[overtrue]

Summary

Report the calibration response phase, received byte count and actual read error while preserving the two-second socket read deadline and exact request-census assertions. This is test-only observation; it does not reproduce or fix the historical reset or observe the server writer. Related to #1543; this gateway-specific fixture has no corresponding s3s change.

The CI repair replaces the diagnostic test's unregistered panic-payload downcast with three separate expected-panic controls for phase, partial byte count and read-error kind. The complete-response control remains. No downcast allowance, guard change, timeout change or weakened diagnostic requirement was introduced. The branch retains the original PR commit and incorporates main 679b4fe.

Verification

Final repair source, with one Cargo build worker and incremental compilation disabled:

• cargo fmt --all --check: exit 0, 3.20 seconds.
• cargo clippy --workspace --all-targets -- -D warnings: exit 0, 206.56 seconds.
• cargo test --workspace: exit 0, 1045.30 seconds including compilation and doctests. All six peer tests passed, including both real-socket calibration tests.
• cargo xtask verify --crate rustfs-gateway-conformance: the first invocation exited 1 after 150.23 seconds, with 119.30 seconds prebuild and a killed 30-second prepared loop. Package-cache and build-directory lock waits were captured. Following direct scope measurements, one bounded prepared repeat on byte-identical final source exited 0 in 39.59 seconds: 23.11 seconds preparation and 16.12 seconds checked loop. The failed invocation remains recorded in verify: prepared crate loops time out on a contended macOS host #1422; the repeat is not a repair of the deadline failure or a whole-command 30-second pass. See verify: conformance preparation exceeds command feedback budget #1504 for command latency.
• Direct final-source scope measurement: 1,092 library tests passed in 13.26 seconds and the allocation test in 1.02 seconds; 42.26 seconds total including compilation. An unmodified-main source control failed the separate signing feedback case, with 1,087 passed and one failed, recorded in test(conformance): feedback signing case fails on main source #1549. Its underlying wire failure and cause are unknown; the passing candidate is not a repair of that control failure.
• bash scripts/check_no_as_any.sh: reproduced the original rejection, then passed with the repair and the unchanged seven-entry allowance list.
• Guard self-test 5: all 330 assigned cases executed exactly once, zero failures, 93 seconds of the unchanged 300-second budget. The original hosted failure completed the same census in 40 seconds and failed only the unregistered downcast check, not a timeout.
• The actual-source standalone diagnostic controls passed. Six separately compiled mutations of phase, byte count, error detail, swallowed read error, unexpected panic payload and successful bytes each failed; restored controls passed. Source was restored byte-for-byte after all experiments.

The earlier implementation's author-reported full gate and six diagnostic mutations were on da2fc77. The measurements above describe the final CI repair. Neither set establishes a reproduction or repair of #1543.

Role Verdicts

• simplicity-adversary: attacked phase wiring, partial-byte accounting, independent expected-panic controls, error failure behavior, success bytes and unchanged socket deadlines — no break found

Breaking Change

• BREAKING — this PR touches a protected file or changes a public contract.

Checklist

• The four-command gate passed (fmt, clippy, test, cargo xtask verify)
• New or changed public API has rustdoc
• Negative test cases outnumber positive ones
• Every new assertion was mutated — the implementation was broken on purpose and the assertion went red. The PR description names which ones
• No Protected File touched; if one was, the PR description contains BREAKING and a migration path
• No unsafe introduced
• No inventory / linkme introduced
• No #[non_exhaustive] added to a DTO
• No s3s code copied; behavioural evidence is URL + self-written summary
• No credentials, signatures, or expected-signature values reachable from logs or error bodies
• No plan document, analysis report, or working note committed
• Commits follow Conventional Commits; PR title ≤72 characters
• A Handoff comment has been appended to the issue

[overtrue]

Role review

• simplicity-adversary: attacked response phase selection, partial-read accounting, unchanged timeout and panic path. A small helper accepts a standard reader so the failure diagnostic is testable without changing the real socket or swallowing errors. No break found. Existing failure logs cannot be retroactively assigned to either response phase, and this change does not record the server-side write result.

