StreamStopSending { s: x, .. }
+                | Call::StreamReset(x) if *x == s)
+        })
+        .collect()
+}
+
+/// `stream_recv` calls on `s`.
+pub fn recvs(r: &Rig, s: StreamId) -> usize {
+    r.h.log()
+        .iter()
+        .filter(|c| matches!(c, Call::StreamRecv { s: x, .. } if *x == s))
+        .count()
+}
diff --git a/crates/mq-h3/tests/recv.rs b/crates/mq-h3/tests/recv.rs
index b88e399f..58bc929d 100644
--- a/crates/mq-h3/tests/recv.rs
+++ b/crates/mq-h3/tests/recv.rs
@@ -3,7 +3,7 @@
 
 mod common;
 
-use common::Rig;
+use common::{Rig, aborts, recvs};
 use h3wire::{FieldRef, HeaderBlockId, HeadersKind, StreamId as Q};
 use mq_runtime::testing::Call;
 use mq_transport_api::{
@@ -127,24 +127,6 @@ fn assert_body(got: &[Result<(Vec<u8>, bool), StreamError>], body: &[u8], cap: u
     assert!(all == body, "body bytes differ");
 }
 
-/// Reset / STOP_SENDING calls on `s`, in order.
-fn aborts(r: &Rig, s: StreamId) -> Vec<Call> {
-    r.h.log()
-        .into_iter()
-        .filter(|c| {
-            matches!(c, Call::StreamResetSend { s: x, .. } | Call::StreamStopSending { s: x, .. }
-                | Call::StreamReset(x) if *x == s)
-        })
-        .collect()
-}
-
-fn recvs(r: &Rig, s: StreamId) -> usize {
-    r.h.log()
-        .iter()
-        .filter(|c| matches!(c, Call::StreamRecv { s: x, .. } if *x == s))
-        .count()
-}
-
 fn close_codes(r: &Rig) -> Vec<u64> {
     r.h.log()
         .into_iter()
diff --git a/crates/mq-h3/tests/send.rs b/crates/mq-h3/tests/send.rs
new file mode 100644
index 00000000..4d42ff7d
--- /dev/null
+++ b/crates/mq-h3/tests/send.rs
@@ -0,0 +1,492 @@
+//! Request send: client start, DATA framing with partial writes, the finish latch, the
+//! pending FIN, `SendStopped` per role and GOAWAY (adoption spec §4.3 "Start", §4.4, §4.5).
+
+mod common;
+
+use common::{Rig, aborts, recvs};
+use h3wire::{FieldRef, HeaderBlockId, HeadersKind, StreamId as Q};
+use mq_runtime::testing::Call;
+use mq_transport_api::{Event, H3Header, H3ReqId, StreamError, StreamId, TransportOps};
+
+fn h<'a>(n: &'a str, v: &'a str) -> H3Header<'a> {
+    H3Header {
+        name: n.as_bytes(),
+        value: v.as_bytes(),
+    }
+}
+
+fn f<'a>(n: &'a str, v: &'a str) -> FieldRef<'a> {
+    FieldRef::new(n.as_bytes(), v.as_bytes())
+}
+
+fn request(method: &'static str) -> [H3Header<'static>; 4] {
+    [
+        h(":method", method),
+        h(":scheme", "https"),
+        h(":authority", "example.com"),
+        h(":path", "/"),
+    ]
+}
+
+fn body_of(len: usize) -> Vec<u8> {
+    (0..len).map(|i| (i * 7 % 251) as u8).collect()
+}
+
+/// A DATA frame prefix for `len` payload bytes.
+fn prefix(len: usize) -> Vec<u8> {
+    let mut p = Vec::new();
+    h3wire::frame::encode_header(0x00, len as u64, &mut p);
+    p
+}
+
+/// Client rig with SETTINGS exchanged.
+fn client() -> Rig {
+    let mut r = Rig::client();
+    r.pump();
+    r.events();
+    r
+}
+
+/// Server rig with SETTINGS exchanged and `NewConn` drained.
+fn server() -> Rig {
+    let mut r = Rig::server();
+    r.pump();
+    r.events();
+    r
+}
+
+/// `open_h3_request`: the id and its request stream.
+fn open(r: &mut Rig) -> (H3ReqId, StreamId) {
+    let id = r.w.open_h3_request(r.now, r.conn).expect("open_h3_request");
+    let q = r.w.h3_req_info(id).expect("h3_req_info").quic_id;
+    (id, r.peer_stream(Q(q)))
+}
+
+/// A client POST whose HEADERS (no FIN) reached the peer; the wire length after them.
+fn posting() -> (Rig, H3ReqId, StreamId, usize) {
+    let mut r = client();
+    let (id, s) = open(&mut r);
+    r.w.h3_send_headers(r.now, id, &request("POST"), false)
+        .expect("send_headers");
+    r.pump();
+    r.events();
+    let head = r.h.sent_bytes(s).len();
+    (r, id, s, head)
+}
+
+/// The peer's events on request stream `q`.
+fn peer_events_on(r: &Rig, q: Q) -> Vec<h3wire::Event> {
+    r.peer_events
+        .iter()
+        .filter(|e| match **e {
+            h3wire::Event::Headers { stream, .. }
+            | h3wire::Event::Finished(stream)
+            | h3wire::Event::StreamAborted { stream, .. } => stream == q,
+            _ => false,
+        })
+        .copied()
+        .collect()
+}
+
+fn peer_block(r: &Rig, q: Q) -> HeaderBlockId {
+    r.peer_events
+        .iter()
+        .rev()
+        .find_map(|e| match *e {
+            h3wire::Event::Headers { stream, block, .. } if stream == q => Some(block),
+            _ => None,
+        })
+        .expect("peer got a block")
+}
+
+/// The peer request on `q` got its HEADERS (kind Request) and then `Finished`.
+fn assert_peer_finished(r: &Rig, q: Q) {
+    let ev = peer_events_on(r, q);
+    assert!(
+        matches!(
+            ev[..],
+            [
+                h3wire::Event::Headers {
+                    kind: HeadersKind::Request,
+                    ..
+                },
+                h3wire::Event::Finished(_)
+            ]
+        ),
+        "{ev:?}"
+    );
+}
+
+/// The peer answers request `q` with 200, `body` and FIN.
+fn respond(r: &mut Rig, q: Q, body: &[u8]) {
+    let b = peer_block(r, q);
+    r.peer.release(b);
+    r.peer
+        .send_headers(q, &[f(":status", "200")], false)
+        .expect("peer response");
+    r.peer_send_body(q, body, true);
+    r.pump();
+}
+
+/// `h3_recv_headers` (asserting a bare 200) + `h3_recv_body` to `fin`: the body.
+fn read_response(r: &mut Rig, id: H3ReqId) -> Vec<u8> {
+    let mut head = Vec::new();
+    let res =
+        r.w.h3_recv_headers(r.now, id, &mut |n, v| head.push((n.to_vec(), v.to_vec())));
+    assert_eq!(res, Ok(false));
+    assert_eq!(head, [(b":status".to_vec(), b"200".to_vec())]);
+    let mut body = Vec::new();
+    let mut buf = [0u8; 4096];
+    loop {
+        let (n, fin) = r.w.h3_recv_body(r.now, id, &mut buf).expect("body");
+        body.extend_from_slice(&buf[..n]);
+        if fin {
+            return body;
+        }
+    }
+}
+
+/// `stream_send` calls on `s` (`fin`-only filter when `fin_only`).
+fn sends(r: &Rig, s: StreamId, fin_only: bool) -> usize {
+    r.h.log()
+        .iter()
+        .filter(
+            |c| matches!(c, Call::StreamSend { s: x, fin, .. } if *x == s && (*fin || !fin_only)),
+        )
+        .count()
+}
+
+#[test]
+fn client_request_round_trip() {
+    let mut r = client();
+    let calls = r.h.log().len();
+    let (id, s) = open(&mut r);
+    assert!(r.h.log()[calls..].contains(&Call::OpenStream(r.conn)));
+    assert_eq!(
+        r.w.h3_send_headers(r.now, id, &request("GET"), true),
+        Ok(())
+    );
+    r.pump();
+    assert_peer_finished(&r, Q(0));
+    assert_eq!(r.fins(s), 1);
+    respond(&mut r, Q(0), b"hello");
+    assert!(r.events().contains(&Event::H3Readable(id)));
+    let body = read_response(&mut r, id);
+    assert_eq!(body, b"hello");
+}
+
+#[test]
+fn send_body_partial_payload() {
+    let (mut r, id, s, head) = posting();
+    let body = body_of(1000);
+    r.limit(s, None); // the prefix
+    r.limit(s, Some(10)); // the payload
+    // `fin` rides the frame: committed only by the call that completes it.
+    assert_eq!(r.w.h3_send_body(r.now, id, &body, true), Ok(10));
+    assert_eq!(r.fins(s), 0);
+    assert_eq!(r.w.h3_send_body(r.now, id, &body[10..], true), Ok(990));
+    r.pump();
+    let want = [prefix(1000), body.clone()].concat();
+    assert!(r.h.sent_bytes(s)[head..] == want[..], "one DATA frame");
+    assert!(r.peer_body(Q(0)) == body);
+    assert_eq!(r.fins(s), 1);
+    assert_peer_finished(&r, Q(0));
+}
+
+#[test]
+fn send_body_partial_prefix() {
+    let (mut r, id, s, head) = posting();
+    let body = body_of(1000);
+    r.limit(s, Some(1));
+    assert_eq!(
+        r.w.h3_send_body(r.now, id, &body, false),
+        Err(StreamError::Blocked)
+    );
+    assert_eq!(r.h.sent_bytes(s)[head..], prefix(1000)[..1]);
+    assert_eq!(sends(&r, s, false), 2, "HEADERS, then one prefix byte only");
+    r.h.push_event(Event::StreamWritable(s));
+    r.w.drive(r.now);
+    assert!(r.events().contains(&Event::H3Writable(id)));
+    assert_eq!(r.w.h3_send_body(r.now, id, &body, true), Ok(1000));
+    r.pump();
+    let want = [prefix(1000), body.clone()].concat();
+    assert!(
+        r.h.sent_bytes(s)[head..] == want[..],
+        "one well-formed frame"
+    );
+    assert!(r.peer_body(Q(0)) == body);
+    assert_peer_finished(&r, Q(0));
+}
+
+#[test]
+fn send_body_blocked_returns_blocked() {
+    let mut r = client();
+    let (id, s) = open(&mut r);
+    r.limit(s, Some(0));
+    assert_eq!(
+        r.w.h3_send_headers(r.now, id, &request("POST"), false),
+        Ok(())
+    );
+    r.limit(s, Some(0)); // the HEADERS stay unwritten through the next call, too
+    assert_eq!(
+        r.w.h3_send_body(r.now, id, b"abc", false),
+        Err(StreamError::Blocked)
+    );
+    assert!(r.h.sent_bytes(s).is_empty());
+    assert!(!r.events().contains(&Event::H3Writable(id)));
+    r.h.push_event(Event::StreamWritable(s));
+    r.w.drive(r.now);
+    assert!(!r.h.sent_bytes(s).is_empty(), "the HEADERS drained");
+    assert!(r.events().contains(&Event::H3Writable(id)));
+    assert_eq!(r.w.h3_send_body(r.now, id, b"abc", false), Ok(3));
+}
+
+/// `H3Writable` also follows a drain on a bare call, with no `StreamWritable`.
+#[test]
+fn writable_after_drain_without_stream_writable() {
+    let mut r = client();
+    let (id, s) = open(&mut r);
+    r.limit(s, Some(0));
+    assert_eq!(
+        r.w.h3_send_headers(r.now, id, &request("POST"), false),
+        Ok(())
+    );
+    r.limit(s, Some(0));
+    assert_eq!(
+        r.w.h3_send_body(r.now, id, b"abc", false),
+        Err(StreamError::Blocked)
+    );
+    assert_eq!(r.events(), []);
+    r.w.drive(r.now);
+    assert_eq!(r.events(), [Event::H3Writable(id)]);
+}
+
+/// Review Focus 5.
+#[test]
+fn fin_while_frame_in_flight() {
+    let (mut r, id, s, head) = posting();
+    let body = body_of(1500);
+    r.limit(s, None); // the prefix
+    r.limit(s, Some(400)); // the payload
+    assert_eq!(r.w.h3_send_body(r.now, id, &body[..1000], false), Ok(400));
+    assert_eq!(r.w.h3_send_body(r.now, id, &body[400..], true), Ok(1100));
+    r.pump();
+    let want = [
+        prefix(1000),
+        body[..1000].to_vec(),
+        prefix(500),
+        body[1000..].to_vec(),
+    ]
+    .concat();
+    assert!(
+        r.h.sent_bytes(s)[head..] == want[..],
+        "the frame completes, then a new one; no prefix re-sent"
+    );
+    assert!(r.peer_body(Q(0)) == body);
+    assert_eq!(r.fins(s), 1);
+    assert_peer_finished(&r, Q(0));
+}
+
+#[test]
+fn finish_latched_behind_headers() {
+    let mut r = client();
+    let (id, s) = open(&mut r);
+    r.limit(s, Some(0));
+    assert_eq!(
+        r.w.h3_send_headers(r.now, id, &request("POST"), false),
+        Ok(())
+    );
+    r.limit(s, Some(0));
+    assert_eq!(r.w.h3_finish(r.now, id), Ok(()));
+    assert!(r.h.sent_bytes(s).is_empty());
+    assert_eq!(r.fins(s), 0);
+    r.pump();
+    assert_peer_finished(&r, Q(0));
+    assert_eq!(r.fins(s), 1);
+}
+
+#[test]
+fn pending_fin_retried() {
+    let (mut r, id, s, _) = posting();
+    r.limit(s, Some(0));
+    assert_eq!(r.w.h3_finish(r.now, id), Ok(()));
+    assert_eq!(sends(&r, s, true), 1);
+    assert_eq!(r.fins(s), 0, "the FIN-only send was Blocked");
+    r.h.push_event(Event::StreamWritable(s));
+    r.w.drive(r.now);
+    assert_eq!(r.fins(s), 1);
+    r.pump();
+    r.w.drive(r.now);
+    assert_eq!(sends(&r, s, true), 2, "one retry");
+    assert_eq!(r.fins(s), 1, "exactly one accepted FIN");
+    assert_peer_finished(&r, Q(0));
+}
+
+/// adoption spec §3, §4.5: a late peer RESET does not drop our pending FIN.
+#[test]
+fn pending_fin_survives_peer_reset() {
+    let (mut r, id, s, _) = posting();
+    r.limit(s, Some(0));
+    assert_eq!(r.w.h3_finish(r.now, id), Ok(()));
+    assert_eq!(r.fins(s), 0);
+    r.limit(s, Some(0)); // still Blocked at the next call's sweep
+    r.h.expect_stream_recv(s, Err(StreamError::Reset));
+    r.h.push_event(Event::StreamPeerReset(s, 0x10c));
+    r.w.drive(r.now);
+    assert_eq!(r.fins(s), 1, "the FIN is still sent");
+    assert_eq!(r.h.recv_pending(s), 0, "the probe read the reset");
+    let log = r.h.log();
+    let probe = log
+        .iter()
+        .position(|c| matches!(c, Call::StreamRecv { s: x, .. } if *x == s))
+        .expect("retirement probe");
+    let fin = log
+        .iter()
+        .rposition(|c| matches!(c, Call::StreamSend { s: x, fin: true, .. } if *x == s))
+        .expect("FIN");
+    assert!(probe < fin, "the FIN went out after the reset");
+    assert_eq!(aborts(&r, s), [], "no reset of our finished send side");
+    let mut buf = [0u8; 64];
+    assert_eq!(
+        r.w.h3_recv_body(r.now, id, &mut buf),
+        Err(StreamError::Reset)
+    );
+}
+
+#[test]
+fn send_stopped_client_discards() {
+    let (mut r, id, s, _) = posting();
+    r.h.push_event(Event::StreamStopSending(s, 0x10c));
+    r.w.drive(r.now);
+    assert_eq!(aborts(&r, s), [Call::StreamResetSend { s, code: 0x10c }]);
+    assert_eq!(
+        r.events(),
+        [Event::H3Writable(id)],
+        "a blocked pump learns of it"
+    );
+    let n = sends(&r, s, false);
+    assert_eq!(r.w.h3_send_body(r.now, id, &[7u8; 4096], false), Ok(4096));
+    assert_eq!(r.w.h3_finish(r.now, id), Ok(()));
+    r.w.drive(r.now);
+    assert_eq!(sends(&r, s, false), n, "nothing written");
+    respond(&mut r, Q(0), b"still here");
+    let body = read_response(&mut r, id);
+    assert_eq!(body, b"still here");
+}
+
+#[test]
+fn send_stopped_server_resets() {
+    let mut r = server();
+    let get = [
+        f(":method", "GET"),
+        f(":scheme", "https"),
+        f(":authority", "example.com"),
+        f(":path", "/"),
+    ];
+    r.peer.send_headers(Q(0), &get, false).unwrap();
+    r.pump();
+    let id = r
+        .events()
+        .iter()
+        .find_map(|e| match *e {
+            Event::H3Request(_, id) => Some(id),
+            _ => None,
+        })
+        .expect("H3Request");
+    assert_eq!(r.w.h3_recv_headers(r.now, id, &mut |_, _| {}), Ok(false));
+    assert_eq!(
+        r.w.h3_send_headers(r.now, id, &[h(":status", "200")], false),
+        Ok(())
+    );
+    r.pump();
+    let s = r.peer_stream(Q(0));
+    r.h.push_event(Event::StreamStopSending(s, 0x10c));
+    r.w.drive(r.now);
+    assert_eq!(
+        r.w.h3_send_body(r.now, id, &[7u8; 4096], false),
+        Err(StreamError::Reset)
+    );
+    assert_eq!(r.w.h3_finish(r.now, id), Err(StreamError::Reset));
+}
+
+/// Client requests on quic ids 0 and 4; the peer processed only 0 when it sends GOAWAY(4).
+fn goaway() -> (Rig, H3ReqId, H3ReqId, StreamId) {
+    let mut r = client();
+    let (id0, _) = open(&mut r);
+    r.w.h3_send_headers(r.now, id0, &request("GET"), true)
+        .unwrap();
+    r.pump();
+    let (id4, s4) = open(&mut r);
+    r.limit(s4, Some(0)); // the HEADERS of 4 wait in h3wire
+    r.w.h3_send_headers(r.now, id4, &request("POST"), false)
+        .unwrap();
+    r.peer.finish_shutdown().unwrap(); // GOAWAY(4)
+    r.limit(s4, Some(0)); // and through the pump's first round: GOAWAY reaches w first
+    r.pump();
+    (r, id0, id4, s4)
+}
+
+#[test]
+fn goaway_cutoff_aborts_existing() {
+    let (mut r, id0, id4, s4) = goaway();
+    assert_eq!(
+        aborts(&r, s4),
+        [
+            Call::StreamResetSend { s: s4, code: 0x10c },
+            Call::StreamStopSending { s: s4, code: 0x10c }
+        ]
+    );
+    // h3wire reports REQUEST_REJECTED to the application; the wire says REQUEST_CANCELLED.
+    #[cfg(feature = "test-support")]
+    assert_eq!(
+        r.w.debug_abort(id4),
+        Some((
+            h3wire::H3Code::REQUEST_REJECTED,
+            h3wire::AbortSource::GoAway
+        ))
+    );
+    // One retirement read at the GOAWAY abort, one probe at the peer's own reject.
+    assert_eq!(recvs(&r, s4), 2);
+    assert_eq!(r.h.recv_pending(s4), 0);
+    assert!(r.events().contains(&Event::H3Readable(id4)));
+    let mut buf = [0u8; 64];
+    assert_eq!(
+        r.w.h3_recv_body(r.now, id4, &mut buf),
+        Err(StreamError::Reset)
+    );
+    // Request 0 completes normally.
+    respond(&mut r, Q(0), b"zero");
+    let body = read_response(&mut r, id0);
+    assert_eq!(body, b"zero");
+    assert_eq!(aborts(&r, r.peer_stream(Q(0))), []);
+}
+
+#[test]
+fn going_away_maps_to_conn() {
+    let (mut r, ..) = goaway();
+    let (id, s) = open(&mut r);
+    assert_eq!(
+        r.w.h3_send_headers(r.now, id, &request("GET"), true),
+        Err(StreamError::Conn)
+    );
+    let calls = r.h.log().len();
+    r.w.h3_reset(r.now, id);
+    assert!(
+        r.h.log()[calls..].contains(&Call::StreamReset(s)),
+        "no h3wire state: the raw stream is reset (adoption spec §4.3)"
+    );
+}
+
+#[test]
+fn invalid_field_maps_to_reset() {
+    let mut r = client();
+    let (id, s) = open(&mut r);
+    let mut hs = request("GET").to_vec();
+    hs.push(h("X-Upper", "1"));
+    assert_eq!(
+        r.w.h3_send_headers(r.now, id, &hs, true),
+        Err(StreamError::Reset)
+    );
+    r.pump();
+    assert!(r.h.sent_bytes(s).is_empty());
+}

From 99193b46e09c2e0442c8623228330673d2ebd95c Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 10:53:30 +0900
Subject: [PATCH 07/33] feat(mq-h3): request lifecycle and connection close

---
 crates/mq-h3/src/conn.rs        |  62 ++++-
 crates/mq-h3/src/recv.rs        | 133 ++++++---
 crates/mq-h3/src/req.rs         |   8 +
 crates/mq-h3/src/send.rs        |  50 +++-
 crates/mq-h3/tests/lifecycle.rs | 467 ++++++++++++++++++++++++++++++++
 crates/mq-h3/tests/send.rs      |  14 +
 6 files changed, 668 insertions(+), 66 deletions(-)
 create mode 100644 crates/mq-h3/tests/lifecycle.rs

diff --git a/crates/mq-h3/src/conn.rs b/crates/mq-h3/src/conn.rs
index dea4a1f8..06cf8896 100644
--- a/crates/mq-h3/src/conn.rs
+++ b/crates/mq-h3/src/conn.rs
@@ -1,10 +1,12 @@
 //! One `h3wire::Connection` per H3 conn, and the raw events it consumes (adoption spec §4.2,
 //! §4.4).
 
-use crate::req::{Req, req_id};
+use crate::req::{Req, Terminal, req_id};
 use crate::{BOOT_READ, H3Wire};
 use h3wire::{Config, Connection, H3Code, Role, StreamId as Q};
-use mq_transport_api::{ConnId, ConnProto, Event, StreamError, StreamId, Time, TransportOps};
+use mq_transport_api::{
+    ConnId, ConnProto, Event, H3ReqId, StreamError, StreamId, Time, TransportOps,
+};
 use std::collections::{HashMap, HashSet};
 
 /// Equals `mq_transport::H3_FIELD_SECTION_MAX`; mq-h3 does not depend on mq-transport.
@@ -34,6 +36,11 @@ pub(crate) struct H3Conn {
     /// Request streams whose `FinishStream` write was `Blocked`: retried by `service`
     /// (adoption spec §4.5). At most one per stream.
     pub(crate) fins: HashSet<StreamId>,
+    /// The transport conn is gone; the conn stays only for its retained requests
+    /// (adoption spec §4.3 "Connection close").
+    pub(crate) gone: bool,
+    /// h3wire emitted `Event::Closed`.
+    pub(crate) h3_closed: bool,
 }
 
 impl H3Conn {
@@ -51,6 +58,8 @@ impl<T: TransportOps> H3Wire<T> {
             uni_done: HashSet::new(),
             closing: false,
             fins: HashSet::new(),
+            gone: false,
+            h3_closed: false,
         };
         self.conns.insert(c, conn);
         self.service(now, c);
@@ -66,14 +75,8 @@ impl<T: TransportOps> H3Wire<T> {
                     self.add_conn(now, c, Role::Server);
                 }
             }
-            // ponytail: C2 drops the conn outright; Task C5 adds the request fan-out.
-            Event::ConnClosed(c, _) => {
-                if let Some(conn) = self.conns.remove(&c) {
-                    for s in conn.mq.values() {
-                        self.streams.remove(s);
-                    }
-                }
-            }
+            // The fan-out comes before ConnClosed passes through (adoption spec §4.1).
+            Event::ConnClosed(c, _) => self.conn_closed(c),
             Event::NewStream(c, s, info) => {
                 let Some(conn) = self.conns.get_mut(&c) else {
                     return Some(e);
@@ -106,6 +109,45 @@ impl<T: TransportOps> H3Wire<T> {
         Some(e)
     }
 
+    /// adoption spec §4.3 "Connection close", steps 1, 3 and 5. A client request whose
+    /// response is complete but undelivered is retained while h3wire is open; every other
+    /// request the gateway knows is closed now.
+    fn conn_closed(&mut self, c: ConnId) {
+        let Some(conn) = self.conns.get_mut(&c) else {
+            return;
+        };
+        conn.gone = true;
+        conn.closing = true; // h3wire parses on; its actions are dropped
+        conn.fins.clear();
+        let retain = conn.client && !conn.h3_closed;
+        // ponytail: O(streams + reqs of the shard) per conn close; index them by conn if
+        // shards grow large.
+        self.streams.retain(|_, (x, _)| *x != c);
+        let ids: Vec<H3ReqId> = self
+            .reqs
+            .iter()
+            .filter(|(_, r)| r.conn == c)
+            .map(|(&id, _)| id)
+            .collect();
+        for id in ids {
+            let r = self.reqs.get_mut(&id).expect("listed above");
+            r.stream_closed = true;
+            let complete = r.carry_fin || r.terminal == Some(Terminal::Finished);
+            if !(retain && r.known && !r.handed && complete) {
+                self.close_req(id);
+            }
+        }
+        self.settle_conn(c);
+    }
+
+    /// Drops a gone conn once no retained request is left (adoption spec §4.3 step 5).
+    pub(crate) fn settle_conn(&mut self, c: ConnId) {
+        if self.conns.get(&c).is_some_and(|x| x.gone) && !self.reqs.values().any(|r| r.conn == c) {
+            let mut conn = self.conns.remove(&c).expect("checked");
+            conn.h3.transport_closed();
+        }
+    }
+
     fn on_stream_event(&mut self, now: Time, c: ConnId, s: StreamId, q: Q, e: Event) {
         if q.is_request() && self.on_req_event(now, c, s, q, &e) {
             return;
diff --git a/crates/mq-h3/src/recv.rs b/crates/mq-h3/src/recv.rs
index 6f4c1835..48132e01 100644
--- a/crates/mq-h3/src/recv.rs
+++ b/crates/mq-h3/src/recv.rs
@@ -31,8 +31,27 @@ impl<T: TransportOps> H3Wire<T> {
                 | H3Event::Finished(stream)
                 | H3Event::StreamAborted { stream, .. }
                 | H3Event::SendStopped { stream, .. } => stream,
-                // GoAway: its cutoff arrives as StreamAborted. Closed: Task C5.
-                // PeerSettings, UniStream: nothing to do.
+                // The last event. On a live conn the fan-out follows the transport's
+                // ConnClosed; with the transport gone, the retained requests close now
+                // (adoption spec §4.3 step 4).
+                H3Event::Closed { .. } => {
+                    conn.h3_closed = true;
+                    if conn.gone {
+                        let ids: Vec<H3ReqId> = self
+                            .reqs
+                            .iter()
+                            .filter(|(_, r)| r.conn == c)
+                            .map(|(&id, _)| id)
+                            .collect();
+                        for id in ids {
+                            self.close_req(id);
+                        }
+                        self.settle_conn(c);
+                    }
+                    return retire;
+                }
+                // GoAway: its cutoff arrives as StreamAborted. PeerSettings, UniStream:
+                // nothing to do.
                 _ => continue,
             };
             let id = conn.mq.get(&q.0).map(|&s| req_id(s));
@@ -78,7 +97,7 @@ impl<T: TransportOps> H3Wire<T> {
                 H3Event::Finished(_) => req.terminal = Some(Terminal::Finished),
                 H3Event::StreamAborted { code, source, .. } => {
                     req.terminal = Some(Terminal::Aborted { code, source });
-                    if !req.carry_fin && !req.reset_code_pending {
+                    if !req.fin_read {
                         retire.push(req.stream);
                     }
                     if let Some(b) = req.pending_block.take() {
@@ -99,6 +118,16 @@ impl<T: TransportOps> H3Wire<T> {
         retire
     }
 
+    /// `dispatch`, then the retirement read (adoption spec §3) of every stream it
+    /// aborted with the FIN unread, unless the transport already closed it.
+    pub(crate) fn dispatch_retire(&mut self, now: Time, c: ConnId) {
+        for s in self.dispatch(c) {
+            if self.streams.contains_key(&s) {
+                self.retire_read(now, s);
+            }
+        }
+    }
+
     /// Feeds request `id` until a stop condition (adoption spec §4.4).
     ///
     /// `out = None` is the bootstrap: `BOOT_READ` reads, stopping at a gateway-visible
@@ -125,6 +154,7 @@ impl<T: TransportOps> H3Wire<T> {
                     Ok((n, fin)) => {
                         req.carry.truncate(n);
                         req.carry_fin = fin;
+                        req.fin_read = fin;
                         if n == 0 && !fin {
                             return Ok(0);
                         }
@@ -133,6 +163,7 @@ impl<T: TransportOps> H3Wire<T> {
                         req.carry.clear();
                         // "Reset, code pending": fed nothing more until the code pops.
                         req.reset_code_pending = e == StreamError::Reset;
+                        req.fin_read = req.reset_code_pending;
                         return Err(e);
                     }
                 }
@@ -167,18 +198,13 @@ impl<T: TransportOps> H3Wire<T> {
                 }
             }
             let fin_fed = fin && consumed == len;
-            let fin_read = req.carry_fin;
             req.carry.drain(..consumed);
             req.carry_fin &= !fin_fed;
-            let (c, s) = (req.conn, req.stream);
-            self.dispatch(c);
-            // Aborted by this feed (malformed, content-length, no final response): read the
-            // rest to FIN or the reset so the stream retires; raw xquic does not re-notify
-            // for bytes it already holds, and later StreamReadables continue it (spec §3).
-            if !fin_read && self.reqs.get(&id).is_some_and(|r| r.aborted()) {
-                self.retire_read(now, s);
-                return Ok(0);
-            }
+            // An abort by this feed (malformed, content-length, no final response) gets its
+            // retirement read here: raw xquic does not re-notify for bytes it already
+            // holds, and later StreamReadables continue it (spec §3).
+            let c = req.conn;
+            self.dispatch_retire(now, c);
             if n > 0 || (consumed == 0 && !fin_fed) {
                 return Ok(n);
             }
@@ -238,6 +264,7 @@ impl<T: TransportOps> H3Wire<T> {
         if !req.carry.is_empty() || req.carry_fin {
             self.queue.push(Event::H3Readable(id));
         }
+        self.maybe_close(id);
         self.drive_inner(now);
         Ok(fin)
     }
@@ -266,6 +293,7 @@ impl<T: TransportOps> H3Wire<T> {
             Err(e) => Err(e),
         };
         req.handed |= matches!(out, Ok((_, true)) | Err(StreamError::Reset));
+        self.maybe_close(id);
         self.drive_inner(now);
         out
     }
@@ -303,8 +331,12 @@ impl<T: TransportOps> H3Wire<T> {
                     && !req.aborted()
                 {
                     req.reset_code_pending = false;
-                    self.peer_reset(c, q, H3Code(code));
+                    if let Some(conn) = self.conns.get_mut(&c) {
+                        log_closed(conn.h3.stream_reset_received(q, H3Code(code)));
+                    }
                 }
+                // The probe always runs (spec §3), before the events are dispatched by
+                // the caller's `service`, so the abort owes no second read.
                 self.retire_read(now, s);
             }
             Event::StreamWritable(_) => {
@@ -313,46 +345,56 @@ impl<T: TransportOps> H3Wire<T> {
                 }
             }
             Event::StreamClosed(_) => {
-                // A pending code was dropped with the slot: "reset, code unknown".
-                if let Some(req) = self.reqs.get_mut(&id)
-                    && req.reset_code_pending
-                {
-                    req.reset_code_pending = false;
-                    self.peer_reset(c, q, H3Code::REQUEST_CANCELLED);
-                }
-                // Unmapped first, so actions queued for the gone stream are dropped.
+                // Unrouted first, so actions queued for the gone stream are dropped. The
+                // quic id stays mapped: carried bytes may still yield its h3wire events.
+                self.streams.remove(&s);
                 if let Some(conn) = self.conns.get_mut(&c) {
-                    conn.mq.remove(&q.0);
                     conn.fins.remove(&s);
                 }
-                self.streams.remove(&s);
-                self.close_req(id);
+                let Some(req) = self.reqs.get_mut(&id) else {
+                    return true;
+                };
+                req.stream_closed = true;
+                // A pending code was dropped with the slot: "reset, code unknown".
+                if std::mem::take(&mut req.reset_code_pending) {
+                    if let Some(conn) = self.conns.get_mut(&c) {
+                        log_closed(conn.h3.stream_reset_received(q, H3Code::REQUEST_CANCELLED));
+                    }
+                    self.dispatch_retire(now, c);
+                }
+                self.maybe_close(id);
             }
             _ => return false,
         }
         true
     }
 
-    fn peer_reset(&mut self, c: ConnId, q: Q, code: H3Code) {
-        if let Some(conn) = self.conns.get_mut(&c) {
-            log_closed(conn.h3.stream_reset_received(q, code));
+    /// Closure (adoption spec §4.3): once the transport closed the stream (1) and the
+    /// gateway has the receive end or the request was aborted (2). A request the gateway
+    /// never saw goes at (1).
+    pub(crate) fn maybe_close(&mut self, id: H3ReqId) {
+        let Some(req) = self.reqs.get(&id) else {
+            return;
+        };
+        if !req.stream_closed || (req.known && !req.handed && !req.aborted()) {
+            return;
         }
-        self.dispatch(c);
+        let c = req.conn;
+        self.close_req(id);
+        self.settle_conn(c); // the last retained request of a gone conn
     }
 
-    /// Closure on `StreamClosed` (adoption spec §4.3): `H3Closed` once the gateway has
-    /// the receive end or the request was aborted; a request it never saw just goes.
-    fn close_req(&mut self, id: H3ReqId) {
-        let Some(req) = self.reqs.get(&id) else {
+    /// Removes request `id`, with one `H3Closed` if the gateway knows it: the single place
+    /// that builds the `H3Close` (Task C6 fills its stats).
+    pub(crate) fn close_req(&mut self, id: H3ReqId) {
+        let Some(req) = self.reqs.remove(&id) else {
             return;
         };
-        let closed = req.handed || req.aborted();
-        if req.known && !closed {
-            return; // ponytail: Task C5 defers closure until the gateway has the end
-        }
-        let req = self.reqs.remove(&id).expect("present");
-        if let (Some(b), Some(conn)) = (req.pending_block, self.conns.get_mut(&req.conn)) {
-            conn.h3.release(b);
+        if let Some(conn) = self.conns.get_mut(&req.conn) {
+            conn.mq.remove(&req.quic_id);
+            if let Some(b) = req.pending_block {
+                conn.h3.release(b);
+            }
         }
         if req.known {
             let close = H3Close {
@@ -367,10 +409,15 @@ impl<T: TransportOps> H3Wire<T> {
     /// or a blocked transport.
     pub(crate) fn retire_read(&mut self, now: Time, s: StreamId) {
         let mut buf = [0u8; BOOT_READ];
-        while let Ok((n, fin)) = self.inner.stream_recv(now, s, &mut buf) {
-            if fin || n == 0 {
-                return;
+        let end = loop {
+            match self.inner.stream_recv(now, s, &mut buf) {
+                Ok((_, true)) | Err(StreamError::Reset) => break true,
+                Ok((n, false)) if n > 0 => {}
+                _ => break false,
             }
+        };
+        if let Some(req) = self.reqs.get_mut(&req_id(s)) {
+            req.fin_read |= end;
         }
     }
 }
diff --git a/crates/mq-h3/src/req.rs b/crates/mq-h3/src/req.rs
index 6650a99a..be2a4624 100644
--- a/crates/mq-h3/src/req.rs
+++ b/crates/mq-h3/src/req.rs
@@ -33,6 +33,12 @@ pub(crate) struct Req {
     pub(crate) carry: Vec<u8>,
     /// The transport reported FIN after the carry; not yet fed.
     pub(crate) carry_fin: bool,
+    /// The transport receive side was read to its end (FIN or `Err(Reset)`): no
+    /// retirement read is owed (adoption spec §3).
+    pub(crate) fin_read: bool,
+    /// Closure condition 1: the transport closed the stream, or its conn (adoption spec
+    /// §4.3).
+    pub(crate) stream_closed: bool,
     /// The DATA frame `h3_send_body` started and has not written whole (adoption spec §4.5).
     pub(crate) frame: Option<InFlight>,
     /// `h3_finish` (or a bare `fin`) is waiting for `send_data(0, true)` to stop being
@@ -63,6 +69,8 @@ impl Req {
             reset_code_pending: false,
             carry: Vec::new(),
             carry_fin: false,
+            fin_read: false,
+            stream_closed: false,
             frame: None,
             finish_latched: false,
             writable_wanted: false,
diff --git a/crates/mq-h3/src/send.rs b/crates/mq-h3/src/send.rs
index e13a4d25..d4697fa5 100644
--- a/crates/mq-h3/src/send.rs
+++ b/crates/mq-h3/src/send.rs
@@ -1,8 +1,10 @@
 //! h3wire actions and core bytes on the transport (adoption spec §4.5).
 
 use crate::H3Wire;
-use crate::req::{Req, req_id};
-use h3wire::{Action, Connection, DataFrame, FieldRef, H3Code, StreamId as Q, UsageError};
+use crate::req::{Req, Terminal, req_id};
+use h3wire::{
+    AbortSource, Action, Connection, DataFrame, FieldRef, H3Code, StreamId as Q, UsageError,
+};
 use mq_transport_api::{ConnId, Error, Event, H3Header, H3ReqId, StreamError, Time, TransportOps};
 
 /// The DATA frame `h3_send_body` started: its prefix, then `payload_left` bytes the
@@ -169,7 +171,9 @@ impl<T: TransportOps> H3Wire<T> {
         client: bool,
     ) -> Result<usize, StreamError> {
         let req = &self.reqs[&id];
-        if req.send_stopped {
+        // A retained request (client only) accepts and discards like after SendStopped,
+        // so a running upload pump cannot abort the response (adoption spec §4.3).
+        if req.send_stopped || self.conns[&req.conn].gone {
             // RFC 9114 §4.1: the client's response keeps flowing; xqc_h3 resets the server.
             return if client {
                 Ok(data.len())
@@ -276,16 +280,31 @@ impl<T: TransportOps> H3Wire<T> {
         r
     }
 
-    /// `h3_reset` (adoption spec §4.3). Without h3wire state (a client request whose
-    /// `send_headers` failed) the raw stream is reset directly.
+    /// `h3_reset` (adoption spec §4.3): `Connection::abort` with `REQUEST_CANCELLED`, or,
+    /// without h3wire state (a client request whose `send_headers` failed), the raw
+    /// stream's `stream_reset`, once. The gateway gave the request up, so nothing is left
+    /// to deliver: closure needs only the transport's `StreamClosed`.
     pub(crate) fn reset(&mut self, now: Time, id: H3ReqId) {
-        let Some(req) = self.reqs.get(&id).filter(|r| r.known) else {
+        let Some(req) = self.reqs.get_mut(&id).filter(|r| r.known) else {
             return; // stale: a no-op
         };
-        if !req.core {
+        if req.core {
+            if let Some(conn) = self.conns.get_mut(&req.conn) {
+                // A reaped stream is a no-op; Closed: the conn's close covers it.
+                if let Err(e) = conn.h3.abort(Q(req.quic_id), H3Code::REQUEST_CANCELLED) {
+                    log::debug!("h3wire abort: {e}");
+                }
+            }
+        } else if !req.aborted() {
             self.inner.stream_reset(now, req.stream);
-        } // ponytail: Task C5 adds `Connection::abort` for a request with h3wire state.
-        self.drive_inner(now);
+            req.terminal = Some(Terminal::Aborted {
+                code: H3Code::REQUEST_CANCELLED,
+                source: AbortSource::Local,
+            });
+        }
+        req.handed = true;
+        self.maybe_close(id);
+        self.drive_inner(now); // its sweep runs the abort's actions and retirement read
     }
 
     /// Executes `c`'s actions and writes its core bytes; runs whenever `c`'s h3wire state
@@ -315,9 +334,7 @@ impl<T: TransportOps> H3Wire<T> {
     fn run_actions(&mut self, now: Time, c: ConnId) {
         // Aborts from outside a feed (GOAWAY cutoff, local abort): read the stream to
         // FIN or the reset so it retires (adoption spec §3).
-        for s in self.dispatch(c) {
-            self.retire_read(now, s);
-        }
+        self.dispatch_retire(now, c);
         let Some(conn) = self.conns.get_mut(&c) else {
             return;
         };
@@ -325,7 +342,14 @@ impl<T: TransportOps> H3Wire<T> {
             if conn.closing {
                 continue; // drained and dropped
             }
-            let mq = |q: Q| conn.mq.get(&q.0).copied();
+            // A stream the transport closed is no longer routed: its actions are dropped.
+            let streams = &self.streams;
+            let mq = |q: Q| {
+                conn.mq
+                    .get(&q.0)
+                    .copied()
+                    .filter(|s| streams.contains_key(s))
+            };
             match a {
                 Action::OpenUni(kind) => {
                     let inner = &mut self.inner;
diff --git a/crates/mq-h3/tests/lifecycle.rs b/crates/mq-h3/tests/lifecycle.rs
new file mode 100644
index 00000000..76e31c73
--- /dev/null
+++ b/crates/mq-h3/tests/lifecycle.rs
@@ -0,0 +1,467 @@
+//! Request lifecycle: closure conditions, `h3_reset`, the connection-close fan-out with
+//! client-side retention, and stale ids after close (adoption spec §4.3, §5.1, §5.2).
+
+mod common;
+
+use common::{Rig, aborts};
+use h3wire::{FieldRef, H3Code, HeadersKind, StreamId as Q};
+use mq_runtime::testing::Call;
+use mq_transport_api::{
+    CloseReason, ErrType, Error, Event, H3Header, H3ReqId, StreamError, StreamId, TransportOps,
+};
+
+fn f<'a>(n: &'a str, v: &'a str) -> FieldRef<'a> {
+    FieldRef::new(n.as_bytes(), v.as_bytes())
+}
+
+fn h<'a>(n: &'a str, v: &'a str) -> H3Header<'a> {
+    H3Header {
+        name: n.as_bytes(),
+        value: v.as_bytes(),
+    }
+}
+
+fn request(method: &'static str) -> Vec<FieldRef<'static>> {
+    vec![
+        f(":method", method),
+        f(":scheme", "https"),
+        f(":authority", "example.com"),
+        f(":path", "/x"),
+    ]
+}
+
+fn body_of(len: usize) -> Vec<u8> {
+    (0..len).map(|i| (i * 7 % 251) as u8).collect()
+}
+
+const CLOSE: CloseReason = CloseReason {
+    err_type: ErrType::Application,
+    code: 0x10c,
+};
+
+/// Server rig with SETTINGS exchanged and `NewConn` drained.
+fn server() -> Rig {
+    let mut r = Rig::server();
+    r.pump();
+    r.events();
+    r
+}
+
+/// Client rig with SETTINGS exchanged.
+fn client() -> Rig {
+    let mut r = Rig::client();
+    r.pump();
+    r.events();
+    r
+}
+
+/// The ids of the `H3Request`s in `ev`.
+fn requests(ev: &[Event]) -> Vec<H3ReqId> {
+    ev.iter()
+        .filter_map(|e| match *e {
+            Event::H3Request(_, id) => Some(id),
+            _ => None,
+        })
+        .collect()
+}
+
+/// The single `H3Request` id, asserting `[H3Request, H3Readable]`.
+fn started(r: &mut Rig) -> H3ReqId {
+    let ev = r.events();
+    let ids = requests(&ev);
+    assert_eq!(ids.len(), 1, "{ev:?}");
+    assert_eq!(
+        ev,
+        [Event::H3Request(r.conn, ids[0]), Event::H3Readable(ids[0])]
+    );
+    ids[0]
+}
+
+/// The `H3Closed` ids in `ev`, each asserting `unread: None`.
+fn closed(ev: &[Event]) -> Vec<H3ReqId> {
+    ev.iter()
+        .filter_map(|e| match e {
+            Event::H3Closed(id, c) => {
+                assert_eq!(c.unread, None);
+                Some(*id)
+            }
+            _ => None,
+        })
+        .collect()
+}
+
+fn recv_headers(r: &mut Rig, id: H3ReqId) -> Result<bool, StreamError> {
+    r.w.h3_recv_headers(r.now, id, &mut |_, _| {})
+}
+
+/// `h3_recv_body` with a `cap`-byte buf until `fin` or an error: the bytes and the last
+/// result.
+fn pull(r: &mut Rig, id: H3ReqId, cap: usize) -> (Vec<u8>, Result<(usize, bool), StreamError>) {
+    let mut all = Vec::new();
+    let mut buf = vec![0u8; cap];
+    loop {
+        let res = r.w.h3_recv_body(r.now, id, &mut buf);
+        if let Ok((n, _)) = res {
+            all.extend_from_slice(&buf[..n]);
+        }
+        if !matches!(res, Ok((_, false))) {
+            return (all, res);
+        }
+    }
+}
+
+/// Server request on `q` from the peer, HEADERS taken by the gateway (no FIN yet).
+fn reading_request() -> (Rig, H3ReqId, StreamId) {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &request("GET"), false).unwrap();
+    r.pump();
+    let id = started(&mut r);
+    assert_eq!(recv_headers(&mut r, id), Ok(false));
+    let s = r.peer_stream(Q(0));
+    (r, id, s)
+}
+
+/// A client GET (FIN on HEADERS) whose HEADERS the peer received and released.
+fn client_get(r: &mut Rig) -> (H3ReqId, Q) {
+    let id = r.w.open_h3_request(r.now, r.conn).expect("open_h3_request");
+    let hs = [
+        h(":method", "GET"),
+        h(":scheme", "https"),
+        h(":authority", "example.com"),
+        h(":path", "/"),
+    ];
+    r.w.h3_send_headers(r.now, id, &hs, true)
+        .expect("send_headers");
+    r.pump();
+    let q = Q(r.w.h3_req_info(id).expect("h3_req_info").quic_id);
+    let b = r
+        .peer_events
+        .iter()
+        .find_map(|e| match *e {
+            h3wire::Event::Headers {
+                stream,
+                block,
+                kind: HeadersKind::Request,
+            } if stream == q => Some(block),
+            _ => None,
+        })
+        .expect("peer got the request");
+    r.peer.release(b);
+    (id, q)
+}
+
+/// A raw HEADERS frame over a static-only QPACK section of `fields`.
+fn raw_headers(fields: &[FieldRef]) -> Vec<u8> {
+    let mut p = Vec::new();
+    h3wire::qpack::encoder::encode_field_section(fields, &mut p);
+    let mut out = Vec::new();
+    h3wire::frame::encode_header(0x01, p.len() as u64, &mut out);
+    out.extend_from_slice(&p);
+    out
+}
+
+/// A raw DATA frame declaring `declared` bytes and carrying `payload`.
+fn raw_data(declared: usize, payload: &[u8]) -> Vec<u8> {
+    let mut out = Vec::new();
+    h3wire::frame::encode_header(0x00, declared as u64, &mut out);
+    out.extend_from_slice(payload);
+    out
+}
+
+/// `stream_send` calls on `s`.
+fn sends(r: &Rig, s: StreamId) -> usize {
+    r.h.log()
+        .iter()
+        .filter(|c| matches!(c, Call::StreamSend { s: x, .. } if *x == s))
+        .count()
+}
+
+/// Receive EOF is not closure: the response still goes out (adoption spec §4.3).
+#[test]
+fn server_finished_before_response_is_not_closure() {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &request("GET"), true).unwrap();
+    r.pump();
+    let id = started(&mut r);
+    assert_eq!(recv_headers(&mut r, id), Ok(true), "Finished arrived first");
+    r.pump();
+    assert_eq!(closed(&r.events()), []);
+    assert_eq!(
+        r.w.h3_send_headers(r.now, id, &[h(":status", "200")], false),
+        Ok(())
+    );
+    assert_eq!(r.w.h3_send_body(r.now, id, b"hello", true), Ok(5));
+    r.pump();
+    assert_eq!(r.peer_body(Q(0)), b"hello");
+    assert!(r.peer_events.contains(&h3wire::Event::Finished(Q(0))));
+    assert_eq!(closed(&r.events()), []);
+}
+
+/// Condition 2: StreamClosed waits until the gateway has the receive end.
+#[test]
+fn closed_after_stream_closed_and_delivered() {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &request("POST"), false).unwrap();
+    let body = body_of(1000);
+    r.peer_send_body(Q(0), &body, true);
+    r.pump();
+    let id = started(&mut r);
+    assert_eq!(recv_headers(&mut r, id), Ok(false));
+    let s = r.peer_stream(Q(0));
+    assert_eq!(r.h.recv_pending(s), 0, "the raw FIN sits in the carry");
+    r.h.push_event(Event::StreamClosed(s));
+    r.w.drive(r.now);
+    assert_eq!(closed(&r.events()), [], "the body is not delivered yet");
+    let (got, last) = pull(&mut r, id, 4096);
+    assert!(matches!(last, Ok((_, true))), "{last:?}");
+    assert!(got == body, "body bytes differ");
+    assert_eq!(closed(&r.events()), [id]);
+    r.w.drive(r.now);
+    assert_eq!(closed(&r.events()), []);
+}
+
+#[test]
+fn aborted_closes_on_stream_closed() {
+    let (mut r, id, s) = reading_request();
+    r.peer.abort(Q(0), H3Code::REQUEST_CANCELLED).unwrap();
+    r.pump();
+    assert_eq!(closed(&r.events()), []);
+    r.h.push_event(Event::StreamClosed(s));
+    r.w.drive(r.now);
+    assert_eq!(closed(&r.events()), [id], "no read needed");
+}
+
+/// adoption spec §4.4: a StreamPeerReset after our abort is not passed to h3wire.
+#[test]
+fn late_peer_reset_after_abort_ignored() {
+    let (mut r, id, s) = reading_request();
+    r.w.h3_reset(r.now, id);
+    let ours = [
+        Call::StreamResetSend { s, code: 0x10c },
+        Call::StreamStopSending { s, code: 0x10c },
+    ];
+    assert_eq!(aborts(&r, s), ours);
+    r.h.expect_stream_recv(s, Err(StreamError::Reset));
+    r.h.push_event(Event::StreamPeerReset(s, 0x10c));
+    r.w.drive(r.now);
+    assert_eq!(aborts(&r, s), ours, "no new action");
+    assert_eq!(
+        r.h.recv_pending(s),
+        0,
+        "the retirement probe read the reset"
+    );
+    assert_eq!(closed(&r.events()), []);
+    r.h.push_event(Event::StreamClosed(s));
+    r.w.drive(r.now);
+    assert_eq!(closed(&r.events()), [id]);
+    r.w.drive(r.now);
+    assert_eq!(closed(&r.events()), []);
+}
+
+#[test]
+fn h3_reset_with_core() {
+    let (mut r, id, s) = reading_request();
+    r.w.h3_reset(r.now, id);
+    assert_eq!(
+        aborts(&r, s),
+        [
+            Call::StreamResetSend { s, code: 0x10c },
+            Call::StreamStopSending { s, code: 0x10c }
+        ]
+    );
+    r.w.h3_reset(r.now, id);
+    assert_eq!(aborts(&r, s).len(), 2, "a second h3_reset adds nothing");
+    assert_eq!(closed(&r.events()), []);
+    r.h.push_event(Event::StreamClosed(s));
+    r.w.drive(r.now);
+    assert_eq!(closed(&r.events()), [id]);
+}
+
+/// Review Focus 4 (adoption spec §6.4 "kept").
+#[test]
+fn early_response_then_drain_retires() {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &request("POST"), false).unwrap();
+    let upload = body_of(64 * 1024);
+    r.peer_send_body(Q(0), &upload, true);
+    r.pump();
+    let id = started(&mut r);
+    assert_eq!(recv_headers(&mut r, id), Ok(false));
+    assert_eq!(
+        r.w.h3_send_headers(r.now, id, &[h(":status", "413")], false),
+        Ok(())
+    );
+    assert_eq!(r.w.h3_send_body(r.now, id, b"done", true), Ok(4));
+    r.pump();
+    assert!(r.peer_events.contains(&h3wire::Event::Finished(Q(0))));
+    let s = r.peer_stream(Q(0));
+    assert!(r.h.recv_pending(s) > 0, "the upload is unread");
+    assert_eq!(closed(&r.events()), []);
+    let (got, last) = pull(&mut r, id, 16 * 1024);
+    assert!(matches!(last, Ok((_, true))), "{last:?}");
+    assert!(got == upload, "upload bytes differ");
+    assert_eq!(
+        r.h.recv_pending(s),
+        0,
+        "read to the FIN: the stream can retire"
+    );
+    r.h.push_event(Event::StreamClosed(s));
+    r.w.drive(r.now);
+    assert_eq!(closed(&r.events()), [id]);
+}
+
+#[test]
+fn conn_close_fans_out() {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &request("GET"), false).unwrap();
+    r.peer.send_headers(Q(4), &request("GET"), false).unwrap();
+    r.pump();
+    let mut ids = requests(&r.events());
+    assert_eq!(ids.len(), 2);
+    r.close_transport(CLOSE);
+    r.w.drive(r.now);
+    let ev = r.events();
+    let mut got = closed(&ev);
+    got.sort();
+    ids.sort();
+    assert_eq!(got, ids);
+    assert_eq!(ev.last(), Some(&Event::ConnClosed(r.conn, CLOSE)), "{ev:?}");
+    assert_eq!(ev.len(), 3, "{ev:?}");
+    r.w.drive(r.now);
+    assert_eq!(r.events(), []);
+}
+
+/// Review Focus 3.
+#[test]
+fn retained_download_survives_conn_close() {
+    let mut r = client();
+    let (id, q) = client_get(&mut r);
+    let s = r.peer_stream(q);
+    r.peer
+        .send_headers(q, &[f(":status", "200")], false)
+        .unwrap();
+    let body = body_of(1000);
+    r.peer_send_body(q, &body, true);
+    r.pump();
+    assert_eq!(r.events(), [Event::H3Readable(id)]);
+    assert_eq!(r.h.recv_pending(s), 0, "the raw FIN sits in the carry");
+    r.close_transport(CLOSE);
+    r.w.drive(r.now);
+    assert_eq!(r.events(), [Event::ConnClosed(r.conn, CLOSE)]);
+    let n = sends(&r, s);
+    assert_eq!(r.w.h3_send_body(r.now, id, b"late", false), Ok(4));
+    assert_eq!(r.w.h3_finish(r.now, id), Ok(()));
+    assert_eq!(sends(&r, s), n, "accepted and discarded");
+    assert_eq!(recv_headers(&mut r, id), Ok(false));
+    assert_eq!(closed(&r.events()), []);
+    let (got, last) = pull(&mut r, id, 256);
+    assert!(matches!(last, Ok((_, true))), "{last:?}");
+    assert!(got == body, "body bytes differ");
+    assert_eq!(closed(&r.events()), [id]);
+    r.w.drive(r.now);
+    assert_eq!(closed(&r.events()), []);
+    assert_eq!(r.w.h3_req_info(id), Err(Error::Stale));
+}
+
+/// adoption spec §4.3 step 4, §5.3 (1).
+#[test]
+fn retained_cut_frame_fans_out() {
+    let mut r = client();
+    let (a, qa) = client_get(&mut r);
+    let (b, qb) = client_get(&mut r);
+    let status = raw_headers(&[f(":status", "200")]);
+    r.deliver(qa, &[&status[..], &raw_data(100, &[1; 10])].concat(), true);
+    r.deliver(qb, &[&status[..], &raw_data(5, &[2; 5])].concat(), true);
+    r.pump();
+    let ev = r.events();
+    assert!(ev.contains(&Event::H3Readable(a)) && ev.contains(&Event::H3Readable(b)));
+    r.close_transport(CLOSE);
+    r.w.drive(r.now);
+    assert_eq!(
+        r.events(),
+        [Event::ConnClosed(r.conn, CLOSE)],
+        "both retained"
+    );
+    assert_eq!(recv_headers(&mut r, a), Ok(false));
+    let (_, last) = pull(&mut r, a, 4096);
+    assert!(
+        last.is_err(),
+        "the cut frame is a connection error: {last:?}"
+    );
+    let mut got = closed(&r.events());
+    got.sort();
+    let mut want = vec![a, b];
+    want.sort();
+    assert_eq!(got, want, "both closed at once");
+    assert_eq!(recv_headers(&mut r, b), Err(StreamError::Stale));
+    r.w.drive(r.now);
+    assert_eq!(closed(&r.events()), []);
+}
+
+/// adoption spec §4.3: retention is client-only.
+#[test]
+fn server_requests_not_retained() {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &request("POST"), false).unwrap();
+    r.peer_send_body(Q(0), &body_of(1000), true);
+    r.pump();
+    let id = started(&mut r);
+    assert_eq!(
+        r.h.recv_pending(r.peer_stream(Q(0))),
+        0,
+        "complete in the carry"
+    );
+    r.close_transport(CLOSE);
+    r.w.drive(r.now);
+    let ev = r.events();
+    assert_eq!(closed(&ev), [id], "closed at once");
+    assert_eq!(ev.len(), 2, "{ev:?}");
+    assert_eq!(ev[1], Event::ConnClosed(r.conn, CLOSE));
+    let mut buf = [0u8; 64];
+    assert_eq!(
+        r.w.h3_recv_body(r.now, id, &mut buf),
+        Err(StreamError::Stale)
+    );
+}
+
+#[test]
+fn stale_after_close() {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &request("GET"), true).unwrap();
+    r.pump();
+    let id = started(&mut r);
+    assert_eq!(recv_headers(&mut r, id), Ok(true));
+    assert_eq!(
+        r.w.h3_send_headers(r.now, id, &[h(":status", "204")], true),
+        Ok(())
+    );
+    r.pump();
+    let s = r.peer_stream(Q(0));
+    r.h.push_event(Event::StreamClosed(s));
+    r.w.drive(r.now);
+    assert_eq!(closed(&r.events()), [id]);
+    let now = r.now;
+    let mut buf = [0u8; 64];
+    assert_eq!(r.w.h3_recv_body(now, id, &mut buf), Err(StreamError::Stale));
+    assert_eq!(recv_headers(&mut r, id), Err(StreamError::Stale));
+    assert_eq!(
+        r.w.h3_send_body(now, id, b"x", false),
+        Err(StreamError::Stale)
+    );
+    assert_eq!(
+        r.w.h3_send_headers(now, id, &[h(":status", "200")], false),
+        Err(StreamError::Stale)
+    );
+    assert_eq!(r.w.h3_finish(now, id), Err(StreamError::Stale));
+    assert_eq!(r.w.h3_req_info(id), Err(Error::Stale));
+    let calls = r.h.log().len();
+    r.w.h3_reset(now, id);
+    let after: Vec<_> = r.h.log()[calls..]
+        .iter()
+        .filter(|c| !matches!(c, Call::Drive(_)))
+        .cloned()
+        .collect();
+    assert_eq!(after, [], "h3_reset on a stale id is a no-op");
+    r.w.drive(now);
+    assert_eq!(closed(&r.events()), []);
+}
diff --git a/crates/mq-h3/tests/send.rs b/crates/mq-h3/tests/send.rs
index 4d42ff7d..e4724e4d 100644
--- a/crates/mq-h3/tests/send.rs
+++ b/crates/mq-h3/tests/send.rs
@@ -475,6 +475,20 @@ fn going_away_maps_to_conn() {
         r.h.log()[calls..].contains(&Call::StreamReset(s)),
         "no h3wire state: the raw stream is reset (adoption spec §4.3)"
     );
+    r.w.h3_reset(r.now, id);
+    assert_eq!(
+        aborts(&r, s),
+        [Call::StreamReset(s)],
+        "h3_reset is idempotent"
+    );
+    r.events();
+    r.h.push_event(Event::StreamClosed(s));
+    r.w.drive(r.now);
+    let ev = r.events();
+    assert!(
+        matches!(ev[..], [Event::H3Closed(x, _)] if x == id),
+        "closure follows StreamClosed: {ev:?}"
+    );
 }
 
