[overtrue]

Summary

When unread-body wire assertions fail, report whether the response read ended in EOF, an I/O error kind, or timeout. Preserve the original 400 ms read deadline, received bytes, and the existing closure assertion's acceptance of EOF or read error. A test-only reader exercises EOF, reset after response bytes, and an open peer that times out.

Related to #1531. This diagnostic does not reproduce or repair the intermittent truncated response and does not observe the server writer. The fixture is gateway-specific; no corresponding s3s change is identified.

Verification

On main da2fc77d, with one Cargo build worker and incremental compilation disabled:

• cargo fmt --all --check: exit 0.
• cargo clippy --workspace --all-targets -- -D warnings: exit 0.
• cargo test --workspace: exit 0 on the final source.
• cargo xtask verify --crate rustfs-gateway: exit 0; 46.48 seconds wall time, including 15.78 seconds preparation and successful loops of 24.15 and 5.93 seconds. The complete command exceeded the 30-second target; see verify: conformance preparation exceeds command feedback budget #1504.
• The unread-body module passed all 8 tests after restoration. The observer control initially failed against a stub that reported an empty timeout for received bytes and EOF.
• Independent production-observer mutations for EOF, read error, timeout, dropped received bytes, and bytes cleared on error each made a named observer assertion fail; the final implementation was restored before the gate.

Before the final test improvement, the first workspace attempt failed the unrelated conformance calibration peer with a reset while receiving its response. The identical main's separately compiled focused test and later workspace runs passed; cause is unknown. See #1543. A previous crate verification reported at least 73.61 seconds from its three stages without an independent whole-command timer; its warm repeat took 22.53 seconds. Neither replaces the final-source measurement above.

Role Verdicts

• simplicity-adversary: attacked termination classification, byte preservation, unchanged read deadline and closed-state mapping — no break found

Breaking Change

• BREAKING — this PR touches a protected file or changes a public contract.

Checklist

• The four-command gate passed (fmt, clippy, test, cargo xtask verify)
• New or changed public API has rustdoc
• Negative test cases outnumber positive ones
• Every new assertion was mutated — the implementation was broken on purpose and the assertion
  went red. The PR description names which ones
• No Protected File touched; if one was, the PR description contains BREAKING and a migration path
• No unsafe introduced
• No inventory / linkme introduced
• No #[non_exhaustive] added to a DTO
• No s3s code copied; behavioural evidence is URL + self-written summary
• No credentials, signatures, or expected-signature values reachable from logs or error bodies
• No plan document, analysis report, or working note committed
• Commits follow Conventional Commits; PR title ≤72 characters
• A Handoff comment has been appended to the issue

[overtrue]

Role review

• simplicity-adversary: attacked the three termination classes, preserving bytes before an error, retaining the 400 ms per-read deadline, and the previous EOF-or-error closed mapping. The fixture needs the three-way result to print the observed cause, and the enum remains local to the test module. No break found. The result records the error kind only and does not observe the server writer or establish the reason for the historical truncation.

[overtrue]

Reviewed c56af24 against main da2fc77. No actionable finding in this test-only delta.

The extraction preserves the 400 ms per-read timeout, accumulated response bytes, and the prior acceptance of EOF or a read error as closed. Existing HTTP status, XML error code and connection-header assertions remain enforced. Reporting the error kind is useful evidence for #1531, but neither establishes the remote writer outcome nor repairs the intermittent truncation.

Independent verification compiled the unchanged ReadEnd definition, observer function and observer control test extracted from the actual source, using existing Tokio dependencies in a standalone test harness. The control passed. Five separately compiled faults (wrong EOF, wrong read-error classification, wrong timeout classification, discarded bytes, and bytes cleared on error) each failed the observer assertion; the restored control passed. git diff --check passed and the review worktree is clean. This was a focused observer check, not an independent full integration or four-command Cargo gate run.

CI run 40948622934 is still in progress on this head, with no failed jobs observed at review time. Merge must wait for the complete required checks and a fresh head/discussion check.

Role Verdicts

• simplicity-adversary: attacked termination classification, byte retention across reads and errors, per-read deadline equivalence and preserved closure assertions — no break found

[overtrue]

CI evidence

Run 40948622934 on head c56af2460e7c645aa2b2c1cb88e8481b0bcfb036 passed all 33 jobs. Its Test aggregate completed 433 seconds after run creation. This does not reproduce or explain the historical truncated response. The previous workspace reset and 46.48-second local verifier remain recorded in the description.