[overtrue]

Reviewed a95aaf2 against base da2fc77. No actionable finding in this test-only delta.

Both calibration reads now identify their phase and report the received byte count and actual read error. The two-second socket read timeout, read-to-end failure behavior, text conversion, exact request census and extra-request rejection remain enforced. This improves attribution if #1543 recurs; it does not reproduce that reset or observe the server writer.

Independent verification compiled the unchanged observe_reply helper and its two diagnostic tests extracted from the actual source into a standalone standard-library test harness. Both controls passed. Six separately compiled faults (missing phase, incorrect byte count, missing error detail, swallowed read error, unexpected panic payload and discarded successful response bytes) each failed the relevant assertion. The restored controls passed, git diff --check passed and the review worktree is clean. This scope does not include the complete peer socket module, workspace tests or an independent four-command gate.

CI run 40950959909 is still pending on this exact head with no failed jobs observed. Merge must wait for the full required checks and a fresh head/discussion check.

Role Verdicts

• simplicity-adversary: attacked response phase wiring, partial-byte accounting, retained error failure behavior, success bytes and unchanged socket deadlines — no break found

[overtrue]

Handoff

• Done: Original PR test(conformance): describe calibration read failures #1546 head a95aaf234e6a3ad2e8b7c1d7c02cc62fcda5a3b5 exposed an unregistered type downcast: both Static checks and Guard self-test 5 failed the same guard. A local correction returns the diagnostic text directly and retains the original panic at its caller. scripts/check_no_as_any.sh, the four peer tests, and five targeted mutations passed or failed as intended. The correction is in the uncommitted worktree /Users/overtrue/Library/Caches/migration-2734/1536-main-control, rebased on main 679b4fe5; the remote PR still has the old head.
• Not done: The correction has not passed the ordered workspace gate and is not committed or pushed. The first workspace attempt reported a c-mpu-0015 family regression with no specific failed dimension (test(conformance): multipart case regressed once on macOS #1547); the second observed c-object-0015 reset rather than closed (conformance: reference corpus intermittently regresses HTTP/1.1 cases on macOS #1424). Same-binary focused reruns passed once each without establishing causes. Crate verification was not run after either failed workspace. The original calibration reset remains unproven and unfixed.
• Next command: git -C /Users/overtrue/Library/Caches/migration-2734/1536-main-control status --short
• Gotcha: Do not count earlier old-head gates or focused replays as a passing gate for the corrected source. No tests, timeouts or expectations were weakened.

[overtrue]

Reviewed the final repair at 7a09e29. It preserves original head a95aaf2 and main 679b4fe as ancestors and changes only the peer diagnostic tests relative to main.

The unregistered panic-payload downcast is replaced by three independent expected-panic controls for phase, partial-byte count and error kind. The complete-response and real-socket request-census controls remain. The observer implementation, timeout and guard allowance list are unchanged.

Final-source fmt, full workspace clippy and full workspace tests passed. All six peer tests passed in the actual workspace run. The unchanged no-downcast guard passed; Guard self-test 5 completed all 330 assigned cases exactly once, zero failures, in 93 of 300 seconds. Six actual-source standalone mutations still failed, and restoration passed.

The first crate verifier was terminated at its 30-second prepared deadline after 119.30 seconds of prebuild. Following direct main/candidate scope measurements, one byte-identical prepared repeat passed with 23.11 seconds preparation and a 16.12-second checked loop, 39.59 seconds total. The failed invocation and limits remain recorded in #1422 and #1504. An unmodified-main source control failed the separate signing feedback test; #1549 records that observation without claiming cause or repair.

Hosted run 40957640372 is queued on this exact head. No merge acceptance or repair of the original reset in #1543 is claimed.

Role Verdicts

• simplicity-adversary: attacked independent panic expectations, reset-byte preservation, successful bytes, unchanged census and deadline, and the no-downcast guard boundary — no break found