 #[test]

From ed40746369501608c08f43380e788a5e55e68432 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 11:01:15 +0900
Subject: [PATCH 08/33] feat(mq-h3): request metrics

---
 crates/mq-h3/src/conn.rs    |  11 ++-
 crates/mq-h3/src/recv.rs    |  21 ++++-
 crates/mq-h3/src/req.rs     |  62 ++++++++++---
 crates/mq-h3/src/send.rs    |   5 +-
 crates/mq-h3/tests/stats.rs | 180 ++++++++++++++++++++++++++++++++++++
 5 files changed, 255 insertions(+), 24 deletions(-)
 create mode 100644 crates/mq-h3/tests/stats.rs

diff --git a/crates/mq-h3/src/conn.rs b/crates/mq-h3/src/conn.rs
index 06cf8896..2454633e 100644
--- a/crates/mq-h3/src/conn.rs
+++ b/crates/mq-h3/src/conn.rs
@@ -41,6 +41,9 @@ pub(crate) struct H3Conn {
     pub(crate) gone: bool,
     /// h3wire emitted `Event::Closed`.
     pub(crate) h3_closed: bool,
+    /// The `ConnClosed` code (xquic's `i32`): the stats of a request closed without a
+    /// snapshot (adoption spec §4.6).
+    pub(crate) conn_err: Option<i32>,
 }
 
 impl H3Conn {
@@ -60,6 +63,7 @@ impl<T: TransportOps> H3Wire<T> {
             fins: HashSet::new(),
             gone: false,
             h3_closed: false,
+            conn_err: None,
         };
         self.conns.insert(c, conn);
         self.service(now, c);
@@ -76,7 +80,7 @@ impl<T: TransportOps> H3Wire<T> {
                 }
             }
             // The fan-out comes before ConnClosed passes through (adoption spec §4.1).
-            Event::ConnClosed(c, _) => self.conn_closed(c),
+            Event::ConnClosed(c, reason) => self.conn_closed(c, reason.code as i32),
             Event::NewStream(c, s, info) => {
                 let Some(conn) = self.conns.get_mut(&c) else {
                     return Some(e);
@@ -86,7 +90,7 @@ impl<T: TransportOps> H3Wire<T> {
                 // A peer request stream (server): h3wire holds its state from the first
                 // sight; the gateway learns of it at its HEADERS (adoption spec §4.3).
                 if Q(info.quic_id).is_request() && !conn.client {
-                    let req = Req::new(c, s, info.quic_id, false);
+                    let req = Req::new(now, c, s, info.quic_id, false);
                     self.reqs.insert(req_id(s), req);
                 }
                 return None;
@@ -112,11 +116,12 @@ impl<T: TransportOps> H3Wire<T> {
     /// adoption spec §4.3 "Connection close", steps 1, 3 and 5. A client request whose
     /// response is complete but undelivered is retained while h3wire is open; every other
     /// request the gateway knows is closed now.
-    fn conn_closed(&mut self, c: ConnId) {
+    fn conn_closed(&mut self, c: ConnId, code: i32) {
         let Some(conn) = self.conns.get_mut(&c) else {
             return;
         };
         conn.gone = true;
+        conn.conn_err = Some(code);
         conn.closing = true; // h3wire parses on; its actions are dropped
         conn.fins.clear();
         let retain = conn.client && !conn.h3_closed;
diff --git a/crates/mq-h3/src/recv.rs b/crates/mq-h3/src/recv.rs
index 48132e01..fa81fab1 100644
--- a/crates/mq-h3/src/recv.rs
+++ b/crates/mq-h3/src/recv.rs
@@ -2,7 +2,7 @@
 //! transport events (adoption spec §4.3, §4.4).
 
 use crate::conn::log_closed;
-use crate::req::{Terminal, no_stats, req_id};
+use crate::req::{Terminal, req_id};
 use crate::{BOOT_READ, H3Wire};
 use h3wire::{Event as H3Event, H3Code, HeadersKind, Recv, StreamId as Q};
 use mq_transport_api::{
@@ -292,6 +292,9 @@ impl<T: TransportOps> H3Wire<T> {
             Ok(n) => Ok((n, false)),
             Err(e) => Err(e),
         };
+        if let Ok((n, _)) = out {
+            req.recv_body += n as u64;
+        }
         req.handed |= matches!(out, Ok((_, true)) | Err(StreamError::Reset));
         self.maybe_close(id);
         self.drive_inner(now);
@@ -309,7 +312,7 @@ impl<T: TransportOps> H3Wire<T> {
         e: &Event,
     ) -> bool {
         let id = req_id(s);
-        match *e {
+        match e {
             Event::StreamReadable(_) => {
                 let Some(req) = self.reqs.get(&id) else {
                     return true;
@@ -332,7 +335,7 @@ impl<T: TransportOps> H3Wire<T> {
                 {
                     req.reset_code_pending = false;
                     if let Some(conn) = self.conns.get_mut(&c) {
-                        log_closed(conn.h3.stream_reset_received(q, H3Code(code)));
+                        log_closed(conn.h3.stream_reset_received(q, H3Code(*code)));
                     }
                 }
                 // The probe always runs (spec §3), before the events are dispatched by
@@ -344,6 +347,12 @@ impl<T: TransportOps> H3Wire<T> {
                     self.queue.push(Event::H3Writable(id)); // adoption spec §4.5
                 }
             }
+            Event::StreamCloseStats(_, st) => {
+                // Only a known request's snapshot is kept (adoption spec §4.4).
+                if let Some(req) = self.reqs.get_mut(&id).filter(|r| r.known) {
+                    req.snapshot = Some(st.clone());
+                }
+            }
             Event::StreamClosed(_) => {
                 // Unrouted first, so actions queued for the gone stream are dropped. The
                 // quic id stays mapped: carried bytes may still yield its h3wire events.
@@ -385,12 +394,14 @@ impl<T: TransportOps> H3Wire<T> {
     }
 
     /// Removes request `id`, with one `H3Closed` if the gateway knows it: the single place
-    /// that builds the `H3Close` (Task C6 fills its stats).
+    /// that builds the `H3Close` (adoption spec §4.6).
     pub(crate) fn close_req(&mut self, id: H3ReqId) {
         let Some(req) = self.reqs.remove(&id) else {
             return;
         };
+        let mut conn_err = None;
         if let Some(conn) = self.conns.get_mut(&req.conn) {
+            conn_err = conn.conn_err;
             conn.mq.remove(&req.quic_id);
             if let Some(b) = req.pending_block {
                 conn.h3.release(b);
@@ -398,7 +409,7 @@ impl<T: TransportOps> H3Wire<T> {
         }
         if req.known {
             let close = H3Close {
-                stats: no_stats(),
+                stats: req.stats(conn_err),
                 unread: None,
             };
             self.queue.push(Event::H3Closed(id, Box::new(close)));
diff --git a/crates/mq-h3/src/req.rs b/crates/mq-h3/src/req.rs
index be2a4624..52641a7b 100644
--- a/crates/mq-h3/src/req.rs
+++ b/crates/mq-h3/src/req.rs
@@ -2,7 +2,7 @@
 
 use crate::send::InFlight;
 use h3wire::{AbortSource, H3Code, HeaderBlockId};
-use mq_transport_api::{ConnId, H3ReqId, H3ReqStats, StreamId, Time};
+use mq_transport_api::{ConnId, H3ReqId, H3ReqStats, StreamCloseStats, StreamId, Time};
 
 /// The h3wire terminal event of a request's receive side.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -51,11 +51,23 @@ pub(crate) struct Req {
     pub(crate) send_stopped: bool,
     /// `now` when the first HEADERS byte was accepted (adoption spec §4.6).
     pub(crate) headers_sent_at: Option<Time>,
-    // stats: Task C6
+    /// `now` when the request started (adoption spec §4.6).
+    pub(crate) begin: Time,
+    /// Body payload bytes delivered by `h3_recv_body` / accepted by `h3_send_body`.
+    pub(crate) recv_body: u64,
+    pub(crate) send_body: u64,
+    /// The transport's snapshot, kept for a known request only (adoption spec §4.4).
+    pub(crate) snapshot: Option<Box<StreamCloseStats>>,
 }
 
 impl Req {
-    pub(crate) fn new(conn: ConnId, stream: StreamId, quic_id: u64, client: bool) -> Req {
+    pub(crate) fn new(
+        now: Time,
+        conn: ConnId,
+        stream: StreamId,
+        quic_id: u64,
+        client: bool,
+    ) -> Req {
         Req {
             conn,
             stream,
@@ -76,6 +88,10 @@ impl Req {
             writable_wanted: false,
             send_stopped: false,
             headers_sent_at: None,
+            begin: now,
+            recv_body: 0,
+            send_body: 0,
+            snapshot: None,
         }
     }
 
@@ -89,17 +105,33 @@ pub(crate) fn req_id(s: StreamId) -> H3ReqId {
     H3ReqId::from_slot(s.slot()).expect("a live slot has a nonzero generation")
 }
 
-/// Task C6 fills these from `StreamCloseStats`.
-pub(crate) fn no_stats() -> H3ReqStats {
-    H3ReqStats {
-        send_body: 0,
-        recv_body: 0,
-        begin_us: 0,
-        header_send_us: 0,
-        fin_send_us: 0,
-        fin_ack_us: 0,
-        mp_state: 0,
-        stream_err: 0,
-        close_msg: None,
+impl Req {
+    /// adoption spec §4.6. Without a snapshot, `conn_err` is the `ConnClosed` code of a
+    /// request closed by the fan-out.
+    pub(crate) fn stats(&self, conn_err: Option<i32>) -> H3ReqStats {
+        let (fin_send_us, fin_ack_us, mp_state, stream_err, close_msg) = match &self.snapshot {
+            Some(s) => (
+                s.fin_send_us,
+                s.fin_ack_us,
+                s.mp_state,
+                s.stream_err,
+                s.close_msg.clone(),
+            ),
+            None => match conn_err {
+                Some(e) => (0, 0, 0, e, Some("conn closed".to_string())),
+                None => (0, 0, 0, 0, None),
+            },
+        };
+        H3ReqStats {
+            send_body: self.send_body,
+            recv_body: self.recv_body,
+            begin_us: self.begin.as_micros(),
+            header_send_us: self.headers_sent_at.map_or(0, Time::as_micros),
+            fin_send_us,
+            fin_ack_us,
+            mp_state,
+            stream_err,
+            close_msg,
+        }
     }
 }
diff --git a/crates/mq-h3/src/send.rs b/crates/mq-h3/src/send.rs
index d4697fa5..a8508b30 100644
--- a/crates/mq-h3/src/send.rs
+++ b/crates/mq-h3/src/send.rs
@@ -106,7 +106,7 @@ impl<T: TransportOps> H3Wire<T> {
                 conn.mq.insert(q, s);
                 self.streams.insert(s, (c, Q(q)));
                 let id = req_id(s);
-                self.reqs.insert(id, Req::new(c, s, q, true));
+                self.reqs.insert(id, Req::new(now, c, s, q, true));
                 Ok(id)
             }),
         };
@@ -158,6 +158,9 @@ impl<T: TransportOps> H3Wire<T> {
     ) -> Result<usize, StreamError> {
         let client = self.client_of(id)?;
         let r = self.body(now, id, data, fin, client);
+        if let (Ok(n), Some(req)) = (&r, self.reqs.get_mut(&id)) {
+            req.send_body += *n as u64;
+        }
         self.drive_inner(now);
         r
     }
diff --git a/crates/mq-h3/tests/stats.rs b/crates/mq-h3/tests/stats.rs
new file mode 100644
index 00000000..9ba8f920
--- /dev/null
+++ b/crates/mq-h3/tests/stats.rs
@@ -0,0 +1,180 @@
+//! Request metrics: the `H3ReqStats` of `H3Closed` (adoption spec §4.6).
+
+mod common;
+
+use common::Rig;
+use h3wire::{FieldRef, H3Code, StreamId as Q};
+use mq_transport_api::{
+    CloseReason, ErrType, Event, H3Close, H3Header, H3ReqId, H3ReqStats, StreamCloseStats,
+    StreamError, StreamId, Time, TransportOps,
+};
+
+fn request() -> Vec<FieldRef<'static>> {
+    [
+        (":method", "POST"),
+        (":scheme", "https"),
+        (":authority", "example.com"),
+        (":path", "/x"),
+    ]
+    .map(|(n, v)| FieldRef::new(n.as_bytes(), v.as_bytes()))
+    .to_vec()
+}
+
+fn at(r: &mut Rig, us: u64) {
+    r.now = Time::from_micros(us);
+}
+
+/// A started server request whose HEADERS the gateway took, at rig time `t0`.
+fn server_request(t0: u64) -> (Rig, H3ReqId, StreamId) {
+    let mut r = Rig::server();
+    r.pump();
+    r.events();
+    at(&mut r, t0);
+    r.peer.send_headers(Q(0), &request(), false).unwrap();
+    r.pump();
+    let id = r
+        .events()
+        .iter()
+        .find_map(|e| match *e {
+            Event::H3Request(_, id) => Some(id),
+            _ => None,
+        })
+        .expect("H3Request");
+    assert_eq!(r.w.h3_recv_headers(r.now, id, &mut |_, _| {}), Ok(false));
+    let s = r.peer_stream(Q(0));
+    (r, id, s)
+}
+
+/// The `H3Close`s in `ev`.
+fn closes(ev: &[Event]) -> Vec<(H3ReqId, H3Close)> {
+    ev.iter()
+        .filter_map(|e| match e {
+            Event::H3Closed(id, c) => Some((*id, (**c).clone())),
+            _ => None,
+        })
+        .collect()
+}
+
+fn pull_all(r: &mut Rig, id: H3ReqId) -> Result<(usize, bool), StreamError> {
+    let mut buf = [0u8; 1024];
+    let mut total = 0;
+    loop {
+        let (n, fin) = r.w.h3_recv_body(r.now, id, &mut buf)?;
+        total += n;
+        if fin {
+            return Ok((total, true));
+        }
+    }
+}
+
+#[test]
+fn stats_clean() {
+    let (mut r, id, s) = server_request(100);
+    r.peer_send_body(Q(0), &vec![1u8; 5000], true);
+    r.pump();
+    assert_eq!(pull_all(&mut r, id), Ok((5000, true)));
+    at(&mut r, 250);
+    let hs = [H3Header {
+        name: b":status",
+        value: b"200",
+    }];
+    r.w.h3_send_headers(r.now, id, &hs, false).unwrap();
+    let body = vec![2u8; 7000];
+    let mut sent = 0;
+    while sent < body.len() {
+        let fin = true;
+        sent += r.w.h3_send_body(r.now, id, &body[sent..], fin).unwrap();
+        r.pump();
+    }
+    r.h.push_event(snapshot_for(s, 0, "finished"));
+    r.h.push_event(Event::StreamClosed(s));
+    r.w.drive(r.now);
+    let got = closes(&r.events());
+    assert_eq!(
+        got,
+        [(
+            id,
+            H3Close {
+                stats: H3ReqStats {
+                    send_body: 7000,
+                    recv_body: 5000,
+                    begin_us: 100,
+                    header_send_us: 250,
+                    fin_send_us: 11,
+                    fin_ack_us: 22,
+                    mp_state: 3,
+                    stream_err: 0,
+                    close_msg: Some("finished".into()),
+                },
+                unread: None,
+            }
+        )]
+    );
+}
+
+fn snapshot_for(s: StreamId, err: i32, msg: &str) -> Event {
+    let st = StreamCloseStats {
+        fin_send_us: 11,
+        fin_ack_us: 22,
+        mp_state: 3,
+        stream_err: err,
+        close_msg: Some(msg.into()),
+    };
+    Event::StreamCloseStats(s, Box::new(st))
+}
+
+#[test]
+fn stats_reset_code() {
+    let (mut r, id, s) = server_request(5);
+    r.peer.abort(Q(0), H3Code::REQUEST_CANCELLED).unwrap();
+    r.pump();
+    assert_eq!(pull_all(&mut r, id), Err(StreamError::Reset));
+    r.h.push_event(snapshot_for(s, 0x10c, "reset"));
+    r.h.push_event(Event::StreamClosed(s));
+    r.w.drive(r.now);
+    let got = closes(&r.events());
+    assert_eq!(got.len(), 1);
+    assert_eq!(got[0].1.stats.stream_err, 0x10c);
+    assert_eq!(got[0].1.stats.close_msg.as_deref(), Some("reset"));
+    assert_eq!(got[0].1.stats.fin_ack_us, 22);
+}
+
+/// adoption spec §4.4: a snapshot of a non-request stream is ignored.
+#[test]
+fn close_stats_on_uni_ignored() {
+    let (mut r, id, s) = server_request(5);
+    let ctrl = r.peer_stream(Q(2)); // the peer's control stream
+    r.events();
+    r.h.push_event(snapshot_for(ctrl, 7, "uni"));
+    r.h.push_event(Event::StreamClosed(ctrl));
+    r.w.drive(r.now);
+    assert_eq!(r.events(), []);
+    r.peer.abort(Q(0), H3Code::REQUEST_CANCELLED).unwrap();
+    r.pump();
+    let _ = pull_all(&mut r, id);
+    r.h.push_event(Event::StreamClosed(s));
+    r.w.drive(r.now);
+    let got = closes(&r.events());
+    assert_eq!(got.len(), 1);
+    let st = &got[0].1.stats;
+    assert_eq!(
+        (st.stream_err, st.fin_ack_us, st.close_msg.clone()),
+        (0, 0, None)
+    );
+}
+
+#[test]
+fn stats_fan_out_without_snapshot() {
+    let (mut r, id, _) = server_request(5);
+    r.events();
+    r.close_transport(CloseReason {
+        err_type: ErrType::Application,
+        code: 0x1234,
+    });
+    r.w.drive(r.now);
+    let got = closes(&r.events());
+    assert_eq!(got.len(), 1);
+    assert_eq!(got[0].0, id);
+    assert_eq!(got[0].1.stats.stream_err, 0x1234);
+    assert_eq!(got[0].1.stats.close_msg.as_deref(), Some("conn closed"));
+}

From 0b8e8b48aac3e446d114d0a9ec3fa5bb81c1bdda Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 11:29:19 +0900
Subject: [PATCH 09/33] fix(mq-h3): h3_reset after Finished ends the send side
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

h3wire emits no StreamAborted once Finished went out, so h3_reset on a
request whose receive side had finished left the request un-aborted with
its DATA frame in flight; the next h3_send_body wrote to a stream h3wire
had reaped (data_written: UnknownStream, a debug_assert). h3_reset now
marks the request aborted itself, as it already did without h3wire state
(adoption spec §4.3). Found by the C7 property test.
---
 crates/mq-h3/src/send.rs        |  3 +++
 crates/mq-h3/tests/lifecycle.rs | 34 +++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/crates/mq-h3/src/send.rs b/crates/mq-h3/src/send.rs
index a8508b30..075dd933 100644
--- a/crates/mq-h3/src/send.rs
+++ b/crates/mq-h3/src/send.rs
@@ -300,6 +300,9 @@ impl<T: TransportOps> H3Wire<T> {
             }
         } else if !req.aborted() {
             self.inner.stream_reset(now, req.stream);
+        }
+        // Set here, not only by `StreamAborted`: h3wire emits none after `Finished`.
+        if !req.aborted() {
             req.terminal = Some(Terminal::Aborted {
                 code: H3Code::REQUEST_CANCELLED,
                 source: AbortSource::Local,
diff --git a/crates/mq-h3/tests/lifecycle.rs b/crates/mq-h3/tests/lifecycle.rs
index 76e31c73..e885dff9 100644
--- a/crates/mq-h3/tests/lifecycle.rs
+++ b/crates/mq-h3/tests/lifecycle.rs
@@ -465,3 +465,37 @@ fn stale_after_close() {
     r.w.drive(now);
     assert_eq!(closed(&r.events()), []);
 }
+
+/// h3wire emits no `StreamAborted` after `Finished`: `h3_reset` must still end the send
+/// side, with a DATA frame in flight (found by the property test).
+#[test]
+fn h3_reset_after_finished_ends_send() {
+    let mut r = server();
+    r.peer.send_headers(Q(0), &request("GET"), true).unwrap();
+    r.pump();
+    let id = started(&mut r);
+    assert_eq!(recv_headers(&mut r, id), Ok(true));
+    assert_eq!(
+        r.w.h3_send_headers(r.now, id, &[h(":status", "200")], false),
+        Ok(())
+    );
+    r.pump();
+    let s = r.peer_stream(Q(0));
+    r.limit(s, Some(0));
+    assert_eq!(
+        r.w.h3_send_body(r.now, id, b"x", false),
+        Err(StreamError::Blocked),
+        "the frame is in flight"
+    );
+    r.w.h3_reset(r.now, id);
+    let n = sends(&r, s);
+    assert_eq!(
+        r.w.h3_send_body(r.now, id, b"x", false),
+        Err(StreamError::Reset)
+    );
+    assert_eq!(r.w.h3_finish(r.now, id), Err(StreamError::Reset));
+    assert_eq!(sends(&r, s), n, "nothing written after the reset");
+    r.h.push_event(Event::StreamClosed(s));
+    r.w.drive(r.now);
+    assert_eq!(closed(&r.events()), [id]);
+}

From adae77bbc9af28f462ed530159e64406566b34e0 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 11:29:27 +0900
Subject: [PATCH 10/33] fix(mq-h3): a peer reset after Finished ends the send
 side
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A peer RESET_STREAM after the request's FIN (xqc_h3 sends one on any
cancel) makes h3wire reset our send side, but after Finished it emits no
StreamAborted. H3Wire kept its DATA frame in flight and the next
h3_send_body wrote to a reaped stream (data_written: UnknownStream, a
debug_assert), or got Stale from send_data. It now ends the send side as
SendStopped does: H3Writable, then the client discards and the server
gets Err(Reset) (adoption spec §4.5). Same root cause as the h3_reset
fix, reached from the peer.
---
 crates/mq-h3/src/recv.rs   | 12 ++++++---
 crates/mq-h3/src/req.rs    |  7 +++++
 crates/mq-h3/tests/send.rs | 54 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 70 insertions(+), 3 deletions(-)

diff --git a/crates/mq-h3/src/recv.rs b/crates/mq-h3/src/recv.rs
index fa81fab1..a73613b7 100644
--- a/crates/mq-h3/src/recv.rs
+++ b/crates/mq-h3/src/recv.rs
@@ -86,9 +86,7 @@ impl<T: TransportOps> H3Wire<T> {
                 }
                 // adoption spec §4.5: the client discards later body, the server resets.
                 H3Event::SendStopped { .. } => {
-                    req.send_stopped = true;
-                    req.frame = None;
-                    req.finish_latched = false;
+                    req.stop_send();
                     if req.known {
                         self.queue.push(Event::H3Writable(id)); // a blocked pump learns it
                     }
@@ -337,6 +335,14 @@ impl<T: TransportOps> H3Wire<T> {
                     if let Some(conn) = self.conns.get_mut(&c) {
                         log_closed(conn.h3.stream_reset_received(q, H3Code(*code)));
                     }
+                    // After `Finished` h3wire resets our send side with no event: as
+                    // `SendStopped`.
+                    if req.terminal == Some(Terminal::Finished) {
+                        req.stop_send();
+                        if req.known {
+                            self.queue.push(Event::H3Writable(id));
+                        }
+                    }
                 }
                 // The probe always runs (spec §3), before the events are dispatched by
                 // the caller's `service`, so the abort owes no second read.
diff --git a/crates/mq-h3/src/req.rs b/crates/mq-h3/src/req.rs
index 52641a7b..7968084f 100644
--- a/crates/mq-h3/src/req.rs
+++ b/crates/mq-h3/src/req.rs
@@ -98,6 +98,13 @@ impl Req {
     pub(crate) fn aborted(&self) -> bool {
         matches!(self.terminal, Some(Terminal::Aborted { .. }))
     }
+
+    /// h3wire ended our send side without a `StreamAborted` (adoption spec §4.5).
+    pub(crate) fn stop_send(&mut self) {
+        self.send_stopped = true;
+        self.frame = None;
+        self.finish_latched = false;
+    }
 }
 
 /// The request id is the request stream's slot (adoption spec §4.1).
diff --git a/crates/mq-h3/tests/send.rs b/crates/mq-h3/tests/send.rs
index e4724e4d..ac69ab88 100644
--- a/crates/mq-h3/tests/send.rs
+++ b/crates/mq-h3/tests/send.rs
@@ -504,3 +504,57 @@ fn invalid_field_maps_to_reset() {
     r.pump();
     assert!(r.h.sent_bytes(s).is_empty());
 }
+
+/// A peer RESET_STREAM after the request's FIN (xqc_h3 sends one on any cancel): h3wire
+/// resets our send side but emits no `StreamAborted` after `Finished`, so it ends the send
+/// side as `SendStopped` does, here with a DATA frame in flight.
+#[test]
+fn peer_reset_after_finished_ends_send() {
+    let mut r = server();
+    let get = [
+        f(":method", "GET"),
+        f(":scheme", "https"),
+        f(":authority", "example.com"),
+        f(":path", "/"),
+    ];
+    r.peer.send_headers(Q(0), &get, true).unwrap();
+    r.pump();
+    let id = r
+        .events()
+        .iter()
+        .find_map(|e| match *e {
+            Event::H3Request(_, id) => Some(id),
+            _ => None,
+        })
+        .expect("H3Request");
+    assert_eq!(r.w.h3_recv_headers(r.now, id, &mut |_, _| {}), Ok(true));
+    assert_eq!(
+        r.w.h3_send_headers(r.now, id, &[h(":status", "200")], false),
+        Ok(())
+    );
+    r.pump();
+    let s = r.peer_stream(Q(0));
+    r.limit(s, Some(0));
+    assert_eq!(
+        r.w.h3_send_body(r.now, id, b"x", false),
+        Err(StreamError::Blocked),
+        "the frame is in flight"
+    );
+    r.events();
+    r.h.expect_stream_recv(s, Err(StreamError::Reset));
+    r.h.push_event(Event::StreamPeerReset(s, 0x10c));
+    r.w.drive(r.now);
+    assert_eq!(aborts(&r, s), [Call::StreamResetSend { s, code: 0x10c }]);
+    assert_eq!(
+        r.events(),
+        [Event::H3Writable(id)],
+        "a blocked pump learns of it"
+    );
+    let n = sends(&r, s, false);
+    assert_eq!(
+        r.w.h3_send_body(r.now, id, b"x", false),
+        Err(StreamError::Reset)
+    );
+    assert_eq!(r.w.h3_finish(r.now, id), Err(StreamError::Reset));
+    assert_eq!(sends(&r, s, false), n, "nothing written after the reset");
+}

From c8537e16a8fd4e078347ec873da4d8df15036732 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 11:29:36 +0900
Subject: [PATCH 11/33] test(mq-h3): property test over random op/event
 sequences
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

random_ops_hold_invariants (adoption spec §6.1): 200 cases of up to 64
steps over the Rig, both roles. Steps: peer HEADERS / body / FIN / reset
/ raw reset / STOP_SENDING / GOAWAY, the gateway's h3_* ops (keeping its
re-offer contract), transport StreamWritable / StreamClosed / close, send
limits and pumps. After every step debug_bounds_hold() (new, behind
test-support: carry <= max(BOOT_READ, largest buf), h3wire buffered <=
bound); throughout, one H3Request and at most one H3Closed per request,
nothing after it, and H3Closed once the transport closed the stream and
the gateway has its receive end; at the end, after the close and a
drain, exactly one H3Closed per known request.

The Rig models what xquic can deliver: StreamClosed (after
StreamCloseStats) only once both directions are over, every stream's
close before ConnClosed on the close step, one ConnClosed, no traffic
after it, open_stream Stale after it, and w's resets / STOP_SENDING
relayed to the peer.
---
 crates/mq-h3/src/lib.rs          |  21 ++
 crates/mq-h3/tests/common/mod.rs | 236 +++++++++++++++-
 crates/mq-h3/tests/props.rs      | 461 +++++++++++++++++++++++++++++++
 3 files changed, 703 insertions(+), 15 deletions(-)
 create mode 100644 crates/mq-h3/tests/props.rs

diff --git a/crates/mq-h3/src/lib.rs b/crates/mq-h3/src/lib.rs
index b32f775f..9fed3269 100644
--- a/crates/mq-h3/src/lib.rs
+++ b/crates/mq-h3/src/lib.rs
@@ -37,6 +37,9 @@ pub struct H3Wire<T> {
     /// A `NewConn` was seen: the inner transport is a server. ponytail: learned, not
     /// configured; before its first conn a server reports an unknown conn as `Stale`.
     server: bool,
+    /// The largest `h3_recv_body` buf so far: the carry bound (adoption spec §5.4).
+    #[cfg(feature = "test-support")]
+    max_buf: usize,
 }
 
 impl<T: TransportOps> H3Wire<T> {
@@ -59,6 +62,8 @@ impl<T: TransportOps> H3Wire<T> {
             conns: HashMap::new(),
             streams: HashMap::new(),
             server: false,
+            #[cfg(feature = "test-support")]
+            max_buf: 0,
         }
     }
 
@@ -83,6 +88,18 @@ impl<T: TransportOps> H3Wire<T> {
         }
     }
 
+    /// Every request's carry <= max(BOOT_READ, largest buf passed so far), and every
+    /// connection's h3wire `debug_buffered_bytes() <= debug_bound()` (adoption spec §5.4).
+    #[cfg(feature = "test-support")]
+    pub fn debug_bounds_hold(&self) -> bool {
+        let carry = BOOT_READ.max(self.max_buf);
+        self.reqs.values().all(|r| r.carry.len() <= carry)
+            && self
+                .conns
+                .values()
+                .all(|c| c.h3.debug_buffered_bytes() <= c.h3.debug_bound())
+    }
+
     /// Services every H3 conn, then moves the inner queue into ours, consuming what belongs
     /// to H3 conns; runs at the end of every method that takes `now` (adoption spec §4.1).
     fn drive_inner(&mut self, now: Time) {
@@ -314,6 +331,10 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         r: H3ReqId,
         buf: &mut [u8],
     ) -> Result<(usize, bool), StreamError> {
+        #[cfg(feature = "test-support")]
+        {
+            self.max_buf = self.max_buf.max(buf.len());
+        }
         if self.active {
             return self.recv_body(now, r, buf);
         }
diff --git a/crates/mq-h3/tests/common/mod.rs b/crates/mq-h3/tests/common/mod.rs
index bd3de47a..b0a9d1bb 100644
--- a/crates/mq-h3/tests/common/mod.rs
+++ b/crates/mq-h3/tests/common/mod.rs
@@ -1,14 +1,14 @@
 //! `Rig`: an `H3Wire<ScriptedTransport>` joined to a real `h3wire::Connection` peer.
 #![allow(dead_code)]
 
-use h3wire::{Action, Config, Connection, Recv, Role, StreamId as Q};
+use h3wire::{Action, Config, Connection, H3Code, Recv, Role, StreamId as Q};
 use mq_h3::H3Wire;
 use mq_runtime::testing::{Call, ScriptedHandle, ScriptedTransport};
 use mq_transport_api::{
-    CloseReason, ConnConfig, ConnId, ConnProto, ErrType, Event, StreamError, StreamId, StreamInfo,
-    StreamKind, Time, TransportOps,
+    CloseReason, ConnConfig, ConnId, ConnProto, ErrType, Error, Event, StreamCloseStats,
+    StreamError, StreamId, StreamInfo, StreamKind, Time, TransportOps,
 };
-use std::collections::{BTreeMap, HashMap, VecDeque};
+use std::collections::{BTreeMap, HashMap, HashSet, VecDeque};
 use std::sync::{Arc, Mutex, MutexGuard};
 
 /// `w` → peer bytes of one stream, as the transport accepted them.
@@ -33,6 +33,8 @@ struct Wire {
     limit: HashMap<StreamId, VecDeque<Option<usize>>>,
     /// Quic id of the next request stream `w` opens.
     next_req: u64,
+    /// The conn is closed: `open_stream` fails like the real transport's (`Stale`).
+    conn_closed: bool,
 }
 
 impl Wire {
@@ -56,6 +58,18 @@ pub struct Rig {
     to_w: BTreeMap<u64, (Vec<u8>, bool)>,
     /// Quic id of the next uni stream the peer opens.
     next_peer_uni: u64,
+    /// Streams the transport closed (`close_stream`).
+    closed: HashSet<StreamId>,
+    /// Streams whose transport receive side was given its end (FIN or reset).
+    recv_end: HashSet<StreamId>,
+    /// Streams whose send side `w` reset, or the transport reset on a peer STOP_SENDING.
+    send_reset: HashSet<StreamId>,
+    /// `relay_aborts` cursor into the call log.
+    log_at: usize,
+    /// `relay_aborts` saw `w` close the conn.
+    w_closed: bool,
+    /// Quic ids `peer_raw_reset` reset: later peer bytes on them are dropped.
+    raw_reset: HashSet<u64>,
 }
 
 /// Generous; hitting it means the two sides never settle.
@@ -97,8 +111,11 @@ impl Rig {
         }
         let ww = wire.clone();
         h.on_open_stream(move |h, conn| {
-            let s = h.new_stream_id();
             let mut w = lock(&ww);
+            if w.conn_closed {
+                return Err(Error::Stale);
+            }
+            let s = h.new_stream_id();
             let q = w.next_req;
             w.next_req += 4;
             w.map(s, q);
@@ -131,11 +148,22 @@ impl Rig {
             wire,
             to_w: BTreeMap::new(),
             next_peer_uni: if peer_role == Role::Client { 2 } else { 3 },
+            closed: HashSet::new(),
+            recv_end: HashSet::new(),
+            send_reset: HashSet::new(),
+            log_at: 0,
+            w_closed: false,
+            raw_reset: HashSet::new(),
         }
     }
 
     /// Moves accepted bytes both ways and executes actions on both sides until nothing moves.
+    /// After the transport conn closed, only drives `w`.
     pub fn pump(&mut self) {
+        if self.conn_closed() {
+            self.w.drive(self.now);
+            return;
+        }
         for _ in 0..MAX_ROUNDS {
             self.w.drive(self.now);
             let mut moved = self.feed_peer();
@@ -176,17 +204,23 @@ impl Rig {
 
     /// Peer DATA through send_data / data_written; the bytes reach `w` on the next pump.
     pub fn peer_send_body(&mut self, q: Q, body: &[u8], fin: bool) {
+        assert!(self.try_peer_send_body(q, body, fin), "peer send_data");
+    }
+
+    /// `peer_send_body`, returning false if the peer refuses.
+    pub fn try_peer_send_body(&mut self, q: Q, body: &[u8], fin: bool) -> bool {
         self.drain_peer(); // queued HEADERS go first
-        let f = self
-            .peer
-            .send_data(q, body.len() as u64, fin)
-            .expect("peer send_data");
+        let Ok(f) = self.peer.send_data(q, body.len() as u64, fin) else {
+            return false;
+        };
         let pipe = &mut self.to_w.entry(q.0).or_default().0;
         pipe.extend_from_slice(f.prefix());
         pipe.extend_from_slice(body);
-        self.peer
-            .data_written(q, f.prefix().len() + body.len())
-            .expect("peer data_written");
+        let n = f.prefix().len() + body.len();
+        if n > 0 {
+            self.peer.data_written(q, n).expect("peer data_written");
+        }
+        true
     }
 
     /// Raw bytes on a peer stream (the "raw" cases only).
@@ -196,9 +230,165 @@ impl Rig {
         e.1 |= fin;
     }
 
-    /// Pushes ConnClosed(conn, reason) into the inner transport (transport close, not H3).
+    /// Pushes ConnClosed(conn, reason) into the inner transport (transport close, not H3),
+    /// once; nothing moves between the two sides afterwards.
     pub fn close_transport(&mut self, reason: CloseReason) {
-        self.h.push_event(Event::ConnClosed(self.conn, reason));
+        if !std::mem::replace(&mut lock(&self.wire).conn_closed, true) {
+            self.h.push_event(Event::ConnClosed(self.conn, reason));
+        }
+    }
+
+    /// `close_transport` as xquic does it: every stream's `StreamCloseStats` +
+    /// `StreamClosed` first, then `ConnClosed` (adoption spec §3, A.5).
+    pub fn close_transport_streams(&mut self, reason: CloseReason) {
+        if self.conn_closed() {
+            return;
+        }
+        for (_, s) in self.streams() {
+            self.close_stream(s);
+        }
+        self.close_transport(reason);
+    }
+
+    /// The transport conn is closed: nothing moves between the two sides any more.
+    pub fn conn_closed(&self) -> bool {
+        lock(&self.wire).conn_closed
+    }
+
+    /// `w` closed the conn (`close_conn` / `close_conn_with`) and the transport has not
+    /// reported it yet; seen by `relay_aborts`.
+    pub fn w_closed(&self) -> bool {
+        self.w_closed && !self.conn_closed()
+    }
+
+    /// The mq id of quic id `q`, if mapped.
+    pub fn stream_of(&self, q: u64) -> Option<StreamId> {
+        lock(&self.wire).mq_of.get(&q).copied()
+    }
+
+    /// Every mapped stream (quic id, mq id) the transport has not closed, by quic id.
+    pub fn streams(&self) -> Vec<(u64, StreamId)> {
+        let w = lock(&self.wire);
+        let mut v: Vec<_> = w
+            .mq_of
+            .iter()
+            .filter(|(_, s)| !self.closed.contains(s))
+            .map(|(&q, &s)| (q, s))
+            .collect();
+        v.sort();
+        v
+    }
+
+    /// The transport closed `s` (`close_stream`).
+    pub fn is_closed(&self, s: StreamId) -> bool {
+        self.closed.contains(&s)
+    }
+
+    /// `StreamCloseStats` + `StreamClosed` for `s`, once (xquic destroys the stream).
+    pub fn close_stream(&mut self, s: StreamId) {
+        if !self.closed.insert(s) {
+            return;
+        }
+        let st = StreamCloseStats {
+            fin_send_us: 0,
+            fin_ack_us: 0,
+            mp_state: 0,
+            stream_err: 0,
+            close_msg: None,
+        };
+        self.h.push_event(Event::StreamCloseStats(s, Box::new(st)));
+        self.h.push_event(Event::StreamClosed(s));
+    }
+
+    /// xquic may close `s` on its own: both directions are over. Receive: the transport
+    /// gave its end (FIN or reset) and `w` read everything. Send: `w`'s FIN was accepted,
+    /// or the send side was reset (by `w`, or by xquic on a peer STOP_SENDING). Needs
+    /// `relay_aborts` to have seen the latest calls.
+    pub fn retirable(&self, s: StreamId) -> bool {
+        let Some(&q) = lock(&self.wire).q_of.get(&s) else {
+            return false;
+        };
+        !self.closed.contains(&s)
+            && self.recv_end.contains(&s)
+            && self.h.recv_pending(s) == 0
+            && !self.to_w.contains_key(&q)
+            && (self.fins(s) > 0 || self.send_reset.contains(&s))
+    }
+
+    /// A peer STOP_SENDING on `w`'s stream `q`: the transport event, then xquic's
+    /// RESET_STREAM reply (unless `w`'s FIN was accepted), which the peer receives.
+    pub fn peer_stop_sending(&mut self, q: u64, code: u64) {
+        let Some(s) = self.stream_of(q) else {
+            return;
+        };
+        if self.conn_closed() || self.closed.contains(&s) {
+            return;
+        }
+        self.h.push_event(Event::StreamStopSending(s, code));
+        if self.fins(s) == 0 && self.send_reset.insert(s) {
+            self.abandon(s);
+            let _ = self
+                .peer
+                .stream_reset_received(Q(q), H3Code::REQUEST_CANCELLED);
+        }
+    }
+
+    /// A RESET_STREAM on `q` from a peer stack that resets whatever its h3 state (e.g.
+    /// xqc_h3, even after its FIN); the h3wire peer is not told and its later bytes on `q`
+    /// are dropped.
+    pub fn peer_raw_reset(&mut self, q: u64, code: u64) {
+        let Some(s) = self.stream_of(q) else {
+            return;
+        };
+        if self.conn_closed() || self.closed.contains(&s) || !self.raw_reset.insert(q) {
+            return;
+        }
+        self.to_w.remove(&q);
+        self.recv_end.insert(s);
+        self.h.expect_stream_recv(s, Err(StreamError::Reset));
+        self.h.push_event(Event::StreamPeerReset(s, code));
+    }
+
+    /// Delivers `w`'s RESET_STREAM / STOP_SENDING calls since the last call to the peer.
+    /// A STOP_SENDING makes the peer reset its send side, as its transport would.
+    pub fn relay_aborts(&mut self) {
+        let log = self.h.log();
+        let new = &log[self.log_at..];
+        self.log_at = log.len();
+        for c in new {
+            let (s, reset, stop) = match *c {
+                Call::StreamResetSend { s, code } => (s, Some(code), None),
+                Call::StreamStopSending { s, code } => (s, None, Some(code)),
+                Call::StreamReset(s) => (s, Some(0x10c), Some(0x10c)),
+                Call::CloseConn(_) | Call::CloseConnWith { .. } => {
+                    self.w_closed = true;
+                    continue;
+                }
+                _ => continue,
+            };
+            if reset.is_some() {
+                self.send_reset.insert(s);
+            }
+            let q = lock(&self.wire).q_of.get(&s).copied();
+            let Some(q) = q.filter(|_| !self.conn_closed() && !self.closed.contains(&s)) else {
+                continue;
+            };
+            if let Some(code) = reset {
+                self.abandon(s);
+                let _ = self.peer.stream_reset_received(Q(q), H3Code(code));
+            }
+            if let Some(code) = stop {
+                let _ = self.peer.stop_sending_received(Q(q), H3Code(code));
+            }
+        }
+    }
+
+    /// RESET_STREAM abandons what `w` sent on `s` and the peer has not received.
+    fn abandon(&mut self, s: StreamId) {
+        if let Some(o) = lock(&self.wire).out.get_mut(&s) {
+            o.at = o.buf.len();
+            o.fin_fed = true;
+        }
     }
 
     /// Feeds every accepted `w` → peer byte to the peer; returns whether anything moved.
@@ -265,6 +455,9 @@ impl Rig {
     }
 
     fn peer_action(&mut self, a: Action) {
+        if self.conn_closed() {
+            return;
+        }
         match a {
             Action::OpenUni(kind) => {
                 let q = self.next_peer_uni;
@@ -276,11 +469,18 @@ impl Rig {
             Action::ResetStream { stream, code } => {
                 self.to_w.remove(&stream.0); // RESET_STREAM abandons what is unsent
                 let s = self.mq(stream.0);
+                if self.closed.contains(&s) {
+                    return;
+                }
+                self.recv_end.insert(s);
                 self.h.expect_stream_recv(s, Err(StreamError::Reset));
                 self.h.push_event(Event::StreamPeerReset(s, code.0));
             }
             Action::StopSending { stream, code } => {
                 let s = self.mq(stream.0);
+                if self.closed.contains(&s) {
+                    return;
+                }
                 self.h.push_event(Event::StreamStopSending(s, code.0));
             }
             Action::CloseConnection { code, .. } => self.close_transport(CloseReason {
@@ -295,10 +495,16 @@ impl Rig {
         let staged = std::mem::take(&mut self.to_w);
         let mut moved = false;
         for (q, (bytes, fin)) in staged {
-            if bytes.is_empty() && !fin {
+            if self.conn_closed() || self.raw_reset.contains(&q) || (bytes.is_empty() && !fin) {
                 continue;
             }
             let s = self.mq(q);
+            if self.closed.contains(&s) {
+                continue; // the transport stream is gone
+            }
+            if fin {
+                self.recv_end.insert(s);
+            }
             self.h.expect_stream_recv(s, Ok((bytes, fin)));
             self.h.push_event(Event::StreamReadable(s));
             moved = true;
diff --git a/crates/mq-h3/tests/props.rs b/crates/mq-h3/tests/props.rs
new file mode 100644
index 00000000..09dea533
--- /dev/null
+++ b/crates/mq-h3/tests/props.rs
@@ -0,0 +1,461 @@
+//! Property test (adoption spec §6.1, §5.4, §4.3): random peer, gateway and transport steps
+//! over a `Rig`, both roles.
+//!
+//! After every step: no panic and `debug_bounds_hold()`. Throughout: `H3Request` once per
+//! request, no H3 event after a request's `H3Closed`, at most one `ConnClosed`, and a
+//! request whose stream the transport closed has its `H3Closed` once the gateway has its
+//! receive end or called `h3_reset` (§4.3 "Closure"). At the end, after the transport close
+//! and a drain of every request still open, each request that got `H3Request` or was opened
+//! has exactly one `H3Closed`.
+//!
+//! Transport model (what xquic could deliver; the Rig enforces the rest):
+//! - Peer bytes, resets and STOP_SENDING come from the real h3wire peer. A peer STOP_SENDING
+//!   (h3wire has no API for it alone) is the transport event plus xquic's RESET_STREAM reply,
+//!   unless our FIN was accepted. `w`'s RESET_STREAM / STOP_SENDING reach the peer
+//!   (`relay_aborts`); a STOP_SENDING makes the peer reset, as its transport would.
+//! - `StreamClosed` (always after `StreamCloseStats`) only for a request stream whose two
+//!   directions are over (`Rig::retirable`), and for every stream at a connection close
+//!   that models xquic's order. Nothing reaches a closed stream, and after `ConnClosed`
+//!   nothing moves between the sides.
+//! - `ConnClosed` comes once: from the close step, the peer's `CloseConnection`, or after
+//!   `w`'s own `close_conn_with` (held, then replayed with or without the stream closes).
+//! - The gateway keeps its contract: `h3_send_body` re-offers every unaccepted byte, no send
+//!   after its FIN, `h3_finish` only with nothing pending. Op order is otherwise random.
+#![cfg(feature = "test-support")]
+
+mod common;
+
+use common::Rig;
+use h3wire::{FieldRef, H3Code, StreamId as Q};
+use mq_transport_api::{CloseReason, ErrType, Event, H3Header, H3ReqId, StreamError, TransportOps};
+use proptest::prelude::*;
+use std::collections::{HashMap, HashSet};
+
+const CLOSE: CloseReason = CloseReason {
+    err_type: ErrType::Application,
+    code: 0x10c,
+};
+
+#[derive(Clone, Debug)]
+enum Step {
+    PeerHeaders { q: u8, fin: bool, info: bool },
+    PeerBody { q: u8, len: usize, fin: bool },
+    PeerFin { q: u8 },
+    PeerReset { q: u8 },
+    PeerRawReset { q: u8 },
+    PeerStopSending { q: u8 },
+    PeerGoaway { finish: bool },
+    Open,
+    SendHeaders { r: u8, set: u8, fin: bool },
+    SendBody { r: u8, add: usize, fin: bool },
+    Finish { r: u8 },
+    Reset { r: u8 },
+    RecvHeaders { r: u8 },
+    RecvBody { r: u8, cap: usize },
+    Writable { q: u8 },
+    StreamClosed { q: u8 },
+    Close { streams_first: bool },
+    Limit { q: u8, cap: Option<usize> },
+    Pump,
+}
+
+fn step() -> impl Strategy<Value = Step> {
+    let q = any::<u8>;
+    prop_oneof![
+        20 => (q(), any::<bool>(), prop::bool::weighted(0.2))
+            .prop_map(|(q, fin, info)| Step::PeerHeaders { q, fin, info }),
+        12 => (q(), 0usize..20_000, any::<bool>())
+            .prop_map(|(q, len, fin)| Step::PeerBody { q, len, fin }),
+        4 => q().prop_map(|q| Step::PeerFin { q }),
+        4 => q().prop_map(|q| Step::PeerReset { q }),
+        2 => q().prop_map(|q| Step::PeerRawReset { q }),
+        4 => q().prop_map(|q| Step::PeerStopSending { q }),
+        4 => any::<bool>().prop_map(|finish| Step::PeerGoaway { finish }),
+        16 => Just(Step::Open),
+        12 => (q(), 0u8..8, any::<bool>())
+            .prop_map(|(r, set, fin)| Step::SendHeaders { r, set, fin }),
+        12 => (q(), 0usize..20_000, any::<bool>())
+            .prop_map(|(r, add, fin)| Step::SendBody { r, add, fin }),
+        4 => q().prop_map(|r| Step::Finish { r }),
+        4 => q().prop_map(|r| Step::Reset { r }),
+        8 => q().prop_map(|r| Step::RecvHeaders { r }),
+        16 => (q(), 1usize..32 * 1024).prop_map(|(r, cap)| Step::RecvBody { r, cap }),
+        4 => q().prop_map(|q| Step::Writable { q }),
+        16 => q().prop_map(|q| Step::StreamClosed { q }),
+        1 => any::<bool>().prop_map(|streams_first| Step::Close { streams_first }),
+        8 => (q(), prop_oneof![Just(Some(0)), (1usize..64).prop_map(Some), Just(None)])
+            .prop_map(|(q, cap)| Step::Limit { q, cap }),
+        20 => Just(Step::Pump),
+    ]
+}
+
+/// The gateway's view of one request.
+struct Gw {
+    id: H3ReqId,
+    quic: Option<u64>,
+    /// Body bytes offered and not accepted: re-offered first.
+    pending: usize,
+    fin_sent: bool,
+    /// The gateway got `fin` or `Err(Reset)` from a read, or called `h3_reset`.
+    done: bool,
+}
+
+struct Model {
+    r: Rig,
+    server: bool,
+    reqs: Vec<Gw>,
+    known: HashSet<H3ReqId>,
+    closed: HashMap<H3ReqId, usize>,
+    conn_closed: usize,
+    /// Peer blocks released so far (index into `peer_events`).
+    peer_seen: usize,
+}
+
+fn f<'a>(n: &'a str, v: &'a str) -> FieldRef<'a> {
+    FieldRef::new(n.as_bytes(), v.as_bytes())
+}
+
+fn h<'a>(n: &'a str, v: &'a str) -> H3Header<'a> {
+    H3Header {
+        name: n.as_bytes(),
+        value: v.as_bytes(),
+    }
+}
+
+fn pick<T: Copy>(v: &[T], i: u8) -> Option<T> {
+    (!v.is_empty()).then(|| v[i as usize % v.len()])
+}
+
+impl Model {
+    fn new(server: bool) -> Model {
+        let r = if server { Rig::server() } else { Rig::client() };
+        // `w`'s own closes are replayed through the Rig, so ConnClosed comes once.
+        r.h.hold_conn_closed(true);
+        let mut m = Model {
+            r,
+            server,
+            reqs: Vec::new(),
+            known: HashSet::new(),
+            closed: HashMap::new(),
+            conn_closed: 0,
+            peer_seen: 0,
+        };
+        m.pump();
+        m.events();
+        m
+    }
+
+    /// Request quic ids the peer may act on: the peer opens 0..12 (server), or those `w`
+    /// opened (client).
+    fn peer_q(&self, i: u8) -> Option<Q> {
+        if self.server {
+            return Some(Q(4 * u64::from(i % 4)));
+        }
+        let opened: Vec<u64> = self.reqs.iter().filter_map(|g| g.quic).collect();
+        pick(&opened, i).map(Q)
+    }
+
+    /// `w`'s request and local uni streams the transport still has.
+    fn w_stream(&self, i: u8) -> Option<mq_transport_api::StreamId> {
+        let local_uni = if self.server { 3 } else { 2 };
+        let v: Vec<_> = self
+            .r
+            .streams()
+            .into_iter()
+            .filter(|&(q, _)| q % 4 == 0 || q % 4 == local_uni)
+            .map(|(_, s)| s)
+            .collect();
+        pick(&v, i)
+    }
+
+    fn gw(&mut self, i: u8) -> Option<&mut Gw> {
+        let n = self.reqs.len();
+        (n > 0).then(|| &mut self.reqs[i as usize % n])
+    }
+
+    fn pump(&mut self) {
+        self.r.relay_aborts();
+        self.r.pump();
+        // The peer application takes every block it gets.
+        let blocks: Vec<_> = self.r.peer_events[self.peer_seen..]
+            .iter()
+            .filter_map(|e| match *e {
+                h3wire::Event::Headers { block, .. } => Some(block),
+                _ => None,
+            })
+            .collect();
+        self.peer_seen = self.r.peer_events.len();
+        for b in blocks {
+            self.r.peer.release(b);
+        }
+    }
+
+    fn apply(&mut self, s: &Step) {
+        let now = self.r.now;
+        match *s {
+            Step::PeerHeaders { q, fin, info } => {
+                let Some(q) = self.peer_q(q) else { return };
+                let req = [
+                    f(":method", "POST"),
+                    f(":scheme", "https"),
+                    f(":authority", "example.com"),
+                    f(":path", "/p"),
+                ];
+                let fields: &[FieldRef] = match (self.server, info) {
+                    (true, _) => &req,
+                    (false, true) => &[f(":status", "103")],
+                    (false, false) => &[f(":status", "200")],
+                };
+                let _ = self.r.peer.send_headers(q, fields, fin);
+            }
+            Step::PeerBody { q, len, fin } => {
+                if let Some(q) = self.peer_q(q) {
+                    let body: Vec<u8> = (0..len).map(|i| i as u8).collect();
+                    self.r.try_peer_send_body(q, &body, fin);
+                }
+            }
+            Step::PeerFin { q } => {
+                if let Some(q) = self.peer_q(q) {
+                    self.r.try_peer_send_body(q, &[], true);
+                }
+            }
+            Step::PeerReset { q } => {
+                if let Some(q) = self.peer_q(q) {
+                    let _ = self.r.peer.abort(q, H3Code::REQUEST_CANCELLED);
+                }
+            }
+            Step::PeerRawReset { q } => {
+                if let Some(q) = self.peer_q(q) {
+                    self.r.peer_raw_reset(q.0, H3Code::REQUEST_CANCELLED.0);
+                }
+            }
+            Step::PeerStopSending { q } => {
+                if let Some(q) = self.peer_q(q) {
+                    self.r.peer_stop_sending(q.0, H3Code::REQUEST_CANCELLED.0);
+                }
+            }
+            Step::PeerGoaway { finish } => {
+                let _ = if finish {
+                    self.r.peer.finish_shutdown()
+                } else {
+                    self.r.peer.start_shutdown()
+                };
+            }
+            Step::Open => {
+                if let Ok(id) = self.r.w.open_h3_request(now, self.r.conn) {
+                    self.known.insert(id);
+                    self.add(id);
+                }
+            }
+            Step::SendHeaders { r, set, fin } => {
+                let Some(id) = self.gw(r).map(|g| g.id) else {
+                    return;
+                };
+                let req = [
+                    h(":method", "POST"),
+                    h(":scheme", "https"),
+                    h(":authority", "example.com"),
+                    h(":path", "/"),
+                ];
+                // Mostly what the gateway sends for its role; also a 103 and a field
+                // h3wire refuses.
+                let hs: &[H3Header] = match set {
+                    0..6 if self.server => &[h(":status", "200")],
+                    0..6 => &req,
+                    6 => &[h(":status", "103")],
+                    _ => &[h(":status", "200"), h("X-Upper", "invalid")],
+                };
+                let ok = self.r.w.h3_send_headers(now, id, hs, fin).is_ok();
+                if let Some(g) = self.gw(r).filter(|_| ok && fin) {
+                    g.fin_sent = true;
+                }
+            }
+            Step::SendBody { r, add, fin } => {
+                let Some(g) = self.gw(r).filter(|g| !g.fin_sent) else {
+                    return;
+                };
+                let (id, offer) = (g.id, g.pending + add);
+                let data: Vec<u8> = (0..offer).map(|i| i as u8).collect();
+                let res = self.r.w.h3_send_body(now, id, &data, fin);
+                let g = self.gw(r).expect("picked above");
+                match res {
+                    Ok(n) => {
+                        assert!(n <= offer, "accepted {n} of {offer}");
+                        g.pending = offer - n;
+                        g.fin_sent = fin && n == offer;
+                    }
+                    Err(StreamError::Blocked) => g.pending = offer,
+                    Err(_) => g.pending = 0,
+                }
+            }
+            Step::Finish { r } => {
+                let Some(g) = self.gw(r).filter(|g| !g.fin_sent && g.pending == 0) else {
+                    return;
+                };
+                let id = g.id;
+                let ok = self.r.w.h3_finish(now, id).is_ok();
+                self.gw(r).expect("picked above").fin_sent = ok;
+            }
+            Step::Reset { r } => {
+                if let Some(g) = self.gw(r) {
+                    g.done = true;
+                    let id = g.id;
+                    self.r.w.h3_reset(now, id);
+                }
+            }
+            Step::RecvHeaders { r } => {
+                if let Some(id) = self.gw(r).map(|g| g.id) {
+                    let res = self.r.w.h3_recv_headers(now, id, &mut |_, _| {});
+                    let g = self.gw(r).expect("picked above");
+                    g.done |= matches!(res, Ok(true) | Err(StreamError::Reset));
+                }
+            }
+            Step::RecvBody { r, cap } => {
+                if let Some(id) = self.gw(r).map(|g| g.id) {
+                    let mut buf = vec![0u8; cap];
+                    let res = self.r.w.h3_recv_body(now, id, &mut buf);
+                    if let Ok((n, _)) = res {
+                        assert!(n <= cap);
+                    }
+                    let g = self.gw(r).expect("picked above");
+                    g.done |= matches!(res, Ok((_, true)) | Err(StreamError::Reset));
+                }
+            }
+            Step::Writable { q } => {
+                if let Some(s) = self.w_stream(q).filter(|_| !self.r.conn_closed()) {
+                    self.r.h.push_event(Event::StreamWritable(s));
+                }
+            }
+            Step::StreamClosed { q } => {
+                self.r.relay_aborts();
+                let v: Vec<_> = self
+                    .r
+                    .streams()
+                    .into_iter()
+                    .filter(|&(q, s)| q % 4 == 0 && self.r.retirable(s))
+                    .map(|(_, s)| s)
+                    .collect();
+                if let Some(s) = pick(&v, q) {
+                    self.r.close_stream(s);
+                }
+            }
+            Step::Close { streams_first } => self.close(streams_first),
+            Step::Limit { q, cap } => {
+                if let Some(s) = self.w_stream(q) {
+                    self.r.limit(s, cap);
+                }
+            }
+            Step::Pump => self.pump(),
+        }
+        self.r.w.drive(now);
+        self.r.relay_aborts();
+        // `w` closed the conn itself (held above): the transport reports it now, in
+        // xquic's order.
+        if self.r.w_closed() {
+            self.close(true);
+        }
+    }
+
+    fn close(&mut self, streams_first: bool) {
+        if streams_first {
+            self.r.close_transport_streams(CLOSE);
+        } else {
+            self.r.close_transport(CLOSE);
+        }
+        self.r.w.drive(self.r.now);
+    }
+
+    /// Drains `w`'s events, checking the per-request event rules.
+    fn events(&mut self) {
+        for e in self.r.events() {
+            match e {
+                Event::H3Request(c, id) => {
+                    assert_eq!(c, self.r.conn);
+                    assert!(self.known.insert(id), "second H3Request for {id:?}");
+                    self.add(id);
+                }
+                Event::H3Readable(id) | Event::H3Writable(id) => {
+                    assert!(self.known.contains(&id), "{e:?} for an unknown request");
+                    assert!(!self.closed.contains_key(&id), "{e:?} after H3Closed");
+                }
+                Event::H3Closed(id, _) => {
+                    assert!(self.known.contains(&id), "H3Closed for an unknown request");
+                    *self.closed.entry(id).or_default() += 1;
+                    assert_eq!(self.closed[&id], 1, "second H3Closed for {id:?}");
+                }
+                Event::ConnClosed(..) => self.conn_closed += 1,
+                _ => {}
+            }
+        }
+        assert!(self.conn_closed <= 1, "ConnClosed twice");
+        for g in &self.reqs {
+            let gone = g.quic.and_then(|q| self.r.stream_of(q));
+            if g.done && gone.is_some_and(|s| self.r.is_closed(s)) {
+                assert!(self.closed.contains_key(&g.id), "{:?}: no H3Closed", g.id);
+            }
+        }
+    }
+
+    fn add(&mut self, id: H3ReqId) {
+        let quic = self.r.w.h3_req_info(id).ok().map(|i| i.quic_id);
+        self.reqs.push(Gw {
+            id,
+            quic,
+            pending: 0,
+            fin_sent: false,
+            done: false,
+        });
+    }
+
+    /// The gateway reads every open request to its end.
+    fn drain(&mut self) {
+        let now = self.r.now;
+        for _ in 0..64 {
+            let open: Vec<H3ReqId> = self
+                .known
+                .iter()
+                .filter(|id| !self.closed.contains_key(id))
+                .copied()
+                .collect();
+            if open.is_empty() {
+                return;
+            }
+            for id in open {
+                let _ = self.r.w.h3_recv_headers(now, id, &mut |_, _| {});
+                let mut buf = [0u8; 4096];
+                while let Ok((_, false)) = self.r.w.h3_recv_body(now, id, &mut buf) {}
+                self.events();
+                assert!(self.r.w.debug_bounds_hold(), "bounds after drain");
+            }
+        }
+    }
+}
+
+fn run(server: bool, steps: &[Step], streams_first: bool) {
+    let mut m = Model::new(server);
+    for (i, s) in steps.iter().enumerate() {
+        m.apply(s);
+        m.events();
+        assert!(m.r.w.debug_bounds_hold(), "bounds after step {i}: {s:?}");
+    }
+    m.close(streams_first);
+    m.events();
+    m.drain();
+    assert_eq!(m.conn_closed, 1, "one ConnClosed");
+    for id in &m.known {
+        assert_eq!(m.closed.get(id), Some(&1), "{id:?}: one H3Closed");
+    }
+}
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(200))]
+
+    #[test]
+    fn random_ops_hold_invariants(
+        server in any::<bool>(),
+        steps in prop::collection::vec(step(), 0..=64),
+        streams_first in any::<bool>(),
+    ) {
+        run(server, &steps, streams_first);
+    }
+}

From 625c3471af219eb4ee95a0b31c920252f6cd4481 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 11:54:48 +0900
Subject: [PATCH 12/33] fix(mq-h3): h3_send_headers after our send side ended
 returns Reset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A response to a request the peer already reset (aborted before
Finished, or send side stopped after it) reached h3wire's send_headers
on a reaped stream: UnknownStream, mapped to Err(Stale) for a request
H3Wire still holds. send_headers now returns Err(Reset) once the request
is aborted or its send side stopped, as h3_send_body does (adoption spec
§4.5). Found by the property test's new Stale check.
---
 crates/mq-h3/src/send.rs   |  5 +++++
 crates/mq-h3/tests/send.rs | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/crates/mq-h3/src/send.rs b/crates/mq-h3/src/send.rs
index 075dd933..26688039 100644
--- a/crates/mq-h3/src/send.rs
+++ b/crates/mq-h3/src/send.rs
@@ -127,6 +127,11 @@ impl<T: TransportOps> H3Wire<T> {
             .get_mut(&id)
             .filter(|r| r.known)
             .ok_or(StreamError::Stale)?;
+        // Our send side is over (adoption spec §4.5): h3wire would answer `UnknownStream`
+        // (reaped) or `WrongPhase`, but the request is still held.
+        if req.aborted() || req.send_stopped {
+            return Err(StreamError::Reset);
+        }
         let conn = self.conns.get_mut(&req.conn).ok_or(StreamError::Conn)?;
         let fields: Vec<_> = hs.iter().map(|h| FieldRef::new(h.name, h.value)).collect();
         let r = conn.h3.send_headers(Q(req.quic_id), &fields, fin);
diff --git a/crates/mq-h3/tests/send.rs b/crates/mq-h3/tests/send.rs
index ac69ab88..d1ef18df 100644
--- a/crates/mq-h3/tests/send.rs
+++ b/crates/mq-h3/tests/send.rs
@@ -558,3 +558,39 @@ fn peer_reset_after_finished_ends_send() {
     assert_eq!(r.w.h3_finish(r.now, id), Err(StreamError::Reset));
     assert_eq!(sends(&r, s, false), n, "nothing written after the reset");
 }
+
+/// The gateway answers a request the peer already reset: `Err(Reset)` as for the body, not
+/// `Stale` for a request still held. Before `Finished` the request is aborted; after it the
+/// send side is stopped (found by the property test).
+#[test]
+fn send_headers_after_peer_reset_resets() {
+    for fin in [false, true] {
+        let mut r = server();
+        let get = [
+            f(":method", "GET"),
+            f(":scheme", "https"),
+            f(":authority", "example.com"),
+            f(":path", "/"),
+        ];
+        r.peer.send_headers(Q(0), &get, fin).unwrap();
+        r.pump();
+        let id = r
+            .events()
+            .iter()
+            .find_map(|e| match *e {
+                Event::H3Request(_, id) => Some(id),
+                _ => None,
+            })
+            .expect("H3Request");
+        assert_eq!(r.w.h3_recv_headers(r.now, id, &mut |_, _| {}), Ok(fin));
+        let s = r.peer_stream(Q(0));
+        r.h.expect_stream_recv(s, Err(StreamError::Reset));
+        r.h.push_event(Event::StreamPeerReset(s, 0x10c));
+        r.w.drive(r.now);
+        assert_eq!(
+            r.w.h3_send_headers(r.now, id, &[h(":status", "200")], false),
+            Err(StreamError::Reset),
+            "fin = {fin}"
+        );
+    }
+}

From 95b4ae4e48da696f34145a0273260f03c562fdb3 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 11:54:57 +0900
Subject: [PATCH 13/33] test(mq-h3): deeper property run and the client
 peer-reset case
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- PROPTEST_CASES overrides the case count (default 200) for deep runs.
- peer_reset_after_finished_client_discards: client role of the peer
  RESET after Finished (spec §4.5): upload accepted and discarded,
  (0, true) still read, one H3Closed.
- The drain runs in request order, so a shrunk case replays the same.
- PeerRawReset mostly targets a stream past the peer's FIN, where h3wire
  may be Finished; a new check makes Err(Stale) before H3Closed a
  failure. Together they catch a revert of the peer-reset fix in the
  default 200 cases.
- Model: a synthetic peer RESET / STOP_SENDING only on a stream the
  peer knows; the gateway sends body and finish only after its headers
  and nothing after its FIN.
---
 crates/mq-h3/tests/common/mod.rs | 19 ++++++++-
 crates/mq-h3/tests/props.rs      | 69 ++++++++++++++++++++++++--------
 crates/mq-h3/tests/send.rs       | 34 ++++++++++++++++
 3 files changed, 104 insertions(+), 18 deletions(-)

diff --git a/crates/mq-h3/tests/common/mod.rs b/crates/mq-h3/tests/common/mod.rs
index b0a9d1bb..112d4450 100644
--- a/crates/mq-h3/tests/common/mod.rs
+++ b/crates/mq-h3/tests/common/mod.rs
@@ -279,6 +279,11 @@ impl Rig {
         v
     }
 
+    /// The transport handed `s`'s receive end to `w` (FIN or reset).
+    pub fn recv_ended(&self, s: StreamId) -> bool {
+        self.recv_end.contains(&s)
+    }
+
     /// The transport closed `s` (`close_stream`).
     pub fn is_closed(&self, s: StreamId) -> bool {
         self.closed.contains(&s)
@@ -315,13 +320,19 @@ impl Rig {
             && (self.fins(s) > 0 || self.send_reset.contains(&s))
     }
 
+    /// The peer knows stream `s`: it opened it, or `w` has sent it bytes.
+    fn peer_knows(&self, s: StreamId) -> bool {
+        let peer_client = self.next_peer_uni % 4 == 2;
+        peer_client || lock(&self.wire).out.get(&s).is_some_and(|o| o.at > 0)
+    }
+
     /// A peer STOP_SENDING on `w`'s stream `q`: the transport event, then xquic's
     /// RESET_STREAM reply (unless `w`'s FIN was accepted), which the peer receives.
     pub fn peer_stop_sending(&mut self, q: u64, code: u64) {
         let Some(s) = self.stream_of(q) else {
             return;
         };
-        if self.conn_closed() || self.closed.contains(&s) {
+        if self.conn_closed() || self.closed.contains(&s) || !self.peer_knows(s) {
             return;
         }
         self.h.push_event(Event::StreamStopSending(s, code));
@@ -340,7 +351,11 @@ impl Rig {
         let Some(s) = self.stream_of(q) else {
             return;
         };
-        if self.conn_closed() || self.closed.contains(&s) || !self.raw_reset.insert(q) {
+        if self.conn_closed()
+            || self.closed.contains(&s)
+            || !self.peer_knows(s)
+            || !self.raw_reset.insert(q)
+        {
             return;
         }
         self.to_w.remove(&q);
diff --git a/crates/mq-h3/tests/props.rs b/crates/mq-h3/tests/props.rs
index 09dea533..b25e9aea 100644
--- a/crates/mq-h3/tests/props.rs
+++ b/crates/mq-h3/tests/props.rs
@@ -4,7 +4,7 @@
 //! After every step: no panic and `debug_bounds_hold()`. Throughout: `H3Request` once per
 //! request, no H3 event after a request's `H3Closed`, at most one `ConnClosed`, and a
 //! request whose stream the transport closed has its `H3Closed` once the gateway has its
-//! receive end or called `h3_reset` (§4.3 "Closure"). At the end, after the transport close
+//! receive end or called `h3_reset` (§4.3 "Closure"); `Err(Stale)` only after `H3Closed`. At the end, after the transport close
 //! and a drain of every request still open, each request that got `H3Request` or was opened
 //! has exactly one `H3Closed`.
 //!
@@ -20,7 +20,8 @@
 //! - `ConnClosed` comes once: from the close step, the peer's `CloseConnection`, or after
 //!   `w`'s own `close_conn_with` (held, then replayed with or without the stream closes).
 //! - The gateway keeps its contract: `h3_send_body` re-offers every unaccepted byte, no send
-//!   after its FIN, `h3_finish` only with nothing pending. Op order is otherwise random.
+//!   after its FIN (headers included), `h3_finish` only with nothing pending, body and finish only after its
+//!   headers were accepted. Op order is otherwise random.
 #![cfg(feature = "test-support")]
 
 mod common;
@@ -68,7 +69,7 @@ fn step() -> impl Strategy<Value = Step> {
             .prop_map(|(q, len, fin)| Step::PeerBody { q, len, fin }),
         4 => q().prop_map(|q| Step::PeerFin { q }),
         4 => q().prop_map(|q| Step::PeerReset { q }),
-        2 => q().prop_map(|q| Step::PeerRawReset { q }),
+        4 => q().prop_map(|q| Step::PeerRawReset { q }),
         4 => q().prop_map(|q| Step::PeerStopSending { q }),
         4 => any::<bool>().prop_map(|finish| Step::PeerGoaway { finish }),
         16 => Just(Step::Open),
@@ -95,6 +96,8 @@ struct Gw {
     quic: Option<u64>,
     /// Body bytes offered and not accepted: re-offered first.
     pending: usize,
+    /// `h3_send_headers` succeeded: the gateway sends body only after it.
+    headers: bool,
     fin_sent: bool,
     /// The gateway got `fin` or `Err(Reset)` from a read, or called `h3_reset`.
     done: bool,
@@ -225,8 +228,17 @@ impl Model {
                 }
             }
             Step::PeerRawReset { q } => {
-                if let Some(q) = self.peer_q(q) {
-                    self.r.peer_raw_reset(q.0, H3Code::REQUEST_CANCELLED.0);
+                // Mostly after the peer's FIN, where h3wire may have reached `Finished`
+                // and aborts with no event (the case behind `peer_reset_after_finished_*`).
+                let fin: Vec<u64> = self
+                    .r
+                    .streams()
+                    .into_iter()
+                    .filter(|&(q, s)| q % 4 == 0 && self.r.recv_ended(s))
+                    .map(|(q, _)| q)
+                    .collect();
+                if let Some(q) = pick(&fin, q).or_else(|| self.peer_q(q).map(|q| q.0)) {
+                    self.r.peer_raw_reset(q, H3Code::REQUEST_CANCELLED.0);
                 }
             }
             Step::PeerStopSending { q } => {
@@ -248,7 +260,7 @@ impl Model {
                 }
             }
             Step::SendHeaders { r, set, fin } => {
-                let Some(id) = self.gw(r).map(|g| g.id) else {
+                let Some(id) = self.gw(r).filter(|g| !g.fin_sent).map(|g| g.id) else {
                     return;
                 };
                 let req = [
@@ -265,18 +277,21 @@ impl Model {
                     6 => &[h(":status", "103")],
                     _ => &[h(":status", "200"), h("X-Upper", "invalid")],
                 };
-                let ok = self.r.w.h3_send_headers(now, id, hs, fin).is_ok();
-                if let Some(g) = self.gw(r).filter(|_| ok && fin) {
-                    g.fin_sent = true;
-                }
+                let res = self.r.w.h3_send_headers(now, id, hs, fin);
+                self.not_stale(id, res.err());
+                let ok = res.is_ok();
+                let g = self.gw(r).expect("picked above");
+                g.headers |= ok;
+                g.fin_sent |= ok && fin;
             }
             Step::SendBody { r, add, fin } => {
-                let Some(g) = self.gw(r).filter(|g| !g.fin_sent) else {
+                let Some(g) = self.gw(r).filter(|g| g.headers && !g.fin_sent) else {
                     return;
                 };
                 let (id, offer) = (g.id, g.pending + add);
                 let data: Vec<u8> = (0..offer).map(|i| i as u8).collect();
                 let res = self.r.w.h3_send_body(now, id, &data, fin);
+                self.not_stale(id, res.err());
                 let g = self.gw(r).expect("picked above");
                 match res {
                     Ok(n) => {
@@ -289,11 +304,16 @@ impl Model {
                 }
             }
             Step::Finish { r } => {
-                let Some(g) = self.gw(r).filter(|g| !g.fin_sent && g.pending == 0) else {
+                let Some(g) = self
+                    .gw(r)
+                    .filter(|g| g.headers && !g.fin_sent && g.pending == 0)
+                else {
                     return;
                 };
                 let id = g.id;
-                let ok = self.r.w.h3_finish(now, id).is_ok();
+                let res = self.r.w.h3_finish(now, id);
+                self.not_stale(id, res.err());
+                let ok = res.is_ok();
                 self.gw(r).expect("picked above").fin_sent = ok;
             }
             Step::Reset { r } => {
@@ -306,6 +326,7 @@ impl Model {
             Step::RecvHeaders { r } => {
                 if let Some(id) = self.gw(r).map(|g| g.id) {
                     let res = self.r.w.h3_recv_headers(now, id, &mut |_, _| {});
+                    self.not_stale(id, res.err());
                     let g = self.gw(r).expect("picked above");
                     g.done |= matches!(res, Ok(true) | Err(StreamError::Reset));
                 }
@@ -314,6 +335,7 @@ impl Model {
                 if let Some(id) = self.gw(r).map(|g| g.id) {
                     let mut buf = vec![0u8; cap];
                     let res = self.r.w.h3_recv_body(now, id, &mut buf);
+                    self.not_stale(id, res.err());
                     if let Ok((n, _)) = res {
                         assert!(n <= cap);
                     }
@@ -396,12 +418,23 @@ impl Model {
         }
     }
 
+    /// `Stale` only for a request H3Wire no longer holds (Global Constraints).
+    fn not_stale(&self, id: H3ReqId, e: Option<StreamError>) {
+        if e == Some(StreamError::Stale) {
+            assert!(
+                self.closed.contains_key(&id),
+                "{id:?}: Stale before H3Closed"
+            );
+        }
+    }
+
     fn add(&mut self, id: H3ReqId) {
         let quic = self.r.w.h3_req_info(id).ok().map(|i| i.quic_id);
         self.reqs.push(Gw {
             id,
             quic,
             pending: 0,
+            headers: false,
             fin_sent: false,
             done: false,
         });
@@ -411,11 +444,12 @@ impl Model {
     fn drain(&mut self) {
         let now = self.r.now;
         for _ in 0..64 {
+            // In `reqs` order, so a shrunk case replays the same way.
             let open: Vec<H3ReqId> = self
-                .known
+                .reqs
                 .iter()
+                .map(|g| g.id)
                 .filter(|id| !self.closed.contains_key(id))
-                .copied()
                 .collect();
             if open.is_empty() {
                 return;
@@ -448,7 +482,10 @@ fn run(server: bool, steps: &[Step], streams_first: bool) {
 }
 
 proptest! {
-    #![proptest_config(ProptestConfig::with_cases(200))]
+    // `PROPTEST_CASES` overrides the count for a deep run.
+    #![proptest_config(ProptestConfig::with_cases(
+        std::env::var("PROPTEST_CASES").ok().and_then(|v| v.parse().ok()).unwrap_or(200)
+    ))]
 
     #[test]
     fn random_ops_hold_invariants(
diff --git a/crates/mq-h3/tests/send.rs b/crates/mq-h3/tests/send.rs
index d1ef18df..266f3864 100644
--- a/crates/mq-h3/tests/send.rs
+++ b/crates/mq-h3/tests/send.rs
@@ -559,6 +559,40 @@ fn peer_reset_after_finished_ends_send() {
     assert_eq!(sends(&r, s, false), n, "nothing written after the reset");
 }
 
+/// Client role of `peer_reset_after_finished_ends_send` (adoption spec §4.5 "A peer RESET
+/// after Finished"): the upload is accepted and discarded and the response still ends
+/// clean.
+#[test]
+fn peer_reset_after_finished_client_discards() {
+    let (mut r, id, s, _) = posting();
+    let b = peer_block(&r, Q(0));
+    r.peer.release(b);
+    r.peer
+        .send_headers(Q(0), &[f(":status", "200")], true)
+        .expect("peer response");
+    r.pump();
+    r.events();
+    r.h.expect_stream_recv(s, Err(StreamError::Reset));
+    r.h.push_event(Event::StreamPeerReset(s, 0x10c));
+    r.w.drive(r.now);
+    assert_eq!(aborts(&r, s), [Call::StreamResetSend { s, code: 0x10c }]);
+    assert_eq!(r.events(), [Event::H3Writable(id)]);
+    let n = sends(&r, s, false);
+    assert_eq!(r.w.h3_send_body(r.now, id, &[7u8; 4096], false), Ok(4096));
+    assert_eq!(r.w.h3_finish(r.now, id), Ok(()));
+    assert_eq!(sends(&r, s, false), n, "nothing written");
+    assert_eq!(r.w.h3_recv_headers(r.now, id, &mut |_, _| {}), Ok(true));
+    let mut buf = [0u8; 64];
+    assert_eq!(r.w.h3_recv_body(r.now, id, &mut buf), Ok((0, true)));
+    r.h.push_event(Event::StreamClosed(s));
+    r.w.drive(r.now);
+    let ev = r.events();
+    assert!(
+        matches!(ev[..], [Event::H3Closed(x, _)] if x == id),
+        "one H3Closed: {ev:?}"
+    );
+}
+
 /// The gateway answers a request the peer already reset: `Err(Reset)` as for the body, not
 /// `Stale` for a request still held. Before `Finished` the request is aborted; after it the
 /// send side is stopped (found by the property test).

From 31f73ca9a78c976020408e5f04be5b3c69fabea4 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 12:06:11 +0900
Subject: [PATCH 14/33] test(integration): per-side H3 backend and a raw-H3
 peer

---
 Cargo.lock                             |   2 +
 crates/mq-integration/Cargo.toml       |   5 +
 crates/mq-integration/src/h3_apps.rs   |   1 +
 crates/mq-integration/src/lib.rs       |   2 +
 crates/mq-integration/src/loopback.rs  |  64 ++++++++-
 crates/mq-integration/src/raw_h3.rs    | 192 +++++++++++++++++++++++++
 crates/mq-integration/tests/pair_h3.rs | 126 +++++++++++++++-
 crates/mq-runtime/src/app.rs           |   7 +
 8 files changed, 391 insertions(+), 8 deletions(-)
 create mode 100644 crates/mq-integration/src/raw_h3.rs

diff --git a/Cargo.lock b/Cargo.lock
index 59f9b213..fd8a556c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -553,8 +553,10 @@ name = "mq-integration"
 version = "0.0.4"
 dependencies = [
  "h2",
+ "h3wire",
  "hyper",
  "log",
+ "mq-h3",
  "mq-http",
  "mq-integration",
  "mq-linux",
diff --git a/crates/mq-integration/Cargo.toml b/crates/mq-integration/Cargo.toml
index 1eddc4ed..9263d4ca 100644
--- a/crates/mq-integration/Cargo.toml
+++ b/crates/mq-integration/Cargo.toml
@@ -21,6 +21,8 @@ harness = [
     "dep:rustls",
     "dep:tokio-rustls",
     "dep:socket2",
+    "dep:mq-h3",
+    "dep:h3wire",
     "mq-proxy/test-support",
     "mq-runtime/test-support",
     "mq-transport/test-support",
@@ -34,6 +36,9 @@ mq-transport = { path = "../mq-transport" }
 mq-transport-api = { path = "../mq-transport-api" }
 mq-linux = { path = "../mq-linux" }
 mq-wire = { path = "../mq-wire", optional = true }
+# The h3wire backend (loopback::Backend::Wire) and the raw-H3 peer's byte builders (raw_h3.rs).
+mq-h3 = { path = "../mq-h3", optional = true, features = ["test-support"] }
+h3wire = { path = "../../third_party/h3wire/h3wire", optional = true }
 log = { workspace = true, optional = true }
 mq-http = { path = "../mq-http", optional = true }
 # The real-origin harness (origin_server.rs): a hyper server on a tokio
diff --git a/crates/mq-integration/src/h3_apps.rs b/crates/mq-integration/src/h3_apps.rs
index 37b3de5a..7d1d0049 100644
--- a/crates/mq-integration/src/h3_apps.rs
+++ b/crates/mq-integration/src/h3_apps.rs
@@ -116,6 +116,7 @@ macro_rules! no_io {
         }
     };
 }
+pub(crate) use no_io;
 
 /// How `H3EchoServer` answers a fully read request (every answer has `:status 200`).
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
diff --git a/crates/mq-integration/src/lib.rs b/crates/mq-integration/src/lib.rs
index 19e820fa..62c76bab 100644
--- a/crates/mq-integration/src/lib.rs
+++ b/crates/mq-integration/src/lib.rs
@@ -16,4 +16,6 @@ pub mod origin_loop;
 #[cfg(feature = "harness")]
 pub mod origin_server;
 #[cfg(feature = "harness")]
+pub mod raw_h3;
+#[cfg(feature = "harness")]
 pub mod shard_pair;
diff --git a/crates/mq-integration/src/loopback.rs b/crates/mq-integration/src/loopback.rs
index b68f11b4..4dcd5063 100644
--- a/crates/mq-integration/src/loopback.rs
+++ b/crates/mq-integration/src/loopback.rs
@@ -4,6 +4,7 @@
 //! the local application and the origin with plain `std::net` sockets.
 
 use crate::driver_harness::DriverThread;
+use mq_h3::H3Wire;
 use mq_proxy::client::{Client, FETCH, HTTP_CONNECT, SOCKS5, TRANSPARENT};
 use mq_proxy::config::{ClientConfig, GatewayConfig, MitmConfig, ServerConfig};
 use mq_proxy::server::Server;
@@ -11,7 +12,9 @@ use mq_proxy::server::origin::build_client_config;
 use mq_runtime::driver::{DriverConfig, StdResolver};
 use mq_runtime::{App, ListenKind, ListenerTag, Shard};
 use mq_transport::Transport;
-use mq_transport_api::{CongestionControl, Role, Scheduler, TransportConfig, TransportOps};
+use mq_transport_api::{
+    CongestionControl, H3Backend, Role, Scheduler, TransportConfig, TransportOps,
+};
 use std::net::{IpAddr, Ipv4Addr, SocketAddr};
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
@@ -101,6 +104,33 @@ pub type LoopbackProxy = LoopbackPair<(), ()>;
 /// A real transport as the proxy runs it (test cert, ALPN "mqproxy-tcp/1", BBR/MinRtt); `h3`
 /// registers the H3 ctx.
 pub fn transport(role: Role, h3: bool) -> Transport {
+    transport_on(role, h3, H3Backend::XqcH3)
+}
+
+/// `transport(role, true)` on `h3_backend: Raw`: H3 conns get raw streams and no H3 stack
+/// (adoption spec §3).
+pub fn raw_h3_transport(role: Role) -> Transport {
+    transport_on(role, true, H3Backend::Raw)
+}
+
+/// Which H3 stack serves one endpoint (adoption spec §6.2).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Backend {
+    /// xquic's xqc_h3, behind a passthrough `H3Wire`.
+    XqcH3,
+    /// h3wire, in an active `H3Wire` over `h3_backend: Raw`.
+    Wire,
+}
+
+/// An H3 transport on backend `b` (adoption spec §6.2).
+pub fn h3_transport(role: Role, b: Backend) -> H3Wire<Transport> {
+    match b {
+        Backend::XqcH3 => H3Wire::passthrough(transport(role, true)),
+        Backend::Wire => H3Wire::new(raw_h3_transport(role)),
+    }
+}
+
+fn transport_on(role: Role, h3: bool, h3_backend: H3Backend) -> Transport {
     Transport::new(TransportConfig {
         role,
         alpn: "mqproxy-tcp/1",
@@ -109,7 +139,7 @@ pub fn transport(role: Role, h3: bool) -> Transport {
         cc: CongestionControl::Bbr,
         realtime_offset_us: 0,
         h3,
-        h3_backend: mq_transport_api::H3Backend::XqcH3,
+        h3_backend,
         qlog: None,
     })
     .expect("transport")
@@ -171,14 +201,24 @@ impl LoopbackProxy {
     /// so no raw tunnel); `origin_ca` is the bridge's only trust root. A `None` gateway in
     /// either config is filled with a placeholder / `GatewayConfig::default()`.
     pub fn spawn_gateway(
+        client: ClientConfig,
+        server: ServerConfig,
+        origin_ca: &Path,
+    ) -> LoopbackProxy {
+        Self::spawn_gateway_on(client, server, origin_ca, (Backend::XqcH3, Backend::XqcH3))
+    }
+
+    /// `spawn_gateway` with the (client, server) H3 backends (adoption spec §6.2).
+    pub fn spawn_gateway_on(
         client: ClientConfig,
         mut server: ServerConfig,
         origin_ca: &Path,
+        backends: (Backend, Backend),
     ) -> LoopbackProxy {
         server.gateway.get_or_insert_with(GatewayConfig::default);
         let tls = build_client_config(Some(origin_ca), &Vec::new).expect("origin CA");
         // `Server` holds `Rc`s: it is built on its driver thread.
-        Self::gateway_pair(client, move || Server::with_gateway(server, tls))
+        Self::gateway_pair(client, move || Server::with_gateway(server, tls), backends)
     }
 
     /// The fetch client of `spawn_gateway` against an arbitrary H3 server `App` (a
@@ -187,12 +227,22 @@ impl LoopbackProxy {
         client: ClientConfig,
         server_app: A,
     ) -> LoopbackProxy {
-        Self::gateway_pair(client, move || server_app)
+        Self::spawn_gateway_against_on(client, server_app, (Backend::XqcH3, Backend::XqcH3))
+    }
+
+    /// `spawn_gateway_against` with the (client, server) H3 backends (adoption spec §6.2).
+    pub fn spawn_gateway_against_on<A: App + Send + 'static>(
+        client: ClientConfig,
+        server_app: A,
+        backends: (Backend, Backend),
+    ) -> LoopbackProxy {
+        Self::gateway_pair(client, move || server_app, backends)
     }
 
     fn gateway_pair<A: App + 'static>(
         mut client: ClientConfig,
         server_app: impl FnOnce() -> A + Send + 'static,
+        (client_b, server_b): (Backend, Backend),
     ) -> LoopbackProxy {
         // The bound address is what `fetch_addr` reports; `Client::new` only needs `Some`.
         client
@@ -204,18 +254,18 @@ impl LoopbackProxy {
             (lo, lo),
             vec![(ListenKind::Plain, FETCH)],
             move |local| {
-                let t = transport(
+                let t = h3_transport(
                     Role::Server {
                         cert: cert("test.crt"),
                         key: cert("test.key"),
                     },
-                    true,
+                    server_b,
                 );
                 (Shard::new(t, server_app(), local, 1), ())
             },
             move |local, server_udp| {
                 client.server = server_udp;
-                let t = transport(Role::Client, true);
+                let t = h3_transport(Role::Client, client_b);
                 (Shard::new(t, Client::new(client), local, 2), ())
             },
         )
diff --git a/crates/mq-integration/src/raw_h3.rs b/crates/mq-integration/src/raw_h3.rs
new file mode 100644
index 00000000..f9e61910
--- /dev/null
+++ b/crates/mq-integration/src/raw_h3.rs
@@ -0,0 +1,192 @@
+//! The raw-H3 peer (adoption spec §6.2): HTTP/3 as fixed bytes on raw streams, for the
+//! malformed input a compliant H3 send API cannot produce.
+
+use mq_runtime::{
+    AcceptMeta, App, Cx, DialError, DialOpId, ListenerTag, SocketOpId, TcpEnd, TcpId, TimerId,
+    UdpSocketId,
+};
+use mq_transport_api::{CloseReason, ConnConfig, ConnId, ConnProto, Event, StreamId, StreamKind};
+use std::collections::{HashMap, HashSet};
+use std::io;
+use std::net::SocketAddr;
+use std::sync::{Arc, Mutex, MutexGuard};
+
+/// The peer's control stream: stream type 0x00, then an empty SETTINGS frame (RFC 9114 §6.2.1).
+const CONTROL: [u8; 3] = [0x00, 0x04, 0x00];
+
+/// What the peer saw.
+#[derive(Debug, Default)]
+pub struct RawH3Seen {
+    /// Every `ConnClosed` reason.
+    pub closed: Vec<CloseReason>,
+    /// Every `StreamPeerReset` code.
+    pub resets: Vec<u64>,
+    /// The bytes read on request streams (the one a client opened, every one opened to a
+    /// server), and whether a FIN ended one.
+    pub read: Vec<u8>,
+    pub fin: bool,
+}
+
+/// `Clone + Send` view of a peer's `RawH3Seen`.
+#[derive(Clone, Debug, Default)]
+pub struct RawH3Handle(Arc<Mutex<RawH3Seen>>);
+
+impl RawH3Handle {
+    pub fn lock(&self) -> MutexGuard<'_, RawH3Seen> {
+        self.0.lock().unwrap_or_else(|e| e.into_inner())
+    }
+}
+
+pub struct RawH3Script {
+    /// Client role: the request stream's bytes and FIN. Server role: written as the response
+    /// to every request stream the peer opens.
+    pub stream: Vec<u8>,
+    pub fin: bool,
+}
+
+/// A peer that speaks HTTP/3 by writing fixed bytes on raw streams (spec §6.2): no H3 stack,
+/// so it can send what no compliant stack sends. Runs on `Transport` with `h3_backend: Raw`
+/// (`loopback::raw_h3_transport`).
+pub struct RawH3Peer {
+    /// Client role: the server to connect to.
+    server: Option<SocketAddr>,
+    s: RawH3Script,
+    h: RawH3Handle,
+    /// Request streams.
+    reqs: HashSet<StreamId>,
+    /// Request streams with script bytes (or the FIN) still unsent: how much was sent.
+    out: HashMap<StreamId, usize>,
+}
+
+impl RawH3Peer {
+    pub fn client(server: SocketAddr, s: RawH3Script) -> (RawH3Peer, RawH3Handle) {
+        Self::make(Some(server), s)
+    }
+
+    pub fn server(s: RawH3Script) -> (RawH3Peer, RawH3Handle) {
+        Self::make(None, s)
+    }
+
+    fn make(server: Option<SocketAddr>, s: RawH3Script) -> (RawH3Peer, RawH3Handle) {
+        let h = RawH3Handle::default();
+        let p = RawH3Peer {
+            server,
+            s,
+            h: h.clone(),
+            reqs: HashSet::new(),
+            out: HashMap::new(),
+        };
+        (p, h)
+    }
+
+    fn control(&mut self, cx: &mut Cx<'_>, c: ConnId) {
+        let s = cx.open_uni(c).expect("open_uni");
+        assert_eq!(cx.stream_send(s, &CONTROL, false), Ok(CONTROL.len()));
+    }
+
+    /// Starts writing the script on request stream `s`.
+    fn respond(&mut self, cx: &mut Cx<'_>, s: StreamId) {
+        self.reqs.insert(s);
+        self.out.insert(s, 0);
+        self.push(cx, s);
+    }
+
+    fn push(&mut self, cx: &mut Cx<'_>, s: StreamId) {
+        let Some(sent) = self.out.get_mut(&s) else {
+            return;
+        };
+        let rest = &self.s.stream[*sent..];
+        let done = match cx.stream_send(s, rest, self.s.fin) {
+            Ok(n) => {
+                *sent += n;
+                n == rest.len()
+            }
+            Err(e) => e != mq_transport_api::StreamError::Blocked,
+        };
+        if done {
+            self.out.remove(&s);
+        }
+    }
+
+    /// Reads everything `s` has; request-stream bytes are recorded, the rest discarded.
+    fn read(&mut self, cx: &mut Cx<'_>, s: StreamId) {
+        let mut buf = [0u8; 16 * 1024];
+        let req = self.reqs.contains(&s);
+        while let Ok((n, fin)) = cx.stream_recv(s, &mut buf) {
+            if req {
+                let mut seen = self.h.lock();
+                seen.read.extend_from_slice(&buf[..n]);
+                seen.fin |= fin;
+            }
+            if fin || n == 0 {
+                break;
+            }
+        }
+    }
+}
+
+impl App for RawH3Peer {
+    fn on_start(&mut self, cx: &mut Cx<'_>) {
+        if let Some(peer) = self.server {
+            let cfg = ConnConfig {
+                peer,
+                sni: "mqproxy",
+                idle_timeout: None,
+                proto: ConnProto::H3,
+            };
+            cx.connect(&cfg).expect("connect");
+        }
+    }
+
+    fn on_transport_event(&mut self, cx: &mut Cx<'_>, ev: Event) {
+        match ev {
+            Event::ConnEstablished(c) if self.server.is_some() => {
+                self.control(cx, c);
+                let s = cx.open_stream(c).expect("open_stream");
+                self.respond(cx, s);
+            }
+            Event::NewConn(c, _) => self.control(cx, c),
+            Event::NewStream(_, s, info) => {
+                if info.kind == StreamKind::Bidi {
+                    self.respond(cx, s);
+                }
+                self.read(cx, s);
+            }
+            Event::StreamReadable(s) => self.read(cx, s),
+            Event::StreamWritable(s) => self.push(cx, s),
+            Event::StreamPeerReset(s, code) => {
+                self.h.lock().resets.push(code);
+                self.read(cx, s); // the retirement probe (adoption spec §3)
+            }
+            Event::ConnClosed(_, why) => self.h.lock().closed.push(why),
+            _ => {}
+        }
+    }
+
+    fn on_timer(&mut self, _: &mut Cx<'_>, _: TimerId) {}
+    crate::h3_apps::no_io!();
+}
+
+/// A HEADERS frame of `fields` (static-table QPACK), unvalidated: on h3wire's hidden
+/// `qpack::encoder::encode_field_section` and `frame::encode_header`.
+pub fn headers_frame(fields: &[(&[u8], &[u8])]) -> Vec<u8> {
+    let fs: Vec<h3wire::FieldRef> = fields
+        .iter()
+        .map(|&(n, v)| h3wire::FieldRef::new(n, v))
+        .collect();
+    let mut section = Vec::new();
+    h3wire::qpack::encoder::encode_field_section(&fs, &mut section);
+    let mut out = Vec::new();
+    h3wire::frame::encode_header(0x01, section.len() as u64, &mut out);
+    out.extend_from_slice(&section);
+    out
+}
+
+/// A DATA frame header declaring `declared` bytes, then `payload` (`declared` may exceed it:
+/// a cut frame).
+pub fn data_frame(declared: u64, payload: &[u8]) -> Vec<u8> {
+    let mut out = Vec::new();
+    h3wire::frame::encode_header(0x00, declared, &mut out);
+    out.extend_from_slice(payload);
+    out
+}
diff --git a/crates/mq-integration/tests/pair_h3.rs b/crates/mq-integration/tests/pair_h3.rs
index df6945e9..9c6dcfb7 100644
--- a/crates/mq-integration/tests/pair_h3.rs
+++ b/crates/mq-integration/tests/pair_h3.rs
@@ -3,7 +3,10 @@
 #![forbid(unsafe_code)]
 
 use mq_integration::h3_apps::{EchoMode, H3Client, H3EchoServer, H3Handle, H3Script};
-use mq_integration::loopback::{LoopbackPair, cert, transport};
+use mq_integration::loopback::{
+    Backend, LoopbackPair, cert, h3_transport, raw_h3_transport, transport,
+};
+use mq_integration::raw_h3::{RawH3Handle, RawH3Peer, RawH3Script, headers_frame};
 use mq_runtime::Shard;
 use mq_transport_api::Role;
 use std::net::Ipv4Addr;
@@ -67,6 +70,9 @@ fn wait(h: &H3Handle, cond: impl Fn(&mq_integration::h3_apps::H3Recorded) -> boo
     }
 }
 
+// The rescue tests below read `H3Closed.unread`, which only xqc_h3 fills: they stay on the
+// xqc_h3 backend, outside the differential matrix (adoption spec §6.2).
+
 /// spec §3.7 (2): the client stops reading for longer than 3 PTO after the server's FIN; every
 /// byte still arrives, through `H3Closed.unread`.
 #[test]
@@ -157,3 +163,121 @@ fn h3_40k_section_both_ways() {
     }
     p.join_both();
 }
+
+fn server_role() -> Role {
+    Role::Server {
+        cert: cert("test.crt"),
+        key: cert("test.key"),
+    }
+}
+
+/// adoption spec §6.2: an `H3Client` and an `H3EchoServer`, both on h3wire over real xquic; a
+/// 1 MiB POST is echoed.
+#[test]
+fn wire_pair_smoke() {
+    let body: Vec<u8> = (0..1u32 << 20).map(|k| (k % 251) as u8).collect();
+    let lo = Ipv4Addr::LOCALHOST.into();
+    let script = post(body.clone(), None);
+    let p = LoopbackPair::spawn(
+        (lo, lo),
+        Vec::new(),
+        move |local| {
+            let (app, h) = H3EchoServer::new(EchoMode::Echo);
+            let t = h3_transport(server_role(), Backend::Wire);
+            (Shard::new(t, app, local, 1), h)
+        },
+        move |local, server| {
+            let (app, h) = H3Client::new(server, script);
+            let t = h3_transport(Role::Client, Backend::Wire);
+            (Shard::new(t, app, local, 2), h)
+        },
+    );
+    wait(&p.client.handle, |r| r.fin && !r.closed.is_empty());
+    {
+        let c = p.client.handle.lock();
+        assert_eq!(c.headers[0], (b":status".to_vec(), b"200".to_vec()));
+        assert!(c.body == body, "echo differs: {} bytes", c.body.len());
+        assert_eq!(c.closed[0].0.stats.stream_err, 0, "{:?}", c.closed[0].0);
+    }
+    p.join_both();
+}
+
+/// The `:status` of the first HEADERS frame in `bytes` (a request stream as read raw).
+fn status(bytes: &[u8]) -> Option<Vec<u8>> {
+    use h3wire::qpack::decoder::{Span, decode_field_section};
+    let mut b = bytes;
+    while !b.is_empty() {
+        let (ty, n) = h3wire::varint::decode(b)?;
+        let (len, m) = h3wire::varint::decode(&b[n..])?;
+        let payload = b.get(n + m..n + m + len as usize)?;
+        b = &b[n + m + len as usize..];
+        if ty != 0x01 {
+            continue; // DATA or a reserved frame
+        }
+        let (mut arena, mut fields) = (Vec::new(), Vec::new());
+        decode_field_section(payload, &mut arena, &mut fields).ok()?;
+        let get = |s: Span| match s {
+            Span::Static(v) => v.to_vec(),
+            Span::Arena(a, z) => arena[a as usize..z as usize].to_vec(),
+        };
+        return fields
+            .iter()
+            .find(|f| get(f.name) == b":status")
+            .map(|f| get(f.value));
+    }
+    None
+}
+
+/// adoption spec §6.2: the raw-H3 peer's valid GET (fixed bytes) gets a 200 from an
+/// `H3EchoServer` on each backend.
+#[test]
+fn raw_peer_smoke() {
+    for b in [Backend::XqcH3, Backend::Wire] {
+        let get = headers_frame(&[
+            (b":method", b"GET"),
+            (b":scheme", b"https"),
+            (b":authority", b"x"),
+            (b":path", b"/"),
+        ]);
+        let lo = Ipv4Addr::LOCALHOST.into();
+        let p: LoopbackPair<H3Handle, RawH3Handle> = LoopbackPair::spawn(
+            (lo, lo),
+            Vec::new(),
+            move |local| {
+                let (app, h) = H3EchoServer::new(EchoMode::Echo);
+                (Shard::new(h3_transport(server_role(), b), app, local, 1), h)
+            },
+            move |local, server| {
+                let s = RawH3Script {
+                    stream: get,
+                    fin: true,
+                };
+                let (app, h) = RawH3Peer::client(server, s);
+                (Shard::new(raw_h3_transport(Role::Client), app, local, 2), h)
+            },
+        );
+        let end = Instant::now() + Duration::from_secs(10);
+        while !p.client.handle.lock().fin {
+            assert!(
+                Instant::now() < end,
+                "{b:?}: timed out: {:?}",
+                p.client.handle.lock()
+            );
+            thread::sleep(Duration::from_millis(5));
+        }
+        {
+            let seen = p.client.handle.lock();
+            assert_eq!(
+                status(&seen.read).as_deref(),
+                Some(&b"200"[..]),
+                "{b:?}: {seen:?}"
+            );
+            assert!(
+                seen.resets.is_empty() && seen.closed.is_empty(),
+                "{b:?}: {seen:?}"
+            );
+        }
+        assert_eq!(p.server.handle.lock().requests, 1, "{b:?}");
+        p.join_both();
+    }
+}
diff --git a/crates/mq-runtime/src/app.rs b/crates/mq-runtime/src/app.rs
index 25fe216d..4e7076b5 100644
--- a/crates/mq-runtime/src/app.rs
+++ b/crates/mq-runtime/src/app.rs
@@ -270,6 +270,13 @@ impl<'a> Cx<'a> {
         let now = self.now;
         self.tm().stream_reset(now, s)
     }
+    /// Tests only: a local unidirectional stream, for the raw-H3 peer's control stream
+    /// (adoption spec §3, §6.2).
+    #[cfg(feature = "test-support")]
+    pub fn open_uni(&mut self, conn: ConnId) -> Result<StreamId, Error> {
+        let now = self.now;
+        self.tm().open_uni(now, conn)
+    }
     /// spec §5.4.
     pub fn stream_info(&self, s: StreamId) -> Result<StreamInfo, Error> {
         self.t.stream_info(s)

From 1712cb5e124e349f8e81d7c7311595e432b9f38f Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 12:12:14 +0900
Subject: [PATCH 15/33] fix(mq-h3): re-check liveness on pop as the bare
 transport does
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Passthrough H3 events and conn-level readiness/creation events (both modes) were popped
without a liveness check, so one that went stale between the inner drain and the pop reached
the app, unlike the bare transport. H3 events now probe h3_req_info in passthrough, conn
events probe conn_stats; close events still always pop (adoption spec §4.1).
---
 crates/mq-h3/src/lib.rs           | 25 +++++++++++++-----
 crates/mq-h3/tests/common/mod.rs  |  1 +
 crates/mq-h3/tests/passthrough.rs | 43 +++++++++++++++++++++++++++++++
 3 files changed, 63 insertions(+), 6 deletions(-)

diff --git a/crates/mq-h3/src/lib.rs b/crates/mq-h3/src/lib.rs
index 9fed3269..6b402df4 100644
--- a/crates/mq-h3/src/lib.rs
+++ b/crates/mq-h3/src/lib.rs
@@ -160,7 +160,8 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
     }
 
     /// Pops our own queue; stale readiness/creation events are dropped, close events never
-    /// (adoption spec §4.1).
+    /// (adoption spec §4.1). The inner transport filtered at drain time; an object can go
+    /// stale between that drain and this pop, so the same checks run again here.
     fn poll_event(&mut self) -> Option<Event> {
         let Self {
             inner,
@@ -170,16 +171,28 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
             ..
         } = self;
         queue.pop(|e| match e {
+            // ponytail: `conn_stats` is the only conn probe `TransportOps` has, and on xquic
+            // it collects path stats; add a cheap `conn_live` op if these pops show up.
+            Event::ConnEstablished(c)
+            | Event::NewConn(c, _)
+            | Event::MpReady(c)
+            | Event::DatagramReadable(c)
+            | Event::PathRemoved(c, _) => inner.conn_stats(*c).is_ok(),
             Event::NewStream(_, s, _)
             | Event::StreamReadable(s)
             | Event::StreamWritable(s)
             | Event::StreamPeerReset(s, _)
             | Event::StreamStopSending(s, _) => inner.stream_info(*s).is_ok(),
-            // The inner transport already filtered passthrough H3 events. An H3Readable
-            // after the receive end was handed over has nothing to deliver.
-            Event::H3Readable(r) => !*active || reqs.get(r).is_some_and(|q| !q.handed),
-            Event::H3Request(_, r) | Event::H3Writable(r) => !*active || reqs.contains_key(r),
-            _ => true,
+            Event::H3Request(_, r) | Event::H3Readable(r) | Event::H3Writable(r) if !*active => {
+                inner.h3_req_info(*r).is_ok()
+            }
+            // An H3Readable after the receive end was handed over has nothing to deliver.
+            Event::H3Readable(r) => reqs.get(r).is_some_and(|q| !q.handed),
+            Event::H3Request(_, r) | Event::H3Writable(r) => reqs.contains_key(r),
+            Event::ConnClosed(..)
+            | Event::StreamClosed(_)
+            | Event::StreamCloseStats(..)
+            | Event::H3Closed(..) => true,
         })
     }
 
diff --git a/crates/mq-h3/tests/common/mod.rs b/crates/mq-h3/tests/common/mod.rs
index 112d4450..6dc062b0 100644
--- a/crates/mq-h3/tests/common/mod.rs
+++ b/crates/mq-h3/tests/common/mod.rs
@@ -102,6 +102,7 @@ impl Rig {
     fn new(peer_role: Role, local_uni: [u64; 3]) -> Rig {
         let (t, h) = ScriptedTransport::new();
         let conn = h.new_conn_id();
+        h.set_conn_stats(conn, Default::default()); // live: its conn events pop
         let wire = Arc::new(Mutex::new(Wire::default()));
         for q in local_uni {
             let s = h.new_stream_id();
diff --git a/crates/mq-h3/tests/passthrough.rs b/crates/mq-h3/tests/passthrough.rs
index 6048a4fe..82c2745d 100644
--- a/crates/mq-h3/tests/passthrough.rs
+++ b/crates/mq-h3/tests/passthrough.rs
@@ -97,6 +97,7 @@ fn raw_events(active: bool) {
         kind: StreamKind::Bidi,
     };
     h.set_stream_info(s, info);
+    h.set_conn_stats(c, Default::default()); // the conn is live
     let reason = CloseReason {
         err_type: ErrType::Unknown,
         code: 0,
@@ -215,3 +216,45 @@ fn active_unknown_id_is_stale_and_not_forwarded() {
         "forwarded: {log:?}"
     );
 }
+
+/// Pops are filtered as the bare transport filters them (adoption spec §4.1): in passthrough,
+/// an H3 event whose request the inner transport no longer knows is dropped; in both modes a
+/// readiness or creation event of a gone conn is dropped. Close events always pop.
+#[test]
+fn stale_on_pop_dropped_like_bare_transport() {
+    for active in [false, true] {
+        let (mut w, h) = mk(active);
+        let (live, gone) = (h.new_conn_id(), h.new_conn_id());
+        h.set_conn_stats(live, Default::default());
+        let r = h.new_h3_request(live);
+        h.inject_h3_headers(r, vec![(b":method".to_vec(), b"GET".to_vec())], true);
+        h.push_event(Event::MpReady(gone));
+        h.push_event(Event::DatagramReadable(gone));
+        h.push_event(Event::MpReady(live));
+        w.drive(NOW); // drained while everything was still live in the inner queue
+        let close = H3Close {
+            stats: H3ReqStats {
+                send_body: 0,
+                recv_body: 0,
+                begin_us: 0,
+                header_send_us: 0,
+                fin_send_us: 0,
+                fin_ack_us: 0,
+                mp_state: 0,
+                stream_err: 0,
+                close_msg: None,
+            },
+            unread: None,
+        };
+        h.close_h3(r, close.clone()); // the request goes stale between drain and pop
+        let got: Vec<_> = std::iter::from_fn(|| w.poll_event()).collect();
+        assert_eq!(got, vec![Event::MpReady(live)], "active={active}");
+        w.drive(NOW);
+        let got: Vec<_> = std::iter::from_fn(|| w.poll_event()).collect();
+        assert_eq!(
+            got,
+            vec![Event::H3Closed(r, Box::new(close))],
+            "active={active}"
+        );
+    }
+}

From f3f5c854a504a3903444d834a9274814eaa50a35 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 12:14:15 +0900
Subject: [PATCH 16/33] test(integration): host the raw-H3 peer as a gateway
 server, retried control write

---
 crates/mq-integration/src/loopback.rs       |  3 +++
 crates/mq-integration/src/raw_h3.rs         | 25 +++++++++++--------
 crates/mq-integration/tests/pair_gateway.rs | 27 ++++++++++++++++++++-
 3 files changed, 44 insertions(+), 11 deletions(-)

diff --git a/crates/mq-integration/src/loopback.rs b/crates/mq-integration/src/loopback.rs
index 4dcd5063..39472cb2 100644
--- a/crates/mq-integration/src/loopback.rs
+++ b/crates/mq-integration/src/loopback.rs
@@ -120,6 +120,8 @@ pub enum Backend {
     XqcH3,
     /// h3wire, in an active `H3Wire` over `h3_backend: Raw`.
     Wire,
+    /// No H3 stack: a passthrough `H3Wire` over `h3_backend: Raw`, for a `RawH3Peer` side.
+    Raw,
 }
 
 /// An H3 transport on backend `b` (adoption spec §6.2).
@@ -127,6 +129,7 @@ pub fn h3_transport(role: Role, b: Backend) -> H3Wire<Transport> {
     match b {
         Backend::XqcH3 => H3Wire::passthrough(transport(role, true)),
         Backend::Wire => H3Wire::new(raw_h3_transport(role)),
+        Backend::Raw => H3Wire::passthrough(raw_h3_transport(role)),
     }
 }
 
diff --git a/crates/mq-integration/src/raw_h3.rs b/crates/mq-integration/src/raw_h3.rs
index f9e61910..56933702 100644
--- a/crates/mq-integration/src/raw_h3.rs
+++ b/crates/mq-integration/src/raw_h3.rs
@@ -19,8 +19,8 @@ const CONTROL: [u8; 3] = [0x00, 0x04, 0x00];
 pub struct RawH3Seen {
     /// Every `ConnClosed` reason.
     pub closed: Vec<CloseReason>,
-    /// Every `StreamPeerReset` code.
-    pub resets: Vec<u64>,
+    /// Every `StreamPeerReset`: the stream and its code.
+    pub resets: Vec<(StreamId, u64)>,
     /// The bytes read on request streams (the one a client opened, every one opened to a
     /// server), and whether a FIN ended one.
     pub read: Vec<u8>,
@@ -54,8 +54,8 @@ pub struct RawH3Peer {
     h: RawH3Handle,
     /// Request streams.
     reqs: HashSet<StreamId>,
-    /// Request streams with script bytes (or the FIN) still unsent: how much was sent.
-    out: HashMap<StreamId, usize>,
+    /// Streams with bytes (or the FIN) still unsent: the bytes, how many were sent, the FIN.
+    out: HashMap<StreamId, (Vec<u8>, usize, bool)>,
 }
 
 impl RawH3Peer {
@@ -81,22 +81,27 @@ impl RawH3Peer {
 
     fn control(&mut self, cx: &mut Cx<'_>, c: ConnId) {
         let s = cx.open_uni(c).expect("open_uni");
-        assert_eq!(cx.stream_send(s, &CONTROL, false), Ok(CONTROL.len()));
+        self.write(cx, s, CONTROL.to_vec(), false);
     }
 
     /// Starts writing the script on request stream `s`.
     fn respond(&mut self, cx: &mut Cx<'_>, s: StreamId) {
         self.reqs.insert(s);
-        self.out.insert(s, 0);
+        self.write(cx, s, self.s.stream.clone(), self.s.fin);
+    }
+
+    /// Writes `bytes` (+ `fin`) on `s`; what is not accepted follows on `StreamWritable`.
+    fn write(&mut self, cx: &mut Cx<'_>, s: StreamId, bytes: Vec<u8>, fin: bool) {
+        self.out.insert(s, (bytes, 0, fin));
         self.push(cx, s);
     }
 
     fn push(&mut self, cx: &mut Cx<'_>, s: StreamId) {
-        let Some(sent) = self.out.get_mut(&s) else {
+        let Some((bytes, sent, fin)) = self.out.get_mut(&s) else {
             return;
         };
-        let rest = &self.s.stream[*sent..];
-        let done = match cx.stream_send(s, rest, self.s.fin) {
+        let rest = &bytes[*sent..];
+        let done = match cx.stream_send(s, rest, *fin) {
             Ok(n) => {
                 *sent += n;
                 n == rest.len()
@@ -155,7 +160,7 @@ impl App for RawH3Peer {
             Event::StreamReadable(s) => self.read(cx, s),
             Event::StreamWritable(s) => self.push(cx, s),
             Event::StreamPeerReset(s, code) => {
-                self.h.lock().resets.push(code);
+                self.h.lock().resets.push((s, code));
                 self.read(cx, s); // the retirement probe (adoption spec §3)
             }
             Event::ConnClosed(_, why) => self.h.lock().closed.push(why),
diff --git a/crates/mq-integration/tests/pair_gateway.rs b/crates/mq-integration/tests/pair_gateway.rs
index b7fb964c..4e382251 100644
--- a/crates/mq-integration/tests/pair_gateway.rs
+++ b/crates/mq-integration/tests/pair_gateway.rs
@@ -9,8 +9,9 @@ use mq_integration::h3_apps::{
     CUT_BODY, EchoMode, H3Client, H3EchoServer, H3Handle, H3Recorded, H3Script,
 };
 use mq_integration::log_tap;
-use mq_integration::loopback::{LoopbackProxy, transport};
+use mq_integration::loopback::{Backend, LoopbackProxy, transport};
 use mq_integration::origin_server::{Handler, ORIGIN_CA, OriginServer, OriginServerMode, Proto};
+use mq_integration::raw_h3::{RawH3Peer, RawH3Script, data_frame, headers_frame};
 use mq_proxy::config::{ClientConfig, GatewayConfig, ServerConfig};
 use mq_proxy::server::origin::host::upload_byte;
 use mq_runtime::Shard;
@@ -469,6 +470,30 @@ fn fetch_response_cut_inside_frame_aborts() {
     assert_eq!(p.join_both(), (0, 0));
 }
 
+/// adoption spec §6.2: a `RawH3Peer::server` hosts the server side of the gateway pair
+/// (`Backend::Raw`); its fixed 200 reaches the fetch socket through each client backend.
+#[test]
+fn raw_server_smoke() {
+    for b in [Backend::XqcH3, Backend::Wire] {
+        let mut stream = headers_frame(&[(b":status", b"200"), (b"content-length", b"2")]);
+        stream.extend(data_frame(2, b"ok"));
+        let (app, h) = RawH3Peer::server(RawH3Script { stream, fin: true });
+        let p = LoopbackProxy::spawn_gateway_against_on(
+            ClientConfig::default(),
+            app,
+            (b, Backend::Raw),
+        );
+        let r = fetch_when_up(p.fetch_addr(), &auth("http://x/raw", "any"));
+        let r = parse(&r.unwrap_or_else(|e| panic!("{b:?}: {e}")));
+        assert_eq!((r.status, r.body.as_slice()), (200, &b"ok"[..]), "{b:?}");
+        assert!(
+            !h.lock().read.is_empty(),
+            "{b:?}: the peer read the request"
+        );
+        assert_eq!(p.join_both(), (0, 0), "{b:?}");
+    }
+}
+
 /// spec §5.4, §6.4, §10.3: a HEAD response and a 304, each carrying `content-length`,
 /// finish cleanly (the HEAD reply's length is rewritten to 0, §12).
 #[test]

From 7187aa8390cef0783537580c485a7ad3f95202df Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 12:26:08 +0900
Subject: [PATCH 17/33] =?UTF-8?q?test(integration):=20xqc=5Fh3=20=C3=97=20?=
 =?UTF-8?q?h3wire=20differential=20matrix?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`matrix!` runs a scenario once per (client, server) backend cell
(xx/xw/wx/ww). Every compliant pair_gateway scenario and pair_h3's
h3_40k_section_both_ways now run in all four cells (adoption spec §6.2).
Request paths carry the cell tag so no cell can satisfy another's log
marker; the 403 drain line (path "-") is keyed by a per-cell body length.

Per-cell expectations from spec §5.3 (6): on a Wire server,
content-length 10 with FIN on HEADERS is reset before the gateway sees
the request, so the cell asserts a nonzero stream_err and an untouched
origin. The direct-H3 CONNECT is now the valid authority form, which
reaches the gateway's 400 in every cell.
---
 crates/mq-integration/src/loopback.rs       |  33 +
 crates/mq-integration/tests/pair_gateway.rs | 692 +++++++++++---------
 crates/mq-integration/tests/pair_h3.rs      |  76 ++-
 3 files changed, 457 insertions(+), 344 deletions(-)

diff --git a/crates/mq-integration/src/loopback.rs b/crates/mq-integration/src/loopback.rs
index 39472cb2..ca2c3cc6 100644
--- a/crates/mq-integration/src/loopback.rs
+++ b/crates/mq-integration/src/loopback.rs
@@ -124,6 +124,39 @@ pub enum Backend {
     Raw,
 }
 
+/// The differential matrix (adoption spec §6.2): `matrix!(name, |cells: (Backend, Backend),
+/// tag: &str| body)` runs `body` once per (client, server) backend cell, as the tests
+/// `name::{xx, xw, wx, ww}`; `tag` is the cell's name.
+#[macro_export]
+macro_rules! matrix {
+    ($name:ident, |$cells:ident: (Backend, Backend), $tag:ident: &str| $body:block $(,)?) => {
+        mod $name {
+            use super::*;
+            use $crate::loopback::Backend::{Wire, XqcH3};
+
+            fn body($cells: ($crate::loopback::Backend, $crate::loopback::Backend), $tag: &str)
+                $body
+
+            #[test]
+            fn xx() {
+                body((XqcH3, XqcH3), "xx")
+            }
+            #[test]
+            fn xw() {
+                body((XqcH3, Wire), "xw")
+            }
+            #[test]
+            fn wx() {
+                body((Wire, XqcH3), "wx")
+            }
+            #[test]
+            fn ww() {
+                body((Wire, Wire), "ww")
+            }
+        }
+    };
+}
+
 /// An H3 transport on backend `b` (adoption spec §6.2).
 pub fn h3_transport(role: Role, b: Backend) -> H3Wire<Transport> {
     match b {
diff --git a/crates/mq-integration/tests/pair_gateway.rs b/crates/mq-integration/tests/pair_gateway.rs
index 4e382251..f781754b 100644
--- a/crates/mq-integration/tests/pair_gateway.rs
+++ b/crates/mq-integration/tests/pair_gateway.rs
@@ -9,7 +9,8 @@ use mq_integration::h3_apps::{
     CUT_BODY, EchoMode, H3Client, H3EchoServer, H3Handle, H3Recorded, H3Script,
 };
 use mq_integration::log_tap;
-use mq_integration::loopback::{Backend, LoopbackProxy, transport};
+use mq_integration::loopback::{Backend, LoopbackProxy, h3_transport};
+use mq_integration::matrix;
 use mq_integration::origin_server::{Handler, ORIGIN_CA, OriginServer, OriginServerMode, Proto};
 use mq_integration::raw_h3::{RawH3Peer, RawH3Script, data_frame, headers_frame};
 use mq_proxy::config::{ClientConfig, GatewayConfig, ServerConfig};
@@ -40,13 +41,18 @@ fn server_cfg() -> ServerConfig {
     }
 }
 
-fn gateway_with(server: ServerConfig) -> LoopbackProxy {
+/// Both endpoints on xqc_h3: the tests outside the matrix.
+const XX: (Backend, Backend) = (Backend::XqcH3, Backend::XqcH3);
+
+/// The gateway pair on the (client, server) backends `cells` (adoption spec §6.2).
+fn gateway_with(server: ServerConfig, cells: (Backend, Backend)) -> LoopbackProxy {
     log_tap::install();
-    LoopbackProxy::spawn_gateway(ClientConfig::default(), server, Path::new(ORIGIN_CA))
+    let client = ClientConfig::default();
+    LoopbackProxy::spawn_gateway_on(client, server, Path::new(ORIGIN_CA), cells)
 }
 
-fn gateway() -> LoopbackProxy {
-    gateway_with(server_cfg())
+fn gateway(cells: (Backend, Backend)) -> LoopbackProxy {
+    gateway_with(server_cfg(), cells)
 }
 
 /// Polls `cond` every 5 ms until it holds (at most `T`).
@@ -172,8 +178,9 @@ fn fetch_when_up(addr: SocketAddr, headers: &[(String, String)]) -> io::Result<V
 }
 
 /// Waits for the tunnel with a wrong-token probe (the server answers 403, nothing else).
-fn wait_up(p: &LoopbackProxy) {
-    let r = fetch_when_up(p.fetch_addr(), &auth("http://127.0.0.1:1/probe", "nope"));
+fn wait_up(p: &LoopbackProxy, tag: &str) {
+    let target = format!("http://127.0.0.1:1/probe-{tag}");
+    let r = fetch_when_up(p.fetch_addr(), &auth(&target, "nope"));
     assert_eq!(parse(&r.expect("probe")).status, 403);
 }
 
@@ -201,8 +208,8 @@ fn pattern(len: usize) -> Vec<u8> {
 
 // ---- direct H3 ----
 
-/// An `H3Client` on its own driver against the gateway server.
-fn h3_client(server: SocketAddr, s: H3Script) -> DriverThread<H3Handle> {
+/// An `H3Client` on its own driver, on backend `b`, against the gateway server.
+fn h3_client(server: SocketAddr, s: H3Script, b: Backend) -> DriverThread<H3Handle> {
     let cfg = DriverConfig {
         resolver: Arc::new(StdResolver),
         install_signal_handlers: false,
@@ -211,7 +218,7 @@ fn h3_client(server: SocketAddr, s: H3Script) -> DriverThread<H3Handle> {
     let lo = Ipv4Addr::LOCALHOST.into();
     let mut d = DriverThread::spawn_on(lo, cfg, Vec::new(), move |local| {
         let (app, h) = H3Client::new(server, s);
-        (Shard::new(transport(Role::Client, true), app, local, 3), h)
+        (Shard::new(h3_transport(Role::Client, b), app, local, 3), h)
     });
     d.start();
     d
@@ -406,42 +413,46 @@ fn capture_one(mut tcp: TcpStream) -> Seen {
 
 // ---- fetch API end to end ----
 
-/// spec §5.4, §6.4, §10.3: an 8 MiB download with `content-length` over an h2 TLS origin.
-#[test]
-fn fetch_download_8mib_cl() {
-    let len = 8 * MIB;
-    let o = OriginServer::spawn(OriginServerMode::new(
-        Proto::H2Tls,
-        Handler::FileBytes(len as u64),
-    ));
-    let p = gateway();
-    wait_up(&p);
-    let url = format!("https://127.0.0.1:{}/dl", o.addr.port());
-    let r = parse(&fetch(&p, &url, &[], b"").expect("download"));
-    assert_eq!(r.status, 200);
-    assert_eq!(r.header("content-length"), Some("8388608"));
-    assert!(
-        r.body == pattern(len),
-        "body differs ({} bytes)",
-        r.body.len()
-    );
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// spec §5.3, §6.3, §10.3: an 8 MiB `PUT` upload, streamed back by an h1 echo origin.
-#[test]
-fn fetch_upload_8mib_put() {
-    let o = OriginServer::spawn(OriginServerMode::new(Proto::H1Plain, Handler::Echo));
-    let p = gateway();
-    wait_up(&p);
-    let body = pattern(8 * MIB);
-    let url = format!("http://{}/up", o.addr);
-    let r = parse(&fetch(&p, &url, &[("X-Mq-Method", "PUT")], &body).expect("upload"));
-    assert_eq!(r.status, 200);
-    assert_eq!(r.header("content-length"), Some("8388608"));
-    assert!(r.body == body, "echo differs ({} bytes)", r.body.len());
-    assert_eq!(p.join_both(), (0, 0));
-}
+// spec §5.4, §6.4, §10.3: an 8 MiB download with `content-length` over an h2 TLS origin.
+matrix!(
+    fetch_download_8mib_cl,
+    |cells: (Backend, Backend), tag: &str| {
+        let len = 8 * MIB;
+        let o = OriginServer::spawn(OriginServerMode::new(
+            Proto::H2Tls,
+            Handler::FileBytes(len as u64),
+        ));
+        let p = gateway(cells);
+        wait_up(&p, tag);
+        let url = format!("https://127.0.0.1:{}/dl-{tag}", o.addr.port());
+        let r = parse(&fetch(&p, &url, &[], b"").expect("download"));
+        assert_eq!(r.status, 200);
+        assert_eq!(r.header("content-length"), Some("8388608"));
+        assert!(
+            r.body == pattern(len),
+            "body differs ({} bytes)",
+            r.body.len()
+        );
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// spec §5.3, §6.3, §10.3: an 8 MiB `PUT` upload, streamed back by an h1 echo origin.
+matrix!(
+    fetch_upload_8mib_put,
+    |cells: (Backend, Backend), tag: &str| {
+        let o = OriginServer::spawn(OriginServerMode::new(Proto::H1Plain, Handler::Echo));
+        let p = gateway(cells);
+        wait_up(&p, tag);
+        let body = pattern(8 * MIB);
+        let url = format!("http://{}/up-{tag}", o.addr);
+        let r = parse(&fetch(&p, &url, &[("X-Mq-Method", "PUT")], &body).expect("upload"));
+        assert_eq!(r.status, 200);
+        assert_eq!(r.header("content-length"), Some("8388608"));
+        assert!(r.body == body, "echo differs ({} bytes)", r.body.len());
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
 
 /// spec §5.4, §5.5, §10.3: `content-length: 100` over a complete 50-byte DATA frame + FIN
 /// from a peer: the client's own body check aborts the local socket.
@@ -494,275 +505,314 @@ fn raw_server_smoke() {
     }
 }
 
-/// spec §5.4, §6.4, §10.3: a HEAD response and a 304, each carrying `content-length`,
-/// finish cleanly (the HEAD reply's length is rewritten to 0, §12).
-#[test]
-fn head_and_304_with_cl_finish_cleanly() {
-    let raw = |reply: &[u8]| {
+// spec §5.4, §6.4, §10.3: a HEAD response and a 304, each carrying `content-length`,
+// finish cleanly (the HEAD reply's length is rewritten to 0, §12).
+matrix!(
+    head_and_304_with_cl_finish_cleanly,
+    |cells: (Backend, Backend), tag: &str| {
+        let raw = |reply: &[u8]| {
+            let proto = Proto::RawH1 {
+                tls: false,
+                reply: reply.to_vec(),
+            };
+            OriginServer::spawn(OriginServerMode::new(proto, Handler::Echo))
+        };
+        let head = raw(b"HTTP/1.1 200 OK\r\ncontent-length: 100\r\n\r\n");
+        let nm = raw(b"HTTP/1.1 304 Not Modified\r\ncontent-length: 100\r\n\r\n");
+        let p = gateway(cells);
+        wait_up(&p, tag);
+        let r = fetch(
+            &p,
+            &format!("http://{}/h-{tag}", head.addr),
+            &[("X-Mq-Method", "HEAD")],
+            b"",
+        );
+        let r = parse(&r.expect("HEAD finishes cleanly"));
+        assert_eq!((r.status, r.header("content-length")), (200, Some("0")));
+        assert!(r.body.is_empty());
+        let r = parse(
+            &fetch(&p, &format!("http://{}/n-{tag}", nm.addr), &[], b"")
+                .expect("304 finishes cleanly"),
+        );
+        assert_eq!((r.status, r.header("content-length")), (304, Some("100")));
+        assert!(r.body.is_empty());
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// SP4 spec §5: an origin answering with about 30 KiB of headers (five 6 KiB values, under
+// `SECTION_MAX`) is relayed to the local caller; the fetch request itself stays small.
+matrix!(
+    fetch_30k_response_head_relayed,
+    |cells: (Backend, Backend), tag: &str| {
+        let value = "v".repeat(6 * 1024);
+        let mut reply = String::from("HTTP/1.1 200 OK\r\ncontent-length: 2\r\n");
+        for i in 0..5 {
+            reply += &format!("x-big-{i}: {value}\r\n");
+        }
+        reply += "\r\nok";
         let proto = Proto::RawH1 {
             tls: false,
-            reply: reply.to_vec(),
+            reply: reply.into_bytes(),
         };
-        OriginServer::spawn(OriginServerMode::new(proto, Handler::Echo))
-    };
-    let head = raw(b"HTTP/1.1 200 OK\r\ncontent-length: 100\r\n\r\n");
-    let nm = raw(b"HTTP/1.1 304 Not Modified\r\ncontent-length: 100\r\n\r\n");
-    let p = gateway();
-    wait_up(&p);
-    let r = fetch(
-        &p,
-        &format!("http://{}/h", head.addr),
-        &[("X-Mq-Method", "HEAD")],
-        b"",
-    );
-    let r = parse(&r.expect("HEAD finishes cleanly"));
-    assert_eq!((r.status, r.header("content-length")), (200, Some("0")));
-    assert!(r.body.is_empty());
-    let r = parse(
-        &fetch(&p, &format!("http://{}/n", nm.addr), &[], b"").expect("304 finishes cleanly"),
-    );
-    assert_eq!((r.status, r.header("content-length")), (304, Some("100")));
-    assert!(r.body.is_empty());
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// SP4 spec §5: an origin answering with about 30 KiB of headers (five 6 KiB values, under
-/// `SECTION_MAX`) is relayed to the local caller; the fetch request itself stays small.
-#[test]
-fn fetch_30k_response_head_relayed() {
-    let value = "v".repeat(6 * 1024);
-    let mut reply = String::from("HTTP/1.1 200 OK\r\ncontent-length: 2\r\n");
-    for i in 0..5 {
-        reply += &format!("x-big-{i}: {value}\r\n");
-    }
-    reply += "\r\nok";
-    let proto = Proto::RawH1 {
-        tls: false,
-        reply: reply.into_bytes(),
-    };
-    let origin = OriginServer::spawn(OriginServerMode::new(proto, Handler::Echo));
-    let p = gateway();
-    wait_up(&p);
-    let raw = fetch(&p, &format!("http://{}/big", origin.addr), &[], b"");
-    let r = parse(&raw.expect("fetch"));
-    assert_eq!((r.status, r.body.as_slice()), (200, &b"ok"[..]));
-    for i in 0..5 {
-        assert_eq!(r.header(&format!("x-big-{i}")), Some(value.as_str()), "{i}");
+        let origin = OriginServer::spawn(OriginServerMode::new(proto, Handler::Echo));
+        let p = gateway(cells);
+        wait_up(&p, tag);
+        let raw = fetch(&p, &format!("http://{}/big-{tag}", origin.addr), &[], b"");
+        let r = parse(&raw.expect("fetch"));
+        assert_eq!((r.status, r.body.as_slice()), (200, &b"ok"[..]));
+        for i in 0..5 {
+            assert_eq!(r.header(&format!("x-big-{i}")), Some(value.as_str()), "{i}");
+        }
+        assert_eq!(p.join_both(), (0, 0));
     }
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// spec §7.4, §10.3: `/a/../b` reaches the origin as `/b` (the query untouched).
-#[test]
-fn dot_segments_normalised_at_origin() {
-    let o = Capture::spawn();
-    let p = gateway();
-    wait_up(&p);
-    let r = parse(&fetch(&p, &o.url("/a/../b?q=/../x"), &[], b"").expect("fetch"));
-    assert_eq!((r.status, r.body.as_slice()), (200, &b"ok"[..]));
-    let head = o.one().head;
-    assert!(head.starts_with("get /b?q=/../x http/1.1\r\n"), "{head}");
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// SP4 spec §5: an empty forwarded `x-test:` is sent, and an empty `accept:`
-/// is sent and suppresses the default `accept: */*`.
-#[test]
-fn empty_header_sent_empty_accept_suppresses_default() {
-    let o = Capture::spawn();
-    let p = gateway();
-    wait_up(&p);
-    let extra = [("X-Test", ""), ("Accept", ""), ("X-Kept", "yes")];
-    let r = parse(&fetch(&p, &o.url("/empty"), &extra, b"").expect("fetch"));
-    assert_eq!(r.status, 200);
-    let head = o.one().head;
-    assert!(head.contains("\r\nx-kept: yes\r\n"), "{head}");
-    assert!(head.contains("\r\nx-test:"), "{head}");
-    assert!(head.contains("\r\naccept:"), "{head}");
-    assert!(!head.contains("*/*"), "{head}");
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// spec §7.2, §7.7, §10.3 (e2e case 13): an h1-forced request reuses the idle h1 conn a
-/// default request left in the pool — against an origin that serves one conn at a time, a
-/// second dial would hang until `curl:28`.
-#[test]
-fn h1_forced_reuses_idle_default_conn() {
-    let mode = OriginServerMode {
-        single_conn: true,
-        ..OriginServerMode::new(Proto::H1Tls, Handler::FileBytes(2))
-    };
-    let o = OriginServer::spawn(mode);
-    let mut cfg = server_cfg();
-    if let Some(g) = cfg.gateway.as_mut() {
-        g.origin_connect_timeout = Duration::from_secs(2);
-    }
-    let p = gateway_with(cfg);
-    wait_up(&p);
-    let url = format!("https://127.0.0.1:{}/c13", o.addr.port());
-    let r = parse(&fetch(&p, &url, &[], b"").expect("default request"));
-    assert_eq!((r.status, r.body.len()), (200, 2));
-    let r = fetch(&p, &url, &[("X-Mq-Origin-Protocol", "h1")], b"");
-    let r = parse(&r.expect("h1-forced request"));
-    assert_eq!((r.status, r.body.len()), (200, 2));
-    assert_eq!(o.accepted(), 1);
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// spec §6.4, §10.3: an h2 origin declares `content-length: 100`, sends 50 bytes and then
-/// RST_STREAM(NO_ERROR): the server's body check resets the H3 response (pinned by its
-/// `mq.req`). The Rust client's local reply is an abort, or 502 `upstream-reset` when its
-/// xquic processes HEADERS and RESET_STREAM in one pass (the reset discards the unread
-/// head; `ClTooShort` leaves only 10 ms between them, too little on a slow CI).
-#[test]
-fn h2_cl_100_then_rst_resets_h3_end_to_end() {
-    let h = Handler::ClTooShort { cl: 100, send: 50 };
-    let o = OriginServer::spawn(OriginServerMode::new(Proto::H2Tls, h));
-    let p = gateway();
-    wait_up(&p);
-    let url = format!("https://127.0.0.1:{}/h2-short", o.addr.port());
-    let r = fetch(&p, &url, &[], b"");
-    let upstream_reset = b"HTTP/1.1 502 \r\nX-Mq-Error: upstream-reset\r\nContent-Length: 0\r\nConnection: close\r\n\r\n";
-    assert!(
-        is_reset(&r) || matches!(&r, Ok(b) if b == upstream_reset),
-        "{:?}",
-        r.as_ref().map(|b| String::from_utf8_lossy(b).into_owned())
-    );
-    // The reset is the server's (its check), not only the client's own body check.
-    let line = wait_log(&["mq.req", "path=\"/h2-short\""]);
-    assert!(line.contains("reset=\"local reset\""), "{line}");
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// spec §5.2, §6.2, §10.3: CONNECT is refused by the fetch listener (400 `bad-method`) and
-/// by the server intake (400 `bad-request`).
-#[test]
-fn connect_rejected_both_intakes() {
-    let p = gateway();
-    let r = fetch(
-        &p,
-        "http://127.0.0.1:1/",
-        &[("X-Mq-Method", "CONNECT")],
-        b"",
-    );
-    let want = b"HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\nX-Mq-Error: bad-method\r\n\r\n";
-    assert_eq!(
-        String::from_utf8_lossy(&r.expect("reply")),
-        String::from_utf8_lossy(want)
-    );
-    let auth = bearer();
-    let s = script(
-        "CONNECT",
-        "127.0.0.1:1",
-        "/",
-        &[("x-mq-auth", &auth)],
-        Vec::new(),
-    );
-    let c = h3_client(p.server.udp_addr, s);
-    wait_h3(&c.handle, |r| r.fin);
-    {
-        let r = c.handle.lock();
-        assert_eq!(h3_header(&r, ":status").as_deref(), Some("400"));
-        assert_eq!(h3_header(&r, "x-mq-error").as_deref(), Some("bad-request"));
+);
+
+// spec §7.4, §10.3: `/a/../b` reaches the origin as `/b` (the query untouched).
+matrix!(
+    dot_segments_normalised_at_origin,
+    |cells: (Backend, Backend), tag: &str| {
+        let o = Capture::spawn();
+        let p = gateway(cells);
+        wait_up(&p, tag);
+        let url = o.url(&format!("/a/../b-{tag}?q=/../x"));
+        let r = parse(&fetch(&p, &url, &[], b"").expect("fetch"));
+        assert_eq!((r.status, r.body.as_slice()), (200, &b"ok"[..]));
+        let head = o.one().head;
+        let want = format!("get /b-{tag}?q=/../x http/1.1\r\n");
+        assert!(head.starts_with(&want), "{head}");
+        assert_eq!(p.join_both(), (0, 0));
     }
-    stop(c);
-    assert_eq!(p.join_both(), (0, 0));
-}
+);
+
+// SP4 spec §5: an empty forwarded `x-test:` is sent, and an empty `accept:`
+// is sent and suppresses the default `accept: */*`.
+matrix!(
+    empty_header_sent_empty_accept_suppresses_default,
+    |cells: (Backend, Backend), tag: &str| {
+        let o = Capture::spawn();
+        let p = gateway(cells);
+        wait_up(&p, tag);
+        let extra = [("X-Test", ""), ("Accept", ""), ("X-Kept", "yes")];
+        let r = parse(&fetch(&p, &o.url(&format!("/empty-{tag}")), &extra, b"").expect("fetch"));
+        assert_eq!(r.status, 200);
+        let head = o.one().head;
+        assert!(head.contains("\r\nx-kept: yes\r\n"), "{head}");
+        assert!(head.contains("\r\nx-test:"), "{head}");
+        assert!(head.contains("\r\naccept:"), "{head}");
+        assert!(!head.contains("*/*"), "{head}");
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// spec §7.2, §7.7, §10.3 (e2e case 13): an h1-forced request reuses the idle h1 conn a
+// default request left in the pool — against an origin that serves one conn at a time, a
+// second dial would hang until `curl:28`.
+matrix!(
+    h1_forced_reuses_idle_default_conn,
+    |cells: (Backend, Backend), tag: &str| {
+        let mode = OriginServerMode {
+            single_conn: true,
+            ..OriginServerMode::new(Proto::H1Tls, Handler::FileBytes(2))
+        };
+        let o = OriginServer::spawn(mode);
+        let mut cfg = server_cfg();
+        if let Some(g) = cfg.gateway.as_mut() {
+            g.origin_connect_timeout = Duration::from_secs(2);
+        }
+        let p = gateway_with(cfg, cells);
+        wait_up(&p, tag);
+        let url = format!("https://127.0.0.1:{}/c13-{tag}", o.addr.port());
+        let r = parse(&fetch(&p, &url, &[], b"").expect("default request"));
+        assert_eq!((r.status, r.body.len()), (200, 2));
+        let r = fetch(&p, &url, &[("X-Mq-Origin-Protocol", "h1")], b"");
+        let r = parse(&r.expect("h1-forced request"));
+        assert_eq!((r.status, r.body.len()), (200, 2));
+        assert_eq!(o.accepted(), 1);
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// spec §6.4, §10.3: an h2 origin declares `content-length: 100`, sends 50 bytes and then
+// RST_STREAM(NO_ERROR): the server's body check resets the H3 response (pinned by its
+// `mq.req`). The Rust client's local reply is an abort, or 502 `upstream-reset` when its
+// xquic processes HEADERS and RESET_STREAM in one pass (the reset discards the unread
+// head; `ClTooShort` leaves only 10 ms between them, too little on a slow CI).
+matrix!(
+    h2_cl_100_then_rst_resets_h3_end_to_end,
+    |cells: (Backend, Backend), tag: &str| {
+        let h = Handler::ClTooShort { cl: 100, send: 50 };
+        let o = OriginServer::spawn(OriginServerMode::new(Proto::H2Tls, h));
+        let p = gateway(cells);
+        wait_up(&p, tag);
+        let url = format!("https://127.0.0.1:{}/h2-short-{tag}", o.addr.port());
+        let r = fetch(&p, &url, &[], b"");
+        let upstream_reset = b"HTTP/1.1 502 \r\nX-Mq-Error: upstream-reset\r\nContent-Length: 0\r\nConnection: close\r\n\r\n";
+        assert!(
+            is_reset(&r) || matches!(&r, Ok(b) if b == upstream_reset),
+            "{:?}",
+            r.as_ref().map(|b| String::from_utf8_lossy(b).into_owned())
+        );
+        // The reset is the server's (its check), not only the client's own body check.
+        let line = wait_log(&["mq.req", &format!("path=\"/h2-short-{tag}\"")]);
+        assert!(line.contains("reset=\"local reset\""), "{line}");
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// spec §5.2, §6.2, §10.3: CONNECT is refused by the fetch listener (400 `bad-method`) and
+// by the server intake (400 `bad-request`). The direct-H3 CONNECT is the valid authority
+// form (RFC 9114 §4.4), so it reaches the gateway on both server backends (adoption spec
+// §6.2; the malformed form is a raw-peer case).
+matrix!(
+    connect_rejected_both_intakes,
+    |cells: (Backend, Backend), tag: &str| {
+        let p = gateway(cells);
+        let target = format!("http://127.0.0.1:1/connect-{tag}");
+        let r = fetch(&p, &target, &[("X-Mq-Method", "CONNECT")], b"");
+        let want = b"HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\nX-Mq-Error: bad-method\r\n\r\n";
+        assert_eq!(
+            String::from_utf8_lossy(&r.expect("reply")),
+            String::from_utf8_lossy(want)
+        );
+        let auth = bearer();
+        let headers = [
+            (":method", "CONNECT"),
+            (":authority", "127.0.0.1:1"),
+            ("x-mq-auth", &auth),
+        ];
+        let s = H3Script {
+            headers: headers.map(|(n, v)| (n.into(), v.into())).to_vec(),
+            ..H3Script::default()
+        };
+        let c = h3_client(p.server.udp_addr, s, cells.0);
+        wait_h3(&c.handle, |r| r.fin);
+        {
+            let r = c.handle.lock();
+            assert_eq!(h3_header(&r, ":status").as_deref(), Some("400"));
+            assert_eq!(h3_header(&r, "x-mq-error").as_deref(), Some("bad-request"));
+        }
+        stop(c);
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
 
 // ---- direct H3 against the gateway server ----
 
-/// spec §3.7 (1), §6.3, Review Focus 3: a 4 MiB body sent after a 403 is drained, so the
-/// server's `recv_body_size` (`req_bytes`) reports the whole body.
-#[test]
-fn drain_after_403_counts_whole_body() {
-    let p = gateway();
-    let body_len = 4 * MIB;
-    let extra = [("x-mq-auth", "Bearer wrong")];
-    let s = script("POST", "127.0.0.1:1", "/drain", &extra, vec![7; body_len]);
-    let c = h3_client(p.server.udp_addr, s);
-    wait_h3(&c.handle, |r| !r.closed.is_empty());
-    {
-        let r = c.handle.lock();
-        assert_eq!(h3_header(&r, ":status").as_deref(), Some("403"));
-        assert_eq!(r.closed[0].0.stats.stream_err, 0, "{:?}", r.closed);
-        assert_eq!(r.closed[0].0.stats.send_body, body_len as u64);
+// spec §3.7 (1), §6.3, Review Focus 3: a 4 MiB body sent after a 403 is drained, so the
+// server's `recv_body_size` (`req_bytes`) reports the whole body.
+// A 403 line has `path="-"`, so the cell's marker is its body length.
+matrix!(
+    drain_after_403_counts_whole_body,
+    |cells: (Backend, Backend), tag: &str| {
+        let p = gateway(cells);
+        let cell = ["xx", "xw", "wx", "ww"].iter().position(|t| *t == tag);
+        let body_len = 4 * MIB + cell.unwrap();
+        let extra = [("x-mq-auth", "Bearer wrong")];
+        let path = format!("/drain-{tag}");
+        let s = script("POST", "127.0.0.1:1", &path, &extra, vec![7; body_len]);
+        let c = h3_client(p.server.udp_addr, s, cells.0);
+        wait_h3(&c.handle, |r| !r.closed.is_empty());
+        {
+            let r = c.handle.lock();
+            assert_eq!(h3_header(&r, ":status").as_deref(), Some("403"));
+            assert_eq!(r.closed[0].0.stats.stream_err, 0, "{:?}", r.closed);
+            assert_eq!(r.closed[0].0.stats.send_body, body_len as u64);
+        }
+        wait_log(&["mq.req", "status=403", &format!("req_bytes={body_len} ")]);
+        stop(c);
+        assert_eq!(p.join_both(), (0, 0));
     }
-    wait_log(&["mq.req", "status=403", &format!("req_bytes={body_len} ")]);
-    stop(c);
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// spec §6.2 step 8, §10.3: `content-length: 10` with FIN on HEADERS reaches the origin
-/// bodiless (no chunked framing, no positive length).
-#[test]
-fn direct_h3_cl_with_fin_on_headers_is_bodiless() {
-    let o = Capture::spawn();
-    let p = gateway();
-    let auth = bearer();
-    let extra = [("x-mq-auth", auth.as_str()), ("content-length", "10")];
-    let c = h3_client(
-        p.server.udp_addr,
-        script("POST", &o.authority(), "/fin", &extra, Vec::new()),
-    );
-    wait_h3(&c.handle, |r| r.fin);
-    assert_eq!(
-        h3_header(&c.handle.lock(), ":status").as_deref(),
-        Some("200")
-    );
-    let seen = o.one();
-    assert!(seen.complete && seen.body.is_empty(), "{seen:?}");
-    assert!(!seen.head.contains("transfer-encoding"), "{}", seen.head);
-    let cl = seen
-        .head
-        .lines()
-        .find_map(|l| l.strip_prefix("content-length:"));
-    assert!(cl.is_none_or(|v| v.trim() == "0"), "{}", seen.head);
-    stop(c);
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// spec §7.4, §10.3: a GET with an unknown-length DATA body reaches an h1 origin chunked and
-/// complete.
-#[test]
-fn direct_h3_get_with_body_is_chunked_on_h1() {
-    let o = Capture::spawn();
-    let p = gateway();
-    let auth = bearer();
-    let extra = [("x-mq-auth", auth.as_str())];
-    let s = script(
-        "GET",
-        &o.authority(),
-        "/chunked",
-        &extra,
-        b"hello body".to_vec(),
-    );
-    let c = h3_client(p.server.udp_addr, s);
-    wait_h3(&c.handle, |r| r.fin);
-    assert_eq!(
-        h3_header(&c.handle.lock(), ":status").as_deref(),
-        Some("200")
-    );
-    let seen = o.one();
-    assert!(
-        seen.head.contains("\r\ntransfer-encoding: chunked\r\n"),
-        "{}",
-        seen.head
-    );
-    assert_eq!(dechunk(&seen.body).as_deref(), Some(&b"hello body"[..]));
-    stop(c);
-    assert_eq!(p.join_both(), (0, 0));
-}
+);
+
+// spec §6.2 step 8, §10.3: `content-length: 10` with FIN on HEADERS reaches the origin
+// bodiless (no chunked framing, no positive length). adoption spec §5.3 (6): a `Wire` server
+// finds the mismatch in the read that delivers the HEADERS, so the gateway's intake read
+// fails (its line has `path="-"`, which no cell can match) and the origin sees nothing.
+matrix!(
+    direct_h3_cl_with_fin_on_headers_is_bodiless,
+    |cells: (Backend, Backend), tag: &str| {
+        let o = Capture::spawn();
+        let p = gateway(cells);
+        let auth = bearer();
+        let extra = [("x-mq-auth", auth.as_str()), ("content-length", "10")];
+        let path = format!("/fin-{tag}");
+        let s = script("POST", &o.authority(), &path, &extra, Vec::new());
+        let c = h3_client(p.server.udp_addr, s, cells.0);
+        if cells.1 == Backend::Wire {
+            wait_h3(&c.handle, |r| !r.closed.is_empty());
+            let stats = c.handle.lock().closed[0].0.stats.clone();
+            assert_ne!(stats.stream_err, 0, "{stats:?}");
+            stop(c);
+            assert_eq!(p.join_both(), (0, 0));
+            assert!(o.settled().is_empty(), "the origin saw a request");
+            return;
+        }
+        wait_h3(&c.handle, |r| r.fin);
+        assert_eq!(
+            h3_header(&c.handle.lock(), ":status").as_deref(),
+            Some("200")
+        );
+        let seen = o.one();
+        assert!(seen.complete && seen.body.is_empty(), "{seen:?}");
+        assert!(!seen.head.contains("transfer-encoding"), "{}", seen.head);
+        let cl = seen
+            .head
+            .lines()
+            .find_map(|l| l.strip_prefix("content-length:"));
+        assert!(cl.is_none_or(|v| v.trim() == "0"), "{}", seen.head);
+        stop(c);
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// spec §7.4, §10.3: a GET with an unknown-length DATA body reaches an h1 origin chunked and
+// complete.
+matrix!(
+    direct_h3_get_with_body_is_chunked_on_h1,
+    |cells: (Backend, Backend), tag: &str| {
+        let o = Capture::spawn();
+        let p = gateway(cells);
+        let auth = bearer();
+        let extra = [("x-mq-auth", auth.as_str())];
+        let path = format!("/chunked-{tag}");
+        let s = script("GET", &o.authority(), &path, &extra, b"hello body".to_vec());
+        let c = h3_client(p.server.udp_addr, s, cells.0);
+        wait_h3(&c.handle, |r| r.fin);
+        assert_eq!(
+            h3_header(&c.handle.lock(), ":status").as_deref(),
+            Some("200")
+        );
+        let seen = o.one();
+        assert!(
+            seen.head.contains("\r\ntransfer-encoding: chunked\r\n"),
+            "{}",
+            seen.head
+        );
+        assert_eq!(dechunk(&seen.body).as_deref(), Some(&b"hello body"[..]));
+        stop(c);
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
 
 /// A direct-H3 upload the server must reset (§6.3): the client sees the reset, the server
-/// logs the request, and the origin never received a complete body.
-fn upload_reset(path: &str, cl: &str, body: Vec<u8>, truncate: bool) -> H3Handle {
+/// logs the request, and the origin never received a complete body. On a `Wire` server the
+/// reset is h3wire's (`H3_MESSAGE_ERROR`, adoption spec §5.3 (6)), and the gateway still logs
+/// it as `local reset`.
+fn upload_reset(
+    cells: (Backend, Backend),
+    path: &str,
+    cl: &str,
+    body: Vec<u8>,
+    truncate: bool,
+) -> H3Handle {
     let o = Capture::spawn();
-    let p = gateway();
+    let p = gateway(cells);
     let auth = bearer();
     let extra = [("x-mq-auth", auth.as_str()), ("content-length", cl)];
     let mut s = script("POST", &o.authority(), path, &extra, body);
     s.truncate_after_partial = truncate;
-    let c = h3_client(p.server.udp_addr, s);
+    let c = h3_client(p.server.udp_addr, s, cells.0);
     wait_h3(&c.handle, |r| !r.closed.is_empty());
     {
         let r = c.handle.lock();
@@ -779,17 +829,33 @@ fn upload_reset(path: &str, cl: &str, body: Vec<u8>, truncate: bool) -> H3Handle
     h
 }
 
-/// spec §6.3, §10.3: 50 bytes + FIN (a complete frame) under `content-length: 100`.
-#[test]
-fn direct_h3_short_request_body_resets() {
-    upload_reset("/short-req", "100", vec![1; 50], false);
-}
-
-/// spec §6.3, §10.3: 50 bytes under `content-length: 10`.
-#[test]
-fn direct_h3_excess_request_body_resets() {
-    upload_reset("/excess-req", "10", vec![1; 50], false);
-}
+// spec §6.3, §10.3: 50 bytes + FIN (a complete frame) under `content-length: 100`.
+matrix!(
+    direct_h3_short_request_body_resets,
+    |cells: (Backend, Backend), tag: &str| {
+        upload_reset(
+            cells,
+            &format!("/short-req-{tag}"),
+            "100",
+            vec![1; 50],
+            false,
+        );
+    }
+);
+
+// spec §6.3, §10.3: 50 bytes under `content-length: 10`.
+matrix!(
+    direct_h3_excess_request_body_resets,
+    |cells: (Backend, Backend), tag: &str| {
+        upload_reset(
+            cells,
+            &format!("/excess-req-{tag}"),
+            "10",
+            vec![1; 50],
+            false,
+        );
+    }
+);
 
 /// spec §3.7 (3), §6.3, Review Focus 5: the request's DATA frame is cut by FIN inside its
 /// declared length (`CUT_BODY` under `content-length: 33554432`, partial acceptance then
@@ -797,7 +863,7 @@ fn direct_h3_excess_request_body_resets() {
 #[test]
 fn direct_h3_request_body_cut_inside_frame_resets() {
     let cl = CUT_BODY.to_string();
-    let h = upload_reset("/cut-req", &cl, vec![2; CUT_BODY], true);
+    let h = upload_reset(XX, "/cut-req", &cl, vec![2; CUT_BODY], true);
     let accepted = h.lock().accepted.expect("partial acceptance");
     assert!(0 < accepted && accepted < CUT_BODY, "accepted {accepted}");
 }
@@ -807,7 +873,7 @@ fn direct_h3_request_body_cut_inside_frame_resets() {
 #[test]
 fn nul_in_auth_path_class_direct_h3() {
     let o = Capture::spawn();
-    let p = gateway();
+    let p = gateway(XX);
     let auth = bearer();
     let nul_auth = format!("{auth}\0junk");
     let a = o.authority();
@@ -838,7 +904,7 @@ fn nul_in_auth_path_class_direct_h3() {
         ),
     ];
     for (s, (status, xmq)) in cases {
-        let c = h3_client(p.server.udp_addr, s);
+        let c = h3_client(p.server.udp_addr, s, Backend::XqcH3);
         wait_h3(&c.handle, |r| r.fin);
         {
             let r = c.handle.lock();
diff --git a/crates/mq-integration/tests/pair_h3.rs b/crates/mq-integration/tests/pair_h3.rs
index 9c6dcfb7..6a74f0d7 100644
--- a/crates/mq-integration/tests/pair_h3.rs
+++ b/crates/mq-integration/tests/pair_h3.rs
@@ -6,6 +6,7 @@ use mq_integration::h3_apps::{EchoMode, H3Client, H3EchoServer, H3Handle, H3Scri
 use mq_integration::loopback::{
     Backend, LoopbackPair, cert, h3_transport, raw_h3_transport, transport,
 };
+use mq_integration::matrix;
 use mq_integration::raw_h3::{RawH3Handle, RawH3Peer, RawH3Script, headers_frame};
 use mq_runtime::Shard;
 use mq_transport_api::Role;
@@ -13,15 +14,8 @@ use std::net::Ipv4Addr;
 use std::thread;
 use std::time::{Duration, Instant};
 
+/// Bare xqc_h3 on both sides (the rescue tests).
 fn pair(mode: EchoMode, script: H3Script) -> LoopbackPair<H3Handle, H3Handle> {
-    pair_with(mode, Vec::new(), script)
-}
-
-fn pair_with(
-    mode: EchoMode,
-    resp_headers: Vec<(String, String)>,
-    script: H3Script,
-) -> LoopbackPair<H3Handle, H3Handle> {
     let lo = Ipv4Addr::LOCALHOST.into();
     LoopbackPair::spawn(
         (lo, lo),
@@ -35,7 +29,6 @@ fn pair_with(
                 true,
             );
             let (app, h) = H3EchoServer::new(mode);
-            let app = app.with_response_headers(resp_headers.clone());
             (Shard::new(t, app, local, 1), h)
         },
         move |local, server| {
@@ -139,30 +132,51 @@ fn section(hs: &[(Vec<u8>, Vec<u8>)]) -> usize {
     hs.iter().map(|(n, v)| n.len() + v.len() + 32).sum()
 }
 
-/// SP4 spec §5: both engines accept a 40 KiB field section (xquic's default limit was 32 KiB;
-/// `H3_FIELD_SECTION_MAX` is 64 KiB): a request section reaches the server and a response
-/// section comes back.
-#[test]
-fn h3_40k_section_both_ways() {
-    let mut script = post(Vec::new(), None);
-    script.headers.extend(fields(6, 7000));
-    let p = pair_with(EchoMode::Echo, fields(6, 7000), script);
-    wait(&p.client.handle, |r| r.fin);
-    {
-        let s = p.server.handle.lock();
-        assert!(
-            section(&s.request_headers) >= 40 * 1024,
-            "{}",
-            section(&s.request_headers)
+// SP4 spec §5: both engines accept a 40 KiB field section (xquic's default limit was 32 KiB;
+// `H3_FIELD_SECTION_MAX` is 64 KiB): a request section reaches the server and a response
+// section comes back. Matrixed over (client, server) backends (adoption spec §6.2).
+matrix!(
+    h3_40k_section_both_ways,
+    |cells: (Backend, Backend), _tag: &str| {
+        let mut script = post(Vec::new(), None);
+        script.headers.extend(fields(6, 7000));
+        let lo = Ipv4Addr::LOCALHOST.into();
+        let p = LoopbackPair::spawn(
+            (lo, lo),
+            Vec::new(),
+            move |local| {
+                let (app, h) = H3EchoServer::new(EchoMode::Echo);
+                let app = app.with_response_headers(fields(6, 7000));
+                (
+                    Shard::new(h3_transport(server_role(), cells.1), app, local, 1),
+                    h,
+                )
+            },
+            move |local, server| {
+                let (app, h) = H3Client::new(server, script);
+                (
+                    Shard::new(h3_transport(Role::Client, cells.0), app, local, 2),
+                    h,
+                )
+            },
         );
+        wait(&p.client.handle, |r| r.fin);
+        {
+            let s = p.server.handle.lock();
+            assert!(
+                section(&s.request_headers) >= 40 * 1024,
+                "{}",
+                section(&s.request_headers)
+            );
+        }
+        {
+            let c = p.client.handle.lock();
+            assert_eq!(c.headers[0].0, b":status");
+            assert!(section(&c.headers) >= 40 * 1024, "{}", section(&c.headers));
+        }
+        p.join_both();
     }
-    {
-        let c = p.client.handle.lock();
-        assert_eq!(c.headers[0].0, b":status");
-        assert!(section(&c.headers) >= 40 * 1024, "{}", section(&c.headers));
-    }
-    p.join_both();
-}
+);
 
 fn server_role() -> Role {
     Role::Server {

From 7a8df5ac26bfb4c8f20daf627646fd19f66b8de4 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 12:32:02 +0900
Subject: [PATCH 18/33] test(integration): malformed-input cells against each
 receiver
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The malformed producers move to RawH3Peer and run against an xqc_h3 and
a Wire receiver (`receivers!`, cells x / w; adoption spec §6.2):

- a response DATA frame cut by FIN: the fetch socket is reset in both
  cells; h3wire closes the conn with H3_FRAME_ERROR (spec §5.3 (1));
- the same cut on a request: xqc_h3 logs the gateway's reset; on Wire
  the conn closes with H3_FRAME_ERROR and the fan-out logs it once;
- NUL in x-mq-auth / :path / x-mq-class and a CONNECT with :scheme /
  :path: xqc_h3 keeps today's 403 / 400 / `?` and 400; h3wire resets
  with H3_MESSAGE_ERROR and the gateway logs nothing (spec §5.3 (6)).

fetch_short_cl_response_aborts_client joins the 4-cell matrix.
EchoMode::CutResponseFrame, H3Script.truncate_after_partial, CUT_BODY
and H3Recorded.accepted lose their last users and are deleted.
---
 crates/mq-integration/src/h3_apps.rs        |  28 --
 crates/mq-integration/src/loopback.rs       |  23 ++
 crates/mq-integration/src/raw_h3.rs         |  27 ++
 crates/mq-integration/tests/pair_gateway.rs | 333 ++++++++++++++------
 crates/mq-integration/tests/pair_h3.rs      |  31 +-
 5 files changed, 282 insertions(+), 160 deletions(-)

diff --git a/crates/mq-integration/src/h3_apps.rs b/crates/mq-integration/src/h3_apps.rs
index 7d1d0049..50a30068 100644
--- a/crates/mq-integration/src/h3_apps.rs
+++ b/crates/mq-integration/src/h3_apps.rs
@@ -13,11 +13,6 @@ use std::net::SocketAddr;
 use std::sync::{Arc, Mutex, MutexGuard};
 use std::time::{Duration, Instant};
 
-/// Above `XQC_MAX_RECV_WINDOW` (16 MiB, xqc_conn.h:40), which the Rust conn settings never
-/// lower (`init_recv_window = 0`): one `h3_send_body` of it is accepted only partially, and
-/// the DATA frame header already declared the whole length (xqc_h3_stream.c:455).
-pub const CUT_BODY: usize = 32 << 20;
-
 /// What an app observed.
 #[derive(Debug, Default)]
 pub struct H3Recorded {
@@ -31,9 +26,6 @@ pub struct H3Recorded {
     pub request_headers: Vec<(Vec<u8>, Vec<u8>)>,
     /// Every `H3Closed`, with its arrival time.
     pub closed: Vec<(H3Close, Instant)>,
-    /// `CutResponseFrame` / `truncate_after_partial`: what the oversized `h3_send_body`
-    /// accepted (0 when `Blocked`).
-    pub accepted: Option<usize>,
     /// `ResetBeforeFin` / `CloseConnMidResponse`: when the server cut the response, and the
     /// connection's srtt then.
     pub cut_at: Option<Instant>,
@@ -130,10 +122,6 @@ pub enum EchoMode {
     CloseConnMidResponse,
     /// `content-length: cl` over a complete `sent`-byte DATA frame + FIN.
     ShortCl { cl: u64, sent: usize },
-    /// `content-length: CUT_BODY`, one `h3_send_body` of `CUT_BODY` bytes, then `h3_finish`
-    /// on the partial acceptance (xqc_h3_stream.c:579 attaches the FIN without checking the
-    /// incomplete frame): spec §3.7 (3)'s malformed peer.
-    CutResponseFrame,
 }
 
 const CUT_DELAY: Duration = Duration::from_millis(100);
@@ -195,14 +183,6 @@ impl H3EchoServer {
                 hs.push(cl(n));
                 (q.resp, q.fin) = (vec![b'x'; sent], true);
             }
-            EchoMode::CutResponseFrame => {
-                hs.push(cl(CUT_BODY as u64));
-                let _ = cx.h3_send_headers(r, &hdrs(&hs), false);
-                let n = cx.h3_send_body(r, &vec![0; CUT_BODY], false).unwrap_or(0);
-                self.h.lock().accepted = Some(n);
-                let _ = cx.h3_finish(r);
-                return;
-            }
         }
         let _ = cx.h3_send_headers(r, &hdrs(&hs), q.fin && q.resp.is_empty());
         if !q.resp.is_empty() {
@@ -288,9 +268,6 @@ pub struct H3Script {
     /// On the first `H3Readable`, read nothing for this long (reading the FIN would set
     /// `fin_consumed` and nothing would be rescued, spec §3.3), then read everything.
     pub pause_reads: Option<Duration>,
-    /// The request-side twin of `EchoMode::CutResponseFrame`: on a partial acceptance of
-    /// `body`, `h3_finish` instead of waiting for `H3Writable`.
-    pub truncate_after_partial: bool,
 }
 
 /// An `App` that connects (H3) to `peer` on start, sends its one scripted request once the
@@ -323,11 +300,6 @@ impl H3Client {
             return;
         }
         push(cx, r, &self.s.body, &mut self.sent, true);
-        if self.s.truncate_after_partial && self.sent < self.s.body.len() {
-            self.h.lock().accepted = Some(self.sent);
-            self.sent = self.s.body.len();
-            let _ = cx.h3_finish(r);
-        }
     }
 
     fn read(&mut self, cx: &mut Cx<'_>, r: H3ReqId) {
diff --git a/crates/mq-integration/src/loopback.rs b/crates/mq-integration/src/loopback.rs
index ca2c3cc6..37e17c25 100644
--- a/crates/mq-integration/src/loopback.rs
+++ b/crates/mq-integration/src/loopback.rs
@@ -157,6 +157,29 @@ macro_rules! matrix {
     };
 }
 
+/// Malformed input against each receiver (adoption spec §6.2): `receivers!(name, |b: Backend,
+/// tag: &str| body)` runs `body` as the tests `name::{x, w}`, with `b` the receiving side's
+/// backend (`XqcH3`, `Wire`) and `tag` the cell's name; a `RawH3Peer` is the other side.
+#[macro_export]
+macro_rules! receivers {
+    ($name:ident, |$b:ident: Backend, $tag:ident: &str| $body:block $(,)?) => {
+        mod $name {
+            use super::*;
+
+            fn body($b: $crate::loopback::Backend, $tag: &str) $body
+
+            #[test]
+            fn x() {
+                body($crate::loopback::Backend::XqcH3, "x")
+            }
+            #[test]
+            fn w() {
+                body($crate::loopback::Backend::Wire, "w")
+            }
+        }
+    };
+}
+
 /// An H3 transport on backend `b` (adoption spec §6.2).
 pub fn h3_transport(role: Role, b: Backend) -> H3Wire<Transport> {
     match b {
diff --git a/crates/mq-integration/src/raw_h3.rs b/crates/mq-integration/src/raw_h3.rs
index 56933702..c125dfe8 100644
--- a/crates/mq-integration/src/raw_h3.rs
+++ b/crates/mq-integration/src/raw_h3.rs
@@ -195,3 +195,30 @@ pub fn data_frame(declared: u64, payload: &[u8]) -> Vec<u8> {
     out.extend_from_slice(payload);
     out
 }
+
+/// The value of `name` in the first HEADERS frame of `bytes` (a request stream as read raw);
+/// on h3wire's hidden `varint` and `qpack::decoder`.
+pub fn field(bytes: &[u8], name: &[u8]) -> Option<Vec<u8>> {
+    use h3wire::qpack::decoder::{Span, decode_field_section};
+    let mut b = bytes;
+    while !b.is_empty() {
+        let (ty, n) = h3wire::varint::decode(b)?;
+        let (len, m) = h3wire::varint::decode(&b[n..])?;
+        let payload = b.get(n + m..n + m + len as usize)?;
+        b = &b[n + m + len as usize..];
+        if ty != 0x01 {
+            continue; // DATA or a reserved frame
+        }
+        let (mut arena, mut fields) = (Vec::new(), Vec::new());
+        decode_field_section(payload, &mut arena, &mut fields).ok()?;
+        let get = |s: Span| match s {
+            Span::Static(v) => v.to_vec(),
+            Span::Arena(a, z) => arena[a as usize..z as usize].to_vec(),
+        };
+        return fields
+            .iter()
+            .find(|f| get(f.name) == name)
+            .map(|f| get(f.value));
+    }
+    None
+}
diff --git a/crates/mq-integration/tests/pair_gateway.rs b/crates/mq-integration/tests/pair_gateway.rs
index f781754b..8dcbd66e 100644
--- a/crates/mq-integration/tests/pair_gateway.rs
+++ b/crates/mq-integration/tests/pair_gateway.rs
@@ -1,23 +1,23 @@
 //! spec §10.3 (H3 pair, gateway items): the fetch client and the gateway server on two
 //! production drivers over loopback UDP, real xquic, against real origins. The test thread
 //! plays the local fetch caller (HTTP/1.1 over `std::net`) and, for the direct-H3 cases, an
-//! `H3Client` on a third driver.
+//! `H3Client` or a `RawH3Peer` on a third driver.
 #![forbid(unsafe_code)]
 
 use mq_integration::driver_harness::DriverThread;
-use mq_integration::h3_apps::{
-    CUT_BODY, EchoMode, H3Client, H3EchoServer, H3Handle, H3Recorded, H3Script,
-};
+use mq_integration::h3_apps::{EchoMode, H3Client, H3EchoServer, H3Handle, H3Recorded, H3Script};
 use mq_integration::log_tap;
 use mq_integration::loopback::{Backend, LoopbackProxy, h3_transport};
-use mq_integration::matrix;
 use mq_integration::origin_server::{Handler, ORIGIN_CA, OriginServer, OriginServerMode, Proto};
-use mq_integration::raw_h3::{RawH3Peer, RawH3Script, data_frame, headers_frame};
+use mq_integration::raw_h3::{
+    RawH3Handle, RawH3Peer, RawH3Script, data_frame, field, headers_frame,
+};
+use mq_integration::{matrix, receivers};
 use mq_proxy::config::{ClientConfig, GatewayConfig, ServerConfig};
 use mq_proxy::server::origin::host::upload_byte;
-use mq_runtime::Shard;
 use mq_runtime::driver::{DriverConfig, StdResolver};
-use mq_transport_api::Role;
+use mq_runtime::{App, Shard};
+use mq_transport_api::{CloseReason, ErrType, Role};
 use std::io::{self, Read, Write};
 use std::net::{Ipv4Addr, SocketAddr, TcpListener, TcpStream};
 use std::path::Path;
@@ -41,9 +41,6 @@ fn server_cfg() -> ServerConfig {
     }
 }
 
-/// Both endpoints on xqc_h3: the tests outside the matrix.
-const XX: (Backend, Backend) = (Backend::XqcH3, Backend::XqcH3);
-
 /// The gateway pair on the (client, server) backends `cells` (adoption spec §6.2).
 fn gateway_with(server: ServerConfig, cells: (Backend, Backend)) -> LoopbackProxy {
     log_tap::install();
@@ -208,8 +205,11 @@ fn pattern(len: usize) -> Vec<u8> {
 
 // ---- direct H3 ----
 
-/// An `H3Client` on its own driver, on backend `b`, against the gateway server.
-fn h3_client(server: SocketAddr, s: H3Script, b: Backend) -> DriverThread<H3Handle> {
+/// The client app `make()` builds, on its own driver on backend `b`.
+fn client_on<A: App + 'static, H: Send + 'static>(
+    b: Backend,
+    make: impl FnOnce() -> (A, H) + Send + 'static,
+) -> DriverThread<H> {
     let cfg = DriverConfig {
         resolver: Arc::new(StdResolver),
         install_signal_handlers: false,
@@ -217,14 +217,26 @@ fn h3_client(server: SocketAddr, s: H3Script, b: Backend) -> DriverThread<H3Hand
     };
     let lo = Ipv4Addr::LOCALHOST.into();
     let mut d = DriverThread::spawn_on(lo, cfg, Vec::new(), move |local| {
-        let (app, h) = H3Client::new(server, s);
+        let (app, h) = make();
         (Shard::new(h3_transport(Role::Client, b), app, local, 3), h)
     });
     d.start();
     d
 }
 
-fn stop(d: DriverThread<H3Handle>) {
+/// An `H3Client` on backend `b` against the gateway server.
+fn h3_client(server: SocketAddr, s: H3Script, b: Backend) -> DriverThread<H3Handle> {
+    client_on(b, move || H3Client::new(server, s))
+}
+
+/// A `RawH3Peer` client writing `stream` + FIN to the gateway server.
+fn raw_client(server: SocketAddr, stream: Vec<u8>) -> DriverThread<RawH3Handle> {
+    client_on(Backend::Raw, move || {
+        RawH3Peer::client(server, RawH3Script { stream, fin: true })
+    })
+}
+
+fn stop<H>(d: DriverThread<H>) {
     d.shutdown.trigger();
     assert_eq!(d.join(), 0);
 }
@@ -454,32 +466,59 @@ matrix!(
     }
 );
 
-/// spec §5.4, §5.5, §10.3: `content-length: 100` over a complete 50-byte DATA frame + FIN
-/// from a peer: the client's own body check aborts the local socket.
-#[test]
-fn fetch_short_cl_response_aborts_client() {
-    let (app, h) = H3EchoServer::new(EchoMode::ShortCl { cl: 100, sent: 50 });
-    let p = LoopbackProxy::spawn_gateway_against(ClientConfig::default(), app);
-    let r = fetch_when_up(p.fetch_addr(), &auth("http://x/short", "any"));
-    assert!(is_reset(&r), "{r:?}");
-    assert!(h.lock().requests >= 1);
-    assert_eq!(p.join_both(), (0, 0));
-}
+// spec §5.4, §5.5, §10.3: `content-length: 100` over a complete 50-byte DATA frame + FIN
+// from a peer: the local socket is aborted. On an xqc_h3 client its own body check does it; a
+// `Wire` client's h3wire finds the malformed response (RFC 9114 §4.1.2) and aborts the
+// stream, which reaches the client as `Err(Reset)`.
+matrix!(
+    fetch_short_cl_response_aborts_client,
+    |cells: (Backend, Backend), tag: &str| {
+        let (app, h) = H3EchoServer::new(EchoMode::ShortCl { cl: 100, sent: 50 });
+        let p = LoopbackProxy::spawn_gateway_against_on(ClientConfig::default(), app, cells);
+        let target = format!("http://x/short-{tag}");
+        let r = fetch_when_up(p.fetch_addr(), &auth(&target, "any"));
+        assert!(is_reset(&r), "{r:?}");
+        assert!(h.lock().requests >= 1);
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
 
-/// spec §3.7 (3), §5.4, Review Focus 5: the response's DATA frame is cut by FIN inside its
-/// declared length (xquic reads it as a clean EOF). The local fetch socket is reset — by the
-/// body check at fin or through the `H3Closed.unread` path, whichever the reader's speed
-/// selects; neither is asserted.
-#[test]
-fn fetch_response_cut_inside_frame_aborts() {
-    let (app, h) = H3EchoServer::new(EchoMode::CutResponseFrame);
-    let p = LoopbackProxy::spawn_gateway_against(ClientConfig::default(), app);
-    let r = fetch_when_up(p.fetch_addr(), &auth("http://x/cut", "any"));
-    assert!(is_reset(&r), "{:?}", r.as_ref().map(|b| b.len()));
-    let accepted = h.lock().accepted.expect("the peer sent the cut frame");
-    assert!(0 < accepted && accepted < CUT_BODY, "accepted {accepted}");
-    assert_eq!(p.join_both(), (0, 0));
-}
+/// The declared length of a cut DATA frame, and what the raw peer sends of it.
+const CUT_DECLARED: u64 = 32 << 20;
+const CUT_SENT: usize = 32 * 1024;
+
+/// adoption spec §5.3 (1).
+const FRAME_ERROR: CloseReason = CloseReason {
+    err_type: ErrType::Application,
+    code: 0x106,
+};
+
+// spec §3.7 (3), §5.4, Review Focus 5: the response's DATA frame is cut by FIN inside its
+// declared length; the local fetch socket is reset in both cells. An xqc_h3 client reads the
+// cut as a clean EOF and its body check (or the `H3Closed.unread` path) resets; h3wire closes
+// the connection with `H3_FRAME_ERROR` (adoption spec §5.3 (1)).
+receivers!(
+    fetch_response_cut_inside_frame_aborts,
+    |b: Backend, tag: &str| {
+        let cl = CUT_DECLARED.to_string();
+        let mut stream = headers_frame(&[(b":status", b"200"), (b"content-length", cl.as_bytes())]);
+        stream.extend(data_frame(CUT_DECLARED, &[0; CUT_SENT]));
+        let (app, h) = RawH3Peer::server(RawH3Script { stream, fin: true });
+        let p = LoopbackProxy::spawn_gateway_against_on(
+            ClientConfig::default(),
+            app,
+            (b, Backend::Raw),
+        );
+        let target = format!("http://x/cut-{tag}");
+        let r = fetch_when_up(p.fetch_addr(), &auth(&target, "any"));
+        assert!(is_reset(&r), "{:?}", r.as_ref().map(|b| b.len()));
+        if b == Backend::Wire {
+            wait_until("the peer's ConnClosed", || !h.lock().closed.is_empty());
+            assert_eq!(h.lock().closed, [FRAME_ERROR]);
+        }
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
 
 /// adoption spec §6.2: a `RawH3Peer::server` hosts the server side of the gateway pair
 /// (`Backend::Raw`); its fixed 200 reaches the fetch socket through each client backend.
@@ -799,19 +838,12 @@ matrix!(
 /// logs the request, and the origin never received a complete body. On a `Wire` server the
 /// reset is h3wire's (`H3_MESSAGE_ERROR`, adoption spec §5.3 (6)), and the gateway still logs
 /// it as `local reset`.
-fn upload_reset(
-    cells: (Backend, Backend),
-    path: &str,
-    cl: &str,
-    body: Vec<u8>,
-    truncate: bool,
-) -> H3Handle {
+fn upload_reset(cells: (Backend, Backend), path: &str, cl: &str, body: Vec<u8>) {
     let o = Capture::spawn();
     let p = gateway(cells);
     let auth = bearer();
     let extra = [("x-mq-auth", auth.as_str()), ("content-length", cl)];
-    let mut s = script("POST", &o.authority(), path, &extra, body);
-    s.truncate_after_partial = truncate;
+    let s = script("POST", &o.authority(), path, &extra, body);
     let c = h3_client(p.server.udp_addr, s, cells.0);
     wait_h3(&c.handle, |r| !r.closed.is_empty());
     {
@@ -823,23 +855,15 @@ fn upload_reset(
     assert!(line.contains("reset=\"local reset\""), "{line}");
     let seen = o.settled();
     assert!(seen.iter().all(|s| !s.complete), "{seen:?}");
-    let h = c.handle.clone();
     stop(c);
     assert_eq!(p.join_both(), (0, 0));
-    h
 }
 
 // spec §6.3, §10.3: 50 bytes + FIN (a complete frame) under `content-length: 100`.
 matrix!(
     direct_h3_short_request_body_resets,
     |cells: (Backend, Backend), tag: &str| {
-        upload_reset(
-            cells,
-            &format!("/short-req-{tag}"),
-            "100",
-            vec![1; 50],
-            false,
-        );
+        upload_reset(cells, &format!("/short-req-{tag}"), "100", vec![1; 50]);
     }
 );
 
@@ -847,72 +871,175 @@ matrix!(
 matrix!(
     direct_h3_excess_request_body_resets,
     |cells: (Backend, Backend), tag: &str| {
-        upload_reset(
-            cells,
-            &format!("/excess-req-{tag}"),
-            "10",
-            vec![1; 50],
-            false,
-        );
+        upload_reset(cells, &format!("/excess-req-{tag}"), "10", vec![1; 50]);
     }
 );
 
-/// spec §3.7 (3), §6.3, Review Focus 5: the request's DATA frame is cut by FIN inside its
-/// declared length (`CUT_BODY` under `content-length: 33554432`, partial acceptance then
-/// `h3_finish`); the server's upload check resets the request.
-#[test]
-fn direct_h3_request_body_cut_inside_frame_resets() {
-    let cl = CUT_BODY.to_string();
-    let h = upload_reset(XX, "/cut-req", &cl, vec![2; CUT_BODY], true);
-    let accepted = h.lock().accepted.expect("partial acceptance");
-    assert!(0 < accepted && accepted < CUT_BODY, "accepted {accepted}");
+// ---- malformed input against each receiver (adoption spec §6.2) ----
+
+/// A HEADERS frame of `fields`, as the raw peer writes it (unvalidated).
+fn raw_headers(fields: &[(&str, &str)]) -> Vec<u8> {
+    let fs: Vec<(&[u8], &[u8])> = fields
+        .iter()
+        .map(|(n, v)| (n.as_bytes(), v.as_bytes()))
+        .collect();
+    headers_frame(&fs)
 }
 
-/// spec §6.2, §12, §10.3: an embedded NUL in `x-mq-auth`, `:path` and `x-mq-class` gives
-/// 403 / 400 / `?` in the log.
-#[test]
-fn nul_in_auth_path_class_direct_h3() {
+/// `RawH3Peer`'s HEADERS was malformed (adoption spec §5.3 (6)): h3wire resets the stream with
+/// `H3_MESSAGE_ERROR` and the gateway never sees the request, so no `mq.req` line carries
+/// `marker` for 500 ms after the reset.
+fn assert_message_error(c: &DriverThread<RawH3Handle>, marker: &str) {
+    wait_until("the peer's reset", || !c.handle.lock().resets.is_empty());
+    assert_eq!(c.handle.lock().resets[0].1, 0x10e, "{:?}", c.handle.lock());
+    let end = Instant::now() + Duration::from_millis(500);
+    while Instant::now() < end {
+        let lines = log_tap::lines();
+        let hit = lines
+            .iter()
+            .find(|l| l.contains("mq.req") && l.contains(marker));
+        assert!(hit.is_none(), "{hit:?}");
+        thread::sleep(Duration::from_millis(5));
+    }
+}
+
+/// The raw response's `name` field.
+fn raw_field(c: &DriverThread<RawH3Handle>, name: &str) -> Option<String> {
+    let v = field(&c.handle.lock().read, name.as_bytes());
+    v.map(|v| String::from_utf8_lossy(&v).into_owned())
+}
+
+// spec §3.7 (3), §6.3, Review Focus 5: the request's DATA frame is cut by FIN inside its
+// declared length. An xqc_h3 server reads the cut as a clean EOF and its upload check resets
+// the request. h3wire closes the connection with `H3_FRAME_ERROR` (adoption spec §5.3 (1));
+// the valid HEADERS reached the gateway first, so the connection-close fan-out (§4.3) logs
+// the request once, reset.
+receivers!(
+    direct_h3_request_body_cut_inside_frame_resets,
+    |b: Backend, tag: &str| {
+        let o = Capture::spawn();
+        let p = gateway((Backend::XqcH3, b));
+        let (auth, cl, path) = (
+            bearer(),
+            CUT_DECLARED.to_string(),
+            format!("/cut-req-{tag}"),
+        );
+        let mut stream = raw_headers(&[
+            (":method", "POST"),
+            (":scheme", "http"),
+            (":authority", &o.authority()),
+            (":path", &path),
+            ("x-mq-auth", &auth),
+            ("content-length", &cl),
+        ]);
+        stream.extend(data_frame(CUT_DECLARED, &[2; CUT_SENT]));
+        let c = raw_client(p.server.udp_addr, stream);
+        let marker = format!("path=\"{path}\"");
+        let line = wait_log(&["mq.req", &marker]);
+        if b == Backend::Wire {
+            wait_until("the peer's ConnClosed", || {
+                !c.handle.lock().closed.is_empty()
+            });
+            assert_eq!(c.handle.lock().closed, [FRAME_ERROR]);
+            assert!(!line.contains("reset=\"\""), "{line}");
+            let n = log_tap::lines()
+                .iter()
+                .filter(|l| l.contains("mq.req") && l.contains(&marker))
+                .count();
+            assert_eq!(n, 1);
+        } else {
+            assert!(line.contains("reset=\"local reset\""), "{line}");
+        }
+        let seen = o.settled();
+        assert!(seen.iter().all(|s| !s.complete), "{seen:?}");
+        stop(c);
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// spec §6.2, §12, §10.3: an embedded NUL in `x-mq-auth`, `:path` and `x-mq-class`. An
+// xqc_h3 server passes them to the gateway: 403 / 400 / `?` in the log. RFC 9114 §4.2 makes
+// such a request malformed, and h3wire resets it (adoption spec §5.3 (6)).
+receivers!(nul_in_auth_path_class_direct_h3, |b: Backend, tag: &str| {
     let o = Capture::spawn();
-    let p = gateway(XX);
+    let p = gateway((Backend::XqcH3, b));
     let auth = bearer();
     let nul_auth = format!("{auth}\0junk");
+    let class = format!("nul\0class-marker-{tag}");
     let a = o.authority();
+    let get = |path: &str, extra: &[(&str, &str)]| {
+        let mut fs = vec![
+            (":method", "GET"),
+            (":scheme", "http"),
+            (":authority", a.as_str()),
+            (":path", path),
+        ];
+        fs.extend_from_slice(extra);
+        raw_headers(&fs)
+    };
+    let (p_auth, p_path, p_class) = (
+        format!("/nul-auth-{tag}"),
+        format!("/ok\0junk-{tag}"),
+        format!("/nul-class-{tag}"),
+    );
     let cases = [
         (
-            script(
-                "GET",
-                &a,
-                "/nul-auth",
-                &[("x-mq-auth", &nul_auth)],
-                Vec::new(),
-            ),
+            get(&p_auth, &[("x-mq-auth", &nul_auth)]),
+            &p_auth,
             ("403", Some("auth-failed")),
         ),
         (
-            script("GET", &a, "/ok\0junk", &[("x-mq-auth", &auth)], Vec::new()),
+            get(&p_path, &[("x-mq-auth", &auth)]),
+            &p_path,
             ("400", Some("bad-target")),
         ),
         (
-            script(
-                "GET",
-                &a,
-                "/nul-class",
-                &[("x-mq-auth", &auth), ("x-mq-class", "nul\0class-marker")],
-                Vec::new(),
-            ),
+            get(&p_class, &[("x-mq-auth", &auth), ("x-mq-class", &class)]),
+            &p_class,
             ("200", None),
         ),
     ];
-    for (s, (status, xmq)) in cases {
-        let c = h3_client(p.server.udp_addr, s, Backend::XqcH3);
-        wait_h3(&c.handle, |r| r.fin);
-        {
-            let r = c.handle.lock();
-            assert_eq!(h3_header(&r, ":status").as_deref(), Some(status));
-            assert_eq!(h3_header(&r, "x-mq-error").as_deref(), xmq);
+    for (stream, path, (status, xmq)) in cases {
+        let c = raw_client(p.server.udp_addr, stream);
+        if b == Backend::Wire {
+            assert_message_error(&c, &format!("path=\"{path}\""));
+        } else {
+            wait_until("the response", || c.handle.lock().fin);
+            assert_eq!(raw_field(&c, ":status").as_deref(), Some(status));
+            assert_eq!(raw_field(&c, "x-mq-error").as_deref(), xmq);
         }
         stop(c);
     }
-    wait_log(&["x-mq-class='nul?class-marker'"]);
+    let class_line = format!("x-mq-class='nul?class-marker-{tag}'");
+    if b == Backend::Wire {
+        assert!(!log_tap::lines().iter().any(|l| l.contains(&class_line)));
+    } else {
+        wait_log(&[&class_line]);
+    }
     assert_eq!(p.join_both(), (0, 0));
-}
+});
+
+// spec §5.2, §6.2: CONNECT with `:scheme` and `:path` (RFC 9114 §4.4 forbids both). An
+// xqc_h3 server passes it to the gateway, which answers 400 `bad-request`; h3wire resets it
+// as malformed (adoption spec §5.3 (6)).
+receivers!(connect_malformed_direct_h3, |b: Backend, tag: &str| {
+    let p = gateway((Backend::XqcH3, b));
+    let (auth, path) = (bearer(), format!("/connect-{tag}"));
+    let stream = raw_headers(&[
+        (":method", "CONNECT"),
+        (":scheme", "http"),
+        (":authority", "127.0.0.1:1"),
+        (":path", &path),
+        ("x-mq-auth", &auth),
+    ]);
+    let c = raw_client(p.server.udp_addr, stream);
+    if b == Backend::Wire {
+        assert_message_error(&c, &format!("path=\"{path}\""));
+    } else {
+        wait_until("the response", || c.handle.lock().fin);
+        assert_eq!(raw_field(&c, ":status").as_deref(), Some("400"));
+        assert_eq!(raw_field(&c, "x-mq-error").as_deref(), Some("bad-request"));
+    }
+    stop(c);
+    assert_eq!(p.join_both(), (0, 0));
+});
diff --git a/crates/mq-integration/tests/pair_h3.rs b/crates/mq-integration/tests/pair_h3.rs
index 6a74f0d7..8f4ec4ab 100644
--- a/crates/mq-integration/tests/pair_h3.rs
+++ b/crates/mq-integration/tests/pair_h3.rs
@@ -7,7 +7,7 @@ use mq_integration::loopback::{
     Backend, LoopbackPair, cert, h3_transport, raw_h3_transport, transport,
 };
 use mq_integration::matrix;
-use mq_integration::raw_h3::{RawH3Handle, RawH3Peer, RawH3Script, headers_frame};
+use mq_integration::raw_h3::{RawH3Handle, RawH3Peer, RawH3Script, field, headers_frame};
 use mq_runtime::Shard;
 use mq_transport_api::Role;
 use std::net::Ipv4Addr;
@@ -50,7 +50,6 @@ fn post(body: Vec<u8>, pause_reads: Option<Duration>) -> H3Script {
         .to_vec(),
         body,
         pause_reads,
-        truncate_after_partial: false,
     }
 }
 
@@ -216,32 +215,6 @@ fn wire_pair_smoke() {
     p.join_both();
 }
 
-/// The `:status` of the first HEADERS frame in `bytes` (a request stream as read raw).
-fn status(bytes: &[u8]) -> Option<Vec<u8>> {
-    use h3wire::qpack::decoder::{Span, decode_field_section};
-    let mut b = bytes;
-    while !b.is_empty() {
-        let (ty, n) = h3wire::varint::decode(b)?;
-        let (len, m) = h3wire::varint::decode(&b[n..])?;
-        let payload = b.get(n + m..n + m + len as usize)?;
-        b = &b[n + m + len as usize..];
-        if ty != 0x01 {
-            continue; // DATA or a reserved frame
-        }
-        let (mut arena, mut fields) = (Vec::new(), Vec::new());
-        decode_field_section(payload, &mut arena, &mut fields).ok()?;
-        let get = |s: Span| match s {
-            Span::Static(v) => v.to_vec(),
-            Span::Arena(a, z) => arena[a as usize..z as usize].to_vec(),
-        };
-        return fields
-            .iter()
-            .find(|f| get(f.name) == b":status")
-            .map(|f| get(f.value));
-    }
-    None
-}
-
 /// adoption spec §6.2: the raw-H3 peer's valid GET (fixed bytes) gets a 200 from an
 /// `H3EchoServer` on each backend.
 #[test]
@@ -282,7 +255,7 @@ fn raw_peer_smoke() {
         {
             let seen = p.client.handle.lock();
             assert_eq!(
-                status(&seen.read).as_deref(),
+                field(&seen.read, b":status").as_deref(),
                 Some(&b"200"[..]),
                 "{b:?}: {seen:?}"
             );

From d4ff0b65e896588852f0a5f8afc07db8ce205c7e Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 12:38:24 +0900
Subject: [PATCH 19/33] test(integration): mq.req parity per matrixed request
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every matrixed pair_gateway request that the server logs now waits for
its mq.req line before shutdown and asserts the full record, field for
field (adoption spec §6.2). `assert_req` takes one expected record per
scenario: a timing field written `T` needs a value >= 0 (its stamps were
set), and -1 stays exact. The §5.3 (6) differences are written per cell:
`req_bytes` 50 on an xqc_h3 server and 0 on a Wire server for the short
and excess uploads.

Lines with `path="-"` are keyed by a per-cell `req_bytes`: the 403 drain
as before, and the direct-H3 CONNECT, which now carries a `cell + 1` byte
body. `cell_index(cells)` is the one source of that index. On a Wire
server the client's `stream_err` is asserted as H3_MESSAGE_ERROR, and the
cl-with-FIN cell also asserts that no `:status` and no FIN arrived.
---
 crates/mq-integration/tests/pair_gateway.rs | 147 ++++++++++++++++++--
 1 file changed, 133 insertions(+), 14 deletions(-)

diff --git a/crates/mq-integration/tests/pair_gateway.rs b/crates/mq-integration/tests/pair_gateway.rs
index 8dcbd66e..64727de8 100644
--- a/crates/mq-integration/tests/pair_gateway.rs
+++ b/crates/mq-integration/tests/pair_gateway.rs
@@ -72,6 +72,36 @@ fn wait_log(markers: &[&str]) -> String {
     find().unwrap()
 }
 
+/// adoption spec §6.2: `line` is the `mq.req` record `want` (written without its `mq.req
+/// cid=- ` prefix), field for field. A timing field written `T` in `want` (`ttfb_ms`,
+/// `duration_ms`, `origin_connect_ms`, `completion_ms`) only needs a value ≥ 0, i.e. its
+/// stamps were set; `-1` (a stamp unset) stays exact.
+fn assert_req(line: &str, want: &str) {
+    let got = line.split_once("mq.req cid=- ").map_or("", |(_, r)| r);
+    let (g, w): (Vec<&str>, Vec<&str>) = (got.split(' ').collect(), want.split(' ').collect());
+    assert_eq!(g.len(), w.len(), "\n got: {got}\nwant: {want}");
+    for (g, w) in g.iter().zip(&w) {
+        let ok = match w.strip_suffix("=T") {
+            Some(k) => g
+                .strip_prefix(k)
+                .and_then(|v| v.strip_prefix('='))
+                .is_some_and(|v| v.parse::<u64>().is_ok()),
+            None => g == w,
+        };
+        assert!(ok, "{w}\n got: {got}\nwant: {want}");
+    }
+}
+
+/// The `mq.req` line of the request to `path` (at most `T`).
+fn req_line(path: &str) -> String {
+    wait_log(&["mq.req", &format!("path=\"{path}\"")])
+}
+
+/// The cell's index (xx 0, xw 1, wx 2, ww 3), for a marker unique to the cell.
+fn cell_index((c, s): (Backend, Backend)) -> usize {
+    2 * usize::from(c == Backend::Wire) + usize::from(s == Backend::Wire)
+}
+
 // ---- the local fetch caller ----
 
 /// Sends `POST /_mqproxy/fetch` with `headers` and `body` (written on its own thread, so a
@@ -445,6 +475,12 @@ matrix!(
             "body differs ({} bytes)",
             r.body.len()
         );
+        let path = format!("/dl-{tag}");
+        let a = format!("127.0.0.1:{}", o.addr.port());
+        let want = format!(
+            "sid=4 method=GET status=200 authority=\"{a}\" path=\"{path}\" req_bytes=0 resp_bytes=8388608 ttfb_ms=T duration_ms=T origin_protocol=h2 origin_tls=ok content_encoding=none cache=bypass origin_reuse=0 origin_connect_ms=T mp_state=0 completion_ms=T reset=\"\""
+        );
+        assert_req(&req_line(&path), &want);
         assert_eq!(p.join_both(), (0, 0));
     }
 );
@@ -462,6 +498,12 @@ matrix!(
         assert_eq!(r.status, 200);
         assert_eq!(r.header("content-length"), Some("8388608"));
         assert!(r.body == body, "echo differs ({} bytes)", r.body.len());
+        let path = format!("/up-{tag}");
+        let want = format!(
+            "sid=4 method=PUT status=200 authority=\"{}\" path=\"{path}\" req_bytes=8388608 resp_bytes=8388608 ttfb_ms=T duration_ms=T origin_protocol=h1 origin_tls=na content_encoding=none cache=bypass origin_reuse=0 origin_connect_ms=T mp_state=0 completion_ms=T reset=\"\"",
+            o.addr
+        );
+        assert_req(&req_line(&path), &want);
         assert_eq!(p.join_both(), (0, 0));
     }
 );
@@ -575,6 +617,15 @@ matrix!(
         );
         assert_eq!((r.status, r.header("content-length")), (304, Some("100")));
         assert!(r.body.is_empty());
+        for (sid, method, status, addr, path) in [
+            (4, "HEAD", 200, head.addr, format!("/h-{tag}")),
+            (8, "GET", 304, nm.addr, format!("/n-{tag}")),
+        ] {
+            let want = format!(
+                "sid={sid} method={method} status={status} authority=\"{addr}\" path=\"{path}\" req_bytes=0 resp_bytes=0 ttfb_ms=T duration_ms=T origin_protocol=h1 origin_tls=na content_encoding=none cache=bypass origin_reuse=0 origin_connect_ms=T mp_state=0 completion_ms=T reset=\"\""
+            );
+            assert_req(&req_line(&path), &want);
+        }
         assert_eq!(p.join_both(), (0, 0));
     }
 );
@@ -603,6 +654,12 @@ matrix!(
         for i in 0..5 {
             assert_eq!(r.header(&format!("x-big-{i}")), Some(value.as_str()), "{i}");
         }
+        let path = format!("/big-{tag}");
+        let want = format!(
+            "sid=4 method=GET status=200 authority=\"{}\" path=\"{path}\" req_bytes=0 resp_bytes=2 ttfb_ms=T duration_ms=T origin_protocol=h1 origin_tls=na content_encoding=none cache=bypass origin_reuse=0 origin_connect_ms=T mp_state=0 completion_ms=T reset=\"\"",
+            origin.addr
+        );
+        assert_req(&req_line(&path), &want);
         assert_eq!(p.join_both(), (0, 0));
     }
 );
@@ -620,6 +677,13 @@ matrix!(
         let head = o.one().head;
         let want = format!("get /b-{tag}?q=/../x http/1.1\r\n");
         assert!(head.starts_with(&want), "{head}");
+        // The line keeps the path as sent, cut at `?`.
+        let path = format!("/a/../b-{tag}");
+        let want = format!(
+            "sid=4 method=GET status=200 authority=\"{}\" path=\"{path}\" req_bytes=0 resp_bytes=2 ttfb_ms=T duration_ms=T origin_protocol=h1 origin_tls=na content_encoding=none cache=bypass origin_reuse=0 origin_connect_ms=T mp_state=0 completion_ms=T reset=\"\"",
+            o.authority()
+        );
+        assert_req(&req_line(&path), &want);
         assert_eq!(p.join_both(), (0, 0));
     }
 );
@@ -640,6 +704,12 @@ matrix!(
         assert!(head.contains("\r\nx-test:"), "{head}");
         assert!(head.contains("\r\naccept:"), "{head}");
         assert!(!head.contains("*/*"), "{head}");
+        let path = format!("/empty-{tag}");
+        let want = format!(
+            "sid=4 method=GET status=200 authority=\"{}\" path=\"{path}\" req_bytes=0 resp_bytes=2 ttfb_ms=T duration_ms=T origin_protocol=h1 origin_tls=na content_encoding=none cache=bypass origin_reuse=0 origin_connect_ms=T mp_state=0 completion_ms=T reset=\"\"",
+            o.authority()
+        );
+        assert_req(&req_line(&path), &want);
         assert_eq!(p.join_both(), (0, 0));
     }
 );
@@ -668,6 +738,17 @@ matrix!(
         let r = parse(&r.expect("h1-forced request"));
         assert_eq!((r.status, r.body.len()), (200, 2));
         assert_eq!(o.accepted(), 1);
+        let path = format!("/c13-{tag}");
+        let a = format!("127.0.0.1:{}", o.addr.port());
+        // The two lines may close in either order: each is found by its stream id.
+        for (sid, reuse) in [(4, 0), (8, 1)] {
+            let marker = format!("path=\"{path}\"");
+            let line = wait_log(&["mq.req", &format!("sid={sid} "), &marker]);
+            let want = format!(
+                "sid={sid} method=GET status=200 authority=\"{a}\" path=\"{path}\" req_bytes=0 resp_bytes=2 ttfb_ms=T duration_ms=T origin_protocol=h1 origin_tls=ok content_encoding=none cache=bypass origin_reuse={reuse} origin_connect_ms=T mp_state=0 completion_ms=T reset=\"\""
+            );
+            assert_req(&line, &want);
+        }
         assert_eq!(p.join_both(), (0, 0));
     }
 );
@@ -692,9 +773,15 @@ matrix!(
             "{:?}",
             r.as_ref().map(|b| String::from_utf8_lossy(b).into_owned())
         );
-        // The reset is the server's (its check), not only the client's own body check.
-        let line = wait_log(&["mq.req", &format!("path=\"/h2-short-{tag}\"")]);
-        assert!(line.contains("reset=\"local reset\""), "{line}");
+        // The reset is the server's (its check), not only the client's own body check. The
+        // origin's failure leaves `origin_tls=connect_fail` and `origin_connect_ms=-1`; the
+        // reset leaves no FIN stamps.
+        let path = format!("/h2-short-{tag}");
+        let want = format!(
+            "sid=4 method=GET status=200 authority=\"127.0.0.1:{}\" path=\"{path}\" req_bytes=0 resp_bytes=50 ttfb_ms=T duration_ms=-1 origin_protocol=h2 origin_tls=connect_fail content_encoding=none cache=bypass origin_reuse=0 origin_connect_ms=-1 mp_state=0 completion_ms=-1 reset=\"local reset\"",
+            o.addr.port()
+        );
+        assert_req(&req_line(&path), &want);
         assert_eq!(p.join_both(), (0, 0));
     }
 );
@@ -720,8 +807,11 @@ matrix!(
             (":authority", "127.0.0.1:1"),
             ("x-mq-auth", &auth),
         ];
+        // Its line has `path="-"`: a body of `cell + 1` bytes (drained, `req_bytes`) marks it.
+        let n = cell_index(cells) + 1;
         let s = H3Script {
             headers: headers.map(|(n, v)| (n.into(), v.into())).to_vec(),
+            body: vec![0; n],
             ..H3Script::default()
         };
         let c = h3_client(p.server.udp_addr, s, cells.0);
@@ -731,6 +821,11 @@ matrix!(
             assert_eq!(h3_header(&r, ":status").as_deref(), Some("400"));
             assert_eq!(h3_header(&r, "x-mq-error").as_deref(), Some("bad-request"));
         }
+        let line = wait_log(&["mq.req", "status=400", &format!("req_bytes={n} ")]);
+        let want = format!(
+            "sid=0 method=- status=400 authority=\"-\" path=\"-\" req_bytes={n} resp_bytes=0 ttfb_ms=T duration_ms=T origin_protocol=none origin_tls=na content_encoding=none cache=bypass origin_reuse=0 origin_connect_ms=-1 mp_state=0 completion_ms=T reset=\"\""
+        );
+        assert_req(&line, &want);
         stop(c);
         assert_eq!(p.join_both(), (0, 0));
     }
@@ -745,8 +840,7 @@ matrix!(
     drain_after_403_counts_whole_body,
     |cells: (Backend, Backend), tag: &str| {
         let p = gateway(cells);
-        let cell = ["xx", "xw", "wx", "ww"].iter().position(|t| *t == tag);
-        let body_len = 4 * MIB + cell.unwrap();
+        let body_len = 4 * MIB + cell_index(cells);
         let extra = [("x-mq-auth", "Bearer wrong")];
         let path = format!("/drain-{tag}");
         let s = script("POST", "127.0.0.1:1", &path, &extra, vec![7; body_len]);
@@ -758,7 +852,11 @@ matrix!(
             assert_eq!(r.closed[0].0.stats.stream_err, 0, "{:?}", r.closed);
             assert_eq!(r.closed[0].0.stats.send_body, body_len as u64);
         }
-        wait_log(&["mq.req", "status=403", &format!("req_bytes={body_len} ")]);
+        let line = wait_log(&["mq.req", "status=403", &format!("req_bytes={body_len} ")]);
+        let want = format!(
+            "sid=0 method=- status=403 authority=\"-\" path=\"-\" req_bytes={body_len} resp_bytes=0 ttfb_ms=T duration_ms=T origin_protocol=none origin_tls=na content_encoding=none cache=bypass origin_reuse=0 origin_connect_ms=-1 mp_state=0 completion_ms=T reset=\"\""
+        );
+        assert_req(&line, &want);
         stop(c);
         assert_eq!(p.join_both(), (0, 0));
     }
@@ -767,7 +865,8 @@ matrix!(
 // spec §6.2 step 8, §10.3: `content-length: 10` with FIN on HEADERS reaches the origin
 // bodiless (no chunked framing, no positive length). adoption spec §5.3 (6): a `Wire` server
 // finds the mismatch in the read that delivers the HEADERS, so the gateway's intake read
-// fails (its line has `path="-"`, which no cell can match) and the origin sees nothing.
+// fails and the origin sees nothing. Its line has `path="-"` and no field unique to the
+// cell, so the cell asserts no `mq.req` (as the brief rules); the client sees the reset.
 matrix!(
     direct_h3_cl_with_fin_on_headers_is_bodiless,
     |cells: (Backend, Backend), tag: &str| {
@@ -780,8 +879,11 @@ matrix!(
         let c = h3_client(p.server.udp_addr, s, cells.0);
         if cells.1 == Backend::Wire {
             wait_h3(&c.handle, |r| !r.closed.is_empty());
-            let stats = c.handle.lock().closed[0].0.stats.clone();
-            assert_ne!(stats.stream_err, 0, "{stats:?}");
+            {
+                let r = c.handle.lock();
+                assert_eq!(r.closed[0].0.stats.stream_err, 0x10e, "{r:?}");
+                assert!(r.headers.is_empty() && !r.fin, "{r:?}");
+            }
             stop(c);
             assert_eq!(p.join_both(), (0, 0));
             assert!(o.settled().is_empty(), "the origin saw a request");
@@ -800,6 +902,11 @@ matrix!(
             .lines()
             .find_map(|l| l.strip_prefix("content-length:"));
         assert!(cl.is_none_or(|v| v.trim() == "0"), "{}", seen.head);
+        let want = format!(
+            "sid=0 method=POST status=200 authority=\"{}\" path=\"{path}\" req_bytes=0 resp_bytes=2 ttfb_ms=T duration_ms=T origin_protocol=h1 origin_tls=na content_encoding=none cache=bypass origin_reuse=0 origin_connect_ms=T mp_state=0 completion_ms=T reset=\"\"",
+            o.authority()
+        );
+        assert_req(&req_line(&path), &want);
         stop(c);
         assert_eq!(p.join_both(), (0, 0));
     }
@@ -829,6 +936,11 @@ matrix!(
             seen.head
         );
         assert_eq!(dechunk(&seen.body).as_deref(), Some(&b"hello body"[..]));
+        let want = format!(
+            "sid=0 method=GET status=200 authority=\"{}\" path=\"{path}\" req_bytes=10 resp_bytes=2 ttfb_ms=T duration_ms=T origin_protocol=h1 origin_tls=na content_encoding=none cache=bypass origin_reuse=0 origin_connect_ms=T mp_state=0 completion_ms=T reset=\"\"",
+            o.authority()
+        );
+        assert_req(&req_line(&path), &want);
         stop(c);
         assert_eq!(p.join_both(), (0, 0));
     }
@@ -836,8 +948,9 @@ matrix!(
 
 /// A direct-H3 upload the server must reset (§6.3): the client sees the reset, the server
 /// logs the request, and the origin never received a complete body. On a `Wire` server the
-/// reset is h3wire's (`H3_MESSAGE_ERROR`, adoption spec §5.3 (6)), and the gateway still logs
-/// it as `local reset`.
+/// reset is h3wire's (`H3_MESSAGE_ERROR`, adoption spec §5.3 (6)) and comes before any body
+/// byte reaches the gateway (`req_bytes=0`, where xqc_h3 delivers the 50 bytes); the gateway
+/// still logs it as `local reset`.
 fn upload_reset(cells: (Backend, Backend), path: &str, cl: &str, body: Vec<u8>) {
     let o = Capture::spawn();
     let p = gateway(cells);
@@ -846,13 +959,19 @@ fn upload_reset(cells: (Backend, Backend), path: &str, cl: &str, body: Vec<u8>)
     let s = script("POST", &o.authority(), path, &extra, body);
     let c = h3_client(p.server.udp_addr, s, cells.0);
     wait_h3(&c.handle, |r| !r.closed.is_empty());
+    let wire = cells.1 == Backend::Wire;
     {
         let r = c.handle.lock();
-        assert_ne!(r.closed[0].0.stats.stream_err, 0, "{r:?}");
+        let code = r.closed[0].0.stats.stream_err;
+        assert!(if wire { code == 0x10e } else { code != 0 }, "{r:?}");
         assert!(!r.fin, "{r:?}");
     }
-    let line = wait_log(&["mq.req", &format!("path=\"{path}\"")]);
-    assert!(line.contains("reset=\"local reset\""), "{line}");
+    let want = format!(
+        "sid=0 method=POST status=0 authority=\"{}\" path=\"{path}\" req_bytes={} resp_bytes=0 ttfb_ms=-1 duration_ms=-1 origin_protocol=none origin_tls=na content_encoding=none cache=bypass origin_reuse=0 origin_connect_ms=-1 mp_state=0 completion_ms=-1 reset=\"local reset\"",
+        o.authority(),
+        if wire { 0 } else { 50 },
+    );
+    assert_req(&req_line(path), &want);
     let seen = o.settled();
     assert!(seen.iter().all(|s| !s.complete), "{seen:?}");
     stop(c);

From 845ee979023bab4d9bb073d224e15df721aeb501 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 13:16:09 +0900
Subject: [PATCH 20/33] perf(mq-h3): sweep only dirty conns, dedupe level
 events in O(1)

Every call that takes `now` serviced every H3 conn, so a tunnel
stream op or a UDP-lane datagram paid O(H3 conns x stream map). Only
conns whose h3wire state an op touched, or that still wait on the
transport (a pending FIN, a short core-bytes write), are swept now;
event handlers keep servicing their own conn. The outer queue keeps its
level events as (kind, slot) flags instead of scanning the queue.
---
 crates/mq-h3/src/lib.rs     | 49 ++++++++++++++++++++++++++++---------
 crates/mq-h3/src/queue.rs   | 34 ++++++++++++++-----------
 crates/mq-h3/src/send.rs    | 34 +++++++++++++++++++------
 crates/mq-h3/tests/setup.rs | 20 +++++++++++++++
 4 files changed, 104 insertions(+), 33 deletions(-)

diff --git a/crates/mq-h3/src/lib.rs b/crates/mq-h3/src/lib.rs
index 6b402df4..6441f91d 100644
--- a/crates/mq-h3/src/lib.rs
+++ b/crates/mq-h3/src/lib.rs
@@ -18,7 +18,7 @@ use mq_transport_api::{
 };
 use queue::OutQueue;
 use req::Req;
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::net::SocketAddr;
 
 /// Bootstrap read size for a request stream (adoption spec §4.4).
@@ -32,6 +32,9 @@ pub struct H3Wire<T> {
     /// Request streams of H3 conns, by request id (adoption spec §4.3).
     reqs: HashMap<H3ReqId, Req>,
     conns: HashMap<ConnId, H3Conn>,
+    /// H3 conns whose h3wire state changed since their last `service`, or that still wait
+    /// on the transport (a pending FIN, a short core-bytes write): the only ones swept.
+    dirty: HashSet<ConnId>,
     /// Every stream of an H3 conn: its conn and quic id.
     streams: HashMap<StreamId, (ConnId, h3wire::StreamId)>,
     /// A `NewConn` was seen: the inner transport is a server. ponytail: learned, not
@@ -40,6 +43,9 @@ pub struct H3Wire<T> {
     /// The largest `h3_recv_body` buf so far: the carry bound (adoption spec §5.4).
     #[cfg(feature = "test-support")]
     max_buf: usize,
+    /// `service` runs so far.
+    #[cfg(feature = "test-support")]
+    services: u64,
 }
 
 impl<T: TransportOps> H3Wire<T> {
@@ -60,10 +66,13 @@ impl<T: TransportOps> H3Wire<T> {
             queue: OutQueue::default(),
             reqs: HashMap::new(),
             conns: HashMap::new(),
+            dirty: HashSet::new(),
             streams: HashMap::new(),
             server: false,
             #[cfg(feature = "test-support")]
             max_buf: 0,
+            #[cfg(feature = "test-support")]
+            services: 0,
         }
     }
 
@@ -79,6 +88,13 @@ impl<T: TransportOps> H3Wire<T> {
         self.inner
     }
 
+    /// Request `r`'s h3wire state may change: its conn is swept next (adoption spec §4.5).
+    fn touch(&mut self, r: H3ReqId) {
+        if let Some(q) = self.reqs.get(&r) {
+            self.dirty.insert(q.conn);
+        }
+    }
+
     /// The h3wire abort of request `r` (code, source), if it was aborted.
     #[cfg(feature = "test-support")]
     pub fn debug_abort(&self, r: H3ReqId) -> Option<(h3wire::H3Code, h3wire::AbortSource)> {
@@ -88,6 +104,12 @@ impl<T: TransportOps> H3Wire<T> {
         }
     }
 
+    /// How many times `service` ran.
+    #[cfg(feature = "test-support")]
+    pub fn debug_services(&self) -> u64 {
+        self.services
+    }
+
     /// Every request's carry <= max(BOOT_READ, largest buf passed so far), and every
     /// connection's h3wire `debug_buffered_bytes() <= debug_bound()` (adoption spec §5.4).
     #[cfg(feature = "test-support")]
@@ -100,17 +122,16 @@ impl<T: TransportOps> H3Wire<T> {
                 .all(|c| c.h3.debug_buffered_bytes() <= c.h3.debug_bound())
     }
 
-    /// Services every H3 conn, then moves the inner queue into ours, consuming what belongs
-    /// to H3 conns; runs at the end of every method that takes `now` (adoption spec §4.1).
+    /// Services the dirty H3 conns, then moves the inner queue into ours, consuming what
+    /// belongs to H3 conns; runs at the end of every method that takes `now` (adoption spec
+    /// §4.1).
     fn drive_inner(&mut self, now: Time) {
-        if self.active {
-            // Core bytes and actions after every call that takes `now` (adoption spec §4.5).
-            // Running first covers what this call changed; each event below services its
-            // own conn. ponytail: O(conns) per call; keep a dirty set if shards grow large.
-            let cs: Vec<ConnId> = self.conns.keys().copied().collect();
-            for c in cs {
-                self.service(now, c);
-            }
+        // Core bytes and actions after every call that takes `now` (adoption spec §4.5).
+        // Running first covers what this call changed; each event below services its own
+        // conn. A conn nothing touched has nothing to run, so only dirty ones are swept.
+        let cs: Vec<ConnId> = self.dirty.iter().copied().collect();
+        for c in cs {
+            self.service(now, c);
         }
         while let Some(e) = self.inner.poll_event() {
             let out = if self.active {
@@ -301,6 +322,7 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         fin: bool,
     ) -> Result<(), StreamError> {
         if self.active {
+            self.touch(r);
             return self.send_headers(now, r, hs, fin);
         }
         fwd!(self, now, self.inner.h3_send_headers(now, r, hs, fin))
@@ -314,6 +336,7 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         fin: bool,
     ) -> Result<usize, StreamError> {
         if self.active {
+            self.touch(r);
             return self.send_body(now, r, data, fin);
         }
         fwd!(self, now, self.inner.h3_send_body(now, r, data, fin))
@@ -321,6 +344,7 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
 
     fn h3_finish(&mut self, now: Time, r: H3ReqId) -> Result<(), StreamError> {
         if self.active {
+            self.touch(r);
             return self.finish(now, r);
         }
         fwd!(self, now, self.inner.h3_finish(now, r))
@@ -333,6 +357,7 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         each: &mut dyn FnMut(&[u8], &[u8]),
     ) -> Result<bool, StreamError> {
         if self.active {
+            self.touch(r);
             return self.recv_headers(now, r, each);
         }
         fwd!(self, now, self.inner.h3_recv_headers(now, r, each))
@@ -349,6 +374,7 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
             self.max_buf = self.max_buf.max(buf.len());
         }
         if self.active {
+            self.touch(r);
             return self.recv_body(now, r, buf);
         }
         fwd!(self, now, self.inner.h3_recv_body(now, r, buf))
@@ -356,6 +382,7 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
 
     fn h3_reset(&mut self, now: Time, r: H3ReqId) {
         if self.active {
+            self.touch(r);
             return self.reset(now, r);
         }
         fwd!(self, now, self.inner.h3_reset(now, r))
diff --git a/crates/mq-h3/src/queue.rs b/crates/mq-h3/src/queue.rs
index 76629309..f45e151b 100644
--- a/crates/mq-h3/src/queue.rs
+++ b/crates/mq-h3/src/queue.rs
@@ -1,23 +1,25 @@
 //! Outer event queue (adoption spec §4.1): level events coalesce, stale ones drop on pop.
 
-use mq_transport_api::Event;
-use std::collections::VecDeque;
+use mq_transport_api::{Event, SlotId};
+use std::collections::{HashSet, VecDeque};
+use std::mem::{Discriminant, discriminant};
 
 #[derive(Default)]
 pub(crate) struct OutQueue {
     q: VecDeque<Event>,
+    /// The level events in `q`, as flags (the bare transport's slot flags).
+    level: HashSet<(Discriminant<Event>, SlotId)>,
 }
 
-fn is_level(e: &Event) -> bool {
-    matches!(
-        e,
-        Event::StreamReadable(_)
-            | Event::StreamWritable(_)
-            | Event::DatagramReadable(_)
-            | Event::MpReady(_)
-            | Event::H3Readable(_)
-            | Event::H3Writable(_)
-    )
+/// A level event's flag: its kind and object.
+fn level(e: &Event) -> Option<(Discriminant<Event>, SlotId)> {
+    let slot = match *e {
+        Event::StreamReadable(s) | Event::StreamWritable(s) => s.slot(),
+        Event::DatagramReadable(c) | Event::MpReady(c) => c.slot(),
+        Event::H3Readable(r) | Event::H3Writable(r) => r.slot(),
+        _ => return None,
+    };
+    Some((discriminant(e), slot))
 }
 
 /// Close events are the last word on an id and are never dropped (adoption spec §4.1).
@@ -34,8 +36,9 @@ fn is_close(e: &Event) -> bool {
 impl OutQueue {
     /// A level event already queued is not queued twice.
     pub(crate) fn push(&mut self, e: Event) {
-        // ponytail: linear scan; queues are short per drain. Index by object if profiling says so.
-        if is_level(&e) && self.q.contains(&e) {
+        if let Some(f) = level(&e)
+            && !self.level.insert(f)
+        {
             return;
         }
         self.q.push_back(e);
@@ -44,6 +47,9 @@ impl OutQueue {
     /// The next event that is a close event or that `live` accepts.
     pub(crate) fn pop(&mut self, live: impl Fn(&Event) -> bool) -> Option<Event> {
         while let Some(e) = self.q.pop_front() {
+            if let Some(f) = level(&e) {
+                self.level.remove(&f);
+            }
             if is_close(&e) || live(&e) {
                 return Some(e);
             }
diff --git a/crates/mq-h3/src/send.rs b/crates/mq-h3/src/send.rs
index 26688039..b59b250b 100644
--- a/crates/mq-h3/src/send.rs
+++ b/crates/mq-h3/src/send.rs
@@ -319,12 +319,21 @@ impl<T: TransportOps> H3Wire<T> {
     }
 
     /// Executes `c`'s actions and writes its core bytes; runs whenever `c`'s h3wire state
-    /// may have changed, so also after every call that takes `now`.
+    /// may have changed, and after every call that takes `now` while `c` is dirty.
     pub(crate) fn service(&mut self, now: Time, c: ConnId) {
+        #[cfg(feature = "test-support")]
+        {
+            self.services += 1;
+        }
         self.retry_fins(now, c);
         self.run_actions(now, c);
-        self.flush(now, c);
+        let short = self.flush(now, c);
         self.run_actions(now, c); // `sent` may queue FinishStream
+        // Clean once nothing waits on the transport: no pending FIN, no short write.
+        match self.conns.get(&c) {
+            Some(conn) if short || !conn.fins.is_empty() => self.dirty.insert(c),
+            _ => self.dirty.remove(&c),
+        };
     }
 
     /// Pending FINs (adoption spec §4.5): kept while `Blocked`, dropped on any other
@@ -417,8 +426,9 @@ impl<T: TransportOps> H3Wire<T> {
 
     /// Writes core bytes per stream until the transport accepts less than offered. A
     /// request stream that drains fires its finish latch and wakes a gateway that was
-    /// `Blocked` behind them (adoption spec §4.5).
-    fn flush(&mut self, now: Time, c: ConnId) {
+    /// `Blocked` behind them (adoption spec §4.5). Returns whether a write was short or
+    /// `Blocked`: bytes wait on the transport.
+    fn flush(&mut self, now: Time, c: ConnId) -> bool {
         let Self {
             conns,
             reqs,
@@ -427,11 +437,12 @@ impl<T: TransportOps> H3Wire<T> {
             ..
         } = self;
         let Some(conn) = conns.get_mut(&c) else {
-            return;
+            return false;
         };
         if conn.closing {
-            return;
+            return false;
         }
+        let mut short = false;
         for q in conn.h3.sendable().collect::<Vec<_>>() {
             let Some(&s) = conn.mq.get(&q.0) else {
                 continue;
@@ -439,8 +450,13 @@ impl<T: TransportOps> H3Wire<T> {
             let mut req = reqs.get_mut(&req_id(s)).filter(|_| q.is_request());
             while let Some(bytes) = conn.h3.poll_send(q).filter(|b| !b.is_empty()) {
                 let len = bytes.len();
-                let Ok(n) = inner.stream_send(now, s, bytes, false) else {
-                    break;
+                // Another error is final for the stream: no retry owed.
+                let n = match inner.stream_send(now, s, bytes, false) {
+                    Ok(n) => n,
+                    Err(e) => {
+                        short |= e == StreamError::Blocked;
+                        break;
+                    }
                 };
                 if let Some(req) = req.as_mut().filter(|_| n > 0) {
                     req.headers_sent_at.get_or_insert(now);
@@ -448,6 +464,7 @@ impl<T: TransportOps> H3Wire<T> {
                 let sent = conn.h3.sent(q, n);
                 debug_assert!(sent.is_ok(), "sent({q:?}, {n}): {sent:?}");
                 if n < len {
+                    short = true;
                     break;
                 }
             }
@@ -458,6 +475,7 @@ impl<T: TransportOps> H3Wire<T> {
                 }
             }
         }
+        short
     }
 }
 
diff --git a/crates/mq-h3/tests/setup.rs b/crates/mq-h3/tests/setup.rs
index 1d5edf95..afab55b0 100644
--- a/crates/mq-h3/tests/setup.rs
+++ b/crates/mq-h3/tests/setup.rs
@@ -137,3 +137,23 @@ fn core_bytes_retried_on_bare_drive() {
     assert!(r.peer_events.contains(&h3wire::Event::PeerSettings));
     assert!(close_codes(&r).is_empty());
 }
+
+/// Raw-conn ops (tunnel streams, the UDP lane) and bare drives do not service an H3 conn
+/// whose h3wire state did not change (adoption spec §4.5 holds through the dirty set).
+#[cfg(feature = "test-support")]
+#[test]
+fn raw_ops_skip_clean_h3_conn() {
+    let mut r = Rig::server();
+    r.pump();
+    r.events();
+    let before = r.w.debug_services();
+    let raw = r.h.new_stream_id(); // a stream of some raw conn
+    assert_eq!(r.w.stream_send(r.now, raw, b"x", false), Ok(1));
+    let mut buf = [0u8; 16];
+    assert_eq!(
+        r.w.stream_recv(r.now, raw, &mut buf),
+        Err(mq_transport_api::StreamError::Blocked)
+    );
+    r.w.drive(r.now);
+    assert_eq!(r.w.debug_services(), before, "a clean H3 conn was serviced");
+}

From bd757795f2ecb5684852876d4ecd39e40255635c Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 13:16:14 +0900
Subject: [PATCH 21/33] test(mq-h3): keep an offered body fin in the property
 model

A gateway that offered `fin` has ended its body: a re-offer after a
Blocked or partial h3_send_body keeps the fin and adds no bytes. The
model dropped it, so H3Wire finished the stream the gateway still
believed open and a later contract-breaking h3_send_headers got Stale
before H3Closed (a PROPTEST_CASES=30000 run hit it at d4ff0b6).
---
 crates/mq-h3/tests/props.rs | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/crates/mq-h3/tests/props.rs b/crates/mq-h3/tests/props.rs
index b25e9aea..aa979998 100644
--- a/crates/mq-h3/tests/props.rs
+++ b/crates/mq-h3/tests/props.rs
@@ -99,6 +99,9 @@ struct Gw {
     /// `h3_send_headers` succeeded: the gateway sends body only after it.
     headers: bool,
     fin_sent: bool,
+    /// A body `fin` was offered: the gateway's body has ended, so a re-offer adds no
+    /// bytes and keeps the `fin`.
+    fin_offered: bool,
     /// The gateway got `fin` or `Err(Reset)` from a read, or called `h3_reset`.
     done: bool,
 }
@@ -288,7 +291,9 @@ impl Model {
                 let Some(g) = self.gw(r).filter(|g| g.headers && !g.fin_sent) else {
                     return;
                 };
-                let (id, offer) = (g.id, g.pending + add);
+                let add = if g.fin_offered { 0 } else { add };
+                let (id, offer, fin) = (g.id, g.pending + add, fin || g.fin_offered);
+                g.fin_offered = fin;
                 let data: Vec<u8> = (0..offer).map(|i| i as u8).collect();
                 let res = self.r.w.h3_send_body(now, id, &data, fin);
                 self.not_stale(id, res.err());
@@ -436,6 +441,7 @@ impl Model {
             pending: 0,
             headers: false,
             fin_sent: false,
+            fin_offered: false,
             done: false,
         });
     }

From 1922a6a9d6fbf6aad03cdf2818c7e036de6fb89a Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 13:17:39 +0900
Subject: [PATCH 22/33] test(integration): run pair_mitm in all four backend
 cells

spawn_mitm_on takes the (client, server) backends; spawn_mitm keeps the
xqc_h3 pair. Every pair_mitm scenario becomes a matrix! test. The cells
of a test that waits for an opaque-route log line run one at a time,
each waiting for a line logged after it started, since the line is the
same in every cell.

mq-h3: the MITM's empty-buffer terminal probe gets Rig tests: a bare
FIN gives (0, true) as on xqc_h3; framing alone before the FIN stays
Blocked (no byte fits an empty slice), which xqc_h3 answers (0, true).
---
 crates/mq-h3/tests/recv.rs               |  45 ++
 crates/mq-integration/src/loopback.rs    |  19 +-
 crates/mq-integration/tests/pair_mitm.rs | 735 +++++++++++++----------
 3 files changed, 465 insertions(+), 334 deletions(-)

diff --git a/crates/mq-h3/tests/recv.rs b/crates/mq-h3/tests/recv.rs
index 58bc929d..c4cd8ec6 100644
--- a/crates/mq-h3/tests/recv.rs
+++ b/crates/mq-h3/tests/recv.rs
@@ -534,3 +534,48 @@ fn oversized_headers_closes() {
             .any(|e| matches!(e, Event::H3Request(..) | Event::H3Readable(_)))
     );
 }
+
+/// The MITM's terminal probe `h3_recv_body(id, &mut [])` (mq-proxy `client/mitm/stream.rs`)
+/// answers as on xqc_h3: `Blocked` while payload or nothing is left, `(0, true)` once only
+/// the FIN is. The FIN comes alone here: the probe reads it into the empty carry and feeds
+/// it as a bare carried FIN (a carried FIN never outlives a feed otherwise: a slice passes it
+/// with the whole carry).
+#[test]
+fn empty_probe_bare_fin() {
+    let (mut r, id, _) = reading_request();
+    let body = body_of(100);
+    r.peer_send_body(Q(0), &body, false);
+    r.pump();
+    let probe = |r: &mut Rig| r.w.h3_recv_body(r.now, id, &mut []);
+    assert_eq!(probe(&mut r), Err(StreamError::Blocked), "payload left");
+    assert_eq!(
+        pull(&mut r, id, 4096),
+        [Ok((body, false)), Err(StreamError::Blocked)]
+    );
+    assert_eq!(probe(&mut r), Err(StreamError::Blocked), "nothing left");
+    r.peer_send_body(Q(0), &[], true);
+    r.pump();
+    assert_eq!(probe(&mut r), Ok((0, true)), "only the FIN left");
+}
+
+/// Framing alone (an empty DATA frame) left before the FIN: the probe feeds no byte (slices
+/// of at most `buf.len()`, adoption spec §4.4) and stays `Blocked`, where xqc_h3, which parsed
+/// the frame on arrival, answers `(0, true)`. Open against the spec (final-fix report, I3);
+/// the next read with a buffer ends the body.
+#[test]
+fn empty_probe_framing_before_fin() {
+    let (mut r, id, _) = reading_request();
+    let mut bytes = Vec::new();
+    h3wire::frame::encode_header(0x00, 3, &mut bytes);
+    bytes.extend_from_slice(b"abc");
+    h3wire::frame::encode_header(0x00, 0, &mut bytes);
+    r.deliver(Q(0), &bytes, true);
+    r.pump();
+    let mut buf = [0u8; 64];
+    assert_eq!(r.w.h3_recv_body(r.now, id, &mut buf), Ok((3, false)));
+    assert_eq!(
+        r.w.h3_recv_body(r.now, id, &mut []),
+        Err(StreamError::Blocked)
+    );
+    assert_eq!(r.w.h3_recv_body(r.now, id, &mut buf), Ok((0, true)));
+}
diff --git a/crates/mq-integration/src/loopback.rs b/crates/mq-integration/src/loopback.rs
index 37e17c25..e7087830 100644
--- a/crates/mq-integration/src/loopback.rs
+++ b/crates/mq-integration/src/loopback.rs
@@ -339,23 +339,36 @@ impl LoopbackProxy {
     /// against `Server::with_gateway` (`origin_ca` its only trust root); H3 on both
     /// transports. The client keeps its raw tunnel for the opaque relay.
     pub fn spawn_mitm(
+        client: ClientConfig,
+        server: ServerConfig,
+        origin_ca: &Path,
+        mitm: MitmConfig,
+        fixed_dst: SocketAddr,
+    ) -> LoopbackProxy {
+        let cells = (Backend::XqcH3, Backend::XqcH3);
+        Self::spawn_mitm_on(client, server, origin_ca, mitm, fixed_dst, cells)
+    }
+
+    /// `spawn_mitm` with the (client, server) H3 backends (adoption spec §6.2).
+    pub fn spawn_mitm_on(
         mut client: ClientConfig,
         mut server: ServerConfig,
         origin_ca: &Path,
         mitm: MitmConfig,
         fixed_dst: SocketAddr,
+        (client_b, server_b): (Backend, Backend),
     ) -> LoopbackProxy {
         server.gateway.get_or_insert_with(GatewayConfig::default);
         let tls = build_client_config(Some(origin_ca), &Vec::new).expect("origin CA");
         let respawn = move |udp: SocketAddr| {
             let (server, tls) = (server.clone(), tls.clone());
             DriverThread::spawn_on_addr(udp, driver_config(), Vec::new(), move |local| {
-                let t = transport(
+                let t = h3_transport(
                     Role::Server {
                         cert: cert("test.crt"),
                         key: cert("test.key"),
                     },
-                    true,
+                    server_b,
                 );
                 let app = Server::with_gateway(server, tls);
                 (Shard::new(t, app, local, 1), ())
@@ -369,7 +382,7 @@ impl LoopbackProxy {
             vec![(ListenKind::Fixed(fixed_dst), TRANSPARENT)],
             move |local, server_udp| {
                 client.server = server_udp;
-                let t = transport(Role::Client, true);
+                let t = h3_transport(Role::Client, client_b);
                 (Shard::new(t, Client::new(client), local, 2), ())
             },
         );
diff --git a/crates/mq-integration/tests/pair_mitm.rs b/crates/mq-integration/tests/pair_mitm.rs
index 179f4141..26cd5b2b 100644
--- a/crates/mq-integration/tests/pair_mitm.rs
+++ b/crates/mq-integration/tests/pair_mitm.rs
@@ -6,7 +6,8 @@
 
 use mq_integration::browser::{Body, Resp, TestBrowser, roots};
 use mq_integration::log_tap;
-use mq_integration::loopback::LoopbackProxy;
+use mq_integration::loopback::{Backend, LoopbackProxy};
+use mq_integration::matrix;
 use mq_integration::origin_server::{
     Handler, ORIGIN_CA, ORIGIN_CRT, OriginServer, OriginServerMode, Proto,
 };
@@ -22,9 +23,9 @@ use std::io::{Read, Write};
 use std::net::{Shutdown, SocketAddr, TcpListener, TcpStream};
 use std::os::unix::fs::PermissionsExt;
 use std::path::{Path, PathBuf};
-use std::sync::Arc;
 use std::sync::Once;
 use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex, MutexGuard};
 use std::thread::{self, JoinHandle};
 use std::time::{Duration, Instant};
 
@@ -66,7 +67,7 @@ fn p256() -> MitmConfig {
 }
 
 /// The pair, its `TRANSPARENT` accepts stamped with `origin` (R3).
-fn proxy(origin: SocketAddr, mitm: MitmConfig) -> LoopbackProxy {
+fn proxy(origin: SocketAddr, mitm: MitmConfig, cells: (Backend, Backend)) -> LoopbackProxy {
     // The routing decisions are logged at debug (SP4 spec §7.10). Once: `install` resets
     // the level to Info, which would race a parallel test's debug line.
     static TAP: Once = Once::new();
@@ -83,7 +84,7 @@ fn proxy(origin: SocketAddr, mitm: MitmConfig) -> LoopbackProxy {
         token: TOKEN.into(),
         ..ServerConfig::default()
     };
-    LoopbackProxy::spawn_mitm(client, server, Path::new(ORIGIN_CA), mitm, origin)
+    LoopbackProxy::spawn_mitm_on(client, server, Path::new(ORIGIN_CA), mitm, origin, cells)
 }
 
 fn origin(proto: Proto, handler: Handler) -> OriginServer {
@@ -139,11 +140,41 @@ fn wait_until(what: &str, cond: impl Fn() -> bool) {
     }
 }
 
-/// A `log_tap` line containing `marker` (at most `T`). Lines accumulate across the tests
-/// of this binary: each opaque reason is produced by one test only.
-fn wait_log(marker: &str) {
-    let seen = || log_tap::lines().iter().any(|l| l.contains(marker));
-    wait_until(&format!("a log line with {marker:?}"), seen);
+/// The cells of every test that waits for a log line run one at a time: lines accumulate
+/// across the tests of this binary, and each opaque reason is produced by one test only,
+/// but by every cell of it.
+static SERIAL: Mutex<()> = Mutex::new(());
+
+/// A log marker one cell waits for, with `SERIAL` held from before the cell starts.
+struct Logged {
+    marker: &'static str,
+    before: usize,
+    _serial: MutexGuard<'static, ()>,
+}
+
+impl Logged {
+    fn start(marker: &'static str) -> Logged {
+        let _serial = SERIAL.lock().unwrap_or_else(|e| e.into_inner());
+        let before = Logged::count(marker);
+        Logged {
+            marker,
+            before,
+            _serial,
+        }
+    }
+
+    fn count(marker: &str) -> usize {
+        log_tap::lines()
+            .iter()
+            .filter(|l| l.contains(marker))
+            .count()
+    }
+
+    /// A line with the marker logged since `start` (at most `T`).
+    fn wait(&self) {
+        let seen = || Logged::count(self.marker) > self.before;
+        wait_until(&format!("a log line with {:?}", self.marker), seen);
+    }
 }
 
 fn pattern(len: usize) -> Vec<u8> {
@@ -171,189 +202,207 @@ fn header<'a>(h: &'a [(String, Vec<u8>)], name: &str) -> Vec<&'a [u8]> {
 
 // ---- data ----
 
-/// SP4 spec §11.3: a byte-exact 8 MiB download, from an h1 and an h2 TLS origin.
-#[test]
-fn mitm_8mib_download_byte_exact_h1_and_h2_origin() {
-    let len = 8 * MIB;
-    for proto in [Proto::H1Tls, Proto::H2Tls] {
-        let o = origin(proto, Handler::FileBytes(len as u64));
-        let p = proxy(o.addr, p256());
+// SP4 spec §11.3: a byte-exact 8 MiB download, from an h1 and an h2 TLS origin.
+matrix!(
+    mitm_8mib_download_byte_exact_h1_and_h2_origin,
+    |cells: (Backend, Backend), _tag: &str| {
+        let len = 8 * MIB;
+        for proto in [Proto::H1Tls, Proto::H2Tls] {
+            let o = origin(proto, Handler::FileBytes(len as u64));
+            let p = proxy(o.addr, p256(), cells);
+            let b = mitm_browser(&p, o.addr);
+            let (status, h, body) = b.get("/dl", &[]);
+            assert_eq!(status, 200);
+            assert_eq!(h.get("content-length").unwrap(), "8388608");
+            assert!(body == pattern(len), "body differs ({} bytes)", body.len());
+            assert_eq!(p.join_both(), (0, 0));
+        }
+    }
+);
+
+// SP4 spec §7.5 step 6, §11.3: 8 MiB uploads echoed back, with a known length (forwarded
+// as `content-length`) and streamed (none).
+matrix!(
+    mitm_8mib_upload_known_cl_and_streaming,
+    |cells: (Backend, Backend), _tag: &str| {
+        let o = origin(Proto::H2Tls, Handler::Echo);
+        let p = proxy(o.addr, p256(), cells);
         let b = mitm_browser(&p, o.addr);
-        let (status, h, body) = b.get("/dl", &[]);
-        assert_eq!(status, 200);
-        assert_eq!(h.get("content-length").unwrap(), "8388608");
-        assert!(body == pattern(len), "body differs ({} bytes)", body.len());
+        let data = pattern(8 * MIB);
+        for (path, known) in [("/known", true), ("/streaming", false)] {
+            let (status, _, body) = b.post(path, &[], data.clone(), known);
+            assert_eq!(status, 200, "{path}");
+            assert!(body == data, "{path}: echo differs ({} bytes)", body.len());
+        }
+        let reqs = o.requests();
+        let cl = |path: &str| {
+            let r = reqs.iter().find(|r| r.path == path).expect("request");
+            header(&r.headers, "content-length").concat()
+        };
+        assert_eq!(cl("/known"), b"8388608");
+        assert_eq!(cl("/streaming"), b"");
         assert_eq!(p.join_both(), (0, 0));
     }
-}
-
-/// SP4 spec §7.5 step 6, §11.3: 8 MiB uploads echoed back, with a known length (forwarded
-/// as `content-length`) and streamed (none).
-#[test]
-fn mitm_8mib_upload_known_cl_and_streaming() {
-    let o = origin(Proto::H2Tls, Handler::Echo);
-    let p = proxy(o.addr, p256());
-    let b = mitm_browser(&p, o.addr);
-    let data = pattern(8 * MIB);
-    for (path, known) in [("/known", true), ("/streaming", false)] {
-        let (status, _, body) = b.post(path, &[], data.clone(), known);
-        assert_eq!(status, 200, "{path}");
-        assert!(body == data, "{path}: echo differs ({} bytes)", body.len());
-    }
-    let reqs = o.requests();
-    let cl = |path: &str| {
-        let r = reqs.iter().find(|r| r.path == path).expect("request");
-        header(&r.headers, "content-length").concat()
-    };
-    assert_eq!(cl("/known"), b"8388608");
-    assert_eq!(cl("/streaming"), b"");
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// SP4 spec §11.3: 16 concurrent streams on one browser connection.
-#[test]
-fn mitm_16_parallel_streams() {
-    let len = 256 * 1024;
-    let o = origin(Proto::H2Tls, Handler::FileBytes(len as u64));
-    let p = proxy(o.addr, p256());
-    let b = mitm_browser(&p, o.addr);
-    let all = b.get_parallel(16, "/p");
-    assert_eq!(all.len(), 16);
-    for (status, _, body) in all {
-        assert_eq!(status, 200);
-        assert!(body == pattern(len), "body differs ({} bytes)", body.len());
+);
+
+// SP4 spec §11.3: 16 concurrent streams on one browser connection.
+matrix!(
+    mitm_16_parallel_streams,
+    |cells: (Backend, Backend), _tag: &str| {
+        let len = 256 * 1024;
+        let o = origin(Proto::H2Tls, Handler::FileBytes(len as u64));
+        let p = proxy(o.addr, p256(), cells);
+        let b = mitm_browser(&p, o.addr);
+        let all = b.get_parallel(16, "/p");
+        assert_eq!(all.len(), 16);
+        for (status, _, body) in all {
+            assert_eq!(status, 200);
+            assert!(body == pattern(len), "body differs ({} bytes)", body.len());
+        }
+        assert_eq!(p.join_both(), (0, 0));
     }
-    assert_eq!(p.join_both(), (0, 0));
-}
+);
 
 // ---- request and response shape ----
 
-/// SP4 spec §7.5 step 4: a 6 KiB cookie sent as crumbs arrives as one joined field at an
-/// h1 origin.
-#[test]
-fn mitm_split_cookie_joined_at_h1_origin() {
-    let o = origin(Proto::H1Tls, Handler::Status(200));
-    let p = proxy(o.addr, p256());
-    let b = mitm_browser(&p, o.addr);
-    let crumbs: Vec<String> = (0..6)
-        .map(|i| format!("c{i}={}", "x".repeat(1020)))
-        .collect();
-    let hs: Vec<(&str, &[u8])> = crumbs.iter().map(|c| ("cookie", c.as_bytes())).collect();
-    assert_eq!(b.get("/cookie", &hs).0, 200);
-    let reqs = o.requests();
-    let r = reqs.iter().find(|r| r.path == "/cookie").expect("request");
-    assert_eq!(header(&r.headers, "cookie"), [crumbs.join("; ").as_bytes()]);
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// SP4 spec §5, §11.3: a 4 KiB `:path` and a 6 KiB CSP response header pass.
-#[test]
-fn mitm_4k_path_and_6k_csp() {
-    let csp = "a".repeat(6 * 1024);
-    let h = Handler::WithHeaders(
-        vec![("content-security-policy", csp.clone())],
-        Box::new(Handler::Status(200)),
-    );
-    let o = origin(Proto::H2Tls, h);
-    let p = proxy(o.addr, p256());
-    let b = mitm_browser(&p, o.addr);
-    let path = format!("/long?q={}", "q".repeat(4 * 1024));
-    let (status, h, _) = b.get(&path, &[]);
-    assert_eq!(status, 200);
-    assert_eq!(h.get("content-security-policy").unwrap(), &csp[..]);
-    assert!(o.requests().iter().any(|r| r.path == path), "path not seen");
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// SP4 spec §5 "Methods", "Empty header values": both reach the origin unchanged.
-#[test]
-fn mitm_lowercase_method_and_empty_header_reach_origin() {
-    let o = origin(Proto::H1Tls, Handler::Status(200));
-    let p = proxy(o.addr, p256());
-    let b = mitm_browser(&p, o.addr);
-    let r = b.request("purgeit", None, "/m", &[("x-empty", b"")], Body::Empty);
-    assert_eq!(r.expect("request").0, 200);
-    let reqs = o.requests();
-    let r = reqs.iter().find(|r| r.path == "/m").expect("request");
-    assert_eq!(r.method, "purgeit");
-    assert_eq!(header(&r.headers, "x-empty"), [b""]);
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// SP4 spec §5 "Browser h2 side" and "Errors": a browser section over `SECTION_MAX` gets
-/// h2's own 431 or a reset; a rendered head over a limit gets 400 `header-too-long`; a
-/// response over a limit gets 502 `upstream-protocol`.
-#[test]
-fn mitm_over_limit_400_or_431_and_502() {
-    let h = Handler::PerPath(vec![("/big-resp", Handler::HeaderListBytes(9000))]);
-    let o = origin(Proto::H2Tls, h);
-    let p = proxy(o.addr, p256());
-    let b = mitm_browser(&p, o.addr);
-
-    // 5 × 7000 bytes: every field within FIELD_MAX, the section over SECTION_MAX.
-    let v = vec![b'v'; 7000];
-    let names: Vec<String> = (0..5).map(|i| format!("x-big{i}")).collect();
-    let hs: Vec<(&str, &[u8])> = names.iter().map(|n| (n.as_str(), &v[..])).collect();
-    match b.request("GET", None, "/section", &hs, Body::Empty) {
-        Ok(r) => assert_eq!(r.0, 431),
-        Err(e) => assert!(e.is_reset(), "{e}"),
+// SP4 spec §7.5 step 4: a 6 KiB cookie sent as crumbs arrives as one joined field at an
+// h1 origin.
+matrix!(
+    mitm_split_cookie_joined_at_h1_origin,
+    |cells: (Backend, Backend), _tag: &str| {
+        let o = origin(Proto::H1Tls, Handler::Status(200));
+        let p = proxy(o.addr, p256(), cells);
+        let b = mitm_browser(&p, o.addr);
+        let crumbs: Vec<String> = (0..6)
+            .map(|i| format!("c{i}={}", "x".repeat(1020)))
+            .collect();
+        let hs: Vec<(&str, &[u8])> = crumbs.iter().map(|c| ("cookie", c.as_bytes())).collect();
+        assert_eq!(b.get("/cookie", &hs).0, 200);
+        let reqs = o.requests();
+        let r = reqs.iter().find(|r| r.path == "/cookie").expect("request");
+        assert_eq!(header(&r.headers, "cookie"), [crumbs.join("; ").as_bytes()]);
+        assert_eq!(p.join_both(), (0, 0));
     }
+);
+
+// SP4 spec §5, §11.3: a 4 KiB `:path` and a 6 KiB CSP response header pass.
+matrix!(
+    mitm_4k_path_and_6k_csp,
+    |cells: (Backend, Backend), _tag: &str| {
+        let csp = "a".repeat(6 * 1024);
+        let h = Handler::WithHeaders(
+            vec![("content-security-policy", csp.clone())],
+            Box::new(Handler::Status(200)),
+        );
+        let o = origin(Proto::H2Tls, h);
+        let p = proxy(o.addr, p256(), cells);
+        let b = mitm_browser(&p, o.addr);
+        let path = format!("/long?q={}", "q".repeat(4 * 1024));
+        let (status, h, _) = b.get(&path, &[]);
+        assert_eq!(status, 200);
+        assert_eq!(h.get("content-security-policy").unwrap(), &csp[..]);
+        assert!(o.requests().iter().any(|r| r.path == path), "path not seen");
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// SP4 spec §5 "Methods", "Empty header values": both reach the origin unchanged.
+matrix!(
+    mitm_lowercase_method_and_empty_header_reach_origin,
+    |cells: (Backend, Backend), _tag: &str| {
+        let o = origin(Proto::H1Tls, Handler::Status(200));
+        let p = proxy(o.addr, p256(), cells);
+        let b = mitm_browser(&p, o.addr);
+        let r = b.request("purgeit", None, "/m", &[("x-empty", b"")], Body::Empty);
+        assert_eq!(r.expect("request").0, 200);
+        let reqs = o.requests();
+        let r = reqs.iter().find(|r| r.path == "/m").expect("request");
+        assert_eq!(r.method, "purgeit");
+        assert_eq!(header(&r.headers, "x-empty"), [b""]);
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// SP4 spec §5 "Browser h2 side" and "Errors": a browser section over `SECTION_MAX` gets
+// h2's own 431 or a reset; a rendered head over a limit gets 400 `header-too-long`; a
+// response over a limit gets 502 `upstream-protocol`.
+matrix!(
+    mitm_over_limit_400_or_431_and_502,
+    |cells: (Backend, Backend), _tag: &str| {
+        let h = Handler::PerPath(vec![("/big-resp", Handler::HeaderListBytes(9000))]);
+        let o = origin(Proto::H2Tls, h);
+        let p = proxy(o.addr, p256(), cells);
+        let b = mitm_browser(&p, o.addr);
 
-    // One 9000-byte field: under SECTION_MAX for h2, over FIELD_MAX for the render.
-    let v = vec![b'v'; 9000];
-    let r = b.request("GET", None, "/field", &[("x-big", &v)], Body::Empty);
-    let r = r.expect("request");
-    assert_eq!(
-        (r.0.as_u16(), xmq_error(&r)),
-        (400, Some("header-too-long"))
-    );
-
-    let r = b.get("/big-resp", &[]);
-    assert_eq!(
-        (r.0.as_u16(), xmq_error(&r)),
-        (502, Some("upstream-protocol"))
-    );
-    assert!(
-        !o.requests()
-            .iter()
-            .any(|r| r.path == "/section" || r.path == "/field")
-    );
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// SP4 spec §7.7 (D9): `alt-svc` is dropped; other headers stay.
-#[test]
-fn mitm_alt_svc_stripped() {
-    let h = Handler::WithHeaders(
-        vec![
-            ("alt-svc", "h3=\":443\"; ma=86400".into()),
-            ("x-kept", "yes".into()),
-        ],
-        Box::new(Handler::Status(200)),
-    );
-    let o = origin(Proto::H2Tls, h);
-    let p = proxy(o.addr, p256());
-    let b = mitm_browser(&p, o.addr);
-    let (status, h, _) = b.get("/alt", &[]);
-    assert_eq!(status, 200);
-    assert_eq!(h.get("x-kept").unwrap(), "yes");
-    assert!(h.get("alt-svc").is_none(), "{h:?}");
-    assert_eq!(p.join_both(), (0, 0));
-}
+        // 5 × 7000 bytes: every field within FIELD_MAX, the section over SECTION_MAX.
+        let v = vec![b'v'; 7000];
+        let names: Vec<String> = (0..5).map(|i| format!("x-big{i}")).collect();
+        let hs: Vec<(&str, &[u8])> = names.iter().map(|n| (n.as_str(), &v[..])).collect();
+        match b.request("GET", None, "/section", &hs, Body::Empty) {
+            Ok(r) => assert_eq!(r.0, 431),
+            Err(e) => assert!(e.is_reset(), "{e}"),
+        }
 
-/// SP4 spec §7.5 step 3: `:authority` ≠ SNI → 421, no `x-mq-error`, nothing forwarded.
-#[test]
-fn mitm_421_on_authority_mismatch() {
-    let o = origin(Proto::H2Tls, Handler::Status(200));
-    let p = proxy(o.addr, p256());
-    let b = mitm_browser(&p, o.addr);
-    let other = format!("other.localhost:{}", o.addr.port());
-    let r = b.request("GET", Some(&other), "/misdirected", &[], Body::Empty);
-    let r = r.expect("request");
-    assert_eq!((r.0.as_u16(), xmq_error(&r)), (421, None));
-    assert!(!o.requests().iter().any(|r| r.path == "/misdirected"));
-    assert_eq!(p.join_both(), (0, 0));
-}
+        // One 9000-byte field: under SECTION_MAX for h2, over FIELD_MAX for the render.
+        let v = vec![b'v'; 9000];
+        let r = b.request("GET", None, "/field", &[("x-big", &v)], Body::Empty);
+        let r = r.expect("request");
+        assert_eq!(
+            (r.0.as_u16(), xmq_error(&r)),
+            (400, Some("header-too-long"))
+        );
+
+        let r = b.get("/big-resp", &[]);
+        assert_eq!(
+            (r.0.as_u16(), xmq_error(&r)),
+            (502, Some("upstream-protocol"))
+        );
+        assert!(
+            !o.requests()
+                .iter()
+                .any(|r| r.path == "/section" || r.path == "/field")
+        );
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// SP4 spec §7.7 (D9): `alt-svc` is dropped; other headers stay.
+matrix!(
+    mitm_alt_svc_stripped,
+    |cells: (Backend, Backend), _tag: &str| {
+        let h = Handler::WithHeaders(
+            vec![
+                ("alt-svc", "h3=\":443\"; ma=86400".into()),
+                ("x-kept", "yes".into()),
+            ],
+            Box::new(Handler::Status(200)),
+        );
+        let o = origin(Proto::H2Tls, h);
+        let p = proxy(o.addr, p256(), cells);
+        let b = mitm_browser(&p, o.addr);
+        let (status, h, _) = b.get("/alt", &[]);
+        assert_eq!(status, 200);
+        assert_eq!(h.get("x-kept").unwrap(), "yes");
+        assert!(h.get("alt-svc").is_none(), "{h:?}");
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// SP4 spec §7.5 step 3: `:authority` ≠ SNI → 421, no `x-mq-error`, nothing forwarded.
+matrix!(
+    mitm_421_on_authority_mismatch,
+    |cells: (Backend, Backend), _tag: &str| {
+        let o = origin(Proto::H2Tls, Handler::Status(200));
+        let p = proxy(o.addr, p256(), cells);
+        let b = mitm_browser(&p, o.addr);
+        let other = format!("other.localhost:{}", o.addr.port());
+        let r = b.request("GET", Some(&other), "/misdirected", &[], Body::Empty);
+        let r = r.expect("request");
+        assert_eq!((r.0.as_u16(), xmq_error(&r)), (421, None));
+        assert!(!o.requests().iter().any(|r| r.path == "/misdirected"));
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
 
 // ---- tunnel ----
 
@@ -390,127 +439,145 @@ fn during_outage(b: &TestBrowser, path: &str, unavailable: &Cell<bool>) -> Outag
     }
 }
 
-/// SP4 spec §10: with the tunnel down, a request gets 502 `tunnel-unavailable` and the
-/// browser connection stays usable.
-#[test]
-fn mitm_tunnel_down_502() {
-    let o = origin(Proto::H2Tls, Handler::Status(200));
-    let p = proxy(o.addr, p256());
-    let b = mitm_browser(&p, o.addr);
-    assert_eq!(b.get("/before", &[]).0, 200);
-    p.server.shutdown.trigger();
-    let seen = Cell::new(false);
-    wait_until("502 tunnel-unavailable", || {
-        during_outage(&b, "/down", &seen) == Outage::Unavailable
-    });
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// Review Focus 1: the tunnel drops (server restart) while a MITM stream is in flight.
-/// That stream ends with 502 `upstream-reset` (SP4 spec §10) or a stream reset; requests during the outage follow
-/// `during_outage`'s order; once the tunnel is back, the same browser
-/// connection is served on it. `TestBrowser` never redials, so a success on its one
-/// `SendRequest` after the restart is that connection.
-#[test]
-fn mitm_survives_tunnel_reconnect() {
-    let h = Handler::PerPath(vec![
-        ("/hang", Handler::HangNoResponse),
-        ("/before", Handler::Status(200)),
-        ("/after", Handler::Status(200)),
-    ]);
-    let o = origin(Proto::H2Tls, h);
-    let mut p = proxy(o.addr, p256());
-    let b = mitm_browser(&p, o.addr);
-    assert_eq!(b.get("/before", &[]).0, 200);
-
-    let hang = b.start_get("/hang");
-    b.drive_until(|| o.requests().iter().any(|r| r.path == "/hang"));
-    p.restart_server();
-    match b.finish(hang) {
-        Ok(r) => assert_eq!((r.0.as_u16(), xmq_error(&r)), (502, Some("upstream-reset"))),
-        Err(e) => assert!(e.is_reset() && !e.is_go_away() && !e.is_io(), "{e}"),
+// SP4 spec §10: with the tunnel down, a request gets 502 `tunnel-unavailable` and the
+// browser connection stays usable.
+matrix!(
+    mitm_tunnel_down_502,
+    |cells: (Backend, Backend), _tag: &str| {
+        let o = origin(Proto::H2Tls, Handler::Status(200));
+        let p = proxy(o.addr, p256(), cells);
+        let b = mitm_browser(&p, o.addr);
+        assert_eq!(b.get("/before", &[]).0, 200);
+        p.server.shutdown.trigger();
+        let seen = Cell::new(false);
+        wait_until("502 tunnel-unavailable", || {
+            during_outage(&b, "/down", &seen) == Outage::Unavailable
+        });
+        assert_eq!(p.join_both(), (0, 0));
     }
+);
+
+// Review Focus 1: the tunnel drops (server restart) while a MITM stream is in flight.
+// That stream ends with 502 `upstream-reset` (SP4 spec §10) or a stream reset; requests during the outage follow
+// `during_outage`'s order; once the tunnel is back, the same browser
+// connection is served on it. `TestBrowser` never redials, so a success on its one
+// `SendRequest` after the restart is that connection.
+matrix!(
+    mitm_survives_tunnel_reconnect,
+    |cells: (Backend, Backend), _tag: &str| {
+        let h = Handler::PerPath(vec![
+            ("/hang", Handler::HangNoResponse),
+            ("/before", Handler::Status(200)),
+            ("/after", Handler::Status(200)),
+        ]);
+        let o = origin(Proto::H2Tls, h);
+        let mut p = proxy(o.addr, p256(), cells);
+        let b = mitm_browser(&p, o.addr);
+        assert_eq!(b.get("/before", &[]).0, 200);
+
+        let hang = b.start_get("/hang");
+        b.drive_until(|| o.requests().iter().any(|r| r.path == "/hang"));
+        p.restart_server();
+        match b.finish(hang) {
+            Ok(r) => assert_eq!((r.0.as_u16(), xmq_error(&r)), (502, Some("upstream-reset"))),
+            Err(e) => assert!(e.is_reset() && !e.is_go_away() && !e.is_io(), "{e}"),
+        }
 
-    let seen = Cell::new(false);
-    wait_until("a 200 on the new tunnel", || {
-        during_outage(&b, "/after", &seen) == Outage::Served
-    });
-    assert_eq!(p.join_both(), (0, 0));
-}
+        let seen = Cell::new(false);
+        wait_until("a 200 on the new tunnel", || {
+            during_outage(&b, "/after", &seen) == Outage::Served
+        });
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
 
 // ---- opaque routes: the origin's own certificate, verified with the origin CA ----
 
-/// SP4 spec §7.3 route step 3: no `h2` in ALPN → opaque.
-#[test]
-fn opaque_no_h2_alpn() {
+// SP4 spec §7.3 route step 3: no `h2` in ALPN → opaque.
+matrix!(opaque_no_h2_alpn, |cells: (Backend, Backend),
+                            _tag: &str| {
+    let log = Logged::start("opaque(NoH2)");
     let o = origin(Proto::H2Tls, Handler::Status(200));
-    let p = proxy(o.addr, p256());
+    let p = proxy(o.addr, p256(), cells);
     let b = browser(&p, o.addr, Path::new(ORIGIN_CA));
     assert_origin_chain(&b.tls_only(&[b"http/1.1"], "localhost"));
-    wait_log("opaque(NoH2)");
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// SP4 spec §7.3 route step 4: an ignored host → opaque; h2 then runs with the origin.
-#[test]
-fn opaque_ignored_host() {
-    let o = origin(Proto::H2Tls, Handler::Status(200));
-    let p = proxy(
-        o.addr,
-        mitm_cfg("ca-p256", &["localhost"], MitmTuning::default()),
-    );
-    let b = browser(&p, o.addr, Path::new(ORIGIN_CA));
-    assert_origin_chain(&b.tls_only(&[b"h2"], "localhost"));
-    assert_eq!(b.get("/direct", &[]).0, 200);
-    assert!(o.requests().iter().any(|r| r.path == "/direct"));
-    wait_log("opaque(Ignored)");
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// SP4 spec §7.3 "Peek": bytes that are not TLS → opaque, relayed as they are.
-#[test]
-fn opaque_non_tls_bytes() {
-    let o = origin(Proto::H1Plain, Handler::Status(200));
-    let p = proxy(o.addr, p256());
-    let mut s = TcpStream::connect(p.mitm_addr()).unwrap();
-    s.set_read_timeout(Some(T)).unwrap();
-    s.write_all(b"GET /plain HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
-        .unwrap();
-    let mut reply = Vec::new();
-    s.read_to_end(&mut reply).unwrap();
-    assert!(reply.starts_with(b"HTTP/1.1 200"), "{reply:?}");
-    wait_log("opaque(NotTls)");
+    log.wait();
     assert_eq!(p.join_both(), (0, 0));
-}
-
-/// SP4 spec §7.3 route step 5: an SNI outside a NameConstraints CA's scope → opaque.
-#[test]
-fn opaque_out_of_scope_constrained_ca() {
-    let o = origin(Proto::H2Tls, Handler::Status(200));
-    let mitm = mitm_cfg("ca-dns-constraint", &[], MitmTuning::default());
-    let p = proxy(o.addr, mitm);
-    let b = browser(&p, o.addr, Path::new(ORIGIN_CA));
-    assert_origin_chain(&b.tls_only(&[b"h2"], "localhost"));
-    wait_log("opaque(OutOfCaScope)");
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// SP4 spec §7.3: no ClientHello within the peek deadline → opaque; a handshake started
-/// afterwards reaches the origin.
-#[test]
-fn opaque_peek_timeout() {
-    let o = origin(Proto::H2Tls, Handler::Status(200));
-    let tuning = MitmTuning {
-        peek: Duration::from_millis(200),
-        ..MitmTuning::default()
-    };
-    let p = proxy(o.addr, mitm_cfg("ca-p256", &[], tuning));
-    let b = browser(&p, o.addr, Path::new(ORIGIN_CA));
-    let tcp = TcpStream::connect(p.mitm_addr()).unwrap();
-    wait_log("opaque(Timeout)");
-    assert_origin_chain(&b.tls_on(tcp, &[b"h2"], "localhost"));
-    assert_eq!(p.join_both(), (0, 0));
-}
+});
+
+// SP4 spec §7.3 route step 4: an ignored host → opaque; h2 then runs with the origin.
+matrix!(
+    opaque_ignored_host,
+    |cells: (Backend, Backend), _tag: &str| {
+        let log = Logged::start("opaque(Ignored)");
+        let o = origin(Proto::H2Tls, Handler::Status(200));
+        let p = proxy(
+            o.addr,
+            mitm_cfg("ca-p256", &["localhost"], MitmTuning::default()),
+            cells,
+        );
+        let b = browser(&p, o.addr, Path::new(ORIGIN_CA));
+        assert_origin_chain(&b.tls_only(&[b"h2"], "localhost"));
+        assert_eq!(b.get("/direct", &[]).0, 200);
+        assert!(o.requests().iter().any(|r| r.path == "/direct"));
+        log.wait();
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// SP4 spec §7.3 "Peek": bytes that are not TLS → opaque, relayed as they are.
+matrix!(
+    opaque_non_tls_bytes,
+    |cells: (Backend, Backend), _tag: &str| {
+        let log = Logged::start("opaque(NotTls)");
+        let o = origin(Proto::H1Plain, Handler::Status(200));
+        let p = proxy(o.addr, p256(), cells);
+        let mut s = TcpStream::connect(p.mitm_addr()).unwrap();
+        s.set_read_timeout(Some(T)).unwrap();
+        s.write_all(b"GET /plain HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
+            .unwrap();
+        let mut reply = Vec::new();
+        s.read_to_end(&mut reply).unwrap();
+        assert!(reply.starts_with(b"HTTP/1.1 200"), "{reply:?}");
+        log.wait();
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// SP4 spec §7.3 route step 5: an SNI outside a NameConstraints CA's scope → opaque.
+matrix!(
+    opaque_out_of_scope_constrained_ca,
+    |cells: (Backend, Backend), _tag: &str| {
+        let log = Logged::start("opaque(OutOfCaScope)");
+        let o = origin(Proto::H2Tls, Handler::Status(200));
+        let mitm = mitm_cfg("ca-dns-constraint", &[], MitmTuning::default());
+        let p = proxy(o.addr, mitm, cells);
+        let b = browser(&p, o.addr, Path::new(ORIGIN_CA));
+        assert_origin_chain(&b.tls_only(&[b"h2"], "localhost"));
+        log.wait();
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// SP4 spec §7.3: no ClientHello within the peek deadline → opaque; a handshake started
+// afterwards reaches the origin.
+matrix!(
+    opaque_peek_timeout,
+    |cells: (Backend, Backend), _tag: &str| {
+        let log = Logged::start("opaque(Timeout)");
+        let o = origin(Proto::H2Tls, Handler::Status(200));
+        let tuning = MitmTuning {
+            peek: Duration::from_millis(200),
+            ..MitmTuning::default()
+        };
+        let p = proxy(o.addr, mitm_cfg("ca-p256", &[], tuning), cells);
+        let b = browser(&p, o.addr, Path::new(ORIGIN_CA));
+        let tcp = TcpStream::connect(p.mitm_addr()).unwrap();
+        log.wait();
+        assert_origin_chain(&b.tls_on(tcp, &[b"h2"], "localhost"));
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
 
 /// A plain TCP origin that reads to EOF, writes back what it read, and closes.
 fn echo_to_eof() -> (SocketAddr, JoinHandle<Vec<u8>>) {
@@ -527,40 +594,46 @@ fn echo_to_eof() -> (SocketAddr, JoinHandle<Vec<u8>>) {
     (addr, t)
 }
 
-/// SP4 spec §7.3 "EOF and errors while peeking": a half-close with bytes in rx → opaque;
-/// the relay carries the bytes and the EOF, and the answer still comes back.
-#[test]
-fn opaque_peek_eof_half_close() {
-    let (addr, origin) = echo_to_eof();
-    let p = proxy(addr, p256());
-    let mut s = TcpStream::connect(p.mitm_addr()).unwrap();
-    s.set_read_timeout(Some(T)).unwrap();
-    // A TLS record header prefix: the peek waits for more, then sees the EOF.
-    let sent = [0x16, 0x03, 0x01, 0x00];
-    s.write_all(&sent).unwrap();
-    s.shutdown(Shutdown::Write).unwrap();
-    let mut reply = Vec::new();
-    s.read_to_end(&mut reply).unwrap();
-    assert_eq!(reply, sent);
-    assert_eq!(origin.join().unwrap(), sent);
-    wait_log("opaque(Eof)");
-    assert_eq!(p.join_both(), (0, 0));
-}
-
-/// SP4 spec §7.3 "Accept" step 2: at `max_conns` (lowered to 1) a new flow goes opaque.
-#[test]
-fn opaque_at_capacity() {
-    let o = origin(Proto::H2Tls, Handler::Status(200));
-    let tuning = MitmTuning {
-        max_conns: 1,
-        ..MitmTuning::default()
-    };
-    let p = proxy(o.addr, mitm_cfg("ca-p256", &[], tuning));
-    // The one MITM conn, live.
-    let held = mitm_browser(&p, o.addr);
-    let b = browser(&p, o.addr, Path::new(ORIGIN_CA));
-    assert_origin_chain(&b.tls_only(&[b"h2"], "localhost"));
-    assert_eq!(held.get("/still", &[]).0, 200);
-    wait_log("opaque(AtCapacity)");
-    assert_eq!(p.join_both(), (0, 0));
-}
+// SP4 spec §7.3 "EOF and errors while peeking": a half-close with bytes in rx → opaque;
+// the relay carries the bytes and the EOF, and the answer still comes back.
+matrix!(
+    opaque_peek_eof_half_close,
+    |cells: (Backend, Backend), _tag: &str| {
+        let log = Logged::start("opaque(Eof)");
+        let (addr, origin) = echo_to_eof();
+        let p = proxy(addr, p256(), cells);
+        let mut s = TcpStream::connect(p.mitm_addr()).unwrap();
+        s.set_read_timeout(Some(T)).unwrap();
+        // A TLS record header prefix: the peek waits for more, then sees the EOF.
+        let sent = [0x16, 0x03, 0x01, 0x00];
+        s.write_all(&sent).unwrap();
+        s.shutdown(Shutdown::Write).unwrap();
+        let mut reply = Vec::new();
+        s.read_to_end(&mut reply).unwrap();
+        assert_eq!(reply, sent);
+        assert_eq!(origin.join().unwrap(), sent);
+        log.wait();
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// SP4 spec §7.3 "Accept" step 2: at `max_conns` (lowered to 1) a new flow goes opaque.
+matrix!(
+    opaque_at_capacity,
+    |cells: (Backend, Backend), _tag: &str| {
+        let log = Logged::start("opaque(AtCapacity)");
+        let o = origin(Proto::H2Tls, Handler::Status(200));
+        let tuning = MitmTuning {
+            max_conns: 1,
+            ..MitmTuning::default()
+        };
+        let p = proxy(o.addr, mitm_cfg("ca-p256", &[], tuning), cells);
+        // The one MITM conn, live.
+        let held = mitm_browser(&p, o.addr);
+        let b = browser(&p, o.addr, Path::new(ORIGIN_CA));
+        assert_origin_chain(&b.tls_only(&[b"h2"], "localhost"));
+        assert_eq!(held.get("/still", &[]).0, 200);
+        log.wait();
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);

From 1abf3aa863b7099b97e56b84b9b08b223033454c Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 13:18:15 +0900
Subject: [PATCH 23/33] fix(mq-h3): close the conn on a server-initiated bidi
 stream
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No request exists for it on a client, so h3wire was never fed, no
H3_STREAM_CREATION_ERROR was raised (RFC 9114 §6.1) and the stream never
retired. Its NewStream now feeds h3wire an empty read, which closes the
connection.
---
 crates/mq-h3/src/conn.rs   |  8 +++++++-
 crates/mq-h3/tests/recv.rs | 12 ++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/crates/mq-h3/src/conn.rs b/crates/mq-h3/src/conn.rs
index 2454633e..6dad6d19 100644
--- a/crates/mq-h3/src/conn.rs
+++ b/crates/mq-h3/src/conn.rs
@@ -89,9 +89,15 @@ impl<T: TransportOps> H3Wire<T> {
                 self.streams.insert(s, (c, Q(info.quic_id)));
                 // A peer request stream (server): h3wire holds its state from the first
                 // sight; the gateway learns of it at its HEADERS (adoption spec §4.3).
-                if Q(info.quic_id).is_request() && !conn.client {
+                let q = Q(info.quic_id);
+                if q.is_request() && !conn.client {
                     let req = Req::new(now, c, s, info.quic_id, false);
                     self.reqs.insert(req_id(s), req);
+                } else if !q.is_uni() && !conn.is_local(q) {
+                    // A server-initiated bidi stream: h3wire closes the conn with
+                    // H3_STREAM_CREATION_ERROR (RFC 9114 §6.1).
+                    log_closed(conn.h3.recv(q, &[], false).map(drop));
+                    self.service(now, c);
                 }
                 return None;
             }
diff --git a/crates/mq-h3/tests/recv.rs b/crates/mq-h3/tests/recv.rs
index c4cd8ec6..c114fbda 100644
--- a/crates/mq-h3/tests/recv.rs
+++ b/crates/mq-h3/tests/recv.rs
@@ -579,3 +579,15 @@ fn empty_probe_framing_before_fin() {
     );
     assert_eq!(r.w.h3_recv_body(r.now, id, &mut buf), Ok((0, true)));
 }
+
+/// A server-initiated bidirectional stream is a connection error on the client
+/// (`H3_STREAM_CREATION_ERROR`, RFC 9114 §6.1).
+#[test]
+fn server_initiated_bidi_closes() {
+    let mut r = Rig::client();
+    r.pump();
+    r.events();
+    r.deliver(Q(1), b"x", false);
+    r.pump();
+    assert_eq!(close_codes(&r), [0x103]);
+}

From 6fabcc289bb54316745c8a06a42c7597ffda4c7c Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 13:19:09 +0900
Subject: [PATCH 24/33] fix(mq-h3): defer a peer RESET while the raw FIN is
 carried
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A peer RESET that arrived after the transport FIN was read into the
carry, but before h3wire reached Finished, aborted a complete response;
one h3_recv_body later the same reset was handled as after Finished
(adoption spec §5.3 (7)). The code is now held and passed to h3wire
once the feed has given it the FIN.
---
 crates/mq-h3/src/recv.rs   | 36 ++++++++++++++++++++++++++----------
 crates/mq-h3/src/req.rs    |  4 ++++
 crates/mq-h3/tests/send.rs | 18 ++++++++++++++++++
 3 files changed, 48 insertions(+), 10 deletions(-)

diff --git a/crates/mq-h3/src/recv.rs b/crates/mq-h3/src/recv.rs
index a73613b7..23c0729e 100644
--- a/crates/mq-h3/src/recv.rs
+++ b/crates/mq-h3/src/recv.rs
@@ -203,6 +203,11 @@ impl<T: TransportOps> H3Wire<T> {
             // holds, and later StreamReadables continue it (spec §3).
             let c = req.conn;
             self.dispatch_retire(now, c);
+            if fin_fed
+                && let Some(code) = self.reqs.get_mut(&id).and_then(|r| r.reset_deferred.take())
+            {
+                self.peer_reset(id, code);
+            }
             if n > 0 || (consumed == 0 && !fin_fed) {
                 return Ok(n);
             }
@@ -332,16 +337,10 @@ impl<T: TransportOps> H3Wire<T> {
                     && !req.aborted()
                 {
                     req.reset_code_pending = false;
-                    if let Some(conn) = self.conns.get_mut(&c) {
-                        log_closed(conn.h3.stream_reset_received(q, H3Code(*code)));
-                    }
-                    // After `Finished` h3wire resets our send side with no event: as
-                    // `SendStopped`.
-                    if req.terminal == Some(Terminal::Finished) {
-                        req.stop_send();
-                        if req.known {
-                            self.queue.push(Event::H3Writable(id));
-                        }
+                    if req.carry_fin {
+                        req.reset_deferred = Some(*code); // `feed` passes it after the FIN
+                    } else {
+                        self.peer_reset(id, *code);
                     }
                 }
                 // The probe always runs (spec §3), before the events are dispatched by
@@ -384,6 +383,23 @@ impl<T: TransportOps> H3Wire<T> {
         true
     }
 
+    /// Passes a peer RESET of request `id` to h3wire. After `Finished` h3wire resets our
+    /// send side with no event: as `SendStopped` (adoption spec §4.5).
+    fn peer_reset(&mut self, id: H3ReqId, code: u64) {
+        let Some(req) = self.reqs.get_mut(&id).filter(|r| !r.aborted()) else {
+            return;
+        };
+        if let Some(conn) = self.conns.get_mut(&req.conn) {
+            log_closed(conn.h3.stream_reset_received(Q(req.quic_id), H3Code(code)));
+        }
+        if req.terminal == Some(Terminal::Finished) {
+            req.stop_send();
+            if req.known {
+                self.queue.push(Event::H3Writable(id));
+            }
+        }
+    }
+
     /// Closure (adoption spec §4.3): once the transport closed the stream (1) and the
     /// gateway has the receive end or the request was aborted (2). A request the gateway
     /// never saw goes at (1).
diff --git a/crates/mq-h3/src/req.rs b/crates/mq-h3/src/req.rs
index 7968084f..8b3a927b 100644
--- a/crates/mq-h3/src/req.rs
+++ b/crates/mq-h3/src/req.rs
@@ -29,6 +29,9 @@ pub(crate) struct Req {
     /// The transport read failed with `Reset` before its `StreamPeerReset` popped
     /// (adoption spec §4.4).
     pub(crate) reset_code_pending: bool,
+    /// A peer RESET's code, held while the raw FIN is carried: h3wire takes it once the
+    /// FIN is fed, so a complete message stays complete (adoption spec §5.3 (7)).
+    pub(crate) reset_deferred: Option<u64>,
     /// Raw bytes read and not consumed by h3wire; never parsed payload.
     pub(crate) carry: Vec<u8>,
     /// The transport reported FIN after the carry; not yet fed.
@@ -79,6 +82,7 @@ impl Req {
             terminal: None,
             handed: false,
             reset_code_pending: false,
+            reset_deferred: None,
             carry: Vec::new(),
             carry_fin: false,
             fin_read: false,
diff --git a/crates/mq-h3/tests/send.rs b/crates/mq-h3/tests/send.rs
index 266f3864..b1ee8ebb 100644
--- a/crates/mq-h3/tests/send.rs
+++ b/crates/mq-h3/tests/send.rs
@@ -628,3 +628,21 @@ fn send_headers_after_peer_reset_resets() {
         );
     }
 }
+
+/// A peer RESET while the raw FIN is still carried, before h3wire reached `Finished`: the
+/// reset waits for the carry to be fed, so the complete response is delivered as after
+/// `Finished` (adoption spec §5.3 (7)) instead of being aborted.
+#[test]
+fn peer_reset_with_fin_carried_client_discards() {
+    let (mut r, id, s, _) = posting();
+    let body = body_of(1000);
+    respond(&mut r, Q(0), &body); // read whole by the bootstrap: DATA + FIN carried
+    r.events();
+    r.h.expect_stream_recv(s, Err(StreamError::Reset));
+    r.h.push_event(Event::StreamPeerReset(s, 0x10c));
+    r.w.drive(r.now);
+    assert_eq!(aborts(&r, s), [], "deferred until the carry is fed");
+    assert_eq!(read_response(&mut r, id), body);
+    assert_eq!(aborts(&r, s), [Call::StreamResetSend { s, code: 0x10c }]);
+    assert_eq!(r.w.h3_send_body(r.now, id, &[7u8; 64], false), Ok(64));
+}

From f9f50935f3df12826701dc8bd87570ac4a722e10 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 13:19:43 +0900
Subject: [PATCH 25/33] refactor(mq-h3): merge duplicated request helpers, fix
 a stale comment

`reqs_of` collects a conn's requests for both fan-outs; `Req::stop_send`
queues the H3Writable that every caller pushed after it; Req has one
impl block. The latched-finish comment in `flush` now says that Closed
and GoingAway drop it silently.
---
 crates/mq-h3/src/conn.rs | 12 ++----------
 crates/mq-h3/src/recv.rs | 25 ++++++++++---------------
 crates/mq-h3/src/req.rs  | 23 +++++++++++++----------
 crates/mq-h3/src/send.rs |  4 +++-
 4 files changed, 28 insertions(+), 36 deletions(-)

diff --git a/crates/mq-h3/src/conn.rs b/crates/mq-h3/src/conn.rs
index 6dad6d19..472e9fa9 100644
--- a/crates/mq-h3/src/conn.rs
+++ b/crates/mq-h3/src/conn.rs
@@ -4,9 +4,7 @@
 use crate::req::{Req, Terminal, req_id};
 use crate::{BOOT_READ, H3Wire};
 use h3wire::{Config, Connection, H3Code, Role, StreamId as Q};
-use mq_transport_api::{
-    ConnId, ConnProto, Event, H3ReqId, StreamError, StreamId, Time, TransportOps,
-};
+use mq_transport_api::{ConnId, ConnProto, Event, StreamError, StreamId, Time, TransportOps};
 use std::collections::{HashMap, HashSet};
 
 /// Equals `mq_transport::H3_FIELD_SECTION_MAX`; mq-h3 does not depend on mq-transport.
@@ -134,13 +132,7 @@ impl<T: TransportOps> H3Wire<T> {
         // ponytail: O(streams + reqs of the shard) per conn close; index them by conn if
         // shards grow large.
         self.streams.retain(|_, (x, _)| *x != c);
-        let ids: Vec<H3ReqId> = self
-            .reqs
-            .iter()
-            .filter(|(_, r)| r.conn == c)
-            .map(|(&id, _)| id)
-            .collect();
-        for id in ids {
+        for id in self.reqs_of(c) {
             let r = self.reqs.get_mut(&id).expect("listed above");
             r.stream_closed = true;
             let complete = r.carry_fin || r.terminal == Some(Terminal::Finished);
diff --git a/crates/mq-h3/src/recv.rs b/crates/mq-h3/src/recv.rs
index 23c0729e..1e7f6dee 100644
--- a/crates/mq-h3/src/recv.rs
+++ b/crates/mq-h3/src/recv.rs
@@ -37,13 +37,7 @@ impl<T: TransportOps> H3Wire<T> {
                 H3Event::Closed { .. } => {
                     conn.h3_closed = true;
                     if conn.gone {
-                        let ids: Vec<H3ReqId> = self
-                            .reqs
-                            .iter()
-                            .filter(|(_, r)| r.conn == c)
-                            .map(|(&id, _)| id)
-                            .collect();
-                        for id in ids {
+                        for id in self.reqs_of(c) {
                             self.close_req(id);
                         }
                         self.settle_conn(c);
@@ -86,10 +80,7 @@ impl<T: TransportOps> H3Wire<T> {
                 }
                 // adoption spec §4.5: the client discards later body, the server resets.
                 H3Event::SendStopped { .. } => {
-                    req.stop_send();
-                    if req.known {
-                        self.queue.push(Event::H3Writable(id)); // a blocked pump learns it
-                    }
+                    req.stop_send(&mut self.queue);
                     continue;
                 }
                 H3Event::Finished(_) => req.terminal = Some(Terminal::Finished),
@@ -393,13 +384,17 @@ impl<T: TransportOps> H3Wire<T> {
             log_closed(conn.h3.stream_reset_received(Q(req.quic_id), H3Code(code)));
         }
         if req.terminal == Some(Terminal::Finished) {
-            req.stop_send();
-            if req.known {
-                self.queue.push(Event::H3Writable(id));
-            }
+            req.stop_send(&mut self.queue);
         }
     }
 
+    /// The requests of conn `c`. ponytail: O(reqs of the shard); index them by conn if
+    /// shards grow large.
+    pub(crate) fn reqs_of(&self, c: ConnId) -> Vec<H3ReqId> {
+        let of_c = self.reqs.iter().filter(|(_, r)| r.conn == c);
+        of_c.map(|(&id, _)| id).collect()
+    }
+
     /// Closure (adoption spec §4.3): once the transport closed the stream (1) and the
     /// gateway has the receive end or the request was aborted (2). A request the gateway
     /// never saw goes at (1).
diff --git a/crates/mq-h3/src/req.rs b/crates/mq-h3/src/req.rs
index 8b3a927b..de5b270c 100644
--- a/crates/mq-h3/src/req.rs
+++ b/crates/mq-h3/src/req.rs
@@ -1,8 +1,9 @@
 //! Per-request state (adoption spec §4.3).
 
+use crate::queue::OutQueue;
 use crate::send::InFlight;
 use h3wire::{AbortSource, H3Code, HeaderBlockId};
-use mq_transport_api::{ConnId, H3ReqId, H3ReqStats, StreamCloseStats, StreamId, Time};
+use mq_transport_api::{ConnId, Event, H3ReqId, H3ReqStats, StreamCloseStats, StreamId, Time};
 
 /// The h3wire terminal event of a request's receive side.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -103,20 +104,17 @@ impl Req {
         matches!(self.terminal, Some(Terminal::Aborted { .. }))
     }
 
-    /// h3wire ended our send side without a `StreamAborted` (adoption spec §4.5).
-    pub(crate) fn stop_send(&mut self) {
+    /// h3wire ended our send side without a `StreamAborted` (adoption spec §4.5); a
+    /// blocked pump learns it from `H3Writable`.
+    pub(crate) fn stop_send(&mut self, queue: &mut OutQueue) {
         self.send_stopped = true;
         self.frame = None;
         self.finish_latched = false;
+        if self.known {
+            queue.push(Event::H3Writable(req_id(self.stream)));
+        }
     }
-}
-
-/// The request id is the request stream's slot (adoption spec §4.1).
-pub(crate) fn req_id(s: StreamId) -> H3ReqId {
-    H3ReqId::from_slot(s.slot()).expect("a live slot has a nonzero generation")
-}
 
-impl Req {
     /// adoption spec §4.6. Without a snapshot, `conn_err` is the `ConnClosed` code of a
     /// request closed by the fan-out.
     pub(crate) fn stats(&self, conn_err: Option<i32>) -> H3ReqStats {
@@ -146,3 +144,8 @@ impl Req {
         }
     }
 }
+
+/// The request id is the request stream's slot (adoption spec §4.1).
+pub(crate) fn req_id(s: StreamId) -> H3ReqId {
+    H3ReqId::from_slot(s.slot()).expect("a live slot has a nonzero generation")
+}
diff --git a/crates/mq-h3/src/send.rs b/crates/mq-h3/src/send.rs
index b59b250b..924bce8b 100644
--- a/crates/mq-h3/src/send.rs
+++ b/crates/mq-h3/src/send.rs
@@ -469,7 +469,9 @@ impl<T: TransportOps> H3Wire<T> {
                 }
             }
             if let Some(req) = req.filter(|_| conn.h3.poll_send(q).is_none()) {
-                let _ = try_finish(&mut conn.h3, req); // refused: logged by usage_err
+                // An error drops the latched finish: `Closed` / `GoingAway` (the conn is
+                // ending, silently), else a refusal `usage_err` logged.
+                let _ = try_finish(&mut conn.h3, req);
                 if std::mem::take(&mut req.writable_wanted) && req.known {
                     queue.push(Event::H3Writable(req_id(s)));
                 }

From 33cf97a8b1e7e161851cf0c25835c757cef63c6f Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 13:21:50 +0900
Subject: [PATCH 26/33] test(integration): compare whole header lists per
 matrixed request
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

adoption spec §6.2 compares status and headers. Every matrixed
pair_gateway scenario now asserts the full response header list, the
fetch reply's and the direct H3 response's, against one list with
`date` normalised; h3_40k_section_both_ways compares both sections
exactly. All four cells agree: no difference to write in.
---
 crates/mq-integration/tests/pair_gateway.rs | 108 +++++++++++++++++---
 crates/mq-integration/tests/pair_h3.rs      |  23 +++--
 2 files changed, 107 insertions(+), 24 deletions(-)

diff --git a/crates/mq-integration/tests/pair_gateway.rs b/crates/mq-integration/tests/pair_gateway.rs
index 64727de8..c9b2fed7 100644
--- a/crates/mq-integration/tests/pair_gateway.rs
+++ b/crates/mq-integration/tests/pair_gateway.rs
@@ -92,6 +92,29 @@ fn assert_req(line: &str, want: &str) {
     }
 }
 
+/// adoption spec §6.2: the response header list is `want`, in order; the volatile `date`
+/// value is normalised to `T`.
+fn assert_headers(got: &[(String, String)], want: &[(&str, &str)]) {
+    let got: Vec<(&str, &str)> = got
+        .iter()
+        .map(|(n, v)| (n.as_str(), if n == "date" { "T" } else { v.as_str() }))
+        .collect();
+    assert_eq!(got, want);
+}
+
+/// The gateway server's H3 response to a direct request an h1 origin answered `ok`.
+const H3_OK: [(&str, &str); 3] = [
+    (":status", "200"),
+    ("x-mq-origin-protocol", "http/1.1"),
+    ("content-length", "2"),
+];
+
+/// The H3 response header list of an `H3Client`.
+fn h3_headers(r: &H3Recorded) -> Vec<(String, String)> {
+    let s = |b: &[u8]| String::from_utf8_lossy(b).into_owned();
+    r.headers.iter().map(|(n, v)| (s(n), s(v))).collect()
+}
+
 /// The `mq.req` line of the request to `path` (at most `T`).
 fn req_line(path: &str) -> String {
     wait_log(&["mq.req", &format!("path=\"{path}\"")])
@@ -304,11 +327,6 @@ fn wait_h3(h: &H3Handle, cond: impl Fn(&H3Recorded) -> bool) {
     wait_until("the H3 client", || cond(&h.lock()));
 }
 
-fn h3_header(r: &H3Recorded, name: &str) -> Option<String> {
-    let h = r.headers.iter().find(|(n, _)| n == name.as_bytes());
-    h.map(|(_, v)| String::from_utf8_lossy(v).into_owned())
-}
-
 // ---- a capturing h1 origin ----
 
 /// What `Capture` read on one connection.
@@ -468,6 +486,13 @@ matrix!(
         wait_up(&p, tag);
         let url = format!("https://127.0.0.1:{}/dl-{tag}", o.addr.port());
         let r = parse(&fetch(&p, &url, &[], b"").expect("download"));
+        let want = [
+            ("x-mq-origin-protocol", "h2"),
+            ("date", "T"),
+            ("content-length", "8388608"),
+            ("connection", "close"),
+        ];
+        assert_headers(&r.headers, &want);
         assert_eq!(r.status, 200);
         assert_eq!(r.header("content-length"), Some("8388608"));
         assert!(
@@ -495,6 +520,13 @@ matrix!(
         let body = pattern(8 * MIB);
         let url = format!("http://{}/up-{tag}", o.addr);
         let r = parse(&fetch(&p, &url, &[("X-Mq-Method", "PUT")], &body).expect("upload"));
+        let want = [
+            ("x-mq-origin-protocol", "http/1.1"),
+            ("content-length", "8388608"),
+            ("date", "T"),
+            ("connection", "close"),
+        ];
+        assert_headers(&r.headers, &want);
         assert_eq!(r.status, 200);
         assert_eq!(r.header("content-length"), Some("8388608"));
         assert!(r.body == body, "echo differs ({} bytes)", r.body.len());
@@ -609,6 +641,12 @@ matrix!(
             b"",
         );
         let r = parse(&r.expect("HEAD finishes cleanly"));
+        let want = [
+            ("x-mq-origin-protocol", "http/1.1"),
+            ("content-length", "0"),
+            ("connection", "close"),
+        ];
+        assert_headers(&r.headers, &want);
         assert_eq!((r.status, r.header("content-length")), (200, Some("0")));
         assert!(r.body.is_empty());
         let r = parse(
@@ -616,6 +654,12 @@ matrix!(
                 .expect("304 finishes cleanly"),
         );
         assert_eq!((r.status, r.header("content-length")), (304, Some("100")));
+        let want = [
+            ("x-mq-origin-protocol", "http/1.1"),
+            ("content-length", "100"),
+            ("connection", "close"),
+        ];
+        assert_headers(&r.headers, &want);
         assert!(r.body.is_empty());
         for (sid, method, status, addr, path) in [
             (4, "HEAD", 200, head.addr, format!("/h-{tag}")),
@@ -650,6 +694,14 @@ matrix!(
         wait_up(&p, tag);
         let raw = fetch(&p, &format!("http://{}/big-{tag}", origin.addr), &[], b"");
         let r = parse(&raw.expect("fetch"));
+        let names: Vec<String> = (0..5).map(|i| format!("x-big-{i}")).collect();
+        let mut want = vec![
+            ("x-mq-origin-protocol", "http/1.1"),
+            ("content-length", "2"),
+        ];
+        want.extend(names.iter().map(|n| (n.as_str(), value.as_str())));
+        want.push(("connection", "close"));
+        assert_headers(&r.headers, &want);
         assert_eq!((r.status, r.body.as_slice()), (200, &b"ok"[..]));
         for i in 0..5 {
             assert_eq!(r.header(&format!("x-big-{i}")), Some(value.as_str()), "{i}");
@@ -673,6 +725,12 @@ matrix!(
         wait_up(&p, tag);
         let url = o.url(&format!("/a/../b-{tag}?q=/../x"));
         let r = parse(&fetch(&p, &url, &[], b"").expect("fetch"));
+        let want = [
+            ("x-mq-origin-protocol", "http/1.1"),
+            ("content-length", "2"),
+            ("connection", "close"),
+        ];
+        assert_headers(&r.headers, &want);
         assert_eq!((r.status, r.body.as_slice()), (200, &b"ok"[..]));
         let head = o.one().head;
         let want = format!("get /b-{tag}?q=/../x http/1.1\r\n");
@@ -698,6 +756,12 @@ matrix!(
         wait_up(&p, tag);
         let extra = [("X-Test", ""), ("Accept", ""), ("X-Kept", "yes")];
         let r = parse(&fetch(&p, &o.url(&format!("/empty-{tag}")), &extra, b"").expect("fetch"));
+        let want = [
+            ("x-mq-origin-protocol", "http/1.1"),
+            ("content-length", "2"),
+            ("connection", "close"),
+        ];
+        assert_headers(&r.headers, &want);
         assert_eq!(r.status, 200);
         let head = o.one().head;
         assert!(head.contains("\r\nx-kept: yes\r\n"), "{head}");
@@ -733,9 +797,17 @@ matrix!(
         wait_up(&p, tag);
         let url = format!("https://127.0.0.1:{}/c13-{tag}", o.addr.port());
         let r = parse(&fetch(&p, &url, &[], b"").expect("default request"));
+        let want = [
+            ("x-mq-origin-protocol", "http/1.1"),
+            ("content-length", "2"),
+            ("date", "T"),
+            ("connection", "close"),
+        ];
+        assert_headers(&r.headers, &want);
         assert_eq!((r.status, r.body.len()), (200, 2));
         let r = fetch(&p, &url, &[("X-Mq-Origin-Protocol", "h1")], b"");
         let r = parse(&r.expect("h1-forced request"));
+        assert_headers(&r.headers, &want);
         assert_eq!((r.status, r.body.len()), (200, 2));
         assert_eq!(o.accepted(), 1);
         let path = format!("/c13-{tag}");
@@ -818,8 +890,12 @@ matrix!(
         wait_h3(&c.handle, |r| r.fin);
         {
             let r = c.handle.lock();
-            assert_eq!(h3_header(&r, ":status").as_deref(), Some("400"));
-            assert_eq!(h3_header(&r, "x-mq-error").as_deref(), Some("bad-request"));
+            let want = [
+                (":status", "400"),
+                ("x-mq-error", "bad-request"),
+                ("content-length", "0"),
+            ];
+            assert_headers(&h3_headers(&r), &want);
         }
         let line = wait_log(&["mq.req", "status=400", &format!("req_bytes={n} ")]);
         let want = format!(
@@ -848,7 +924,12 @@ matrix!(
         wait_h3(&c.handle, |r| !r.closed.is_empty());
         {
             let r = c.handle.lock();
-            assert_eq!(h3_header(&r, ":status").as_deref(), Some("403"));
+            let want = [
+                (":status", "403"),
+                ("x-mq-error", "auth-failed"),
+                ("content-length", "0"),
+            ];
+            assert_headers(&h3_headers(&r), &want);
             assert_eq!(r.closed[0].0.stats.stream_err, 0, "{:?}", r.closed);
             assert_eq!(r.closed[0].0.stats.send_body, body_len as u64);
         }
@@ -890,10 +971,7 @@ matrix!(
             return;
         }
         wait_h3(&c.handle, |r| r.fin);
-        assert_eq!(
-            h3_header(&c.handle.lock(), ":status").as_deref(),
-            Some("200")
-        );
+        assert_headers(&h3_headers(&c.handle.lock()), &H3_OK);
         let seen = o.one();
         assert!(seen.complete && seen.body.is_empty(), "{seen:?}");
         assert!(!seen.head.contains("transfer-encoding"), "{}", seen.head);
@@ -925,10 +1003,7 @@ matrix!(
         let s = script("GET", &o.authority(), &path, &extra, b"hello body".to_vec());
         let c = h3_client(p.server.udp_addr, s, cells.0);
         wait_h3(&c.handle, |r| r.fin);
-        assert_eq!(
-            h3_header(&c.handle.lock(), ":status").as_deref(),
-            Some("200")
-        );
+        assert_headers(&h3_headers(&c.handle.lock()), &H3_OK);
         let seen = o.one();
         assert!(
             seen.head.contains("\r\ntransfer-encoding: chunked\r\n"),
@@ -965,6 +1040,7 @@ fn upload_reset(cells: (Backend, Backend), path: &str, cl: &str, body: Vec<u8>)
         let code = r.closed[0].0.stats.stream_err;
         assert!(if wire { code == 0x10e } else { code != 0 }, "{r:?}");
         assert!(!r.fin, "{r:?}");
+        assert_headers(&h3_headers(&r), &[]);
     }
     let want = format!(
         "sid=0 method=POST status=0 authority=\"{}\" path=\"{path}\" req_bytes={} resp_bytes=0 ttfb_ms=-1 duration_ms=-1 origin_protocol=none origin_tls=na content_encoding=none cache=bypass origin_reuse=0 origin_connect_ms=-1 mp_state=0 completion_ms=-1 reset=\"local reset\"",
diff --git a/crates/mq-integration/tests/pair_h3.rs b/crates/mq-integration/tests/pair_h3.rs
index 8f4ec4ab..5cd63d17 100644
--- a/crates/mq-integration/tests/pair_h3.rs
+++ b/crates/mq-integration/tests/pair_h3.rs
@@ -131,14 +131,24 @@ fn section(hs: &[(Vec<u8>, Vec<u8>)]) -> usize {
     hs.iter().map(|(n, v)| n.len() + v.len() + 32).sum()
 }
 
+/// `hs` as the apps record a header list.
+fn bytes(hs: &[(String, String)]) -> Vec<(Vec<u8>, Vec<u8>)> {
+    let b = |s: &String| s.as_bytes().to_vec();
+    hs.iter().map(|(n, v)| (b(n), b(v))).collect()
+}
+
 // SP4 spec §5: both engines accept a 40 KiB field section (xquic's default limit was 32 KiB;
 // `H3_FIELD_SECTION_MAX` is 64 KiB): a request section reaches the server and a response
-// section comes back. Matrixed over (client, server) backends (adoption spec §6.2).
+// section comes back, each exactly as sent. Matrixed over (client, server) backends
+// (adoption spec §6.2).
 matrix!(
     h3_40k_section_both_ways,
     |cells: (Backend, Backend), _tag: &str| {
         let mut script = post(Vec::new(), None);
         script.headers.extend(fields(6, 7000));
+        let want_req = bytes(&script.headers);
+        let mut want_resp = vec![(b":status".to_vec(), b"200".to_vec())];
+        want_resp.extend(bytes(&fields(6, 7000)));
         let lo = Ipv4Addr::LOCALHOST.into();
         let p = LoopbackPair::spawn(
             (lo, lo),
@@ -162,16 +172,13 @@ matrix!(
         wait(&p.client.handle, |r| r.fin);
         {
             let s = p.server.handle.lock();
-            assert!(
-                section(&s.request_headers) >= 40 * 1024,
-                "{}",
-                section(&s.request_headers)
-            );
+            assert!(section(&want_req) >= 40 * 1024, "{}", section(&want_req));
+            assert!(s.request_headers == want_req, "request headers differ");
         }
         {
             let c = p.client.handle.lock();
-            assert_eq!(c.headers[0].0, b":status");
-            assert!(section(&c.headers) >= 40 * 1024, "{}", section(&c.headers));
+            assert!(section(&want_resp) >= 40 * 1024, "{}", section(&want_resp));
+            assert!(c.headers == want_resp, "response headers differ");
         }
         p.join_both();
     }

From db4401c9af5adbc549246eed486df727cb62d6d3 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 13:24:00 +0900
Subject: [PATCH 27/33] =?UTF-8?q?test(integration):=20=C2=A75.3=20(2)=20an?=
 =?UTF-8?q?d=20(3)=20cells=20against=20each=20receiver?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A raw peer sends a request HEADERS frame over 64 KiB encoded (h3wire
closes the connection with H3_EXCESSIVE_LOAD; xqc_h3 resets the stream
with H3_MESSAGE_ERROR), a request stream with a FIN and no HEADERS
(h3wire resets with H3_REQUEST_INCOMPLETE; xqc_h3 drops it silently),
and a response that ends without a final response, bare or after a 103
(h3wire aborts it and the fetch client answers 502 upstream-reset;
xqc_h3 relays the 103 as the final response).
---
 crates/mq-integration/tests/pair_gateway.rs | 98 +++++++++++++++++++++
 1 file changed, 98 insertions(+)

diff --git a/crates/mq-integration/tests/pair_gateway.rs b/crates/mq-integration/tests/pair_gateway.rs
index c9b2fed7..3240d07d 100644
--- a/crates/mq-integration/tests/pair_gateway.rs
+++ b/crates/mq-integration/tests/pair_gateway.rs
@@ -567,6 +567,12 @@ const FRAME_ERROR: CloseReason = CloseReason {
     code: 0x106,
 };
 
+/// adoption spec §5.3 (3).
+const EXCESSIVE_LOAD: CloseReason = CloseReason {
+    err_type: ErrType::Application,
+    code: 0x107,
+};
+
 // spec §3.7 (3), §5.4, Review Focus 5: the response's DATA frame is cut by FIN inside its
 // declared length; the local fetch socket is reset in both cells. An xqc_h3 client reads the
 // cut as a clean EOF and its body check (or the `H3Closed.unread` path) resets; h3wire closes
@@ -1087,6 +1093,11 @@ fn raw_headers(fields: &[(&str, &str)]) -> Vec<u8> {
 fn assert_message_error(c: &DriverThread<RawH3Handle>, marker: &str) {
     wait_until("the peer's reset", || !c.handle.lock().resets.is_empty());
     assert_eq!(c.handle.lock().resets[0].1, 0x10e, "{:?}", c.handle.lock());
+    assert_no_req(marker);
+}
+
+/// No `mq.req` line carries `marker` for 500 ms.
+fn assert_no_req(marker: &str) {
     let end = Instant::now() + Duration::from_millis(500);
     while Instant::now() < end {
         let lines = log_tap::lines();
@@ -1238,3 +1249,90 @@ receivers!(connect_malformed_direct_h3, |b: Backend, tag: &str| {
     stop(c);
     assert_eq!(p.join_both(), (0, 0));
 });
+
+// adoption spec §5.3 (3): a request HEADERS frame over 64 KiB encoded (`~` has no Huffman
+// gain, so ten 7000-byte values stay raw). h3wire closes the connection with
+// `H3_EXCESSIVE_LOAD` at the frame header. xqc_h3 limits the decoded size instead and resets
+// the stream with `H3_MESSAGE_ERROR`, keeping the connection. Neither reaches the gateway.
+receivers!(
+    direct_h3_oversize_headers_rejected,
+    |b: Backend, tag: &str| {
+        let p = gateway((Backend::XqcH3, b));
+        let (auth, path, pad) = (bearer(), format!("/big-req-{tag}"), "~".repeat(7000));
+        let names: Vec<String> = (0..10).map(|i| format!("x-pad-{i}")).collect();
+        let mut fs = vec![
+            (":method", "GET"),
+            (":scheme", "http"),
+            (":authority", "127.0.0.1:1"),
+            (":path", path.as_str()),
+            ("x-mq-auth", auth.as_str()),
+        ];
+        fs.extend(names.iter().map(|n| (n.as_str(), pad.as_str())));
+        let stream = raw_headers(&fs);
+        assert!(stream.len() > 64 * 1024, "{}", stream.len());
+        let c = raw_client(p.server.udp_addr, stream);
+        if b == Backend::Wire {
+            wait_until("the peer's ConnClosed", || {
+                !c.handle.lock().closed.is_empty()
+            });
+            assert_eq!(c.handle.lock().closed, [EXCESSIVE_LOAD]);
+            assert!(c.handle.lock().resets.is_empty(), "{:?}", c.handle.lock());
+        } else {
+            wait_until("the peer's reset", || !c.handle.lock().resets.is_empty());
+            assert_eq!(c.handle.lock().resets[0].1, 0x10e, "{:?}", c.handle.lock());
+            assert!(c.handle.lock().closed.is_empty(), "{:?}", c.handle.lock());
+        }
+        assert_no_req(&format!("path=\"{path}\""));
+        stop(c);
+        assert_eq!(p.join_both(), (0, 0));
+    }
+);
+
+// adoption spec §5.3 (2), server: a request stream that ends without HEADERS. h3wire resets it
+// with `H3_REQUEST_INCOMPLETE`; xqc_h3 drops it with no reset and no close (none within
+// 500 ms).
+receivers!(direct_h3_fin_without_headers, |b: Backend, _tag: &str| {
+    let p = gateway((Backend::XqcH3, b));
+    let c = raw_client(p.server.udp_addr, Vec::new());
+    if b == Backend::Wire {
+        wait_until("the peer's reset", || !c.handle.lock().resets.is_empty());
+        assert_eq!(c.handle.lock().resets[0].1, 0x10d, "{:?}", c.handle.lock());
+    } else {
+        thread::sleep(Duration::from_millis(500));
+        assert!(c.handle.lock().resets.is_empty(), "{:?}", c.handle.lock());
+    }
+    assert!(c.handle.lock().closed.is_empty(), "{:?}", c.handle.lock());
+    stop(c);
+    assert_eq!(p.join_both(), (0, 0));
+});
+
+// adoption spec §5.3 (2), client: the response stream ends without a final response, after a
+// bare FIN or after a 103. h3wire aborts it with `H3_MESSAGE_ERROR`, which the fetch client
+// answers with 502 `upstream-reset`. xqc_h3 does the same after the bare FIN, but takes the
+// 103 for the final response and relays it with an empty body (RFC 9114 §4.1 makes it
+// interim).
+receivers!(
+    fetch_response_without_final_fails,
+    |b: Backend, tag: &str| {
+        let reset = "HTTP/1.1 502 \r\nX-Mq-Error: upstream-reset\r\nContent-Length: 0\r\nConnection: close\r\n\r\n";
+        let relayed_103 =
+            "HTTP/1.1 103 \r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n0\r\n\r\n";
+        for (i, stream) in [Vec::new(), headers_frame(&[(b":status", b"103")])]
+            .into_iter()
+            .enumerate()
+        {
+            let (app, _) = RawH3Peer::server(RawH3Script { stream, fin: true });
+            let cells = (b, Backend::Raw);
+            let p = LoopbackProxy::spawn_gateway_against_on(ClientConfig::default(), app, cells);
+            let target = format!("http://x/no-final-{i}-{tag}");
+            let r = fetch_when_up(p.fetch_addr(), &auth(&target, "any")).expect("a reply");
+            let want = if b == Backend::XqcH3 && i == 1 {
+                relayed_103
+            } else {
+                reset
+            };
+            assert_eq!(String::from_utf8_lossy(&r), want, "case {i}");
+            assert_eq!(p.join_both(), (0, 0));
+        }
+    }
+);

From 248a170fa635b9ce86085fa987a51780976d11d2 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 13:24:00 +0900
Subject: [PATCH 28/33] test(integration): mark h2_cl_100's origin_tls pin as a
 gateway misreport

The origin connect succeeds, so origin_tls=connect_fail and
origin_connect_ms=-1 are an existing gateway misreport outside this
plan; a later fix to them is not a regression.
---
 crates/mq-integration/tests/pair_gateway.rs | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/crates/mq-integration/tests/pair_gateway.rs b/crates/mq-integration/tests/pair_gateway.rs
index 3240d07d..d1a97baa 100644
--- a/crates/mq-integration/tests/pair_gateway.rs
+++ b/crates/mq-integration/tests/pair_gateway.rs
@@ -851,9 +851,10 @@ matrix!(
             "{:?}",
             r.as_ref().map(|b| String::from_utf8_lossy(b).into_owned())
         );
-        // The reset is the server's (its check), not only the client's own body check. The
-        // origin's failure leaves `origin_tls=connect_fail` and `origin_connect_ms=-1`; the
-        // reset leaves no FIN stamps.
+        // The reset is the server's (its check), not only the client's own body check; it
+        // leaves no FIN stamps. `origin_tls=connect_fail` and `origin_connect_ms=-1` pin an
+        // existing gateway misreport, outside this plan: the origin connect succeeded. A
+        // later gateway fix that changes these two fields is not a regression.
         let path = format!("/h2-short-{tag}");
         let want = format!(
             "sid=4 method=GET status=200 authority=\"127.0.0.1:{}\" path=\"{path}\" req_bytes=0 resp_bytes=50 ttfb_ms=T duration_ms=-1 origin_protocol=h2 origin_tls=connect_fail content_encoding=none cache=bypass origin_reuse=0 origin_connect_ms=-1 mp_state=0 completion_ms=-1 reset=\"local reset\"",

From 503298b992e18a807b4ea9b0e3b0d592901e1c57 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 14:06:21 +0900
Subject: [PATCH 29/33] perf(mq-h3): consume the request carry by cursor, not
 front-drain

Tiny DATA frames made every feed memmove the rest of the carry. The carry is
refilled only when empty, so a cursor needs no compaction; the bound is
unchanged.
---
 crates/mq-h3/src/recv.rs | 44 ++++++++++++-----------
 crates/mq-h3/src/req.rs  | 76 ++++++++++++++++++++++++++++++++++++++--
 2 files changed, 98 insertions(+), 22 deletions(-)

diff --git a/crates/mq-h3/src/recv.rs b/crates/mq-h3/src/recv.rs
index 1e7f6dee..74477725 100644
--- a/crates/mq-h3/src/recv.rs
+++ b/crates/mq-h3/src/recv.rs
@@ -92,7 +92,7 @@ impl<T: TransportOps> H3Wire<T> {
                     if let Some(b) = req.pending_block.take() {
                         conn.h3.release(b);
                     }
-                    req.carry = Vec::new();
+                    req.carry.clear();
                     req.carry_fin = false;
                     // Aborted: a later StreamClosed is not a peer reset to pass on.
                     req.reset_code_pending = false;
@@ -138,10 +138,10 @@ impl<T: TransportOps> H3Wire<T> {
                 return Ok(0);
             }
             if req.carry.is_empty() && !req.carry_fin {
-                req.carry.resize(cap, 0);
-                match self.inner.stream_recv(now, req.stream, &mut req.carry) {
+                let buf = req.carry.start_read(cap);
+                match self.inner.stream_recv(now, req.stream, buf) {
                     Ok((n, fin)) => {
-                        req.carry.truncate(n);
+                        req.carry.filled(n);
                         req.carry_fin = fin;
                         req.fin_read = fin;
                         if n == 0 && !fin {
@@ -161,33 +161,37 @@ impl<T: TransportOps> H3Wire<T> {
             let Some(conn) = self.conns.get_mut(&req.conn) else {
                 return Err(StreamError::Conn);
             };
-            let (consumed, body) = match conn.h3.recv(Q(req.quic_id), &req.carry[..len], fin) {
-                Err(e) => {
-                    log::debug!("h3wire: {e}");
-                    req.carry = Vec::new(); // never fed again
-                    return Err(StreamError::Conn);
-                }
-                Ok(Recv::Paused) => return Ok(0),
-                Ok(Recv::Body { consumed, range }) => (consumed, Some(range)),
-                Ok(
-                    Recv::Consumed(n)
-                    | Recv::Frame { consumed: n, .. }
-                    | Recv::Raw { consumed: n, .. },
-                ) => (n, None),
-            };
+            let (consumed, body) =
+                match conn
+                    .h3
+                    .recv(Q(req.quic_id), &req.carry.pending()[..len], fin)
+                {
+                    Err(e) => {
+                        log::debug!("h3wire: {e}");
+                        req.carry.clear(); // never fed again
+                        return Err(StreamError::Conn);
+                    }
+                    Ok(Recv::Paused) => return Ok(0),
+                    Ok(Recv::Body { consumed, range }) => (consumed, Some(range)),
+                    Ok(
+                        Recv::Consumed(n)
+                        | Recv::Frame { consumed: n, .. }
+                        | Recv::Raw { consumed: n, .. },
+                    ) => (n, None),
+                };
             let mut n = 0;
             if let Some(range) = body {
                 // The range lies inside a slice of at most `buf.len()` bytes.
                 match out.as_deref_mut() {
                     Some(buf) => {
                         n = range.len();
-                        buf[..n].copy_from_slice(&req.carry[range]);
+                        buf[..n].copy_from_slice(&req.carry.pending()[range]);
                     }
                     None => debug_assert!(false, "the bootstrap never produces body bytes"),
                 }
             }
             let fin_fed = fin && consumed == len;
-            req.carry.drain(..consumed);
+            req.carry.consume(consumed);
             req.carry_fin &= !fin_fed;
             // An abort by this feed (malformed, content-length, no final response) gets its
             // retirement read here: raw xquic does not re-notify for bytes it already
diff --git a/crates/mq-h3/src/req.rs b/crates/mq-h3/src/req.rs
index de5b270c..8e03cd61 100644
--- a/crates/mq-h3/src/req.rs
+++ b/crates/mq-h3/src/req.rs
@@ -12,6 +12,52 @@ pub(crate) enum Terminal {
     Aborted { code: H3Code, source: AbortSource },
 }
 
+/// The raw bytes read from the transport and not yet consumed by h3wire.
+#[derive(Default)]
+pub(crate) struct Carry {
+    buf: Vec<u8>,
+    off: usize,
+}
+
+impl Carry {
+    /// The unconsumed bytes.
+    pub(crate) fn pending(&self) -> &[u8] {
+        &self.buf[self.off..]
+    }
+
+    pub(crate) fn len(&self) -> usize {
+        self.buf.len() - self.off
+    }
+
+    pub(crate) fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    pub(crate) fn clear(&mut self) {
+        self.buf = Vec::new();
+        self.off = 0;
+    }
+
+    /// A `cap`-byte buffer to read into; the carry must be empty. Call `filled` after.
+    pub(crate) fn start_read(&mut self, cap: usize) -> &mut [u8] {
+        self.buf.clear();
+        self.off = 0;
+        self.buf.resize(cap, 0);
+        &mut self.buf
+    }
+
+    pub(crate) fn filled(&mut self, n: usize) {
+        self.buf.truncate(n);
+    }
+
+    pub(crate) fn consume(&mut self, n: usize) {
+        // No mid-buffer compaction: the carry is refilled only once empty (`start_read`
+        // resets it), so the buffer never outgrows one read.
+        self.off += n;
+        debug_assert!(self.off <= self.buf.len());
+    }
+}
+
 pub(crate) struct Req {
     pub(crate) conn: ConnId,
     pub(crate) stream: StreamId,
@@ -34,7 +80,7 @@ pub(crate) struct Req {
     /// FIN is fed, so a complete message stays complete (adoption spec §5.3 (7)).
     pub(crate) reset_deferred: Option<u64>,
     /// Raw bytes read and not consumed by h3wire; never parsed payload.
-    pub(crate) carry: Vec<u8>,
+    pub(crate) carry: Carry,
     /// The transport reported FIN after the carry; not yet fed.
     pub(crate) carry_fin: bool,
     /// The transport receive side was read to its end (FIN or `Err(Reset)`): no
@@ -84,7 +130,7 @@ impl Req {
             handed: false,
             reset_code_pending: false,
             reset_deferred: None,
-            carry: Vec::new(),
+            carry: Carry::default(),
             carry_fin: false,
             fin_read: false,
             stream_closed: false,
@@ -149,3 +195,29 @@ impl Req {
 pub(crate) fn req_id(s: StreamId) -> H3ReqId {
     H3ReqId::from_slot(s.slot()).expect("a live slot has a nonzero generation")
 }
+
+#[cfg(test)]
+mod tests {
+    use super::Carry;
+
+    /// Tiny frames consume the carry in O(1) each: the remaining bytes never move.
+    #[test]
+    fn consume_never_moves_the_rest() {
+        let mut c = Carry::default();
+        c.start_read(16 * 1024).fill(7);
+        let base = c.pending().as_ptr();
+        for i in 0..16 * 1024 - 1 {
+            c.consume(1);
+            assert_eq!(
+                c.pending().as_ptr(),
+                base.wrapping_add(i + 1),
+                "moved at {i}"
+            );
+        }
+        assert_eq!(c.len(), 1);
+        c.consume(1);
+        assert!(c.is_empty());
+        c.start_read(8).fill(1);
+        assert_eq!(c.pending(), [1; 8], "refill after drain starts clean");
+    }
+}

From d0655f556da0d23fbad5275db8bf57d7954697f2 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 14:08:03 +0900
Subject: [PATCH 30/33] perf(mq-h3): flush only streams that may hold core
 bytes

service() called h3wire's sendable(), a scan of every live stream, on each
request event and body op. h3wire's core bytes come from bind_uni,
send_headers and GOAWAY, so keep a per-conn set (our uni streams plus
requests with undrained HEADERS) and flush just those.
---
 crates/mq-h3/src/conn.rs   |  9 ++++++++-
 crates/mq-h3/src/lib.rs    |  7 +++++++
 crates/mq-h3/src/send.rs   | 13 +++++++++++--
 crates/mq-h3/tests/send.rs | 27 +++++++++++++++++++++++++++
 4 files changed, 53 insertions(+), 3 deletions(-)

diff --git a/crates/mq-h3/src/conn.rs b/crates/mq-h3/src/conn.rs
index 472e9fa9..478db536 100644
--- a/crates/mq-h3/src/conn.rs
+++ b/crates/mq-h3/src/conn.rs
@@ -5,7 +5,7 @@ use crate::req::{Req, Terminal, req_id};
 use crate::{BOOT_READ, H3Wire};
 use h3wire::{Config, Connection, H3Code, Role, StreamId as Q};
 use mq_transport_api::{ConnId, ConnProto, Event, StreamError, StreamId, Time, TransportOps};
-use std::collections::{HashMap, HashSet};
+use std::collections::{BTreeSet, HashMap, HashSet};
 
 /// Equals `mq_transport::H3_FIELD_SECTION_MAX`; mq-h3 does not depend on mq-transport.
 const FIELD_SECTION_MAX: usize = 64 * 1024;
@@ -29,6 +29,12 @@ pub(crate) struct H3Conn {
     /// Peer uni streams read to FIN or reset: never fed again, since h3wire would take
     /// further bytes for a new stream's type.
     pub(crate) uni_done: HashSet<StreamId>,
+    /// Quic ids of the streams that may hold core bytes: our uni streams (kept; they carry
+    /// SETTINGS, the stream types and any GOAWAY) and the request streams whose HEADERS
+    /// were queued, until `poll_send` drains them. All the bytes h3wire owns come from
+    /// `bind_uni`, `send_headers` and GOAWAY, so `flush` visits these instead of scanning
+    /// every stream with `sendable()`. Ascending, like `sendable()`.
+    pub(crate) core: BTreeSet<u64>,
     /// We closed the transport; h3wire's actions and bytes are dropped from then on.
     pub(crate) closing: bool,
     /// Request streams whose `FinishStream` write was `Blocked`: retried by `service`
@@ -57,6 +63,7 @@ impl<T: TransportOps> H3Wire<T> {
             client: role == Role::Client,
             mq: HashMap::new(),
             uni_done: HashSet::new(),
+            core: BTreeSet::new(),
             closing: false,
             fins: HashSet::new(),
             gone: false,
diff --git a/crates/mq-h3/src/lib.rs b/crates/mq-h3/src/lib.rs
index 6441f91d..78bbb2c3 100644
--- a/crates/mq-h3/src/lib.rs
+++ b/crates/mq-h3/src/lib.rs
@@ -110,6 +110,13 @@ impl<T: TransportOps> H3Wire<T> {
         self.services
     }
 
+    /// Streams the core-bytes flush visits per service: our uni streams plus the request
+    /// streams with HEADERS bytes not yet drained.
+    #[cfg(feature = "test-support")]
+    pub fn debug_core_streams(&self) -> usize {
+        self.conns.values().map(|c| c.core.len()).sum()
+    }
+
     /// Every request's carry <= max(BOOT_READ, largest buf passed so far), and every
     /// connection's h3wire `debug_buffered_bytes() <= debug_bound()` (adoption spec §5.4).
     #[cfg(feature = "test-support")]
diff --git a/crates/mq-h3/src/send.rs b/crates/mq-h3/src/send.rs
index 924bce8b..378150d1 100644
--- a/crates/mq-h3/src/send.rs
+++ b/crates/mq-h3/src/send.rs
@@ -136,6 +136,9 @@ impl<T: TransportOps> H3Wire<T> {
         let fields: Vec<_> = hs.iter().map(|h| FieldRef::new(h.name, h.value)).collect();
         let r = conn.h3.send_headers(Q(req.quic_id), &fields, fin);
         req.core |= r.is_ok();
+        if r.is_ok() {
+            conn.core.insert(req.quic_id);
+        }
         self.drive_inner(now);
         r.map_err(usage_err)
     }
@@ -381,6 +384,7 @@ impl<T: TransportOps> H3Wire<T> {
                     match bound {
                         Some((s, q)) => {
                             conn.mq.insert(q, s);
+                            conn.core.insert(q);
                             self.streams.insert(s, (c, Q(q)));
                         }
                         // The peer granted fewer than three uni streams (RFC 9114 §6.2).
@@ -443,8 +447,10 @@ impl<T: TransportOps> H3Wire<T> {
             return false;
         }
         let mut short = false;
-        for q in conn.h3.sendable().collect::<Vec<_>>() {
-            let Some(&s) = conn.mq.get(&q.0) else {
+        for id in conn.core.iter().copied().collect::<Vec<_>>() {
+            let q = Q(id);
+            let Some(&s) = conn.mq.get(&id) else {
+                conn.core.remove(&id); // the stream is gone
                 continue;
             };
             let mut req = reqs.get_mut(&req_id(s)).filter(|_| q.is_request());
@@ -468,6 +474,9 @@ impl<T: TransportOps> H3Wire<T> {
                     break;
                 }
             }
+            if conn.h3.poll_send(q).is_none() && q.is_request() {
+                conn.core.remove(&id); // drained: `send_headers` adds it again
+            }
             if let Some(req) = req.filter(|_| conn.h3.poll_send(q).is_none()) {
                 // An error drops the latched finish: `Closed` / `GoingAway` (the conn is
                 // ending, silently), else a refusal `usage_err` logged.
diff --git a/crates/mq-h3/tests/send.rs b/crates/mq-h3/tests/send.rs
index b1ee8ebb..1c2f5ed6 100644
--- a/crates/mq-h3/tests/send.rs
+++ b/crates/mq-h3/tests/send.rs
@@ -646,3 +646,30 @@ fn peer_reset_with_fin_carried_client_discards() {
     assert_eq!(aborts(&r, s), [Call::StreamResetSend { s, code: 0x10c }]);
     assert_eq!(r.w.h3_send_body(r.now, id, &[7u8; 64], false), Ok(64));
 }
+
+/// The core-bytes flush visits only the streams that may hold core bytes (adoption spec
+/// §4.5): drained requests leave the set, so a body op is not O(live requests).
+#[cfg(feature = "test-support")]
+#[test]
+fn flush_set_drops_drained_requests() {
+    let mut r = client();
+    let base = r.w.debug_core_streams();
+    let ids: Vec<_> = (0..64)
+        .map(|_| {
+            let (id, _) = open(&mut r);
+            r.w.h3_send_headers(r.now, id, &request("POST"), false)
+                .expect("send_headers");
+            id
+        })
+        .collect();
+    r.pump();
+    r.events();
+    assert_eq!(
+        r.w.debug_core_streams(),
+        base,
+        "drained requests left the set"
+    );
+    assert_eq!(r.w.h3_send_body(r.now, ids[0], b"x", false), Ok(1));
+    r.pump();
+    assert_eq!(r.w.debug_core_streams(), base);
+}

From 3e3c9fc959bd7b938a3109880ffa85594eec41c8 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 14:09:31 +0900
Subject: [PATCH 31/33] feat(mq-transport-api): conn_live, a cheap conn
 liveness probe

H3Wire::poll_event used conn_stats (hash lookup, snprintf, malloc on xquic) to
check conn liveness of every conn-level pop. conn_live is the slot-table
check; Transport, ScriptedTransport and H3Wire implement it. No default
body: no impl lives under mq-proxy/src, so the gateway is untouched.
---
 crates/mq-h3/src/lib.rs                   |  8 +++++---
 crates/mq-h3/tests/passthrough.rs         | 22 ++++++++++++++++++++++
 crates/mq-runtime/src/testing/scripted.rs | 13 ++++++++++++-
 crates/mq-runtime/tests/app.rs            |  3 +++
 crates/mq-transport-api/src/ops.rs        |  2 ++
 crates/mq-transport/src/lib.rs            |  4 ++++
 crates/mq-transport/tests/fabric_stale.rs |  2 ++
 7 files changed, 50 insertions(+), 4 deletions(-)

diff --git a/crates/mq-h3/src/lib.rs b/crates/mq-h3/src/lib.rs
index 78bbb2c3..42b6a734 100644
--- a/crates/mq-h3/src/lib.rs
+++ b/crates/mq-h3/src/lib.rs
@@ -199,13 +199,11 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
             ..
         } = self;
         queue.pop(|e| match e {
-            // ponytail: `conn_stats` is the only conn probe `TransportOps` has, and on xquic
-            // it collects path stats; add a cheap `conn_live` op if these pops show up.
             Event::ConnEstablished(c)
             | Event::NewConn(c, _)
             | Event::MpReady(c)
             | Event::DatagramReadable(c)
-            | Event::PathRemoved(c, _) => inner.conn_stats(*c).is_ok(),
+            | Event::PathRemoved(c, _) => inner.conn_live(*c),
             Event::NewStream(_, s, _)
             | Event::StreamReadable(s)
             | Event::StreamWritable(s)
@@ -296,6 +294,10 @@ impl<T: TransportOps> TransportOps for H3Wire<T> {
         self.inner.conn_stats(conn)
     }
 
+    fn conn_live(&self, conn: ConnId) -> bool {
+        self.inner.conn_live(conn)
+    }
+
     fn stream_info(&self, s: StreamId) -> Result<StreamInfo, Error> {
         self.inner.stream_info(s)
     }
diff --git a/crates/mq-h3/tests/passthrough.rs b/crates/mq-h3/tests/passthrough.rs
index 82c2745d..d7c29005 100644
--- a/crates/mq-h3/tests/passthrough.rs
+++ b/crates/mq-h3/tests/passthrough.rs
@@ -258,3 +258,25 @@ fn stale_on_pop_dropped_like_bare_transport() {
         );
     }
 }
+
+/// The liveness check of a conn-level pop is the cheap `conn_live`, not `conn_stats` (which
+/// collects path stats on xquic): after the cutover the UDP lane pops these constantly.
+#[test]
+fn conn_pops_do_not_collect_stats() {
+    for active in [false, true] {
+        let (mut w, h) = mk(active);
+        let (live, gone) = (h.new_conn_id(), h.new_conn_id());
+        h.set_conn_stats(live, Default::default());
+        h.push_event(Event::DatagramReadable(live));
+        h.push_event(Event::MpReady(gone));
+        w.drive(NOW);
+        let before = h.conn_stats_calls();
+        let got: Vec<_> = std::iter::from_fn(|| w.poll_event()).collect();
+        assert_eq!(got, [Event::DatagramReadable(live)], "active={active}");
+        assert_eq!(
+            h.conn_stats_calls(),
+            before,
+            "conn_stats probed, active={active}"
+        );
+    }
+}
diff --git a/crates/mq-runtime/src/testing/scripted.rs b/crates/mq-runtime/src/testing/scripted.rs
index 6afaf4e8..5fd43f7a 100644
--- a/crates/mq-runtime/src/testing/scripted.rs
+++ b/crates/mq-runtime/src/testing/scripted.rs
@@ -153,6 +153,7 @@ struct ScriptState {
     recv: HashMap<StreamId, VecDeque<RecvChunk>>,
     stream_info: HashMap<StreamId, StreamInfo>,
     conn_stats: HashMap<ConnId, ConnStats>,
+    conn_stats_calls: usize,
     transmits: HashMap<TxKey, (SocketAddr, VecDeque<Vec<u8>>)>,
     resume_pending: bool,
     next_timeout: Option<Time>,
@@ -338,6 +339,10 @@ impl ScriptedHandle {
     pub fn datagram_mss_calls(&self, c: ConnId) -> usize {
         self.st().dgram_mss_calls.get(&c).copied().unwrap_or(0)
     }
+    /// How often `conn_stats` was called (the expensive liveness probe `conn_live` replaces).
+    pub fn conn_stats_calls(&self) -> usize {
+        self.st().conn_stats_calls
+    }
     pub fn set_conn_stats(&self, c: ConnId, st: ConnStats) {
         self.st().conn_stats.insert(c, st);
     }
@@ -725,7 +730,13 @@ impl TransportOps for ScriptedTransport {
     }
 
     fn conn_stats(&self, conn: ConnId) -> Result<ConnStats, Error> {
-        self.st().conn_stats.get(&conn).cloned().ok_or(Error::Stale)
+        let mut st = self.st();
+        st.conn_stats_calls += 1;
+        st.conn_stats.get(&conn).cloned().ok_or(Error::Stale)
+    }
+
+    fn conn_live(&self, conn: ConnId) -> bool {
+        self.st().conn_stats.contains_key(&conn)
     }
 
     fn stream_info(&self, s: StreamId) -> Result<StreamInfo, Error> {
diff --git a/crates/mq-runtime/tests/app.rs b/crates/mq-runtime/tests/app.rs
index 6ad82f1e..fc251083 100644
--- a/crates/mq-runtime/tests/app.rs
+++ b/crates/mq-runtime/tests/app.rs
@@ -67,6 +67,9 @@ impl TransportOps for Null {
     fn conn_stats(&self, _: ConnId) -> Result<ConnStats, Error> {
         Err(Error::Stale)
     }
+    fn conn_live(&self, _: ConnId) -> bool {
+        false
+    }
     fn stream_info(&self, _: StreamId) -> Result<StreamInfo, Error> {
         Err(Error::Stale)
     }
diff --git a/crates/mq-transport-api/src/ops.rs b/crates/mq-transport-api/src/ops.rs
index 975505c1..905fc111 100644
--- a/crates/mq-transport-api/src/ops.rs
+++ b/crates/mq-transport-api/src/ops.rs
@@ -68,6 +68,8 @@ pub trait TransportOps {
     /// connections never marked (spec §4.7). A no-op on a stale id.
     fn mark_conn_authed(&mut self, conn: ConnId);
     fn conn_stats(&self, conn: ConnId) -> Result<ConnStats, Error>;
+    /// Whether `conn` is a live conn id: the cheap liveness probe (no stats collected).
+    fn conn_live(&self, conn: ConnId) -> bool;
     fn stream_info(&self, s: StreamId) -> Result<StreamInfo, Error>;
 
     // datagrams (spec §3.1)
diff --git a/crates/mq-transport/src/lib.rs b/crates/mq-transport/src/lib.rs
index e5198712..514a266b 100644
--- a/crates/mq-transport/src/lib.rs
+++ b/crates/mq-transport/src/lib.rs
@@ -241,6 +241,10 @@ impl TransportOps for Transport {
         conn::conn_stats(self, c)
     }
 
+    fn conn_live(&self, c: ConnId) -> bool {
+        self.inner.conns.is_live(c.slot())
+    }
+
     fn stream_info(&self, s: StreamId) -> Result<StreamInfo, mq_transport_api::Error> {
         stream::stream_info(self, s)
     }
diff --git a/crates/mq-transport/tests/fabric_stale.rs b/crates/mq-transport/tests/fabric_stale.rs
index 5c04d42e..4b5800dc 100644
--- a/crates/mq-transport/tests/fabric_stale.rs
+++ b/crates/mq-transport/tests/fabric_stale.rs
@@ -96,6 +96,8 @@ fn stale_conn_id_never_reaches_the_reused_slot() {
             .contains(&mq_transport_api::Event::ConnEstablished(new))
     );
     assert!(p.client.call(p.now, move |t, _| t.conn_stats(new)).is_ok());
+    assert!(p.client.call(p.now, move |t, _| t.conn_live(new)));
+    assert!(!p.client.call(p.now, move |t, _| t.conn_live(old)));
     assert_eq!(
         p.client
             .call(p.now, move |t, _| t.conn_stats(old).map(|_| ())),

From c1865d3e66c703686d76b6cb7776a896840711a3 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 14:12:07 +0900
Subject: [PATCH 32/33] test(integration): single mutex guard in reset asserts;
 count gateway requests

assert_eq!(c.handle.lock().x, v, "{:?}", c.handle.lock()) held the guard
through the failure branch and relocked it: a wrong code hung. One guard now,
scoped to the assert.

The malformed-request checks searched the log for the submitted path, which a
gateway line with path="-" (before intake) does not carry. spawn_gateway_on
pairs now count the H3Request events the server app is handed; the h3wire
receiver must have none. xqc_h3 does hand over the stream before decoding, so
it keeps the path search.
---
 crates/mq-integration/src/loopback.rs       | 81 ++++++++++++++++++++-
 crates/mq-integration/tests/pair_gateway.rs | 72 ++++++++++++++----
 2 files changed, 134 insertions(+), 19 deletions(-)

diff --git a/crates/mq-integration/src/loopback.rs b/crates/mq-integration/src/loopback.rs
index e7087830..d555fc61 100644
--- a/crates/mq-integration/src/loopback.rs
+++ b/crates/mq-integration/src/loopback.rs
@@ -10,14 +10,19 @@ use mq_proxy::config::{ClientConfig, GatewayConfig, MitmConfig, ServerConfig};
 use mq_proxy::server::Server;
 use mq_proxy::server::origin::build_client_config;
 use mq_runtime::driver::{DriverConfig, StdResolver};
-use mq_runtime::{App, ListenKind, ListenerTag, Shard};
+use mq_runtime::{
+    AcceptMeta, App, Cx, DialError, DialOpId, ListenKind, ListenerTag, Shard, SocketOpId, TcpEnd,
+    TcpId, TimerId, UdpSocketId,
+};
 use mq_transport::Transport;
 use mq_transport_api::{
-    CongestionControl, H3Backend, Role, Scheduler, TransportConfig, TransportOps,
+    CongestionControl, Event, H3Backend, Role, Scheduler, TransportConfig, TransportOps,
 };
+use std::io;
 use std::net::{IpAddr, Ipv4Addr, SocketAddr};
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
+use std::sync::atomic::{AtomicUsize, Ordering};
 use std::time::Duration;
 
 /// Builds and starts a server driver bound to the given UDP address.
@@ -29,6 +34,67 @@ pub struct LoopbackPair<S, C> {
     pub client: DriverThread<C>,
     /// `restart_server`'s factory (pairs built by `spawn_mitm`).
     respawn: Option<Respawn<S>>,
+    /// `H3Request`s the server app was handed (`spawn_gateway_on` pairs; 0 elsewhere): what
+    /// the gateway saw of the requests, whatever it logged.
+    pub server_h3_requests: Arc<AtomicUsize>,
+}
+
+/// Counts the `H3Request` events its app is handed.
+struct CountH3Requests<A> {
+    app: A,
+    n: Arc<AtomicUsize>,
+}
+
+impl<A: App> App for CountH3Requests<A> {
+    fn on_start(&mut self, cx: &mut Cx<'_>) {
+        self.app.on_start(cx)
+    }
+    fn on_transport_event(&mut self, cx: &mut Cx<'_>, ev: Event) {
+        if matches!(ev, Event::H3Request(..)) {
+            self.n.fetch_add(1, Ordering::SeqCst);
+        }
+        self.app.on_transport_event(cx, ev)
+    }
+    fn on_accepted(&mut self, cx: &mut Cx<'_>, l: ListenerTag, tcp: TcpId, meta: AcceptMeta) {
+        self.app.on_accepted(cx, l, tcp, meta)
+    }
+    fn on_tcp_data(&mut self, cx: &mut Cx<'_>, tcp: TcpId) {
+        self.app.on_tcp_data(cx, tcp)
+    }
+    fn on_tcp_end(&mut self, cx: &mut Cx<'_>, tcp: TcpId, end: TcpEnd) {
+        self.app.on_tcp_end(cx, tcp, end)
+    }
+    fn on_tcp_writable(&mut self, cx: &mut Cx<'_>, tcp: TcpId) {
+        self.app.on_tcp_writable(cx, tcp)
+    }
+    fn on_dial_result(&mut self, cx: &mut Cx<'_>, op: DialOpId, r: Result<TcpId, DialError>) {
+        self.app.on_dial_result(cx, op, r)
+    }
+    fn on_resolve_result(
+        &mut self,
+        cx: &mut Cx<'_>,
+        op: DialOpId,
+        r: Result<SocketAddr, DialError>,
+    ) {
+        self.app.on_resolve_result(cx, op, r)
+    }
+    fn on_udp_socket(
+        &mut self,
+        cx: &mut Cx<'_>,
+        op: SocketOpId,
+        r: Result<(UdpSocketId, SocketAddr), io::ErrorKind>,
+    ) {
+        self.app.on_udp_socket(cx, op, r)
+    }
+    fn on_udp_rx(&mut self, cx: &mut Cx<'_>, sock: UdpSocketId, peer: SocketAddr, data: &[u8]) {
+        self.app.on_udp_rx(cx, sock, peer, data)
+    }
+    fn on_timer(&mut self, cx: &mut Cx<'_>, id: TimerId) {
+        self.app.on_timer(cx, id)
+    }
+    fn on_shutdown(&mut self, cx: &mut Cx<'_>) {
+        self.app.on_shutdown(cx)
+    }
 }
 
 fn driver_config() -> DriverConfig {
@@ -83,6 +149,7 @@ impl<S: Send + 'static, C: Send + 'static> LoopbackPair<S, C> {
             server,
             client,
             respawn: None,
+            server_h3_requests: Arc::default(),
         }
     }
 
@@ -277,7 +344,15 @@ impl LoopbackProxy {
         server.gateway.get_or_insert_with(GatewayConfig::default);
         let tls = build_client_config(Some(origin_ca), &Vec::new).expect("origin CA");
         // `Server` holds `Rc`s: it is built on its driver thread.
-        Self::gateway_pair(client, move || Server::with_gateway(server, tls), backends)
+        let n = Arc::new(AtomicUsize::new(0));
+        let n2 = n.clone();
+        let app = move || CountH3Requests {
+            app: Server::with_gateway(server, tls),
+            n: n2,
+        };
+        let mut p = Self::gateway_pair(client, app, backends);
+        p.server_h3_requests = n;
+        p
     }
 
     /// The fetch client of `spawn_gateway` against an arbitrary H3 server `App` (a
diff --git a/crates/mq-integration/tests/pair_gateway.rs b/crates/mq-integration/tests/pair_gateway.rs
index d1a97baa..ae450b80 100644
--- a/crates/mq-integration/tests/pair_gateway.rs
+++ b/crates/mq-integration/tests/pair_gateway.rs
@@ -978,6 +978,8 @@ matrix!(
             return;
         }
         wait_h3(&c.handle, |r| r.fin);
+        // The control of `assert_not_seen`: a request the gateway took is counted.
+        assert_eq!(p.server_h3_requests.load(Ordering::SeqCst), 1);
         assert_headers(&h3_headers(&c.handle.lock()), &H3_OK);
         let seen = o.one();
         assert!(seen.complete && seen.body.is_empty(), "{seen:?}");
@@ -1089,15 +1091,18 @@ fn raw_headers(fields: &[(&str, &str)]) -> Vec<u8> {
 }
 
 /// `RawH3Peer`'s HEADERS was malformed (adoption spec §5.3 (6)): h3wire resets the stream with
-/// `H3_MESSAGE_ERROR` and the gateway never sees the request, so no `mq.req` line carries
-/// `marker` for 500 ms after the reset.
-fn assert_message_error(c: &DriverThread<RawH3Handle>, marker: &str) {
+/// `H3_MESSAGE_ERROR` and the gateway never sees the request.
+fn assert_message_error(p: &LoopbackProxy, c: &DriverThread<RawH3Handle>) {
     wait_until("the peer's reset", || !c.handle.lock().resets.is_empty());
-    assert_eq!(c.handle.lock().resets[0].1, 0x10e, "{:?}", c.handle.lock());
-    assert_no_req(marker);
+    {
+        let g = c.handle.lock();
+        assert_eq!(g.resets[0].1, 0x10e, "{g:?}");
+    }
+    assert_not_seen(p);
 }
 
-/// No `mq.req` line carries `marker` for 500 ms.
+/// No `mq.req` line carries `marker` for 500 ms (the xqc_h3 receiver: it can log the
+/// request as `path="-"` before decoding, so only the submitted path is searched for).
 fn assert_no_req(marker: &str) {
     let end = Instant::now() + Duration::from_millis(500);
     while Instant::now() < end {
@@ -1110,6 +1115,18 @@ fn assert_no_req(marker: &str) {
     }
 }
 
+/// The server never handed the gateway a request (`H3Request`) for 500 ms. Counted at the
+/// server app of this test's own pair, so neither a `path="-"` log line (the gateway's name
+/// for a request it has not accepted) nor another test's lines can hide a leak.
+fn assert_not_seen(p: &LoopbackProxy) {
+    let end = Instant::now() + Duration::from_millis(500);
+    while Instant::now() < end {
+        let n = p.server_h3_requests.load(Ordering::SeqCst);
+        assert_eq!(n, 0, "the gateway was handed a request");
+        thread::sleep(Duration::from_millis(5));
+    }
+}
+
 /// The raw response's `name` field.
 fn raw_field(c: &DriverThread<RawH3Handle>, name: &str) -> Option<String> {
     let v = field(&c.handle.lock().read, name.as_bytes());
@@ -1206,10 +1223,10 @@ receivers!(nul_in_auth_path_class_direct_h3, |b: Backend, tag: &str| {
             ("200", None),
         ),
     ];
-    for (stream, path, (status, xmq)) in cases {
+    for (stream, _, (status, xmq)) in cases {
         let c = raw_client(p.server.udp_addr, stream);
         if b == Backend::Wire {
-            assert_message_error(&c, &format!("path=\"{path}\""));
+            assert_message_error(&p, &c);
         } else {
             wait_until("the response", || c.handle.lock().fin);
             assert_eq!(raw_field(&c, ":status").as_deref(), Some(status));
@@ -1241,7 +1258,7 @@ receivers!(connect_malformed_direct_h3, |b: Backend, tag: &str| {
     ]);
     let c = raw_client(p.server.udp_addr, stream);
     if b == Backend::Wire {
-        assert_message_error(&c, &format!("path=\"{path}\""));
+        assert_message_error(&p, &c);
     } else {
         wait_until("the response", || c.handle.lock().fin);
         assert_eq!(raw_field(&c, ":status").as_deref(), Some("400"));
@@ -1277,13 +1294,27 @@ receivers!(
                 !c.handle.lock().closed.is_empty()
             });
             assert_eq!(c.handle.lock().closed, [EXCESSIVE_LOAD]);
-            assert!(c.handle.lock().resets.is_empty(), "{:?}", c.handle.lock());
+            {
+                let g = c.handle.lock();
+                assert!(g.resets.is_empty(), "{g:?}");
+            }
         } else {
             wait_until("the peer's reset", || !c.handle.lock().resets.is_empty());
-            assert_eq!(c.handle.lock().resets[0].1, 0x10e, "{:?}", c.handle.lock());
-            assert!(c.handle.lock().closed.is_empty(), "{:?}", c.handle.lock());
+            {
+                let g = c.handle.lock();
+                assert_eq!(g.resets[0].1, 0x10e, "{g:?}");
+            }
+            {
+                let g = c.handle.lock();
+                assert!(g.closed.is_empty(), "{g:?}");
+            }
+        }
+        if b == Backend::Wire {
+            assert_not_seen(&p);
+        } else {
+            // xqc_h3 hands the gateway the stream before it decodes (and rejects) the block.
+            assert_no_req(&format!("path=\"{path}\""));
         }
-        assert_no_req(&format!("path=\"{path}\""));
         stop(c);
         assert_eq!(p.join_both(), (0, 0));
     }
@@ -1297,12 +1328,21 @@ receivers!(direct_h3_fin_without_headers, |b: Backend, _tag: &str| {
     let c = raw_client(p.server.udp_addr, Vec::new());
     if b == Backend::Wire {
         wait_until("the peer's reset", || !c.handle.lock().resets.is_empty());
-        assert_eq!(c.handle.lock().resets[0].1, 0x10d, "{:?}", c.handle.lock());
+        {
+            let g = c.handle.lock();
+            assert_eq!(g.resets[0].1, 0x10d, "{g:?}");
+        }
     } else {
         thread::sleep(Duration::from_millis(500));
-        assert!(c.handle.lock().resets.is_empty(), "{:?}", c.handle.lock());
+        {
+            let g = c.handle.lock();
+            assert!(g.resets.is_empty(), "{g:?}");
+        }
+    }
+    {
+        let g = c.handle.lock();
+        assert!(g.closed.is_empty(), "{g:?}");
     }
-    assert!(c.handle.lock().closed.is_empty(), "{:?}", c.handle.lock());
     stop(c);
     assert_eq!(p.join_both(), (0, 0));
 });

From fff9b3c75a0b81b757ad24098138417f7f724b30 Mon Sep 17 00:00:00 2001
From: mp0rta <3p0rta26@gmail.com>
Date: Tue, 6 Oct 2026 23:33:25 +0900
Subject: [PATCH 33/33] fix(ci): initialize deps submodules and pin xquic
 caches reliably

---
 .github/workflows/ci.yml          | 30 ++++++++++++++++++++----------
 .github/workflows/codeql.yml      |  6 ++++--
 .github/workflows/perf-weekly.yml |  6 ++++--
 .github/workflows/perf.yml        |  6 ++++--
 .github/workflows/release.yml     |  6 ++++--
 .github/workflows/rust.yml        | 14 ++++++++++----
 6 files changed, 46 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c1e82524..e5208af1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,7 +43,9 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y cmake libevent-dev libcurl4-openssl-dev libnghttp2-dev golang
       - name: Compute xquic SHA
         id: xqsha
-        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"
+        run: |
+          sha=$(git -c safe.directory="$GITHUB_WORKSPACE" rev-parse HEAD:third_party/xquic)
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
 
       - name: Cache BoringSSL (gcc fPIC)
         id: bssl-cache
@@ -68,7 +70,7 @@ jobs:
           path: |
             third_party/xquic/build
             third_party/xquic/include/xquic/xqc_configure.h
-          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v2
+          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v3
       - name: Build xquic
         if: steps.xquic-cache.outputs.cache-hit != 'true'
         run: |
@@ -105,7 +107,9 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y cmake libevent-dev libcurl4-openssl-dev libnghttp2-dev golang
       - name: Compute xquic SHA
         id: xqsha
-        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"
+        run: |
+          sha=$(git -c safe.directory="$GITHUB_WORKSPACE" rev-parse HEAD:third_party/xquic)
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
 
       - name: Cache BoringSSL (gcc fPIC)
         id: bssl-cache
@@ -128,7 +132,7 @@ jobs:
           path: |
             third_party/xquic/build
             third_party/xquic/include/xquic/xqc_configure.h
-          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v2
+          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v3
       - name: Build xquic
         if: steps.xquic-cache.outputs.cache-hit != 'true'
         run: |
@@ -201,7 +205,9 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y cmake libevent-dev libcurl4-openssl-dev libnghttp2-dev golang
       - name: Compute xquic SHA
         id: xqsha
-        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"
+        run: |
+          sha=$(git -c safe.directory="$GITHUB_WORKSPACE" rev-parse HEAD:third_party/xquic)
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
 
       - name: Cache BoringSSL (gcc fPIC)
         id: bssl-cache
@@ -224,7 +230,7 @@ jobs:
           path: |
             third_party/xquic/build
             third_party/xquic/include/xquic/xqc_configure.h
-          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v2
+          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v3
       - name: Build xquic
         if: steps.xquic-cache.outputs.cache-hit != 'true'
         run: |
@@ -278,7 +284,9 @@ jobs:
             ca-certificates
       - name: Compute xquic SHA
         id: xqsha
-        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"
+        run: |
+          sha=$(git -c safe.directory="$GITHUB_WORKSPACE" rev-parse HEAD:third_party/xquic)
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
 
       - name: Cache BoringSSL (gcc fPIC)
         id: bssl-cache
@@ -301,7 +309,7 @@ jobs:
           path: |
             third_party/xquic/build
             third_party/xquic/include/xquic/xqc_configure.h
-          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v2
+          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v3
       - name: Build xquic
         if: steps.xquic-cache.outputs.cache-hit != 'true'
         run: |
@@ -352,7 +360,9 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y cmake libevent-dev libnghttp2-dev golang pkg-config
       - name: Compute xquic SHA
         id: xqsha
-        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"
+        run: |
+          sha=$(git -c safe.directory="$GITHUB_WORKSPACE" rev-parse HEAD:third_party/xquic)
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
 
       - name: Cache BoringSSL (gcc fPIC)
         id: bssl-cache
@@ -375,7 +385,7 @@ jobs:
           path: |
             third_party/xquic/build
             third_party/xquic/include/xquic/xqc_configure.h
-          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v2
+          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v3
       - name: Build xquic
         if: steps.xquic-cache.outputs.cache-hit != 'true'
         run: |
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a5c72de4..b2d06624 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -35,7 +35,9 @@ jobs:
       # extraction. Same cache keys as ci.yml to ride the existing caches. ---
       - name: Compute xquic SHA
         id: xqsha
-        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"
+        run: |
+          sha=$(git -c safe.directory="$GITHUB_WORKSPACE" rev-parse HEAD:third_party/xquic)
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
 
       - name: Cache BoringSSL (gcc fPIC)
         id: bssl-cache
@@ -58,7 +60,7 @@ jobs:
           path: |
             third_party/xquic/build
             third_party/xquic/include/xquic/xqc_configure.h
-          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v2
+          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v3
       - name: Build xquic
         if: steps.xquic-cache.outputs.cache-hit != 'true'
         run: |
diff --git a/.github/workflows/perf-weekly.yml b/.github/workflows/perf-weekly.yml
index d3c980a9..b5f2ee31 100644
--- a/.github/workflows/perf-weekly.yml
+++ b/.github/workflows/perf-weekly.yml
@@ -45,7 +45,9 @@ jobs:
 
       - name: Compute xquic SHA
         id: xqsha
-        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"
+        run: |
+          sha=$(git -c safe.directory="$GITHUB_WORKSPACE" rev-parse HEAD:third_party/xquic)
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
 
       - name: Cache BoringSSL (gcc fPIC)
         id: bssl-cache
@@ -69,7 +71,7 @@ jobs:
           path: |
             third_party/xquic/build
             third_party/xquic/include/xquic/xqc_configure.h
-          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v2
+          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v3
 
       - name: Build xquic
         if: steps.xquic-cache.outputs.cache-hit != 'true'
diff --git a/.github/workflows/perf.yml b/.github/workflows/perf.yml
index 66801436..1b256398 100644
--- a/.github/workflows/perf.yml
+++ b/.github/workflows/perf.yml
@@ -45,7 +45,9 @@ jobs:
 
       - name: Compute xquic SHA
         id: xqsha
-        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"
+        run: |
+          sha=$(git -c safe.directory="$GITHUB_WORKSPACE" rev-parse HEAD:third_party/xquic)
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
 
       - name: Cache BoringSSL (gcc fPIC)
         id: bssl-cache
@@ -69,7 +71,7 @@ jobs:
           path: |
             third_party/xquic/build
             third_party/xquic/include/xquic/xqc_configure.h
-          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v2
+          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-0ce57bb-v3
 
       - name: Build xquic
         if: steps.xquic-cache.outputs.cache-hit != 'true'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d78e4b69..7ba4bf0d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,7 +54,9 @@ jobs:
 
       - name: Compute xquic SHA
         id: xqsha
-        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"
+        run: |
+          sha=$(git -c safe.directory="$GITHUB_WORKSPACE" rev-parse HEAD:third_party/xquic)
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
 
       # Cache keys are arch-qualified: the matrix runs amd64 + arm64, and a
       # non-arch key would let arm64 restore an amd64 BoringSSL/xquic build.
@@ -79,7 +81,7 @@ jobs:
           path: |
             third_party/xquic/build
             third_party/xquic/include/xquic/xqc_configure.h
-          key: xquic-${{ steps.xqsha.outputs.sha }}-${{ matrix.arch }}-gcc-release-bssl-0ce57bb-v1
+          key: xquic-${{ steps.xqsha.outputs.sha }}-${{ matrix.arch }}-gcc-release-bssl-0ce57bb-v2
       - name: Build xquic
         if: steps.xquic-cache.outputs.cache-hit != 'true'
         run: |
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 5b25e22f..9655c602 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -135,6 +135,8 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v6
+        with:
+          submodules: recursive
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-deny,cargo-audit
@@ -186,7 +188,9 @@ jobs:
           echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
       - name: Compute xquic SHA
         id: xqsha
-        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"
+        run: |
+          sha=$(git -c safe.directory="$GITHUB_WORKSPACE" rev-parse HEAD:third_party/xquic)
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
       - name: Cache xquic + BoringSSL (build-xquic.sh)
         uses: actions/cache@v5
         with:
@@ -194,7 +198,7 @@ jobs:
             third_party/xquic/build
             third_party/xquic/third_party/boringssl/build
             third_party/xquic/include/xquic/xqc_configure.h
-          key: xquic-${{ steps.xqsha.outputs.sha }}-build-xquic-sh-v1
+          key: xquic-${{ steps.xqsha.outputs.sha }}-build-xquic-sh-v2
       - name: Build the C mqproxy (interop peer)
         run: |
           scripts/build-xquic.sh
@@ -274,7 +278,9 @@ jobs:
       - name: Compute xquic SHA
         if: github.event_name != 'push'
         id: xqsha
-        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"
+        run: |
+          sha=$(git -c safe.directory="$GITHUB_WORKSPACE" rev-parse HEAD:third_party/xquic)
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
       - name: Cache xquic + BoringSSL (build-xquic.sh)
         if: github.event_name != 'push'
         uses: actions/cache@v5
@@ -283,7 +289,7 @@ jobs:
             third_party/xquic/build
             third_party/xquic/third_party/boringssl/build
             third_party/xquic/include/xquic/xqc_configure.h
-          key: xquic-${{ steps.xqsha.outputs.sha }}-build-xquic-sh-v1
+          key: xquic-${{ steps.xqsha.outputs.sha }}-build-xquic-sh-v2
       - name: Build the C mqproxy (baseline)
         if: github.event_name != 'push'
         run: |